Purpose and Scope

This Privacy Policy describes the practices applicable to the collection, use, disclosure, retention, and protection of personal information in the operation of the Formation Pro online training platform.

Its purpose is to ensure compliance with the requirements of the Act respecting the protection of personal information in the private sector (Québec) and it applies to any person using the platform, whether an individual user or a representative of a client organization.

Personal Information Collected

As part of registration and use of the platform, the following information is collected:

1. First name
2. Last name
3. Email address

Information related to platform usage may also be generated, including:

1. Login history
2. Training progress
3. Assessment results
4. Certificates issued

Financial information related to payments is processed by an external provider (see section 10).

Purposes of Collection

Personal information is collected for specific, legitimate, and necessary purposes, including:

1. Creation and management of user accounts
2. Access to training and learning progress tracking
3. Management of certificates and documentary compliance
4. Administrative communications related to services
5. Compliance with legal and contractual obligations

No information is collected for undefined purposes.

Consent

Collection is based on express consent obtained during registration or use of the platform.

Consent may be withdrawn at any time, subject to applicable legal or contractual obligations.

Disclosure of Information

Personal information is neither sold nor transferred to third parties for commercial purposes. It may be disclosed:

1. To technology providers essential to the operation of the platform
2. To public authorities when required by law
3. To a client organization, when training is completed within an employer–employee contractual framework

Contractual agreements govern third-party access to personal information.

Data Hosting

Personal information is hosted on infrastructure located in Canada.

The organization ensures that the hosting environment meets applicable requirements for information security and personal information protection.

Security Measures

Administrative, technical, and organizational measures proportionate to the sensitivity of the personal information are implemented to ensure its confidentiality, integrity, and availability.

These measures include, in particular:

1. An internal governance framework for personal information protection, including the designation of a responsible person and the adoption of formalized practices
2. Structured access controls based on roles and responsibilities
3. Authentication mechanisms to protect user and administrative accounts
4. Protection of technological infrastructure and application environments
5. Traceability of access and relevant activities
6. A formalized process for managing privacy incidents
7. Secure retention and destruction rules in accordance with applicable obligations

These measures are reviewed periodically to ensure alignment with risks and current legal requirements.

Retention

Information is retained only for the period necessary to achieve the stated purposes or to comply with applicable legal obligations.

Cookies

The platform uses cookies to ensure proper operation, improve user experience, and optimize performance.

A cookie is a text file stored on the user’s device when visiting the site. It allows, among other things, device recognition, session maintenance, and analysis of general service usage.

The categories of cookies used are as follows:

Essential cookies

These cookies are required for the platform to function properly. They enable, in particular:

1. User session management
2. Account authentication and security

These cookies cannot be disabled, as they are essential to the use of the services.

Functional cookies

These cookies enhance the browsing experience by remembering certain choices or preferences, such as:

1. Display language
2. Certain interface settings
3. Usage preferences

They help personalize the experience without being strictly necessary for technical operation.

Analytical cookies

These cookies collect aggregated statistical data on platform usage, including:

1. Pages viewed
2. Visit duration
3. Navigation paths

This information is used for continuous service improvement and does not aim to personally identify users.

Performance cookies

These cookies are used to assess the technical stability and speed of the platform and to identify potential operational issues in order to improve reliability.

Consent management

A consent management mechanism is implemented for non-essential cookies (functional, analytical, and performance).

Users may accept or refuse these categories during their first visit and may change their preferences at any time through the available settings.

Payments – Stripe

Payments made on the platform are processed by the payment service provider Stripe.

Financial information (card number, expiration date, security code) is not stored on the platform. This information is transmitted directly to Stripe through a secure environment.

Although Stripe’s physical servers are not necessarily located in Québec, this provider is considered compliant due to the contractual, technical, and organizational safeguards in place, including:

1. Encryption of data at rest and in transit (including AES-256)
2. Certification to recognized security standards, including PCI-DSS
3. Contractual safeguards for data protection
4. Access control and privilege management mechanisms

In accordance with the requirements of Law 25 regarding the disclosure of personal information outside Québec, a Privacy Impact Assessment (PIA) was conducted to analyze the risks associated with the processing of payment information by this provider.

This assessment considers, in particular:

1. The sensitivity of the information involved
2. The protection measures in place
3. The applicable legal framework
4. The risks of unauthorized access

Based on this analysis, the level of protection provided is deemed adequate and proportionate to applicable legal requirements.

Users are also encouraged to consult Stripe’s privacy policy for additional information regarding the processing of payment data.

Rights of Individuals

In accordance with Law 25, any individual may:

1. Access their personal information
2. Request correction of their information
3. Withdraw their consent
4. Request deletion, where applicable
5. File a complaint with the Commission d’accès à l’information du Québec

Person Responsible for Personal Information Protection

Any request relating to the protection of personal information may be addressed to:

Person Responsible for Personal Information Protection
Email: [email protected]
Phone: +1 (833) 766-5399

Policy Review

This policy may be updated to reflect changes in organizational practices or legal requirements.

The last version is the one published on the platform.