Privacy Policy

At a glance

• Nukleo is a trade name of Nucléus Stratégie inc. (Québec enterprise number 1177652220). Nukleo is responsible for the personal information collected on nukleo.com.
• Our person in charge of the protection of personal information is Clément Roy, President and Founder. You can write to him at hello@nukleo.com.
• The Contact, Agencies, Home page and Careers forms send your information to us by email. The website does not store it in a database.
• Google Analytics stays off until you accept it in the website banner.
• Some of our service providers are located in the United States. Your information may therefore be processed outside Quebec and Canada.
• You can access your information, have it corrected, withdraw your consent and file a complaint. We respond within 30 days.
• We do not sell your personal information.

1. Who we are and who this Policy applies to

Nukleo is a trade name of Nucléus Stratégie inc. (Québec enterprise number 1177652220). The corporation is incorporated in Quebec. In this Policy, "Nukleo", "we" and "us" refer to it. Our head office is at 345-6750 av. de l'Esplanade, Montréal, Quebec H2V 4M1. We also have an office at 1800 Argyle St, Unit 801, Halifax, Nova Scotia B3J 3N8. The corporation is also registered in Nova Scotia (Registry ID 4649655).

This Policy explains how we collect, use, disclose, retain and destroy personal information. It applies to:

• people who visit nukleo.com;
• people who write to us through the website forms or by email;
• people who apply for a job with us;
• representatives of our clients, prospective clients, suppliers and partners.

It is designed to comply with Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25 (the "Quebec Act"). It is also designed to comply with Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"), which applies in particular to our activities in Nova Scotia and to information that moves between provinces or countries.

In some projects, we process personal information on behalf of a client, for example when migrating a database. In those cases, we act as a service provider. The client remains responsible for that information, and we process it according to its instructions and our contract with it. To exercise your rights over that information, please contact that client first.

The IGNITE questionnaire available at nukleo.com/ignite is run by a separate application. This questionnaire is operated by Nukleo. Responses are sent to Clément Roy, our person in charge of the protection of personal information, and are handled under this Policy. Only Nukleo team members who need the responses for this purpose can view them. IGNITE partner organizations do not have access to them.

2. Person in charge of the protection of personal information

Clément Roy, President and Founder, is Nukleo's person in charge of the protection of personal information. He ensures compliance with the law and with this Policy. He receives requests for access, correction and withdrawal of consent, as well as complaints.

How to reach him

Clément Roy, Person in charge of the protection of personal information
Nukleo
345-6750 av. de l'Esplanade
Montréal, Quebec H2V 4M1
Email: hello@nukleo.com (write "Privacy" in the subject line)

3. Definitions

Personal information is information about an individual that allows that individual to be identified, directly or indirectly.

Sensitive information is information that, due to its nature or context, gives rise to a high reasonable expectation of privacy. Examples include medical, biometric or financial information. We do not ask for sensitive information on the website.

Business contact information means an individual's name, title, position, work address, work email and work telephone number. The Quebec Act does not apply to this information when it relates to the performance of duties within a business. PIPEDA does not apply to it when it is used solely to communicate with an individual in relation to their employment or profession. We still handle it with care.

4. Information we collect and how we collect it

Contact, Agencies and Home page forms. We collect your name, the name of your company or agency, your email address, your message and, on the Home page form, the needs you check. Required fields are marked in each form. Your submission goes through our server, which forwards it by email to our team using the SendGrid service. The server does not store it in a database. You then receive an acknowledgement at the email address you provided.

Careers form. We collect your name, your email address, the position you are applying for, your message and, if you provide them, your LinkedIn profile URL and your résumé. Section 8 gives the details.

Browsing the website.

• Our hosting provider receives technical data for each visit: IP address, browser type, page requested, date and time. It may log this data to keep the website running and secure.
• When you submit a form, your IP address is used to block abusive submissions (no more than five submissions per 15-minute period). It is kept in memory for that period only and is not stored.
• The website remembers your language in a cookie and in your browser's local storage. It remembers your cookie choice in local storage.
• If you consent, Google Analytics collects browsing data (see section 7).

Business relationships and projects. We collect the contact details, communications, billing information and documents needed for our engagements. We obtain them from you or from the organization you represent, by email, by phone, in meetings or by videoconference.

Information received from third parties. Someone may send us your contact details, for example a client who introduces a colleague. We then handle that information in accordance with the law. If you give us information about another person, you must be authorized to do so.

Please do not send us sensitive information through the website forms.

5. Purposes of collection

We use personal information to:

• respond to your requests and follow up on our exchanges;
• prepare proposals and enter into contracts;
• deliver our services and manage our projects;
• invoice and keep our accounting records;
• assess applications and recruit;
• protect the website, prevent fraud and block abusive submissions;
• measure website traffic, with your consent;
• meet our legal obligations and enforce our rights.

We do not use your information for any other purpose without your consent, unless the law permits it.

6. Consent

Your consent must be clear, free and informed. It is given for specific purposes.

When you fill out a form, you consent to our using your information to respond to you or to assess your application. For cookies and tracking technologies, we ask for your express consent through the website banner. If sensitive information were ever to be used, we would obtain your express consent.

In some cases, the law allows information to be used or disclosed without consent. Examples include meeting a legal obligation, preventing fraud or engaging a service provider bound by a written contract.

You may withdraw your consent at any time (see section 16).

7. Cookies and tracking technologies

Audience measurement is off by default. On your first visit, a banner asks whether you accept audience measurement by Google Analytics. If you refuse or ignore the banner, Google Analytics is not loaded.

Google's own purposes. Google may use some Google Analytics data for its own purposes, under its own policy: policies.google.com/privacy.

Changing your mind. You can change your choice at any time using the "Cookie preferences" link at the bottom of every page. If you withdraw your consent, the website deletes the Google Analytics cookies placed on nukleo.com, then reloads the page. Data already sent to Google before you withdrew is not erased by this step. It follows the retention period shown in the table above. You can also clear the website's data in your browser. The banner will then reappear on your next visit. Your browser also lets you block cookies.

8. Job applications and résumés

The Careers form collects your name, your email address, the position you are applying for and your message. You may also provide your LinkedIn profile URL and a résumé in PDF, DOC or DOCX format, up to 5 MB.

Your application is sent by email, through SendGrid, to Nukleo's mailbox. Your résumé is attached. The website server does not keep a copy. You receive an acknowledgement. Only the people involved in recruitment have access to your application.

We use this information only to assess your application for the position you selected or your general application. Please do not include your social insurance number, date of birth, photo or health information in your résumé. We only check references or backgrounds at a later stage, with your consent.

If your application is not successful, we keep it for 12 months after the process ends, then destroy it. To keep it longer for other positions, we will ask for your consent. You may withdraw your application at any time.

9. Employee information

We collect the information needed for hiring, payroll, managing the employment relationship and meeting our legal obligations. This information is handled under our internal rules and the applicable laws. Employees may contact the person in charge of the protection of personal information.

10. Disclosure to third parties

We disclose personal information only in the following cases:

• with your consent;
• to our service providers, when needed for their engagement. A written contract requires them to protect the information, to use it only for that engagement and to destroy it when the engagement ends;
• to our professional advisers, such as our lawyers and accountants, who are bound by confidentiality;
• when the law requires or permits it, for example to comply with a court order;
• in a business transaction, such as a merger or the sale of a business, on the conditions set by law.

Our main website-related service providers are:

We do not sell, rent or trade personal information.

11. Disclosure outside Quebec and Canada

Several of our service providers are located in the United States. The website's server is hosted in the Netherlands. Our Halifax team may also have access to some information. Your information may therefore be processed outside Quebec and Canada.

Before disclosing personal information outside Quebec, we conduct a privacy impact assessment. It takes into account the sensitivity of the information, the purposes for which it will be used, the protection measures that will apply, including contractual ones, and the legal framework of the place where it will be processed. We disclose the information only if this assessment shows that it will receive adequate protection. The disclosure is covered by a written agreement.

Information processed outside Canada is subject to the laws of the place where it is located. Authorities in that place may access it under those laws.

12. Automated decisions

We do not make any decision based exclusively on automated processing of your personal information.

If we ever did, we would inform you no later than at the time of the decision. You could then find out what information was used, the reasons and main factors that led to the decision, have your information corrected and submit your observations to a member of our team who is able to review the decision.

13. Retention and destruction

We keep personal information only for as long as needed for the purposes for which it was collected, or for as long as the law requires.

• Requests sent through the forms: 24 months after our last exchange. If a business relationship results, we keep them for the length of that relationship and for as long as the law requires.
• Unsuccessful applications: 12 months after the process ends (see section 8).
• IGNITE questionnaire responses: 24 months after our last exchange with your company. If your company becomes a client, we keep them for the length of our relationship and for as long as the law requires.
• Google Analytics data: 14 months for user-level and event-level data, according to our account's retention setting. Aggregated reports, which do not identify you, may be kept longer.
• Client files, contracts and accounting records: the period required by tax laws, generally six years after the end of the tax year concerned.

At the end of the retention period, we destroy the information securely. We may also anonymize it to use it for serious and legitimate purposes, under the rules set by law.

14. Security

We take reasonable security measures suited to the sensitivity of the information. For example:

• the website is only available over an encrypted connection (HTTPS);
• the forms are protected against automated and abusive submissions;
• résumés are checked (file type and size) before they are sent;
• access to information is limited to the people who need it for their work;
• our team members are bound by confidentiality.

No method of transmission or storage is completely secure. We therefore cannot guarantee absolute security.

15. Confidentiality incidents

A confidentiality incident is any unauthorized access to, use or disclosure of personal information, or its loss.

If an incident occurs, we promptly take steps to reduce its consequences and prevent it from happening again. If the incident presents a risk of serious injury, we promptly notify the Commission d'accès à l'information du Québec and the people concerned. If PIPEDA applies and the incident creates a real risk of significant harm, we also report it to the Office of the Privacy Commissioner of Canada and notify the people concerned.

We keep a register of all confidentiality incidents, including those that do not present a risk of serious injury. We keep the information in this register for at least five years.

16. Your rights

Subject to the exceptions set out in the law, you have the right:

• to be informed about the information we hold about you, how it is used, who has access to it and how long it is kept;
• to access your information and obtain a copy;
• to have corrected information that is inaccurate, incomplete or equivocal, and to have deleted information whose collection, disclosure or retention is not authorized by law;
• to withdraw your consent to the use or disclosure of your information. Withdrawal applies going forward. It may prevent us from responding to you or from continuing a service;
• to request that we stop disseminating information or de-index a hyperlink attached to your name, where the law allows it, for example if the dissemination causes you serious injury;
• to data portability: to obtain the computerized information you provided to us in a structured, commonly used technological format, or to have it sent to the person or organization of your choice;
• to be informed of any decision based exclusively on automated processing, as set out in section 12;
• to file a complaint with us or with a supervisory authority (see section 18).

17. Exercising your rights and response time

Send your request in writing to the person in charge of the protection of personal information, using the contact details in section 2. We may ask you for information to confirm your identity. We will only ask for what is strictly necessary. If you need help preparing your request, we will help you.

Access to your information is free of charge. Reasonable fees may apply for transcription, reproduction or transmission. We will tell you in advance.

We respond in writing no later than 30 days after receiving your request. If we refuse a request, we give the reasons, the provision of the law on which the refusal is based and your remedies. Under the Quebec Act, failure to respond within 30 days is deemed a refusal.

18. Complaints

You may first file a complaint with our person in charge of the protection of personal information, using the contact details in section 2. We acknowledge receipt of your complaint, review it and respond in writing within 30 days.

You may also contact:

• the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca). To challenge a refusal or a failure to respond to a request for access or correction, you must apply to the Commission within 30 days of the refusal or of the expiry of the response period;
• the Office of the Privacy Commissioner of Canada (www.priv.gc.ca), for matters covered by PIPEDA.

19. Minors

The website is intended for businesses and adults. We do not knowingly collect personal information about a minor under 14 without the consent of the person having parental authority or the tutor. If you believe a child has sent us information, please write to us. We will destroy it.

20. Links to other websites and social media

The website contains links to other websites, including LinkedIn and Instagram. These links do not send any data to those platforms until you click on them. Once you are on those websites, their own policies apply. We encourage you to read them.

21. Electronic communications

The acknowledgement you receive after submitting a form is a transactional message. We do not send you promotional messages without your consent, in accordance with Canada's Anti-Spam Legislation. Every promotional message includes a simple way to unsubscribe.

Email carries certain risks. Please avoid including sensitive information in it.

22. Governance

Our internal rules govern the protection of personal information throughout its life cycle. Here are the key points:

• Person in charge. Clément Roy, President and Founder, is the person in charge of the protection of personal information. He approves our rules and oversees their application. You can write to him at hello@nukleo.com, with "Privacy" in the subject line.
• Roles. Each member of our team only accesses the information needed for their work and is bound by confidentiality. Our service providers are bound by contract.
• Retention. We follow a schedule: for example, 24 months for requests received through the website, 12 months for unsuccessful applications and 14 months for Google Analytics data. We then destroy or anonymize the information.
• Requests and complaints. We handle requests for access, correction and portability, as well as complaints, and we respond in writing within 30 days.
• Incidents. We record every confidentiality incident in a register. If an incident presents a risk of serious injury, we notify the Commission d'accès à l'information and the people concerned.
• Assessments. We carry out a privacy impact assessment before any new system that involves personal information and before any communication outside Quebec.
• Review. We review these rules at least once a year.

23. Governing law

This Policy is governed by the laws of Quebec and the applicable federal laws of Canada. Any dispute falls under the jurisdiction of the courts of the judicial district of Montréal. This rule does not limit your right to contact the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada, nor any rights granted to you by a rule of public order.

If you write to us from outside Canada, the laws of your country may give you additional rights. Write to the person in charge of the protection of personal information to exercise them.

24. Changes

We may amend this Policy to reflect changes in our practices, our services or the law. The new version is posted on this page with its update date. If a change is significant, we will clearly indicate it on the website. If we want to use your information for a new purpose, we will ask for your consent where the law requires it.