Privacy policy

ORYX Gestion Inc. (hereinafter "ORYX", "we", "our" or "us") places the utmost importance on the protection of your personal information. This privacy policy (the "Policy") explains clearly and transparently how we collect, use, disclose, retain and protect your personal information when you interact with:

— Our website oryxgestion.com and all of its subdomains

— Our registration forms, including our free trial

— Our professional services, where applicable

— Our ORYX SAAS platform (hereinafter the "Platform")

— Any communication with our team (email, phone, forms)

This Policy is drafted in accordance with: Quebec's Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as amended by Law 25; Canada's Personal Information Protection and Electronic Documents Act (PIPEDA); the European Union's General Data Protection Regulation (GDPR), where applicable; and the California Consumer Privacy Act (CCPA), where applicable, for California residents.

By accessing our site or using our services, you acknowledge that you have read, understood and accepted the practices described in this Policy.

In accordance with Law 25, ORYX has designated a person responsible for the protection of personal information.

— Name: Anthony Payeur, CEO

— Title: Privacy Officer

— Email: admin@oryxgestion.com

For any question, access or correction request, or complaint regarding the processing of your personal information, you may contact this person at the address above.

Information you provide directly. When creating your account and starting your free trial on oryxconsole.com: full name, professional email address, company name, team size and chosen plan. When opening the interactive demo on oryxgestion.com: your email address only. It reaches us as a notification and is stored neither by the website nor in its logs. When requesting a consultation or sending a message through the contact form: name, email address, company name, team size, phone number (optional) and the content of your message. This information reaches us as a notification and is stored neither by the website nor in its logs. In email communications: the content of your messages, your email address and any other information you choose to share. For purchases and Platform subscriptions: billing data (name, billing address); payment information is processed by our payment processor Stripe — we do not have access to your full card number.

Information collected automatically when you visit: technical data (IP address, browser type and version, operating system, screen resolution), browsing data (pages viewed, visit duration, referral source, journey on the site) and cookies (see section 7).

Information from third parties: authentication platforms (if you sign in via Google, Microsoft or another provider), analytics tools, social networks (if you interact with our posts) and your collaborators if they invite you to use the Platform.

Sensitive information. For its own account, ORYX does not collect sensitive information from its visitors and clients, nor information about individuals under 14. The Platform, however, lets our clients record information about their own employees that may be sensitive, including an absence reason that may be medical in nature and a free-text note. ORYX hosts this information on behalf of the client, who remains responsible for it and who must obtain the express consent the law requires. ORYX does not use it for any purpose of its own.

We use your personal information only for legitimate, clearly defined purposes:

— Creating and managing your account and your free trial (performance of contract)

— Responding to your consultation requests and contact-form messages (pre-contractual measures)

— Opening the interactive demo for you and following up with you about ORYX (consent)

— Providing our services if you are a client (performance of contract)

— Processing your payments and invoicing our services (performance of contract and tax obligations)

— Sending you our newsletter and development updates (consent)

— Improving our services and website (legitimate interest, anonymized data)

— Securing our site and preventing fraud (legitimate interest)

— Meeting our legal, tax and accounting obligations (legal obligation)

We do not process your information for purposes incompatible with those described above without obtaining your prior consent.

Subprocessors and service providers. Some providers process information on our behalf, each bound by its own contractual data-protection commitments. Several operate outside Quebec: your information may therefore be processed abroad and subject to the laws of that country.

— Base44 — hosting and execution of the ORYX platform

— Vercel — website hosting (United States / Europe)

— Stripe — payment processing (United States / Canada)

— Tally — forms (Europe)

— MailerLite — newsletter (Europe)

— Google Workspace — professional email and collaboration (Canada / United States)

— Cal.com / TidyCal — consultation booking (United States)

— Vercel Analytics and Speed Insights — site audience and performance measurement (United States / Europe)

— Meta Platforms — advertising pixel on the marketing site, ad measurement and audiences (United States)

— Plausible — web traffic analytics (Europe)

— Google Analytics — web traffic analytics (United States)

This list is kept up to date. When a provider confirms in writing the exact location of its servers, we record it here; until then, we do not assert it.

Legal disclosures. We may disclose your information to comply with a legal obligation, court order or valid government request; to protect our rights, property or safety, or that of our users; in the context of judicial or regulatory proceedings; or in the event of a merger, acquisition or asset transfer, subject to equivalent protection of the information.

No sale of personal information. ORYX does not sell, rent or trade your personal information to third parties for marketing purposes.

Some of our subprocessors process your information outside Quebec, notably in the United States and in Europe. There, your information is subject to the laws of the country concerned.

Where we actually stand, stated without rounding up: we are currently obtaining in writing, from each of these providers, their protection commitments and the exact location of their servers. No privacy impact assessment has been completed to date. This section will be updated as those documents reach us, and it will then name what is actually in place rather than what ought to be.

You can write to admin@oryxgestion.com at any time to ask where those efforts stand.

A cookie is a small text file stored on your device when you visit a website. It lets the site recognize your device and remember certain information.

What is written to or read from your device, with no exceptions:

— Site operation — remembering your language and display state, including the oryx_launched local storage key. No personal information.

— Audience measurement — Vercel Analytics and Vercel Speed Insights: number of visits, pages viewed, rendering speed. No advertising cookie.

— Meta (Facebook) pixel, id 1649956662968795 — a third-party advertising cookie set by Meta Platforms on every page of this site. It measures how well our ads perform and builds advertising audiences. The associated information is processed by Meta, in the United States, under its own policies.

This advertising pixel loads as soon as a page opens, so before you have had any say. We write this because it is what happens today. A prior-consent mechanism is being built, and this section will be corrected the day it is in place.

Until then, you can block this cookie through your browser settings or a blocking extension: the site keeps working normally. You can also refuse or erase all cookies at any time through your browser settings.

We keep your personal information only for as long as necessary to fulfill the purposes for which it was collected, unless a legal obligation requires otherwise:

— Free trial data: until you unsubscribe, or 3 years after last contact

— Client data (services): 7 years after the end of the contract (accounting and tax obligations)

— Platform usage data: for the duration of the subscription, then 90 days after termination

— Billing data: 7 years (Canadian tax obligations)

— Communication data (emails): 3 years

— Browsing data and cookies: per the durations in section 7

At the end of these periods, your information is deleted or irreversibly anonymized.

In accordance with applicable laws, you have the following rights regarding your personal information:

— Right of access: obtain confirmation that we process information about you and receive a copy

— Right of rectification: have inaccurate, incomplete or ambiguous information corrected

— Right to deletion (right to be forgotten): request deletion of your information when it is no longer necessary

— Right to portability: receive your information in a structured, commonly used format, or request its direct transfer

— Right to withdraw consent: withdraw your consent at any time, without affecting the lawfulness of prior processing

— Right to de-indexing: request the de-indexing of a hyperlink giving access to information about you where its dissemination causes you serious harm (Law 25)

— Right to object: object to processing based on our legitimate interest, on grounds relating to your particular situation

— Right to information about automated decisions: be informed if a decision about you is based on automated processing, know the main factors involved and have it reviewed by a person

To exercise any of these rights, write to our privacy officer: admin@oryxgestion.com. We respond in writing within 30 days of receiving your request, as the law requires. If we refuse to act on it, our response states the reason for the refusal, the provision of the law it relies on, the recourse available to you and the time limit to exercise it, and we assist you in understanding it. Reasonable proof of identity may be required to process your request securely.

ORYX implements technical and organizational measures to protect your personal information against loss, unauthorized access, disclosure, alteration or destruction.

Technical measures:

— Encryption of communications in transit (HTTPS/TLS)

— Password authentication and role management, each user accessing only the data needed for their work

— Security updates released by our providers are applied

Measures applied inside our subprocessors' infrastructure fall under their own contractual commitments and documentation. We do not present them as ours.

Organizational measures:

— Access to information limited to people with a legitimate need (least-privilege principle)

— Confidentiality commitments binding the people who process information for ORYX

— A privacy incident log, and a procedure for notifying the Commission d'accès à l'information and the individuals concerned when an incident presents a risk of serious injury

No method of electronic transmission or storage is completely secure. While we implement reasonable protections, we cannot guarantee absolute security.

In the event of a privacy incident presenting a risk of serious harm (loss, unauthorized access or disclosure of personal information), in accordance with Law 25 and the GDPR, we undertake to:

— Notify the Commission d'accès à l'information du Québec and any other applicable competent authority without delay

— Notify the individuals concerned as soon as possible

— Keep a register of incidents as required by law

— Implement the corrective measures necessary to limit the consequences and prevent recurrence

Our services are intended for businesses and professionals. We do not knowingly collect personal information about children under 14 (Quebec) or under 13 (United States, COPPA). If you are a parent or guardian and believe your child has provided us with information, contact us immediately at admin@oryxgestion.com and we will delete it.

We may modify this Policy from time to time to reflect changes in our practices, applicable laws or our services. The date of the last update is shown at the top of this page. For substantial changes, we will notify you by email (if you are registered) or by a notice on our site before the changes take effect. Your continued use of our services after the publication of changes constitutes your acceptance of the updated Policy.

If you believe your rights have not been respected or you are dissatisfied with our handling of a request, you have the right to file a complaint with the following authorities:

— In Quebec: Commission d'accès à l'information du Québec (CAI) — www.cai.gouv.qc.ca — 1-888-528-7741

— In Canada (federal): Office of the Privacy Commissioner of Canada (OPC) — www.priv.gc.ca — 1-800-282-1376

— In Europe: the data protection authority of your country of residence, or the CNIL in France — www.cnil.fr

For any question, comment or request regarding this Privacy Policy or our personal information protection practices:

ORYX Gestion Inc.

Attention: Anthony Payeur, Privacy Officer

Email: admin@oryxgestion.com

Website: oryxgestion.com

ORYX Gestion Inc. is incorporated under the laws of Quebec, Canada.

This Privacy Policy does not constitute legal advice. ORYX reserves the right to modify it at any time. For complex or contentious questions, we recommend consulting a qualified legal advisor.