1. Person in Charge of Processing
This privacy policy applies to the website operated by SDC Grande Allée (hereinafter "we," "us," or "our"). As a Quebec-based organization, we are subject to Quebec Law 25 — formally known as An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25) — as well as any other applicable privacy legislation.
This policy explains what personal information we collect when you visit our website, why we collect it, how we protect it, and what rights you have over it. The term "personal information" means any information that identifies you or could reasonably be used to identify you, directly or indirectly.
Our website is hosted in Quebec, Canada, through Horizon-Cumulus (9322-8310 Québec inc.), based in Joliette, Quebec. Consent records and this policy are stored in Quebec (OVH, Beauharnois, Quebec).
2. Personal Information Collected
Depending on how you interact with our website, we may collect the following categories of personal information:
2.1 Identification and Contact Information
- Name and email address (when you subscribe to our newsletter or contact us)
2.2 Technical and Navigation Information
- IP address (approximate)
- Device identifiers and browser type
- Pages visited and time spent on each page
- Navigation behavior and click patterns
- Approximate geographic location (city or region level, derived from IP address)
- Session duration
2.3 Advertising and Social Identifiers
- Advertising identifiers (e.g., cookie IDs used for ad targeting)
- Social network identifiers (when you interact with content linked to Meta/Facebook)
2.4 Consent Preferences
-
Your cookie consent choices, stored locally in your browser via a cookie named
moelleux_{site_key}(valid for 13 months), managed by Moelleux (Horizon-Cumulus, Joliette, Quebec).
We do not knowingly collect sensitive personal information such as health data, financial account numbers, or government-issued identification numbers through this website.
3. Purposes of Processing
We use your personal information only for the purposes described below.
3.1 Website Operation and Security — Essential
We process technical information (IP address, session data, consent preferences) to keep the website functioning correctly, maintain security, and record your consent choices as required by Quebec Law 25.
Legal basis: Legitimate interest (operating a secure, functional website) and legal obligation (recording consent under Quebec Law 25).
Service used: Moelleux by Horizon-Cumulus (consent management platform, hosted in Quebec).
3.2 Audience Measurement and Analytics — Analytics
We analyze how visitors navigate our website (pages visited, session duration, approximate location, device type) to understand what content is most useful and to improve our website's performance.
Legal basis: Your consent, obtained through our cookie consent banner before any analytics cookies are activated.
Service used: Google Analytics 4 (Google LLC, United States). Data may be transferred outside Canada — see Section 5.
3.3 Targeted Advertising and Retargeting — Marketing
We use advertising tools to measure the effectiveness of our campaigns and to show you relevant ads about Grande Allée on third-party platforms, based on your browsing behavior on our website.
Legal basis: Your consent, obtained through our cookie consent banner before any marketing cookies are activated.
Service used: Meta Pixel (Meta Platforms, Inc., United States). Data may be transferred outside Canada — see Section 5.
3.4 Newsletter Communications — Marketing Email
If you subscribe to our newsletter, we use your name and email address to send you updates about events, promotions, and news related to Grande Allée.
Legal basis: Your explicit consent at the time of subscription. You may withdraw your consent at any time by clicking the unsubscribe link in any newsletter or by contacting us directly.
Our business email is operated through Horizon-Cumulus Email (Quebec, Canada). Please note that we also use Microsoft 365 (Microsoft Corporation, United States) for internal business communications; your email address may be processed through this service when we reply to your inquiries. See Section 5 for details on cross-border transfers.
4. Third Parties and Processors
The table below lists every third-party service active on our website, its purpose, its category, and whether it involves a transfer of personal information outside Quebec.
| Service | Purpose | Category | Transfer Outside Quebec |
|---|---|---|---|
| Moelleux (Horizon-Cumulus, Joliette, QC) | Consent management platform; stores your cookie preferences and hosts this policy. Data hosted in Quebec (OVH Beauharnois). | Essential | No — data remains in Quebec |
| Google Analytics 4 (Google LLC) | Audience measurement and website traffic analysis. | Analytics | Yes — United States |
| Meta Pixel (Meta Platforms, Inc.) | Conversion tracking and retargeting for paid advertising campaigns. | Marketing | Yes — United States |
| Horizon-Cumulus Email (Joliette, QC) | Business email communications (replies to inquiries, newsletter delivery). | Functional | No — data remains in Quebec |
| Microsoft 365 (Microsoft Corporation) | Internal business email platform used for staff communications. | Functional | Yes — United States |
We do not sell your personal information to any third party. We share personal information with the processors listed above only to the extent necessary to fulfill the purposes described in Section 3.
5. Transfers Outside Quebec
Some of the services we use involve transferring your personal information to servers or processors located outside Quebec and outside Canada, specifically in the United States. These transfers are governed by section 17 of Quebec Law 25, which requires us to assess whether the destination jurisdiction offers an adequate level of protection before any transfer takes place.
The following services involve cross-border transfers:
- Google Analytics 4 (Google LLC, United States) — Your device identifiers, IP address, pages visited, session behavior, and approximate location may be processed on Google's servers in the United States. Google LLC participates in the EU-U.S. Data Privacy Framework and applies standard contractual clauses for international data transfers.
- Meta Pixel (Meta Platforms, Inc., United States) — Your device identifiers, IP address, browsing behavior, advertising identifiers, and social identifiers may be processed on Meta's servers in the United States. Meta applies standard contractual clauses and participates in applicable cross-border transfer frameworks.
- Microsoft 365 (Microsoft Corporation, United States) — When our team responds to your email inquiries using Microsoft 365, your email address and message content may be processed in the United States. Microsoft applies standard contractual clauses and is certified under applicable data transfer frameworks.
Before activating Google Analytics 4 and Meta Pixel, we conducted a Privacy Impact Assessment (PIA) — known in Quebec as an évaluation des facteurs relatifs à la vie privée (EFVP) — to evaluate the risks associated with transferring personal information to the United States and to confirm that appropriate contractual and technical safeguards are in place.
Analytics and marketing cookies are only activated after you provide your explicit consent through our cookie consent banner. You may withdraw your consent at any time by revisiting your cookie preferences.
6. Retention Period
We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.
| Data Type | Retention Period | Justification |
|---|---|---|
Cookie consent preferences (moelleux_{site_key}) |
13 months | Quebec Law 25 requires that consent be renewed at reasonable intervals; 13 months is the standard renewal cycle. |
| Analytics data (Google Analytics 4) | Up to 14 months (configurable in Google Analytics settings) | Audience analysis and year-over-year performance comparison. |
| Advertising / retargeting data (Meta Pixel) | Up to 180 days (Meta platform default for event data) | Retargeting window for advertising campaigns. |
| Newsletter subscriber information (name, email) | Until you unsubscribe or withdraw consent, plus 30 days for processing | Consent-based communication; retention ends when consent is withdrawn. |
| Email correspondence (inquiries sent to us) | 24 months from last contact | Reasonable period to follow up on tourism inquiries and maintain service continuity. |
| Server and access logs (IP address, technical data) | 90 days | Security monitoring and incident response. |
Once the applicable retention period expires, personal information is securely deleted or anonymized so that it can no longer be linked to you.
7. Your Rights
Under Quebec Law 25, you have the following rights regarding your personal information. To exercise any of these rights, please contact our Person responsible for the protection of personal information (see Section 8). We will respond within 30 days of receiving your request.
- Right of access: You may ask us to confirm whether we hold personal information about you and to receive a copy of that information in a clear and understandable format.
- Right of rectification: If any personal information we hold about you is inaccurate, incomplete, or ambiguous, you may ask us to correct it.
- Right of erasure (right to be forgotten): You may ask us to delete your personal information when it is no longer necessary for the purposes for which it was collected, or when you withdraw your consent and there is no other legal basis for retaining it.
- Right to data portability: You may ask us to provide your personal information in a structured, commonly used, and machine-readable format so that you can transmit it to another organization, where technically feasible.
- Right to withdraw consent: Where we process your personal information based on your consent (analytics cookies, marketing cookies, newsletter subscription), you may withdraw that consent at any time without penalty. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. To withdraw cookie consent, revisit our cookie preference center. To unsubscribe from our newsletter, click the unsubscribe link in any email we send you.
If you believe your rights have not been respected, you have the right to file a complaint with the Quebec Information Access Commission (CAI):
- Website: https://www.cai.gouv.qc.ca
8. Person Responsible for the Protection of Personal Information
In accordance with section 3.1 of Quebec Law 25, SDC Grande Allée has designated a Person responsible for the protection of personal information. This person is your primary point of contact for any question, request, or concern related to this policy or to the handling of your personal information.
We will acknowledge your request within 30 days of receipt, as required by Quebec Law 25.
- Name: André Verreault
- Title: Directeur de la SDC
- Email: info@votregrandeallee.com
- Phone: 418 704-4763
You may contact this person to exercise any of the rights described in Section 7, to ask questions about our privacy practices, or to report a concern about how your personal information is being handled.
9. Effective Date and Versioning
This privacy policy takes effect on 11 juin 2026 and replaces any prior version.
Version: 3
We may update this policy from time to time to reflect changes in our practices, in the services we use, or in applicable law. When we make material changes, we will update the effective date above and, where appropriate, notify you through our website or by email. We encourage you to review this policy periodically.
This policy is managed and hosted by Moelleux (Horizon-Cumulus, Joliette, Quebec). Consent records are stored in Quebec (OVH, Beauharnois, Quebec) and do not leave Canadian territory.