Privacy Statement (CA)

1. Person in Charge of Processing

This privacy policy applies to the website operated by Énergie Renouvelable Onimiki (hereinafter "we," "us," or "our"). As a Quebec-based organization, we are subject to Quebec Law 25 — formally known as An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25) — and we are committed to handling your personal information responsibly and transparently in accordance with its requirements.

This policy explains what personal information we collect, why we collect it, how long we keep it, who we share it with, and what rights you have over it.

2. Personal Information Collected

We collect personal information about you in the following categories, depending on how you interact with our website:

• Identification and contact information: Your name and email address when you subscribe to our newsletter or fill out a contact form.
• Device and technical identifiers: Your IP address, device identifiers, and advertising identifiers collected automatically when you visit our site.
• Browsing behavior: Pages you visit, session duration, navigation patterns, and approximate geographic location derived from your IP address.
• Form and communication data: Information you voluntarily submit through web forms, including messages and preferences.
• Consent preferences: Your cookie consent choices, recorded and stored to respect your preferences on future visits.

We do not knowingly collect sensitive categories of personal information such as health data, financial account numbers, or government-issued identification numbers through this website.

3. Purposes of Processing

We use your personal information only for the purposes described below. Where we rely on your consent, you may withdraw it at any time (see Section 7).

• Website operation and security (Essential): We use session data, IP addresses, and consent preferences to keep the site functioning correctly and securely. This processing is necessary for the operation of the site and does not require your consent.
• Consent management (Essential — Moelleux by Horizon-Cumulus): We use the Moelleux platform, operated by Horizon-Cumulus (9322-8310 Québec inc.) in Joliette, Quebec, to record and manage your cookie consent choices. A preference cookie named moelleux_{site_key} is stored in your browser for up to 13 months. Consent records and this policy are hosted in Quebec (OVH, Beauharnois). This processing is necessary to fulfill our legal obligations under Quebec Law 25.
• Audience measurement and site improvement (Analytics — Google Analytics 4, Hotjar): We use Google Analytics 4 and Hotjar to understand how visitors use our site — which pages are visited, how long sessions last, and where users click or scroll. This helps us improve the site's content and performance. This processing is based on your consent. Both services transfer data to the United States (see Section 5).
• Targeted advertising and remarketing (Marketing — Meta Pixel, HubSpot): We use the Meta Pixel (Facebook) to measure ad conversions and to show targeted or remarketed ads to people who have visited our site. We use HubSpot to manage email marketing communications and track leads. This processing is based on your consent. Both services transfer data to the United States (see Section 5).
• Newsletter communications (Marketing — HubSpot): If you subscribe to our newsletter, we use your name and email address to send you updates about our work. This processing is based on your consent. HubSpot, our email marketing platform, operates in the United States (see Section 5).
• Website display (Functional — Google Fonts): We use Google Fonts to render text content correctly in your browser. Your IP address is transmitted to Google's servers in the United States as part of this process (see Section 5). This processing is based on your consent.

4. Third Parties and Processors

The following third-party services process personal information on our behalf or alongside us. We have entered into or rely on appropriate agreements with each of these providers.

We also use Microsoft 365 (operated in the United States) for internal business email communications. Emails you send to us may be processed on Microsoft's servers. Please see Section 5 for details on cross-border transfers.

5. Transfers Outside Quebec

Several of the services we use transfer your personal information outside Quebec, specifically to the United States. Under Quebec Law 25 (section 17), we are required to conduct a Privacy Impact Assessment (PIA — also called an EFVP in French) before communicating personal information outside Quebec, and to ensure that the destination jurisdiction offers an adequate level of protection.

The following services involve transfers of personal information to the United States:

• Google Analytics 4 (United States): Device identifiers, IP address, browsing behavior, and approximate location are transferred to Google LLC. Google participates in the EU-U.S. Data Privacy Framework and offers standard contractual clauses as a safeguard.
• Hotjar (United States): Device identifiers, IP address, session recordings, and navigation behavior are transferred to Hotjar Ltd. Hotjar relies on standard contractual clauses for international transfers.
• Meta Pixel / Facebook (United States): Device identifiers, IP address, advertising identifiers, social identifiers, and pages visited are transferred to Meta Platforms, Inc. Meta relies on standard contractual clauses for international transfers.
• HubSpot (United States): Contact information, form data, and browsing behavior are transferred to HubSpot, Inc. HubSpot relies on standard contractual clauses for international transfers.
• Google Fonts (United States): Your IP address is transmitted to Google LLC when fonts are loaded. Google participates in the EU-U.S. Data Privacy Framework.
• Microsoft 365 (United States): Business email communications may be processed by Microsoft Corporation on servers located in the United States. Microsoft relies on standard contractual clauses and participates in the EU-U.S. Data Privacy Framework.

We have conducted or are in the process of conducting Privacy Impact Assessments for the transfers listed above, as required by Quebec Law 25. These assessments evaluate the legal framework of the destination jurisdiction and the contractual safeguards in place. You may request a summary of these assessments by contacting our Person responsible for the protection of personal information (see Section 8).

Our website infrastructure and consent records are hosted in Quebec by Horizon-Cumulus (Joliette, Quebec) via OVH (Beauharnois, Quebec). No data processed by Moelleux leaves Quebec.

6. Retention Period

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy, or as required by law. The table below summarizes our retention practices by data type.

Once the applicable retention period expires, personal information is securely deleted or anonymized so that it can no longer be linked to you.

7. Your Rights

Under Quebec Law 25, you have the following rights regarding your personal information. To exercise any of these rights, please contact our Person responsible for the protection of personal information (see Section 8). We will respond within 30 days of receiving your request.

• Right of access: You may ask us to confirm whether we hold personal information about you and to receive a copy of that information in a clear and understandable format.
• Right of rectification: If any personal information we hold about you is inaccurate, incomplete, or ambiguous, you may ask us to correct it.
• Right of erasure (right to be forgotten): You may ask us to delete personal information that we collected unlawfully, that is no longer necessary for the purposes for which it was collected, or where you have withdrawn your consent and there is no other legal basis for retaining it.
• Right to data portability: You may ask us to provide you with the personal information you have given us in a structured, commonly used, and machine-readable format, so that you can transmit it to another organization.
• Right to withdraw consent: Where we process your personal information based on your consent, you may withdraw that consent at any time — for example, by updating your cookie preferences through our consent banner, or by unsubscribing from our newsletter. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

If you believe your rights have not been respected, you have the right to file a complaint with the Quebec Information Access Commission (CAI) at https://www.cai.gouv.qc.ca.

8. Person Responsible for the Protection of Personal Information

In accordance with Quebec Law 25 (section 3.1 and section 8.1), we have designated a Person responsible for the protection of personal information who oversees compliance with this policy and handles requests related to your personal information.

• Name: Andréann Lavoie
• Title / Role: --
• Email: alavoie@devpek.ca
• Phone: 418 275-4262

You may contact this person to exercise your rights (see Section 7), to ask questions about this policy, or to raise a concern about how your personal information is handled. We will acknowledge your request and provide a substantive response within 30 days, as required by Quebec Law 25.

Technical note: Our email infrastructure uses Microsoft 365 (United States) for business communications. Emails sent to the address above may be processed on Microsoft's servers in the United States. Please refer to Section 5 for details on the safeguards in place for this transfer.

DMARC advisory: Our outgoing email authentication policy is currently configured in monitoring mode (p=none). To reduce the risk of email spoofing and strengthen trust in communications from our domain, we recommend upgrading this configuration to p=quarantine or p=reject.

9. Effective Date and Versioning

This privacy policy takes effect on 11 juin 2026 and supersedes any previous version.

Version: 1

We may update this policy from time to time to reflect changes in our practices, the services we use, or applicable law. When we make material changes, we will update the effective date above and, where appropriate, notify you through our website or by email. We encourage you to review this policy periodically.