ICCC Montréal — Privacy Policy

Effective date: [February 27, 2026]
Who we are: ICCC Montreal (“we,” “us,” “our”) operates this website (icccmtl.com). We are based in Montréal, Québec, Canada.

Contact (Privacy):

• Privacy Officer: Ruth Hanna

• Email: office@icccmtl.com

• Mailing address: 2 Place du Commerce, Suite 100, Ile-des-Soeurs, Montréal, QC, H3E 1A1 Canada
  Under Québec’s Law 25, if no one is appointed, the highest-ranking person becomes the Privacy Officer by default—so we’ve designated the role above. [dpocentre.ca]

1) Scope

This policy explains how we collect, use, disclose, store, and protect personal information when you visit our website, contact us, donate, register for events, subscribe to updates, or interact with our social and marketing tools. It also describes your privacy rights and choices under Québec’s Law 25, PIPEDA, and (where applicable) the EU GDPR. [dpocentre.ca], [priv.gc.ca], [gdpr-info.eu]

2) What personal information we collect

We collect the following categories, depending on how you interact with us:

• Identifiers & contact details: Name, email, phone, address, organization, role/title.

• Transactional & event data: Event registrations, donations/payments (via our payment processor), attendance, preferences.

• Communications: Messages you send via forms or email and your preferences (e.g., newsletters).

• Device/usage data: IP address, browser/device type, pages viewed, referring URL, and general location from your IP.

• Cookies & similar technologies: Analytics, performance, and marketing cookies (non‑essential cookies only set with your consent; essential cookies always on). See Cookies below.

• Special situations: If we run surveys, photo/video at events, or profiling/automated decisions, we will explain the specifics at the point of collection.

Under Canadian guidance, IP addresses, device IDs and cookie identifiers can be personal information. [priv.gc.ca], [cookiechimp.com]

3) Why we collect your information (purposes)

We use your information to:

• Operate our website and deliver content and services you request.

• Respond to inquiries and manage event registrations or memberships.

• Process payments/donations via third‑party processors.

• Send updates and marketing (only with your consent where required; you can unsubscribe anytime).

• Analyze and improve site performance and content (analytics with consent for non‑essential cookies).

• Security, fraud prevention, and compliance with legal obligations.

GDPR requires purpose clarity at the time of collection, and Law 25 emphasizes transparency and consent for technologies that profile, identify, or locate individuals. [gdpr-info.eu], [mccarthy.ca]

4) Legal bases we rely on (GDPR, where applicable)

If EU/EEA/UK visitors interact with our site, we rely on:

• Consent (e.g., for non‑essential cookies; newsletter sign‑ups).

• Contract (to provide services you request, such as event registration).

• Legitimate interests (to secure our site, prevent fraud, or perform basic analytics only where a balanced legitimate interest applies; otherwise we use consent).

• Legal obligations (to comply with applicable law).

GDPR Articles 13–14 require disclosing purposes and lawful bases; consent must be freely given and specific. [gdpr-info.eu], [gdpr.eu]

5) Cookies and similar technologies

Banner & preferences. Our site uses a cookie banner to request your explicit, opt‑in consent before setting non‑essential cookies (analytics/marketing). You can change your preferences anytime via the “Cookie settings” link in the footer. Squarespace also allows restricting non‑essential cookies until consent. [mccarthy.ca], [bycrawford.com]

Types of cookies we use:

• Strictly necessary (always on): Security, load balancing, core site functions.

• Analytics (optional): e.g., Google Analytics or similar, to understand site usage.

• Marketing (optional): e.g., email/ads pixels (Meta, LinkedIn), only if implemented.

What this means in Québec: Law 25 generally expects express consent before activating technologies that profile, identify, or locate a person (which can include analytics/advertising cookies). Our banner is designed for opt‑in. [mccarthy.ca], [private-ai.com]

Cookie details & third‑party tools:

Platform: Squarespace—may set necessary cookies and, depending on features you enable, additional integrated cookies. Optional analytics: [e.g., Google Analytics with IP anonymization and retention controls]. Optional marketing: [e.g., Meta Pixel, LinkedIn Insight Tag, Mailchimp signup embeds].
We’ll keep an updated list on this page and in the cookie banner. (Squarespace sites commonly require a posted cookie list/notice.) [support.sq...espace.com]

6) Where your information comes from

• Directly from you (forms, registrations, emails).

• Automatically from your device (IP, device, usage via essential cookies).

• From third parties only if lawful (e.g., ticketing partners or payment processors) and we’ll provide required GDPR Article 14 information when applicable. [gdprlocal.com]

7) Who we share information with

We share personal information with service providers who process it for us under contract and only for the purposes described above:

• Website hosting & platform: Squarespace

• Payments/Donations: [Stripe/PayPal/Square/…]

• Email & CRM: [Mailchimp/HubSpot/…]

• Analytics/measurement: [Google Analytics/…] (only with consent where required)

We require providers to protect the information, use it only as instructed, and delete it when the service ends (a Law 25 requirement for processors/mandataries). [bclplaw.com]

8) International transfers

Our providers may process data in Canada, the United States, or elsewhere. When we transfer personal data internationally, we take appropriate measures (e.g., Standard Contractual Clauses for GDPR; transfer assessments under Law 25 for cross‑border disclosures). We will disclose the countries and safeguards on request. [gdpr-info.eu]

9) How long we keep information (retention)

We keep personal information only as long as necessary for the purposes described, then securely delete or de‑identify it. Specific retention periods depend on legal, accounting, or archival requirements (e.g., donation/tax records). We publish criteria or periods on request. (PIPEDA requires limiting retention; GDPR requires specifying periods/criteria.) [priv.gc.ca], [gdpr-info.eu]

10) Your rights & choices

Under Québec’s Law 25 (and PIPEDA):

• Access and rectification of your personal information.

• Withdraw consent (e.g., cookie banner or unsubscribe links).

• De‑indexing requests where applicable, and the right to be informed of automated decision‑making that uses personal information.

• Data portability (for computerized personal information; effective Sept 22, 2024).
  How to exercise: Email us at [privacy@yourdomain]. We respond within applicable timeframes. [dpocentre.ca]

Under GDPR (for EEA/UK visitors):

• Access, rectification, erasure, restriction, objection, and data portability; right to withdraw consent; and the right to lodge a complaint with an EU regulator. We’ll honor these rights where GDPR applies. [gdpr-info.eu]

11) Children’s privacy

Our site and services are designed for general audiences and not directed to children under the age of 14 in Québec (or 16 in some GDPR contexts). Where consent is required, we obtain it from a parent/guardian as required by law. [dpocentre.ca]

12) Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information (e.g., TLS encryption, access controls, least‑privilege). We maintain an incident response process and will notify regulators/individuals of confidentiality incidents as required by law. (Law 25 and PIPEDA include breach obligations.) [dpocentre.ca], [laws-lois....tice.gc.ca]

13) Links, embeds, and third‑party sites

Our site may link to or embed content from third‑party services (e.g., maps, videos, ticketing). Those providers have their own privacy practices and may set cookies or collect data independently. Review their policies before using those features. (Squarespace sites commonly embed third‑party tools.) [support.sq...espace.com]

14) How to contact us or make a complaint

• Email (privacy): [privacy@yourdomain]

• Mail: [ICCC Montreal, Address, Montréal (Québec), Canada]

• Supervisory authorities:

  • Québec — Commission d’accès à l’information (CAI)

  • Canada (federal) — Office of the Privacy Commissioner of Canada (OPC)

  • EEA — Your local Data Protection Authority

(Quebec’s CAI enforces Law 25; the OPC oversees PIPEDA; GDPR grants the right to lodge a complaint with an EU authority.) [dpocentre.ca], [priv.gc.ca]

15) Changes to this policy

We may update this policy to reflect changes to our practices or the law. We’ll post the revised version with a new “Effective date” and, where appropriate, provide a prominent notice or seek renewed consent (e.g., material changes to cookies). (Transparency and accessibility are emphasized in GDPR Articles 13–14 and Law 25.) [gdpr-info.eu], [dpocentre.ca]