Name a person in charge
Every business has a person in charge of protecting personal information. By default, it is the person with the highest authority (often you). Their title and contact details must be published on your website.
Publish a clear policy
If your site collects information (form, booking, newsletter), a privacy policy in simple terms must explain what, why, for how long, and how to exercise one’s rights.
Ask for clear consent
A checkbox, not ticked in advance, for each use. No advertising cookies without agreement.
Keep little, delete on time
Only ask for what you need and set a retention period (for example, 2 years for messages).
Keep an incident register
A leak or unauthorized access goes in a register; if there is a risk of serious harm, you must notify the Commission d’accès à l’information and the people affected.
What we do for you
On sites made with Custom Creators: generated privacy page, consent on every form, no advertising cookies, messages deleted after 2 years.
Official source: Commission d’accès à l’information du Québec (cai.gouv.qc.ca). This is not legal advice.