Privacy Statement (CA)

1. Person in Charge of Processing

This privacy policy applies to the website operated by Parcs régionaux de la MRC de Matawinie (hereinafter "we," "us," or "our"). As a Quebec-based nonprofit organization, we are subject to Quebec Law 25 — formally titled An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25) — and we are committed to handling your personal information responsibly and transparently.

This policy explains what personal information we collect when you visit our website, why we collect it, with whom we share it, how long we keep it, and what rights you have under Quebec Law 25. It applies to all visitors of our website, regardless of where they are located.

Our website is hosted in Quebec, Canada, by Horizon-Cumulus (9322-8310 Québec inc.), based in Joliette, Quebec. Consent records and this privacy policy are stored at OVH Beauharnois, Quebec. Certain third-party services we use do transfer personal information outside Quebec and Canada — these transfers are described in detail in Sections 4 and 5 below.

2. Personal Information Collected

We collect personal information about you in several ways depending on how you interact with our website. Below is a summary of the categories of personal information we may collect.

• Identification and contact information: Your name, email address, and any other information you voluntarily provide when you subscribe to our newsletter or fill out a contact form.
• Device and technical identifiers: Your IP address, browser type, operating system, and device identifiers collected automatically when you visit our site.
• Browsing and navigation data: Pages you visit, time spent on each page, links clicked, scroll depth, and general navigation behavior on our site.
• Approximate location: General geographic location derived from your IP address (city or region level — not precise GPS coordinates).
• Session recordings and interaction data: Mouse movements, clicks, and on-screen interactions captured for usability analysis purposes via Hotjar.
• Advertising and social identifiers: Advertising identifiers and social network identifiers collected when you interact with content linked to Meta (Facebook) services.
• Form data and communication data: Information you submit through web forms, including inquiries or newsletter sign-up requests, processed via HubSpot.
• Consent preferences: Your cookie consent choices, recorded and stored by Moelleux (par Horizon-Cumulus) for a period of 13 months via a preference cookie named moelleux_{site_key}.

We do not knowingly collect sensitive personal information (such as health data, financial account numbers, or government-issued identification numbers) through this website.

3. Purposes of Processing

We collect and use your personal information only for the purposes described below. Where we rely on your consent, you may withdraw it at any time (see Section 7).

• Website operation and security (Essential — no consent required): We process your IP address and device identifiers to deliver our website to your browser, maintain session integrity, and protect against security threats. This processing is carried out via our hosting infrastructure managed by Horizon-Cumulus in Quebec, and via Cloudflare's content delivery network (United States). This processing is necessary for the legitimate operation of our website and does not require your consent.
• Displaying web fonts (Functional — no consent required): We use Google Fonts (United States) to render text on our website correctly. Your IP address is transmitted to Google's servers as a technical necessity of loading these fonts. This processing is carried out in our legitimate interest in providing a readable, accessible website.
• Consent management (Essential — no consent required): We use Moelleux (par Horizon-Cumulus) to record and store your cookie consent preferences. A cookie named moelleux_{site_key} is placed on your browser for up to 13 months to remember your choices. This processing is strictly necessary to comply with Quebec Law 25 and does not require separate consent.
• Audience measurement and site performance analysis (Analytics — requires your consent): We use Google Analytics 4 (United States) and Hotjar (United States) to understand how visitors use our website — which pages are most visited, how long visitors stay, and where they encounter difficulties. Google Analytics 4 collects device identifiers, IP addresses, pages visited, session duration, navigation behavior, and approximate location. Hotjar additionally records session replays and generates heatmaps of on-screen interactions. This processing is based on your consent, which you may withdraw at any time via our consent banner.
• Newsletter communications (Marketing — requires your consent): If you subscribe to our newsletter, we collect your name and email address and process them via HubSpot (United States) to send you updates about our regional parks, events, and programs. This processing is based on your consent. You may unsubscribe at any time by clicking the unsubscribe link in any email we send you, or by contacting us directly.
• Targeted advertising and remarketing (Marketing — requires your consent): We use the Meta Pixel (Facebook, United States) and HubSpot (United States) to measure the effectiveness of our advertising campaigns, track conversions, and display targeted or retargeted advertisements to visitors who have previously interacted with our website. These services collect device identifiers, IP addresses, pages visited, advertising identifiers, and social identifiers. This processing is based on your consent, which you may withdraw at any time via our consent banner.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects on you.

4. Third Parties and Processors

The following third-party services process personal information on our behalf or in connection with our website. Each service is activated only to the extent permitted by your consent choices, except for Essential and Functional services which are always active.

We also use Microsoft 365 (United States) for our internal business email communications. Emails you send to us may be processed and stored on Microsoft's servers in the United States. Please see Section 5 for details on cross-border transfer safeguards.

We require all third-party processors to handle your personal information only for the purposes we specify, and to maintain appropriate security measures. Where required by Quebec Law 25, we have entered into data processing agreements with these providers.

5. Transfers Outside Quebec

Several of the third-party services we use transfer your personal information to the United States. Under section 17 of Quebec Law 25, we are required to disclose these transfers and to ensure that your personal information receives a level of protection equivalent to what Quebec law provides before any such transfer takes place.

The following services involve transfers of personal information to the United States:

• Google Analytics 4 (Google LLC, United States) — device identifiers, IP address, browsing behavior, approximate location
• Hotjar (Hotjar Ltd., United States) — device identifiers, IP address, session recordings, browsing behavior, approximate location
• Meta Pixel / Facebook (Meta Platforms, Inc., United States) — device identifiers, IP address, advertising identifiers, social identifiers, pages visited
• HubSpot (HubSpot, Inc., United States) — device identifiers, IP address, form data, email address, communication data
• Google Fonts (Google LLC, United States) — IP address
• Cloudflare (Cloudflare, Inc., United States) — IP address
• Microsoft 365 (Microsoft Corporation, United States) — email content and contact information from business email communications

Before authorizing these transfers, we have assessed or rely on the following safeguards, as applicable:

• Contractual clauses: We rely on standard contractual clauses and data processing agreements with each provider to ensure your personal information is protected in accordance with standards comparable to Quebec Law 25.
• Privacy Impact Assessment (PIA / EFVP): Where required by Quebec Law 25 for transfers involving significant volumes of personal information or sensitive processing (such as behavioral tracking via Hotjar and Meta Pixel), we have conducted or are in the process of conducting a Privacy Impact Assessment to evaluate and mitigate the risks associated with these cross-border transfers.
• Consent: For Analytics and Marketing services, transfers occur only after you have given your informed consent via our consent banner. You may withdraw your consent at any time, which will stop these transfers prospectively.

Our website hosting infrastructure and consent management platform (Moelleux by Horizon-Cumulus) are operated entirely in Quebec, Canada. No personal information processed by these core systems leaves Quebec.

For our business email, we use a combination of Horizon-Cumulus Email (Quebec, Canada) and Microsoft 365 (United States). Emails you send to our contact address may be processed by Microsoft's servers in the United States. We have entered into a data processing agreement with Microsoft to govern this transfer.

6. Retention Period

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The table below summarizes our retention practices by data type.

Once the applicable retention period has expired, personal information is securely deleted or anonymized so that it can no longer be linked to you.

7. Rights of Data Subjects

Under Quebec Law 25, you have the following rights with respect to your personal information. To exercise any of these rights, please contact our Person responsible for the protection of personal information using the details provided in Section 8. We will respond to your request within 30 days, as required by law.

• Right of access: You have the right to ask us whether we hold personal information about you, and to receive a copy of that information in a clear and understandable format. You may also ask us to confirm the sources of the information, the purposes for which it is used, and the categories of third parties with whom it has been shared.
• Right of rectification: If you believe that personal information we hold about you is inaccurate, incomplete, or ambiguous, you have the right to ask us to correct it. If the information has been shared with third parties, we will notify them of the correction where feasible.
• Right of erasure (right to be forgotten): You may ask us to delete personal information about you when it is no longer necessary for the purposes for which it was collected, when you withdraw your consent and there is no other legal basis for processing, or when the information was collected unlawfully. Some information may need to be retained to comply with legal obligations, and we will inform you if that is the case.
• Right to data portability: You have the right to receive personal information that you have provided to us in a structured, commonly used, and machine-readable format, and to request that we transmit it to another organization where technically feasible.
• Right to withdraw consent: Where we process your personal information based on your consent (for example, for analytics, marketing, or newsletter communications), you may withdraw that consent at any time without penalty. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. You can withdraw consent for cookies and trackers at any time by clicking the "Manage my preferences" link in our consent banner, or by contacting us directly.

If you believe that we have not handled your personal information in accordance with Quebec Law 25, you have the right to file a complaint with the Quebec Information Access Commission (CAI). You can reach the CAI at www.cai.gouv.qc.ca. We encourage you to contact us first so that we can address your concern directly.

8. Person Responsible for the Protection of Personal Information

In accordance with section 3.1 of Quebec Law 25, we have designated a Person responsible for the protection of personal information who oversees our compliance with Quebec's privacy legislation and serves as your point of contact for any privacy-related questions, requests, or concerns.

• Name: David Lapointe
• Title: DG, SDPRM.
• Email: info@parcsregionaux.org
• Phone: 1-800-264-5441

You may contact our Person responsible for the protection of personal information at any time to exercise your rights under Quebec Law 25, to ask questions about this policy, or to raise a concern about how your personal information is handled. We are required by law to respond to your request within 30 days of receipt.

If your request is complex or if we receive a high volume of requests, we may extend this deadline by an additional 30 days, in which case we will notify you of the extension and the reason for it before the initial 30-day period expires.

9. Effective Date and Versioning

This privacy policy takes effect on 22 juin 2026 and supersedes any previous version of our privacy policy.

Current version: 1

We review and update this policy periodically to reflect changes in our practices, in the services we use, or in applicable law. When we make material changes, we will update the effective date above and, where appropriate, notify you by posting a notice on our website or by other means. We encourage you to review this policy regularly to stay informed about how we protect your personal information.

This policy was generated and is hosted by Moelleux (par Horizon-Cumulus), Joliette, Quebec.