Compliant with Law 25

Personal information protection policy

Last updated: May 8, 2026

1. Who we are

Maison Cacao (« we », « our », « the House ») is an artisan chocolaterie registered with the Quebec enterprise register, operating at 87 Saint-Paul Street West, Old Montreal (QC) H2Y 1Y8.

This policy describes how we collect, use, retain and protect your personal information, in accordance with Quebec's Act respecting the protection of personal information in the private sector (Law 25).

2. Personal information officer

In accordance with section 3.1 of Law 25, we have designated a Personal Information Officer (PIO):

3. Information we collect

We only collect information strictly necessary for the stated purposes:

  • Order or workshop booking form — name, email, phone, preferred date, type of request, free-text message.
  • Newsletter — email address only.
  • Technical data — no browsing data or tracking cookies are collected on this site. No third-party analytics (Google Analytics, Meta Pixel, etc.) are integrated in this demo.

4. Purposes

Your information is used exclusively to:

  • Process your order, workshop request or question.
  • Send you, with your explicit consent, our seasonal newsletter.
  • Comply with our legal and accounting obligations.

No data is sold, rented or transferred to third parties for commercial purposes.

5. Consent

Your consent is requested explicitly, freely and on an informed basis at the time of collection, via a dedicated checkbox separate from the form submission. You can withdraw your consent at any time by emailing vieprivee@art-artisanat.nextiwebstudio.ca.

6. Retention period

  • Order request — 24 months after your last interaction, then deleted.
  • Accounting records — kept for 6 years, in accordance with Canadian tax requirements.
  • Newsletter subscription — kept as long as you remain subscribed. One-click unsubscribe in every email.

7. Hosting and transfers outside Quebec

Our site is hosted by Hostinger, prioritising Canadian servers. Some third-party resources may load from outside Quebec:

  • Google Fonts (USA) — typefaces. No personal data intentionally transmitted.
  • OpenStreetMap (Germany) — location map display.
  • Unsplash (USA) — demo photography.

A Privacy Impact Assessment (PIA) was conducted prior to each third-party integration and concluded a low residual risk. In production, these resources will be brought back onto our own Canadian servers.

8. Security measures

  • HTTPS encryption across the entire site (TLS 1.3).
  • Weekly encrypted backups.
  • Data access limited to people designated by the PIO.
  • Two-factor authentication on all administrative tools.

9. Your rights

Under Law 25, you have the following rights at any time:

  • Access — obtain a copy of your personal information.
  • Rectification — request correction of inaccurate, incomplete or ambiguous information.
  • Withdrawal of consent — at any time, without justification.
  • Portability — receive your data in a structured, commonly used technological format (since September 22, 2024).
  • De-indexation and cessation of dissemination — where Law 25 conditions are met.
  • Complaint — file a complaint with the Commission d'accès à l'information du Québec (CAI).

To exercise your rights, write to vieprivee@art-artisanat.nextiwebstudio.ca. We respond within 30 days.

10. Confidentiality incidents

In the event of an incident likely to cause serious harm, we will inform you without delay and notify the Commission d'accès à l'information, in accordance with section 3.5 of Law 25. An incident log is maintained for 5 years.

11. Updates to this policy

This policy may be amended to reflect changes in our practices or regulations. The update date is shown at the top of the page. For any substantial change, we will notify you by email.

← Back to home