Privacy Policy
Vectanor Group inc. (Groupe Vectanor inc.)
1. Who we are and what this policy covers
Vectanor Group inc. ("Vectanor", "we") is a company incorporated in Québec, with its head office at 1015 Avenue Wilfrid-Pelletier, Suite 410, Québec, QC G1W 0C4, Canada.
Vectanor is the group's single legal entity. Dimonoff, Amotus, Spatium, Vigilia, Fundamentum and SCMS are divisions, brands, products or platforms of Vectanor and are not separate legal entities. This policy therefore applies to all of these brands, including where it is referenced from their respective websites.
This policy explains what personal information we collect, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you can exercise. It covers:
- people who visit our websites and contact us;
- people who use our cloud services (Fundamentum, Spatium, SCMS) on behalf of a customer organization;
- people who apply for a job with us or who represent a supplier or partner.
It is incorporated by reference into our Terms of Use, which govern access to our services.
"Personal information" means any information that relates to a natural person and allows that person to be identified, directly or indirectly.
2. Privacy Officer
In accordance with Québec's Act respecting the protection of personal information in the private sector ("Law 25"), Vectanor has designated a person responsible for the protection of personal information. That person oversees compliance and handles requests for access, rectification and withdrawal of consent.
David Létourneau
Privacy Officer
Vectanor Group inc.
1015 Avenue Wilfrid-Pelletier, Suite 410, Québec, QC G1W 0C4
privacy@vectanor.com
3. Applicable legal framework
We handle personal information in accordance with Law 25 and the federal Personal Information Protection and Electronic Documents Act ("PIPEDA"). Where we handle information about people located outside Canada, we also apply the applicable local requirements.
4. What we collect and why
4.1 When you visit our websites
| Information | Why | Basis |
|---|---|---|
| IP address, device and browser type, language, pages viewed, referring source, time on site | Operate and secure the site, measure audience, improve content | Legitimate interest in operation and security; consent for non-essential audience measurement |
| Cookies and similar technologies | See section 6 | Consent, except for strictly necessary cookies |
4.2 When you contact us
| Information | Why |
|---|---|
| Name, email address, organization, telephone number, subject and content of your message | Answer your request, route you to the relevant division, follow up commercially |
| History of exchanges | Maintain continuity of service and a record of our commitments |
We ask only for what those purposes require. Optional fields in our forms are identified as such.
4.3 When you use our cloud services
Fundamentum, Spatium and SCMS are sold to organizations, not to individuals. Two situations must be distinguished.
Information for which we are responsible. Authorized user account details (name, work email address, role, organization, sign-in logs) are necessary to open and secure access to the services. We are responsible for that information.
Data we process on a customer's behalf. Data that a customer organization uploads to or generates in our services ("Customer Data" under the Terms of Use) remains that organization's property. Where such data contains personal information, Vectanor acts as a service provider (mandataire): we process it only on the customer's instructions and only to deliver the service. It is the customer organization that decides what to put there and that answers to the individuals concerned for the purposes of that collection. If you are an individual whose information sits in one of our customers' systems, address your request to that organization first; we will assist them in responding.
4.4 When you apply for a job
We collect the information you send us (résumé, cover letter, background, references) for the sole purpose of assessing your application. We keep unsuccessful applications for twenty-four (24) months so that we can contact you about a later opening, unless you ask us to delete them sooner.
4.5 What we do not do
We do not sell personal information. We do not rent it, trade it, or disclose it to third parties for those third parties' marketing. We do not permit third-party behavioural tracking on our sites. We do not use our customers' data to train, fine-tune or improve our artificial intelligence models without their prior express written consent, in accordance with section 8.2 of our Terms of Use.
5. Metadata and de-identified data
We produce and use aggregated, anonymized or de-identified technical data derived from the operation of our services — system logs, performance metrics, error rates, usage statistics — in order to operate, maintain and improve our services and to develop new features.
That data is aggregated or de-identified so that it does not, on its own, identify an organization or an individual, and we do not attempt to re-identify it. Where we anonymize information, we do so according to the regulatory criteria applicable in Québec.
6. Cookies and tracking technologies
Our sites use cookies and similar technologies. We group them in three categories.
Strictly necessary. These make the site work: session, security, load balancing, remembering your cookie choice. They cannot be disabled without making the site unusable.
Audience measurement. These tell us which pages are viewed and how visitors move through the site. We use Google Analytics for this.
Functional and marketing. These let us measure the effectiveness of our communications and adapt the content displayed.
In accordance with Law 25, identification, location and profiling functions that are not strictly necessary are deactivated by default and are enabled only with your consent. You can change your choice at any time through the cookie management panel available on our sites, or by configuring your browser to refuse or delete cookies. Refusing non-essential cookies does not prevent you from browsing our sites.
7. Who we share information with
We disclose personal information only in the following cases.
Service providers. We use suppliers acting on our behalf and on our instructions: cloud hosting, application security and attack protection, audience measurement, email delivery, customer relationship and support tools. They are contractually bound to confidentiality obligations and may not use the information for their own purposes.
Within the group. Vectanor's divisions are not separate legal entities; internal exchanges of information occur within a single legal person, on a need-to-know basis.
Legal obligations. We may disclose information where the law requires it, in response to an order from a court or competent authority, or to establish, exercise or defend a legal claim.
Corporate transactions. In a merger, acquisition or sale of assets, information may be transferred to the acquiring party, subject to the protections provided by law and to notice to the individuals concerned where required.
7.1 Disclosure outside Québec
Some of our suppliers process or host information outside Québec, including elsewhere in Canada and in the United States. Before any disclosure of personal information outside Québec, we carry out the privacy impact assessment required by Law 25, in order to confirm that the information will receive adequate protection, and we frame the disclosure in a written agreement.
For Fundamentum, our customers can choose the hosting region for their data, which supports digital sovereignty requirements.
8. Retention and destruction
We keep personal information only for as long as the purposes for which it was collected require, or for as long as the law imposes.
| Category | Retention |
|---|---|
| Contact requests and commercial exchanges | 36 months after the last exchange |
| Authorized user accounts for the services | Duration of the customer's subscription, then deletion under section 9.5 of the Terms of Use |
| Customer Data in the services | On the customer's instructions; deleted without undue delay at the end of the subscription |
| Security and sign-in logs | 12 months |
| Unsuccessful job applications | 24 months |
| Accounting and tax records | For the statutory periods that apply |
At the end of the period, information is securely destroyed or anonymized. Copies held in our backups are deleted in the ordinary course of the backup cycle and remain protected against active processing until deleted.
9. Security
We implement technical and organizational measures proportionate to the sensitivity of the information: encryption of communications, access control on a least-privilege basis, strong authentication for administrative access, logging, backups, vulnerability monitoring and patch management, staff awareness, and contractual controls over our suppliers.
Our security practices for our cloud services are covered by a SOC 2 Type 2 audit report, which attests that these controls are not merely defined but consistently applied over an observation period.
No measure can guarantee absolute security. You are responsible for protecting your credentials and for securing the devices and networks you use to access our services.
10. Confidentiality incidents
We maintain a register of confidentiality incidents, as Law 25 requires. Where an incident presents a risk of serious injury, we promptly notify the Commission d'accès à l'information du Québec and the individuals concerned, and we take reasonable steps to reduce the risk and prevent recurrence. Where an incident affects a customer organization's data, we inform that organization without delay so that it can meet its own obligations.
11. Automated decisions and artificial intelligence
Some of our services may include artificial intelligence or machine learning features, described in section 8 of our Terms of Use.
Where a decision producing a legal effect or a similarly significant effect concerning an individual is based exclusively on automated processing, we inform the individual at or before the time of the decision. On request, we tell them what personal information was used, the principal factors that led to the decision, and how to have that information corrected. The individual may submit observations to a member of our staff who is in a position to review the decision.
12. Your rights
Subject to the conditions and exceptions provided by law, you may:
Access the personal information we hold about you and learn how it is used and disclosed.
Have corrected information that is inaccurate, incomplete or ambiguous, or have deleted information whose collection was not authorized.
Withdraw your consent at any time for processing that relies on it, without affecting the lawfulness of processing carried out before the withdrawal.
Request that dissemination cease, or that a hyperlink giving access to information be de-indexed, where dissemination causes serious injury to your reputation or privacy.
Receive your information in a structured, commonly used technological format, or ask that it be communicated to a third party, where portability applies.
Be informed of the information collected, the purposes pursued, the means of collection, the third parties involved, and the possibility that information may be disclosed outside Québec.
To exercise any of these rights, write to privacy@vectanor.com or to the postal address in section 2. We respond within thirty (30) days of receiving your request. We may ask you to confirm your identity before acting; information collected for that sole purpose is destroyed once verification is complete.
13. Complaints
If you believe we have not handled your personal information in accordance with the law, write first to our Privacy Officer. We will acknowledge your complaint and inform you of the outcome of our review.
If our response does not satisfy you, you may contact the Commission d'accès à l'information du Québec or, depending on your situation, the Office of the Privacy Commissioner of Canada.
14. Children
Our sites and services are directed at organizations and professionals. They are not intended for people under 14 and we do not knowingly collect their personal information. If you believe such information has been sent to us, write to us and we will delete it.
15. Third-party links and services
Our sites and services may link to sites or services operated by third parties. We do not control their practices and are not responsible for them. This policy does not apply to those sites; we encourage you to read theirs.
16. Changes to this policy
We may amend this policy to reflect changes in our business, our technology or applicable law. The version in force is always published at the canonical address shown at the top of this document, with its version date. Where a material change affects users of our services, we give at least thirty (30) days' notice by email or by in-app notification.
17. Contact
Vectanor Group inc. / Groupe Vectanor inc.
1015 Avenue Wilfrid-Pelletier, Suite 410
Québec, QC G1W 0C4
Canada
Privacy and exercise of your rights: privacy@vectanor.com
Security incidents: security@vectanor.com
General enquiries: info@vectanor.com
Telephone: +1 418-682-3636
© Vectanor Group inc. All rights reserved.