Quebec Law 25 Compliance Documentation

1. Scope and Role

This Documentation applies to Dutiva’s handling of personal information where Quebec’s private-sector privacy law applies, including account, website, support, billing, security, product-usage, Advisor, document-workflow, and related service information.

For account, website, billing, support, security, and product-operations information that Dutiva collects directly from users, Dutiva is responsible for that processing under applicable privacy law. For personal information that a customer submits, uploads, generates, or otherwise makes available for HR workflows, generated documents, Advisor context, e-signature workflows, or saved records, the customer generally determines the purposes of processing and Dutiva acts as a service provider or processor, as described in the Data Processing Agreement.

In this Documentation, “Quebec Personal Information” means personal information about Quebec residents, employees, candidates, contractors, users, or other individuals, or personal information otherwise subject to Quebec’s private-sector privacy law.

2. Privacy Officer Accountability

Dutiva designates a Privacy Officer to coordinate privacy governance, public contact information, rights-request handling, incident assessment, privacy impact assessment review, service-provider privacy review, policy maintenance, and internal escalation for privacy-impacting changes.

Privacy questions and requests can be sent to privacy@dutiva.ca.

Dutiva maintains internal ownership for privacy-impacting product changes, personal-information inventories, service-provider review, incident response, retention and deletion workflows, and updates to public privacy documentation.

3. Governance Policies and Public Documentation

Dutiva publishes privacy and legal documentation designed to explain how personal information is collected, used, disclosed, retained, deleted, secured, and processed through AI-assisted workflows and service providers.

Public documentation includes the Privacy Policy, Data Processing Agreement, Data Retention and Deletion Policy, Cookie Policy, Incident and Breach Response Policy, AI Usage Disclosure, AI & Technology Policy, Legal Disclaimer, CASL documentation, and this Quebec Law 25 Documentation.

Internal governance expectations include privacy review for new personal-information workflows, service-provider review, security incident escalation, retention and deletion tracking, role-based access expectations, and policy review as the product evolves.

4. Privacy Impact Assessments

Dutiva conducts privacy impact assessment review for material projects involving personal information, including new systems, major product or processing changes, AI data flows, provider changes, cross-border processing involving Quebec Personal Information, and projects involving the acquisition, development, or overhaul of information systems or electronic service-delivery systems.

PIA review is proportionate to the sensitivity of the information, the purposes for processing, the quantity and distribution of information, the medium on which it is stored, provider access, retention, transparency, security safeguards, and user impact.

The Privacy Officer is consulted early for privacy-impacting projects and may recommend additional controls, documentation, training, vendor safeguards, access limits, or user-facing notices before launch.

5. Cross-Border Processing

Dutiva uses service providers that may process or store personal information outside Quebec and outside Canada, including in the United States. Cross-border processing may occur for hosting, authentication, database services, AI inference, billing, network security, analytics where enabled, support, and operational logging.

Before approving cross-border processing involving Quebec Personal Information, Dutiva assesses whether the information would receive protection appropriate to the risks, taking into account the sensitivity of the information, purposes of processing, safeguards, provider access, applicable legal framework, contractual terms, and operational controls.

Dutiva uses written agreements and technical, contractual, and organizational safeguards intended to address identified risks. Cross-border processing is also described in the Privacy Policy and Data Processing Agreement.

6. Collection, Consent, and Transparency

Dutiva identifies purposes for collection and limits collection to information needed for account access, HR document workflows, Advisor responses, billing, support, security, usage metering, beta access, product operation, and legal compliance.

Privacy notices and product flows are designed to describe categories of information collected, purposes for processing, service-provider involvement, AI-related processing, retention and deletion practices, and available privacy contact points.

Dutiva warns users not to submit highly sensitive employee information to AI features unless a specific workflow expressly supports that data type and the customer has a lawful basis to provide it.

Optional communications, marketing, analytics, or other non-essential technologies use consent, notice, preference, or unsubscribe controls where required. Cookie and local-storage practices are described in the Cookie Policy.

7. Individual Rights and Request Handling

Subject to legal limits, Quebec residents may request access to personal information, correction of inaccurate information, deletion or withdrawal of consent where applicable, and information about Dutiva’s privacy practices.

Quebec residents may also have rights to portability for qualifying computerized personal information, de-indexing or cessation of dissemination in certain circumstances, and information about certain decisions based exclusively on automated processing of personal information.

Dutiva reviews rights requests through the Privacy Officer and may require identity verification before disclosing, correcting, deleting, exporting, or changing account information. Where Dutiva processes Customer Personal Information on behalf of a customer, Dutiva may direct the requester to the customer or provide reasonable assistance to the customer through available product and support channels.

8. AI, Automated Processing, and Human Review

Dutiva uses AI-assisted guidance and workflow support to help users ask HR questions, generate document drafts, identify issues for review, and work through compliance-oriented workflows. Dutiva does not make final employment, hiring, discipline, accommodation, termination, compensation, privacy, or workplace decisions for customers.

Advisor responses and generated content are not legal advice and are not reviewed by a lawyer before delivery. Customers and authorized users remain responsible for reviewing outputs, confirming facts, applying workplace context, and obtaining qualified professional review for high-risk matters.

If Dutiva introduces any feature that makes a decision based exclusively on automated processing of personal information and that decision has legal or similarly significant effects, Dutiva will review whether additional Quebec transparency, explanation, correction, or request-handling measures are required before launch.

Additional information appears in the AI Usage Disclosure, AI & Technology Policy, and Legal Disclaimer.

9. Confidentiality Incidents

Dutiva handles suspected Quebec confidentiality incidents under its Incident and Breach Response Policy. A confidentiality incident may include unauthorized access, unauthorized use, unauthorized communication, loss of personal information, or another breach affecting the protection of personal information.

Dutiva assesses incidents involving Quebec Personal Information for risk of serious injury, considering the sensitivity of the information, the anticipated consequences of its use, and the likelihood that it will be used for injurious purposes.

Where the legal threshold is met, Dutiva will notify the Commission d’accès à l’information du Québec and affected persons, subject to applicable investigation limits. Dutiva maintains a confidentiality incident register for incidents involving Quebec Personal Information and retains register information for the required period.

10. Retention, Destruction, and Anonymization

Dutiva retains personal information only as long as needed for product, legal, security, billing, support, dispute, audit, and operational purposes. Retention periods and deletion workflows are described in the Data Retention and Deletion Policy.

When personal information is no longer required for the purposes for which it was collected or used, Dutiva deletes, destroys, anonymizes, or de-identifies it where appropriate and permitted by law, subject to legal holds, billing and tax records, security logs, backups, incident records, dispute preservation, and other legally permitted exceptions.

Dutiva’s account deletion workflow is designed to remove account-owned rows and generated documents, subject to legal and operational exceptions, and to record an anonymized deletion audit entry.

11. Service Providers and Contractual Controls

Dutiva uses service providers and subprocessors for hosting, authentication, database infrastructure, AI inference, payment processing, network security, analytics where enabled, support, and operational functions. Current core providers are described in the Privacy Policy and Data Processing Agreement.

Dutiva uses provider review and written agreements intended to address confidentiality, security, restricted processing, incident reporting, cross-border processing, retention, deletion, and assistance with privacy obligations where applicable.

Customers remain responsible for determining whether Dutiva is appropriate for their own Quebec privacy obligations, workplace context, HR documents, employee notices, consent practices, and internal governance requirements.

12. French-Language and Quebec-Facing Communications

Dutiva supports bilingual English/French product and document workflows where core features are configured for bilingual use. Quebec-facing privacy and support communications should be clear, understandable, and available in the language required by applicable law and product context.

Separate Quebec language obligations may apply to customer HR documents, employment communications, websites, contracts, postings, policies, and workplace processes. Customers remain responsible for reviewing and satisfying those obligations for their own workplace.

13. Official Reference Points

Reference points include the Act respecting the protection of personal information in the private sector, as modernized by Law 25, and guidance from the Commission d’accès à l’information du Québec on governance, privacy impact assessments, cross-border communications, confidentiality incidents, retention and destruction, individual rights, and automated decision-making.

14. Updates and Review

Dutiva may update this Documentation as its product, providers, AI workflows, legal obligations, public documentation, or Quebec-facing privacy practices evolve. Material public-facing changes will be reflected in this Documentation or related legal pages where appropriate.

15. Contact

Dutiva Canada Inc. - Privacy Officer

Email: privacy@dutiva.ca

Website: dutiva.ca