Privacy Policy

1. Introduction

Syspark Inc. ("Syspark", "we", "our") places fundamental importance on the protection of personal information. This policy describes how we collect, use, retain and protect the personal information of visitors to the syspark.com website.

This policy is established in accordance with:

• Quebec's Law 25 (Act to modernize legislative provisions as regards the protection of personal information, 2021)
• The European Union's General Data Protection Regulation (GDPR) for European visitors
• Canada's PIPEDA (Personal Information Protection and Electronic Documents Act)

2. Data controller

Syspark Inc.
Head office: Montréal, Quebec, Canada
Office: Paris, France
Email: [email protected]
Website: https://syspark.com

3. Person in charge of the protection of personal information

In accordance with section 3.1 of Quebec's Law 25, Syspark has designated a person in charge of the protection of personal information:

Chief Information Officer (CIO) of Syspark Inc.
Email: [email protected] (or [email protected])

Any question about the processing of your personal information, any request for access, rectification or deletion, and any complaint may be addressed to this person directly.

4. Personal information collected

4.1 Data collected through the contact form

When you fill in our contact form, we collect only the information you voluntarily send us:

4.2 Technical data collected automatically

During your visit, for strictly technical and security purposes, the following information is collected:

• IP address: anti-fraud protection, rate limiting
• User agent (browser): detection of automated bots
• Timestamp of the visit: security logging
• Pages viewed: through the server's technical logs

This data is used only for the security and proper operation of the site. No data is used for advertising, marketing or profiling purposes.

4.3 Audience measurement (only with your consent)

If you accept it in the consent banner, Google Analytics 4 collects browsing data: pages viewed, visit duration, traffic source, a cookie identifier, technical information about your device and browser, and an approximate location. If you decline, Google Analytics is not loaded and none of this data is collected.

5. Cookies and trackers

We use no advertising cookies. Audience measurement cookies (Google Analytics 4) are set only with your consent, collected through the banner shown on your first visit; without your agreement, Google Analytics is not loaded. The other cookies are strictly necessary for the operation of the site (exempt from consent according to the CNIL and Quebec's CAI).

Legal basis: legitimate interest / strictly necessary service (GDPR art. 6.1.f, Law 25 s. 8.1 — exemption for strictly necessary cookies); your consent for audience measurement cookies (GDPR art. 6.1.a, Law 25 s. 8.1).

You can change your choice at any time: cookie settings. You can also delete these cookies through your browser settings, with no major impact on browsing.

6. Purposes of processing

Your personal information is processed exclusively to:

1. Respond to your commercial and technical contact requests
2. Ensure the security of the site (protection against attacks, fraud and abuse)
3. Comply with our legal and regulatory obligations
4. Measure site traffic, only with your consent

We carry out no automated profiling, no automated decision-making producing legal effects, and no direct marketing activity based on contact form data without your explicit agreement.

7. Legal basis for processing

In accordance with the GDPR (art. 6) and Quebec's Law 25:

• Contact form: performance of pre-contractual measures at your request (GDPR art. 6.1.b) and explicit consent through submission of the form (Law 25)
• Technical cookies: legitimate interest of the controller and exemption for strictly necessary cookies
• Security logging: legitimate interest in protecting the site and its visitors
• Audience measurement (Google Analytics 4): your consent (GDPR art. 6.1.a, Law 25)

8. Data retention period

Beyond these periods, data is deleted or anonymized.

9. Recipients of the data

9.1 Syspark staff

Your personal information is accessible only to Syspark employees who need it in the performance of their duties (sales, technical, management).

9.2 Technical subcontractors

To ensure the operation and security of the site, we use the services of:

No other third party receives your data. We use no advertising tool, no embedded social network and no third-party form service. Fonts are served from our own servers.

9.3 Transfers outside Quebec and outside the EU

The Cloudflare service, used only for protection against attacks and content acceleration, may cause data to transit technically through servers located in the United States. This transfer is governed by the Standard Contractual Clauses approved by the European Commission and by Cloudflare's DPA, which complies with Law 25.

A privacy impact assessment (PIA) was carried out to govern this transfer.

Requests sent through the contact form are received in our mailbox, hosted by Google (Google Workspace), and may be processed in the United States under the same contractual framework.

If you accept audience measurement, browsing data is sent to Google and may be processed in the United States, under the Standard Contractual Clauses and Google's data processing terms.

10. Your rights

You have the following rights regarding your personal information:

Under Law 25 (Quebec) and PIPEDA

• Right of access: obtain a copy of your personal information
• Right of rectification: correct inaccurate or incomplete data
• Right to withdraw consent
• Right to portability (in force since September 2024)
• Right to file a complaint with the Commission d'accès à l'information du Québec

Under the GDPR (EU visitors)

• Right of access (art. 15)
• Right to rectification (art. 16)
• Right to erasure (art. 17)
• Right to restriction of processing (art. 18)
• Right to data portability (art. 20)
• Right to object (art. 21)
• Right to lodge a complaint with a supervisory authority (CNIL in France)

How to exercise your rights

Write to us at [email protected], specifying your request and attaching proof of identity if necessary. We will reply within a maximum of 30 days.

11. Data security

Syspark implements appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure or destruction, including:

• TLS 1.2+ encryption for all communications between your browser and our servers
• Protection against attacks through Cloudflare (DDoS, bots, injections)
• Form protection by an in-house multi-layer anti-spam system (rate limiting, validation, detection of suspicious content), supplemented by Cloudflare Turnstile
• Sovereign hosting: our servers are located in ISO/IEC 27001 certified data centres in Canada (Vantage QC1, Montréal) and in France (Equinix PA3, Saint-Denis)
• Restricted access to data, with logging of sensitive access
• Regular backups and a business continuity plan

12. Confidentiality incident

In accordance with Law 25 (s. 3.5), in the event of a confidentiality incident presenting a risk of serious injury, Syspark:

• Promptly takes reasonable measures to reduce the risks and prevent the incident from recurring
• Notifies the Commission d'accès à l'information (CAI)
• Informs the persons concerned

An internal register of confidentiality incidents is kept up to date.

13. Changes to the policy

This policy may be updated to reflect legal, technical or operational changes. The date of the last update is shown at the top of this document. In the event of a substantial change, we will inform users through the site.

14. Contact

For any question about this policy or your personal information:

Syspark Inc.
Email: [email protected] (or [email protected])

You may also contact the supervisory authorities:

• Commission d'accès à l'information du Québec: cai.gouv.qc.ca
• Office of the Privacy Commissioner of Canada: priv.gc.ca
• CNIL (France, for EU visitors): cnil.fr

See also: Personal information governance policy