Quebec Privacy Sub-Annex (Law 25)

This sub-annex is incorporated by reference into the Canada PIPEDA Regional Annex (annex/regions/canada-pipeda.md). It describes how Tanqory Inc. ("Tanqory", "we", "us") complies with An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25, commonly referred to as "Law 25"), which substantially amended the Act respecting the protection of personal information in the private sector (RLRQ c P-39.1, the "Quebec Private Sector Act"), in respect of the personal information of residents of the Province of Quebec. The provisions of Law 25 entered into force in three waves on 22 September 2022, 22 September 2023, and 22 September 2024. Where the Canada PIPEDA Regional Annex and this sub-annex address the same matter, this sub-annex prevails for residents of Quebec.

Authoritative sources:

• Quebec Private Sector Act (as amended by Law 25, RLRQ c P-39.1): https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1
• Commission d'accès à l'information du Québec ("CAI"): https://www.cai.gouv.qc.ca/
• CAI guidance on confidentiality incidents: https://www.cai.gouv.qc.ca/protection-renseignements-personnels/incidents-de-confidentialite

1) Scope and relationship to PIPEDA

This sub-annex applies to personal information about identifiable natural persons resident in the Province of Quebec, collected, held, used, communicated, or otherwise processed by Tanqory in the course of the operation of an enterprise within the meaning of section 1525 of the Civil Code of Quebec. It applies in conjunction with the Canada PIPEDA Regional Annex; where Quebec law is stricter on a given matter than PIPEDA, Quebec law governs the processing of personal information of Quebec residents under the doctrine of substantially similar laws applied by the Office of the Privacy Commissioner of Canada to the Quebec Private Sector Act. References in this sub-annex to "Quebec resident" mean a natural person whose habitual residence is in Quebec; "personal information" has the meaning set out in section 2 of the Quebec Private Sector Act ("any information which relates to a natural person and directly or indirectly allows that person to be identified").

2) Person in charge of the protection of personal information (section 3.1)

Pursuant to section 3.1 of the Quebec Private Sector Act, an enterprise must designate a person in charge of the protection of personal information ("Privacy Officer" or "Responsable"). By default that person is the person with the highest authority within the enterprise. The function may be delegated, in writing, to a member of the personnel or to a third party. The title and contact details of the Privacy Officer must be published on the enterprise's website, or made available by any other appropriate means if the enterprise does not maintain a website.

• The person responsible for the protection of personal information is the senior officer designated by the Company's management for that role (the contact for which is privacy@tanqory.com).
• Public contact channel pending confirmation: privacy@tanqory.com with the subject line "Loi 25 — Responsable".
• Tanqory will publish the confirmed title and contact details at https://legal.tanqory.com/ once finalised.

The Privacy Officer is responsible for ensuring the implementation of and compliance with the Quebec Private Sector Act and for the matters specified in sections 3.1 to 3.8, including the governance framework, the privacy impact assessment process, the management of confidentiality incidents, the response to access and rectification requests, the consent framework, and cross-border transfer assessments.

3) Governance framework and policies and practices (section 3.2)

Tanqory has established a governance framework regarding the protection of personal information, including policies and practices governing the retention and destruction of the information, the roles and responsibilities of the members of its personnel throughout the life cycle of the information, and a process for dealing with complaints regarding the protection of the information. A summary of the policies and practices is published on the Tanqory website at https://legal.tanqory.com/ in a manner that is clear and easy to understand, in accordance with section 3.2 of the Quebec Private Sector Act.

4) Privacy impact assessment (sections 3.3 and 3.4)

An enterprise must conduct an assessment of the privacy-related factors of any project to acquire, develop, or redesign an information system or electronic service delivery system involving the collection, use, communication, keeping, or destruction of personal information (section 3.3). Tanqory conducts a Privacy Impact Assessment ("PIA") for each in-scope project, proportionate to:

• (1) the sensitivity of the personal information concerned;
• (2) the purposes for which it is to be used;
• (3) the quantity and distribution of the information; and
• (4) the medium on which it is stored.

The Privacy Officer is consulted at the inception of the project and throughout. Recommendations made by the Privacy Officer are documented. Section 3.4 additionally requires a PIA before any communication of personal information outside Quebec; see section 6 below.

5) Consent (sections 12, 14, and following)

Consent under the Quebec Private Sector Act must be manifest, free, and enlightened, and must be given for specific purposes. Each purpose requires its own consent (section 14). Consent is requested in clear and simple language; if the request for consent is made in writing, it must be presented separately from any other information communicated to the person concerned. If the person concerned so requests, assistance is provided to help them understand the scope of the consent requested. Consent is valid only for the time necessary to achieve the purposes for which it was requested.

Express consent is required for:

• the collection, use, or communication of sensitive personal information (information that, due to its nature, in particular its medical, biometric, or otherwise intimate nature, or to the context of its use or communication, entails a high level of reasonable expectation of privacy) — section 12 (al. 3);
• the use of personal information for purposes other than those for which it was collected, except as permitted by section 12 (al. 2);
• the communication of personal information to third parties for the purposes of a commercial or philanthropic prospection (section 22); and
• the activation, by default, of functions allowing the person to be identified, located, or profiled (section 8.1; opt-in by user action).

For minors under the age of 14 years, consent is given by the holder of parental authority or by the tutor (section 14, al. 2). For minors aged 14 to 17 years, consent may be given by the minor, the holder of parental authority, or the tutor.

Consent may be withdrawn at any time and the procedure to withdraw consent is as simple as the one used to give it. Tanqory records the date, scope, channel, and means of obtaining and withdrawing consent.

6) Communication of personal information outside Quebec (section 17)

Before communicating personal information outside Quebec, Tanqory conducts a privacy impact assessment, which takes into account in particular:

• (1) the sensitivity of the information;
• (2) the purposes for which it is to be used;
• (3) the protection measures, including those that are contractual, that would apply to it; and
• (4) the legal framework applicable in the State in which the information would be communicated, including the personal information protection principles applicable in that State.

The information may be communicated if the assessment establishes that the information would receive adequate protection, in particular in light of generally recognised principles regarding the protection of personal information. The communication of the information must be the subject of a written agreement that takes into account, in particular, the results of the assessment and, if applicable, the terms agreed on to mitigate the risks identified in the assessment. Tanqory maintains a register of cross-border PIAs and the supporting written agreements. The same requirements apply where the personal information is entrusted to a person or body outside Quebec to perform a mandate or to execute a contract of enterprise or for services (section 17, al. 2).

The Tanqory group operates as Tanqory Inc. (Delaware, USA, controller and global contracting party), with Tanqory OÜ (Estonia) as EU representative. For Quebec residents, the data-flow map and the section 17 PIA are available on legitimate request, subject to commercial confidentiality.

7) Confidentiality incident management (sections 3.5 to 3.8)

A "confidentiality incident" means access not authorised by law to personal information, use not authorised by law of personal information, communication not authorised by law of personal information, or loss of personal information or any other breach of the protection of such information (section 3.6). Upon becoming aware of a confidentiality incident, Tanqory takes reasonable measures to reduce the risk of injury and to prevent new incidents of the same nature.

Where the incident presents a risk of serious injury, Tanqory promptly notifies:

• (a) the Commission d'accès à l'information du Québec; and
• (b) any person concerned whose personal information is concerned by the incident, unless doing so would hamper an investigation conducted by a person or body responsible for the prevention, detection, or repression of crime or of statutory offences.

In assessing the risk of injury, Tanqory considers the sensitivity of the information concerned, the apprehended consequences of its use, and the likelihood that such information will be used for injurious purposes (section 3.7). A register of confidentiality incidents is kept and is made available to the CAI on request (section 3.8). Where Tanqory acts as a service provider to a controller, Tanqory notifies the controller without undue delay and supports the controller's own section 3.5 obligations.

8) Rights of the person concerned

A person concerned has the following rights under the Quebec Private Sector Act, in addition to and subject to the rights described in the Canada PIPEDA Regional Annex:

• Right of access (section 27): to be informed of the existence of, and to receive communication of, any personal information concerning them.
• Right of rectification (section 28): to have any inaccurate, incomplete, or equivocal information corrected; to have deleted any information whose collection is not authorised by law; or to have any obsolete information updated.
• Right to portability (section 27, al. 3 — in force since 22 September 2024): to obtain the personal information that the person has provided to the enterprise, in a structured, commonly used technological format, or to have the enterprise communicate the information, in such a format, to any person or body authorised by law to collect it, where doing so does not raise serious practical difficulties.
• Right to de-indexing and cessation of dissemination (section 28.1): to obtain the cessation of dissemination of personal information, or the de-indexing of any hyperlink attached to their name allowing access to that information, where the dissemination contravenes the law or a court order, or causes serious injury in relation to the right to respect of reputation or privacy that is greater than the public's interest in knowing the information or the interest of any person in expressing themselves freely, subject to the conditions of section 28.1.
• Right to withdraw consent at any time (sections 14, 18).
• Right to information regarding automated processing (section 12.1): see section 9 below.
• Right to be informed of communications to third parties, of the categories of persons within the enterprise who have access to the information, of the duration of preservation, and of the contact information of the person in charge of the protection of personal information (section 8 and following).

Requests are submitted to the Privacy Officer at privacy@tanqory.com with the subject line "Loi 25 request" and are processed within 30 days from receipt (section 32). A refusal must be in writing, must state the reasons on which it is based, and must inform the person of the recourses available before the CAI.

9) Automated decision-making transparency (section 12.1)

Any person who uses personal information to render a decision based exclusively on an automated processing of such information must, at the time of or before the decision, inform the person concerned accordingly. Upon request, the enterprise informs the person concerned of:

• (1) the personal information used to render the decision;
• (2) the reasons and the principal factors and parameters that led to the decision; and
• (3) the right of the person concerned to have the personal information used to render the decision corrected.

The person concerned must be given the opportunity to submit observations to a member of the personnel of the enterprise who is in a position to review the decision. Tanqory documents in-scope automated decisions, the factors and parameters used, and the human-review channel.

10) Penalties and remedies

The Quebec Private Sector Act, as amended by Law 25, provides for:

• administrative monetary penalties of up to CAD 10,000,000, or, if higher, the amount corresponding to 2% of worldwide turnover for the preceding fiscal year (section 90.12); and
• penal fines of up to CAD 25,000,000, or, if higher, the amount corresponding to 4% of worldwide turnover for the preceding fiscal year (section 91), for the most serious offences set out in section 91.

Punitive damages may also be awarded by a court where an unlawful interference with the right to privacy is intentional or results from gross fault, with a floor of CAD 1,000 (section 93.1). Tanqory acknowledges these enforcement powers and cooperates with CAI orders and investigations under sections 81 and following.

11) French-language notice and communication requirements

The Charter of the French Language (RLRQ c C-11), as amended by Bill 96, requires that communications with consumers and the general public in Quebec be available in French. Tanqory's Quebec-facing notices, consent requests, rights-request forms, and confidentiality-incident notices are made available in French, with English available on request, and in any event in a format consistent with the consumer's choice. Where this sub-annex is consulted in English, the French version of the Quebec Private Sector Act prevails for purposes of statutory interpretation.

12) Records of processing and retention

Tanqory maintains records of processing activities for Quebec-regulated processing as part of its governance framework under section 3.2. Personal information is destroyed or anonymised when the purposes for which it was collected or used have been achieved, subject to any preservation period provided by law (section 23). Anonymisation is performed in accordance with generally accepted best practices and according to the criteria and terms determined by regulation under the Quebec Private Sector Act.

13) CAI complaint channel and recourses

A person concerned, or any interested person, may file a complaint with the Commission d'accès à l'information du Québec. The CAI may, on its own motion or on a complaint, conduct an inquiry and issue orders under section 81. Decisions of the CAI may be the subject of an application for review and, where applicable, an appeal to the Court of Quebec. Contact: Commission d'accès à l'information du Québec, https://www.cai.gouv.qc.ca/.

14) Relationship with other Tanqory documents

This sub-annex is incorporated by reference into the Canada PIPEDA Regional Annex. It supplements the Tanqory Privacy Policy, the Data Processing Addendum (DPA-master), the Cookie Policy, and the applicable service terms. In case of conflict between this sub-annex and another Tanqory document with respect to processing of personal information of Quebec residents, this sub-annex prevails.

15) Contact

• Privacy Officer (Responsable, section 3.1): the person responsible for the protection of personal information is the senior officer designated by the Company's management for that role; write to privacy@tanqory.com with subject "Loi 25 — Responsable".
• Privacy and rights requests: privacy@tanqory.com
• Registered agent (controller): Tanqory Inc., c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, USA
• Canada contact address: c/o Privacy Compliance, 16192 Coastal Hwy, Lewes, DE 19958, USA

16) Change history