1. Who is responsible for your information?
Evolute T.I. Inc., operating as Evolute and Evolute I.T. (“Evolute,” “we,” “us”), is based in Québec, Canada. We are responsible for the personal information we collect and use for the purposes described in this policy.
Our person responsible for the protection of personal information is:
Frédérick Marcoux, President
Email: [email protected]
Telephone: (450) 312-1002
Mail: Evolute T.I. Inc., Attn: Privacy, 366 rue du Tonnelier, Saint-Jérôme QC J7Y 0R4, Canada
Contact us with a question, request or complaint about personal information. You do not need to be a customer to contact our privacy officer.
2. What does this policy cover?
This policy covers our website and the information we handle for our own business purposes, including enquiries, newsletter subscriptions, business contacts and the administration of customer or supplier relationships.
Our role can be different when we manage IT systems, telephone services, integrations or applications for a customer. If we handle personal information on that customer’s instructions, the customer’s privacy notice and the applicable service and data processing agreements govern that processing. This website policy does not replace those agreements or authorise us to use customer-controlled information for our own marketing.
If your request concerns information controlled by your employer or another Evolute customer, you can contact that organisation directly. If you contact us, we will help identify the appropriate route and assist the customer as required by our obligations.
3. Information we collect and where it comes from
We collect information you provide, information generated when you use the site, and relevant business contact information provided by the organisation you represent or by someone making an introduction.
| Situation | Information involved | Why it is needed |
|---|---|---|
| Contact, quotation or integration enquiry | Your name, email address, subject, message and details you choose to provide about your needs; optional phone number, company and contact preferences. | To understand and answer the request, prepare a proposal or arrange the next step. |
| Newsletter subscription | Email address, selected topics and language; records of the subscription, permission, changes and unsubscribe request. | To send the emails you request, manage delivery and respect your choices. |
| Business relationship | Contact and role details, correspondence, proposals, agreements, billing or transaction records and administrative request history relevant to the relationship. | To manage the relationship, fulfil agreed responsibilities and maintain necessary business records. |
| Website delivery and security | Technical information such as IP address, browser/device information, requested pages, timestamps, errors and form security signals. | To deliver the site, troubleshoot problems, detect abuse and protect the service. |
| Privacy request or complaint | Your contact details, the request, proportionate verification information and the steps taken to answer it. | To process the request, protect against unauthorised disclosure and document the response. |
Required fields are identified on each form. If you do not provide information needed to answer a request, we may be unable to process it. Optional fields and marketing choices are not required to request information about our services.
Please do not send passwords, access codes, payment-card details, government identification numbers or confidential customer records through public forms. If sensitive information is necessary for an authorised task, contact us to arrange an appropriate method.
When someone else supplies your business contact information, we use it for the relevant introduction or business purpose and provide any further notice required by law. An introduction does not automatically subscribe you to a newsletter.
4. How we use information and your choices
We use personal information to respond to requests; prepare quotations and demonstrations; manage business relationships; operate and secure the website; send requested communications; handle privacy requests; and meet applicable legal or recordkeeping obligations.
We limit use to the purposes explained when information is collected or another purpose permitted by law. If we propose a new use that requires your consent, we will ask before beginning it.
Where we rely on your consent, you may refuse it or withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal. We will explain any practical consequences, such as an optional feature no longer operating or our inability to fulfil a request that depends on the information. Refusing marketing does not prevent you from contacting us. Separate processing already based on another valid legal ground may continue where that ground applies.
5. Cookies, preferences and website measurement
The site uses the technologies needed to maintain sessions, protect forms and remember choices you make, such as language selection, dismissing an announcement or your privacy choices. Browser storage may include cookies and local storage. The provider and technology details in section 18 explain the active items, their purposes and retention.
With your permission, we use the audience measurement described in the provider and technology details, which runs on our own website, to understand which pages are useful and improve the site. It processes the page visited, time of the visit and the technical information specified there. It estimates distinct visits using a temporary identifier derived from your connection and browser information; that processing is also described there, and we do not call it anonymous solely because an identifier is hashed.
Optional measurement is off until you agree. You can accept or refuse it in Privacy preferences and withdraw your choice there at any time. Refusal does not prevent access to the website or use of the contact form. We do not use these measurements for cross-site advertising or combine them with newsletter profiles.
With the same permission, the words typed into the site search are counted per day, normalised and without any link to you, so that we can see what people look for; without it, nothing about your search is kept. The provider and technology details give the approved retention period for the measurements we keep.
Form protection. We use Cloudflare Turnstile to help distinguish legitimate visitors from automated abuse. It processes technical signals from your browser and connection. Cloudflare also describes processing to improve its own bot detection. See the Turnstile Privacy Addendum for its role and practices. If you cannot use a form, contact us by email or telephone.
Browser privacy signals. We do not sell personal information or use it for cross-context behavioural or targeted advertising. We honour legally recognised opt-out signals, including Global Privacy Control, where required. On this website, Global Privacy Control and Do Not Track also keep optional audience measurement off. Necessary delivery and security processing continues. You can review the choices available in Privacy preferences.
6. Newsletters and other emails
We send newsletters when you subscribe or otherwise provide the permission required by law. We record the relevant subscription choices and evidence of permission, which may include the date, time, source form, language and IP address associated with the subscription where needed for that evidence.
If you separately opt in to newsletter engagement measurement, we use tracking pixels and tracked links to record when a message is opened and which links are clicked. These events can be associated with your email address and subscription. We use them to assess and improve newsletter content; the provider and technology details identify the data involved and how long it is kept.
You can receive the newsletter without this optional measurement. You can change the choice through the email preference link or by contacting us. Delivery, bounce, consent and unsubscribe records are handled separately so that we can operate the mailing list and respect your choices.
You can unsubscribe using the link in an email or by contacting us. We act within the applicable legal deadline. Unsubscribing from marketing does not stop necessary non-marketing communications about a request, an account, security or a service relationship.
We keep a limited record of a withdrawal or unsubscribe, and proportionate evidence of earlier permission, where needed to respect the refusal and demonstrate compliance. We do not use a suppression record to continue marketing to you.
7. Who receives information?
Access within Evolute is limited to people who need information for their responsibilities. We use providers for functions such as website hosting, email delivery, form and business-request management, security and necessary backup or recordkeeping.
The provider and technology details accompanying this policy identify the active services, their purposes and relevant processing locations. Providers acting on our behalf receive the information needed for their work and are subject to appropriate contractual requirements. Some providers also act independently for particular purposes described in their own notices; the Turnstile notice above is one example.
We may disclose information where required or permitted by law, to respond to lawful requests, protect rights and security, obtain professional advice, or assess or complete a permitted business transaction with appropriate confidentiality and privacy safeguards. A transaction does not give a new owner unrestricted permission to use information for unrelated purposes.
We do not sell or rent personal information. We do not share it for cross-context behavioural advertising or use it for targeted advertising. Disclosures to providers for the purposes explained above are still disclosures of information, even when they are not a sale or advertising-related sharing.
8. Processing outside Québec and Canada
Evolute is based in Québec. Some of our providers process information outside Québec, including outside Canada. Relevant locations and transfer safeguards are identified in the provider and international-transfer details accompanying this policy. Information processed in another jurisdiction can be subject to that jurisdiction’s laws and lawful access by its authorities.
Before entrusting personal information outside Québec where the law requires it, we assess the privacy factors and protection available, and put the required written arrangements in place. We remain responsible for our obligations and do not treat a provider’s location or certification as a substitute for that assessment.
For transfers governed by the GDPR, the accompanying international-transfer details identify the applicable adequacy decision or other transfer safeguard. Contact our privacy officer to request further information or an appropriate copy of the safeguards, subject to necessary redactions.
9. How long we keep information
We keep personal information for the time reasonably needed for its stated purpose and any applicable legal requirements. The criteria include whether a request remains active, whether a business relationship continues, the information needed to document consent or honour a refusal, and any applicable recordkeeping requirement or legal dispute.
| Record | Retention approach |
|---|---|
| Enquiries and related correspondence | General website enquiries that do not become an active customer or supplier matter are deleted from the website’s database 24 months after receipt. The notification email we receive and any correspondence that follows are kept as business records under the next row. If the enquiry leads to a business relationship, the relevant correspondence becomes part of that relationship’s records and follows its retention schedule. Records subject to an identified legal preservation requirement are retained for that requirement. |
| Customer and supplier administrative records | For the relationship and the applicable contractual, accounting, tax, limitation or other legal recordkeeping period. |
| Active newsletter information | While the subscription remains active, subject to removal of information that is no longer needed. |
| Consent evidence and unsubscribe records | A limited record for as long as necessary to demonstrate permission, resolve a relevant dispute and prevent further messages contrary to your choice. |
| Newsletter engagement events | Open and click events recorded with your permission are kept with the sending records of the campaign concerned, for as long as that campaign is kept in our newsletter system. Recording stops as soon as you withdraw the choice. |
| Website statistics | Daily page totals and, with your permission, unique-visitor estimates and search-term counts are kept for 25 months, then deleted. The daily key used for the estimate is discarded after two days and the derived identifiers are never stored. |
| Security and technical records | For the operational or security purpose that justifies the record; longer only where an identified incident, investigation or legal requirement justifies it. |
| Privacy requests and complaints | For handling the matter and the period needed to document compliance or address a related claim. |
When information is no longer needed, we securely delete it or, where permitted, anonymise it in accordance with applicable legal requirements. Merely removing a name or hashing an identifier does not necessarily make information anonymous. Backup copies are removed through their documented rotation and deletion cycles; access remains restricted while those copies exist. A specific legal preservation requirement can delay deletion of affected records.
You may ask our privacy officer for information about the retention period relevant to your request.
10. Security and privacy governance
We use administrative, technical and physical measures appropriate to the sensitivity of the information, the purposes of processing and the risks involved. These include access controls, secure communications, maintenance and procedures for handling information and incidents. No system or transmission method is completely secure.
Our privacy officer oversees our privacy practices and the handling of requests and complaints. Staff responsibilities and access are assigned according to their roles. Our internal practices address collection and use, supplier oversight, retention and destruction, staff awareness and incident response. We review new or changed systems through the privacy assessments required by law.
If a confidentiality incident occurs, we assess it, take appropriate protective steps, keep the required records and notify the people or authorities required by the applicable law.
11. Your rights in Québec and Canada
Depending on the applicable law and circumstances, you can request access to personal information we hold about you, ask for corrections and obtain information about how it has been used or disclosed. You can also withdraw consent for future processing that depends on it and request deletion where the law provides that right or the information is no longer needed.
In Québec, the right to portability can allow you to obtain eligible computerised personal information collected from you in a structured, commonly used technological format, or request its transfer to an authorised person or organisation. This right has legal limits, including for information created or inferred by us and serious practical difficulties. Certain rights to stop dissemination or request de-indexing or re-indexing also exist in the specific circumstances provided by law; they are not an unconditional right to remove every record or search result.
Contact our privacy officer using the details in section 1. Describe the request sufficiently for us to locate the information. We may take proportionate steps to verify identity or authority before disclosing or changing information. Please do not send identity documents unless we request an appropriate verification method.
We answer Québec access and rectification requests in writing within 30 days of receipt. Other applicable laws may set a different deadline or permit a particular extension. If we cannot grant a request, we explain the reasons and the recourse available, as required by law.
12. Additional information where the GDPR applies
This section applies where our processing falls within the scope of the General Data Protection Regulation, including the applicable rules in the European Economic Area.
Lawful bases. We rely on the basis appropriate to the particular purpose:
- Contract, for processing necessary to provide services to you as an individual or take steps you request before entering into a contract.
- Legitimate interests, for managing relationships with representatives of customer organisations, administering our business, and protecting systems, where your rights and freedoms do not override those interests.
- Consent, for optional activities for which we request permission, including tracking or marketing where consent is required.
- A legal obligation, where processing is required by applicable European Union or Member State law.
A contract with your employer does not by itself make every use of your information necessary to perform a contract with you. Submitting an enquiry does not automatically subscribe you to marketing.
Additional rights. Subject to the relevant conditions, you may request access, rectification, erasure, restriction of processing or data portability. You may object to processing based on legitimate interests for reasons relating to your situation. You may object to direct marketing at any time, including related profiling, and we will stop that use. You may withdraw consent without affecting earlier lawful processing.
We respond without undue delay and normally within one month. Where the complexity or number of requests justifies a permitted extension, we explain it within that first month; the extension may be up to two further months. Requests are generally free, subject to the exceptions allowed by law.
You may complain directly to the competent data protection authority, including in the EEA country where you live or work or where an alleged infringement occurred. Information about international transfers appears in section 8 and the accompanying transfer details.
13. Additional information for United States residents
Where an applicable U.S. state privacy law covers our handling of your information, you may have rights to confirm processing, access information, receive a portable copy, correct inaccuracies, request deletion, and opt out of sale, targeted advertising or certain profiling. California law may also provide a right to limit specified uses and disclosures of sensitive personal information.
These rights depend on the applicable law and its exceptions. Where the California Consumer Privacy Act applies, eligible California residents acting as business contacts are also protected; other states can treat commercial and employment contexts differently. Any California-specific disclosure accompanying this policy supplies the required detail about covered processing.
To make a request, contact our privacy officer by email or telephone using section 1, or use an additional request method identified in the applicable state disclosure. An authorised agent can make a request where the law permits. We may require proportionate verification for access, deletion or correction and evidence of an agent’s authority. We do not impose identity verification on an opt-out where the law prohibits it.
We respond within the deadline required by the applicable law. If we decline a request, we explain why and describe an available appeal procedure. Where you have a right to appeal, email [email protected] with the subject Privacy appeal, or contact us by telephone for assistance. If we deny an appeal, we provide the required information about contacting the appropriate regulator.
We do not unlawfully discriminate against you for exercising privacy rights. Our sale, sharing, targeted-advertising practices and browser-signal handling are described in sections 5 and 7.
14. Automated decisions and children
We do not use the information covered by this policy to make decisions about individuals that have legal or similarly significant effects based solely on automated processing. Our form security tools can block suspected automated abuse; contact us by email or telephone if you need another way to reach us.
Québec law also provides rights concerning decisions based exclusively on automated processing, without requiring those effects. Where that rule applies, we inform you of the automated decision no later than when we communicate it. On request, we provide information about the personal information used, the reasons and principal factors and parameters that led to the decision, and your right to have the information corrected. You can also present observations to a staff member able to review the decision.
The website is intended for business users, not children. We do not knowingly seek personal information from children under 14 through it. If you believe a child has provided personal information, contact our privacy officer so that we can assess the situation and take the steps required by law, including obtaining valid authorisation or deleting information where appropriate.
15. External links and service portals
Links to billing, support, vendor or other external websites take you to services that may use their own technologies and privacy notices. Review the notice presented by the service you use. Our responsibilities for information processed on our behalf still apply; an external link does not remove those responsibilities.
16. Questions and complaints
Send a privacy question or complaint to our privacy officer using section 1. Explain the concern and the outcome you are seeking. We review the matter, request only the additional information needed, and explain our response and appropriate next steps.
You may also contact the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada, as appropriate. You may contact another competent regulator where its law applies. You do not need to complete our internal complaint process before exercising a right to complain directly to a regulator.
17. Changes to this policy
We update this policy when our practices or legal requirements change. The date at the top identifies the latest approved version. For a material change, we provide any additional notice or request any new consent required by law. A policy update does not retrospectively authorise a new use of information.
18. Providers, technologies and international transfers
The following details describe the services and technologies active for the processing covered by this policy. Retention refers to the specified record or technology, not automatically to every business record associated with it. You can contact our privacy officer for more information about the applicable safeguards.
Providers
| Service/provider | Purpose and information involved | Role and privacy notice | Processing locations relevant to our use | Applicable transfer safeguard, where required |
|---|---|---|---|---|
| Amazon Web Services (website hosting, server managed with Laravel Forge) | Runs the website, its database, queues and backups: everything the website stores under this policy, including form submissions, newsletter subscriptions and daily statistics. | Processor acting on our behalf. AWS privacy notice | Canada (Montréal region). Administrative access from Québec. | Not a transfer outside Canada for the data stored there; the provider’s data processing terms apply. |
| SMTP2GO (email delivery) | Sends our transactional emails and newsletters: recipient address and name, message content, delivery, bounce and unsubscribe information. | Processor acting on our behalf. SMTP2GO privacy policy | Outside Canada; the provider operates infrastructure in the United States and the European Union. | The provider’s data processing terms, which incorporate the European Commission’s standard contractual clauses for transfers governed by the GDPR, and our assessment under Québec law. |
| Cloudflare Turnstile (form protection) | Distinguishes visitors from automated abuse on our forms: technical signals from your browser and connection. | Processor for the check itself; Cloudflare also acts independently to improve its own bot detection. Turnstile Privacy Addendum | Cloudflare, Inc. (United States), on its global network. | The provider’s data processing terms, which incorporate the European Commission’s standard contractual clauses for transfers governed by the GDPR, and our assessment under Québec law. |
| Benji Pays (billing portal) | External link only: the billing portal is a separate service you sign in to. This website sends it nothing. | Independent service, governed by the notice presented in the portal. | Not applicable to this website. | Not applicable. |
| Support portal (evoluteit.rmmservice.ca) | External link only: the support portal is a separate service you sign in to. This website sends it nothing. | Independent service, governed by the notice presented in the portal. | Not applicable to this website. | Not applicable. |
Technologies
| Technology and provider | Purpose and information involved | When active / your choice | Storage or record duration |
|---|---|---|---|
| Session cookie (evolute-ti-session, this website) | Keeps your session and form state between pages. | Necessary, always active. | Two hours after your last request. |
| Request-forgery token (XSRF-TOKEN, this website) | Protects forms against forged requests. | Necessary, always active. | Two hours. |
| Language cookie (locale, this website) | Remembers the language you chose. | Necessary, set when you switch language. | One year. |
| Privacy-choice cookie (evolute_privacy, this website) | Records your answer to the privacy choices so that we can honour it on every request. | Necessary, set when you answer. | One year; asked again if the notice changes. |
| Announcement dismissal (local storage, this website) | Remembers that you closed an announcement banner. | Necessary, set when you close it. | Until you clear your browser storage. |
| Cloudflare Turnstile | Form protection as described in section 5; may use Cloudflare storage according to its notice. | Necessary on pages with a form. | See the Turnstile notice. |
| Daily page totals (this website) | Counts how many times each page is viewed per day, without any identifier. | Necessary aggregate count, always active. | 25 months. |
| Unique-visitor estimate (this website) | Estimates distinct visitors per day from a temporary identifier derived from a daily key, your IP address and your browser; the identifier is never stored. | Optional: off until you accept in Privacy preferences, and off with Global Privacy Control or Do Not Track. | Daily key: two days. Totals: 25 months. |
| Search-term statistics (this website) | Counts the words searched on the site per day, normalised and without any link to you. | Optional: the same choice as above. | 25 months. |
| Newsletter open pixel and tracked links (this website) | Records when a newsletter is opened and which links are clicked, associated with your subscription. | Optional: only if you tick the engagement measurement choice when subscribing or in your preferences. | With the sending records of the campaign concerned. |
International transfers
For covered transfers to Evolute in Canada, we rely on the European Commission’s adequacy decision for recipients subject to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). This does not automatically cover onward transfers to another provider or country.
For transfers governed by the GDPR to SMTP2GO and Cloudflare, we rely on those providers’ data processing terms, which incorporate the European Commission’s standard contractual clauses. Contact our privacy officer to request information about the safeguards or an appropriate copy, subject to necessary redactions.