Introduction
Hilo Tech ("we", "we", "our") respects your privacy and is committed to protecting your personal information. This policy describes what information we collect, how we use it, our legal basis for processing it, and your rights. It applies to the hilotech.ca website and related services, and complies with Quebec's Law 25 (Act to modernize legislative provisions as regards the protection of personal information) as well as the European Union's General Data Protection Regulation (GDPR) for visitors in the EEA or United Kingdom.
Data Controller
Hilo Tech is the controller responsible for your personal information. You can reach our Privacy Officer at the contact details provided below.
Information We Collect
We only collect information necessary to provide our services:
- Contact details you voluntarily provide through our contact, support, or career forms (name, email, phone, message).
- Technical browsing data (truncated IP address, device type, pages viewed) through Google Analytics, only with your consent.
- Cookies and similar technologies, as described in the "Cookies" section below.
- Resumes and attachments you voluntarily submit as part of a job application.
Purposes and Legal Basis
We use your information for the following purposes:
- Respond to your inquiries and quotation requests (legal basis: pre-contractual measures / legitimate interest).
- Deliver and administer our managed IT services (performance of a contract).
- Analyze and improve site performance (consent, you may withdraw your consent at any time).
- Recruit and evaluate applications (pre-contractual measures).
- Comply with our legal, regulatory, and tax obligations (legal obligation).
Retention, Access, and Sharing
We retain your personal information only as long as necessary for the purposes described, and at most two years after your last interaction, unless the law requires longer retention. Accounting and contractual records are retained for applicable legal periods (up to 7 years).
Only authorized employees and processors with a business need have access to your information. They are bound by strict confidentiality obligations.
Your information may be disclosed to: (i) service providers (hosting, analytics, transactional email) contractually bound to equivalent security measures; (ii) entities resulting from a merger or reorganization; (iii) public authorities when required by law. We do not sell your personal information.
Transfers Outside Quebec / Outside the EU
Some of our providers (e.g. Google Analytics, cloud infrastructure) may process data outside Quebec, Canada, or the EU. Prior to any transfer, we conduct the Privacy Impact Assessment required by Law 25 and put appropriate safeguards in place (standard contractual clauses, processing agreements, anonymization). On request, we will provide you with the list of recipient countries.
Your Rights
Under Law 25 and the GDPR, you have the following rights:
- Right of access: obtain confirmation that your information is being processed and receive a copy of it.
- Right to rectification: correct inaccurate, incomplete, or ambiguous information.
- Right to erasure: request the deletion of your information when the legal conditions are met.
- Right to data portability: receive your information in a structured, commonly-used format (Law 25, in force since September 2024; GDPR).
- Right to object: object to processing based on legitimate interest or for direct marketing purposes.
- Right to restriction: request the restriction of processing in certain circumstances (GDPR).
- Right to de-indexation: request that information about you no longer be accessible through a search engine (Law 25).
- Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Right not to be subject to a fully automated decision producing significant effects on you, and to be informed when one occurs.
To exercise these rights, write to our Privacy Officer (contact details below). We will respond within a maximum of 30 days.
Automated Decisions
We do not use fully automated decision-making that produces legal or significant effects on you. If this were to change, we would inform you and offer you the ability to request human intervention.
Cookies
Our site uses strictly necessary cookies for operation (always active), as well as analytics and marketing cookies that are only set with your explicit consent. You can change your choices at any time via the banner below or the "Manage cookie preferences" link in the footer. Google Analytics is configured with IP anonymization and Consent Mode v2.
Security Measures
We implement reasonable technical and organizational measures (encryption in transit, access controls, Canadian backups, logging, employee training) to protect your information against loss, theft, unauthorized access, modification, or disclosure. In the event of a confidentiality incident presenting a serious risk of harm, we will notify the Commission d'accès à l'information (CAI) and the individuals concerned within the prescribed timeframes.
Protection of Minors
Our site is not intended for individuals under 14. We do not knowingly collect personal information from minors without the consent of the person exercising parental authority.
Complaints
If you believe your rights are not being respected, you can file a complaint with the competent authority:
- Quebec / Canada: Commission d'accès à l'information (CAI): cai.gouv.qc.ca
- European Union: your national data protection authority (e.g. CNIL in France, ICO in the UK)
Changes to This Policy
We may update this policy to reflect changes in our practices, technologies, or legal obligations. The last updated date is indicated at the top of the page. Material changes will be communicated by a prominent notice on the site.
Privacy Officer
Pascal Dupuis
Privacy Officer
175 Chemin de Chambly, Longueuil, J4H 3L3, Quebec, Canada
Mon–Fri, 8 AM – 5 PM
Quebec, Canada