Phosphotopia
Book

Privacy policy

This policy describes how [LEGAL NAME] processes your personal information through the Phosphotopia platform, in accordance with Québec's Act respecting the protection of personal information in the private sector, as modernized by Law 25.

Person responsible for the protection of personal information

The person responsible for the protection of personal information within our business is [NAME OF PERSON RESPONSIBLE], [TITLE]. You may contact them for any question, access or rectification request, or to file a complaint: info@phosphotopia.com or [MAILING ADDRESS].

Information we collect

  • Account: name, email address, phone number, preferred language.
  • Reservation: delivery and billing address, geographic coordinates of the delivery address (to estimate distance), dates, delivery method, and notes you send us.
  • Payment: processed by Stripe. We do not keep your card number; only the card type and last four digits are stored.
  • Reviews: the rating and comment you choose to publish.
  • Account security: two-factor authentication details if you enable it.
  • Technical data: IP address, session identifiers and a log of administrative activity related to your reservations, for security and traceability.

Purposes

We use this information to: create and manage your account; process your reservations, payments, deliveries and deposits; send you communications related to your reservations (confirmation, activation, reminders, reviews, refunds, cancellations); ensure security and prevent fraud; publish and moderate reviews; and comply with our legal, tax and accounting obligations.

Consent

You consent to the collection of your information at the time of booking. You may withdraw your consent at any time; however, some services (such as fulfilling a rental already booked) may then no longer be possible.

Disclosure to third parties (service providers)

We do not sell your information. We use service providers acting on our behalf, solely for the purposes above:

  • Stripe — payment and deposit processing (receives your name, email and payment data).
  • Google (Distance Matrix) — delivery distance estimation (receives the delivery address entered).
  • Email provider — sending transactional communications.
  • Hosting — DigitalOcean, where platform data is hosted [region: Canada (Toronto) / United States — to be confirmed].

Information hosted or processed outside Québec

Some of our providers may process or host information outside Québec (notably Stripe and Google, in the United States, and depending on the hosting region chosen). Before any disclosure outside Québec, we carry out the privacy impact assessment required by Law 25 and frame these transfers by contract to ensure adequate protection. [TO BE REVIEWED — privacy impact assessment and contractual clauses.]

Retention period

We keep your information for as long as necessary for the stated purposes. Transactional data (reservation number, amounts, taxes, payment identifiers) is kept for the period required by our tax and accounting obligations [period — e.g. 6 years]. When you delete your account, your personal information is anonymized: addresses and notes are erased, your name and email are replaced, while data strictly necessary for accounting obligations is kept in a dissociated form.

Your rights

Law 25 grants you several rights, which we have built into your account area:

  • Access and portability — download all of your data in a readable format from "Account → Privacy".
  • Rectification — correct your information from your profile.
  • Withdrawal of consent and deletion / anonymization of your account (possible when you have no ongoing rental).
  • De-indexing and objection, in the cases provided for by law.

To exercise a right that is not available online, write to the person responsible. We respond within 30 days.

Cookies

We use only cookies that are essential to the site's operation: maintaining your session, security (anti-forgery token) and remembering your language. We do not use advertising cookies. [If you add an analytics tool, update this section and provide for the required consent.]

Security

We implement reasonable measures to protect your information: encryption in transit (HTTPS), hashed passwords, access controls, optional two-factor authentication and logging of sensitive actions.

Privacy incident

We keep a register of privacy incidents. In the event of an incident presenting a risk of serious harm, we notify the Commission d'accès à l'information and the persons concerned, as required by law.

Complaint

If you believe your rights have not been respected, first contact our person responsible. You may also file a complaint with Québec's Commission d'accès à l'information (cai.gouv.qc.ca).

Changes

We may amend this policy; the current version is published on the site, with its last-updated date. Any significant change will be brought to your attention by appropriate means.