Privacy Policy

In accordance with Law 25: Law modernizing legislative provisions

in matters of personal information protection (Quebec)

Person responsible for the protection of personal information:

Effective date: [April 20, 2026]

Last updated: [April 19, 2026]

INTRODUCTION

VIVALANG places paramount importance on protecting the personal information of the people with whom it interacts, including its students, clients, corporate clients and teachers.

This privacy policy has been written in accordance with Law 25, entitled An Act to modernize legislative provisions concerning the protection of personal information, and the Act respecting the protection of personal information in the private sector of Quebec.

It applies to all personal information collected in the course of our activities, by any means whatsoever.



In this policy, the masculine gender is used without discrimination and solely for the purpose of simplifying the text.

DEFINITIONS

For the purposes of this policy:

“Student” refers to any person participating in a training course offered by VIVALANG, whether registered individually or by a client company.

“Client” means any person or organization that retains VIVALANG’s services, including individual customers and corporate clients.

“Client company” refers to any organization that retains VIVALANG’s services for its employees, managers or collaborators.

"Employee" means any person employed by VIVALANG.

“Teacher” means any person providing training services on behalf of VIVALANG, as a self-employed worker.

1. HOW WE COLLECT YOUR PERSONAL INFORMATION

We collect personal information in several ways depending on the context of our relationship with you.



1.1 By telephone, email or web form

Anyone, whether an individual customer or a business client, can contact us directly by phone, email, or via the form on our website. The information provided during this contact is recorded in our customer relationship management system (Monday.com).

1.2 Within the framework of B2B contracts with client companies

When a client company signs a training contract with us, they provide us with a list of the students who will participate in the courses. This can be done via email, an Excel file, or a secure form. The information received comes from the client company and pertains to its students.

In this context, VIVALANG acts as the custodian of personal information transmitted by the client company. We encourage client companies to inform the individuals concerned of this transmission in accordance with Law 25.

1.3 During teacher recruitment

Candidates for teaching positions submit their applications via an online form or by email, including through recruitment platforms. The information provided is used solely for recruitment purposes.

1.4 Via our website, cookies and analytics tools

Our website uses cookies and analytics tools, including Google Analytics, to better understand how our site is used. A consent message is displayed during your visit.

Google Analytics may collect certain information, such as IP address (anonymized), pages visited, duration of visit, device type and browser used.

2. THE INFORMATION WE COLLECT AND WHY

2.1 Information relating to students, clients and client companies

As part of our language training services, we collect the following information:

• First and last name
• Email address
• Phone number
• Company name and contact details of the responsible person
• History of contracts and training
• 
  

This information is used for the following purposes:

• Organize and manage training courses
• Communicating with students, customers, and client companies
• Provide educational support
• Issue invoices and manage payments via QuickBooks
• To meet legal and tax obligations

2.2 Teacher Information

As part of the recruitment and management of teachers, we collect:

• First and last name
• Email address and phone number
• Curriculum vitae, diplomas and references
• Bank details for direct deposit
• IN THE

This information is used for the following purposes:

• Evaluate applications and proceed with hiring
• Managing self-employment contracts
• Process direct deposit payments
• Send the newsletter for teachers
• To meet tax obligations

2.3 Communications marketing

With the teachers' consent, we send them a newsletter via our distribution platform. They can unsubscribe at any time directly from the newsletter.

3. WHO HAS ACCESS TO YOUR PERSONAL INFORMATION

3.1 Internal Staff

Access to personal information is limited to those who need it in the performance of their duties, in accordance with the need-to-know principle.

Within VIVALANG, only authorized staff members have access to personal information, according to their responsibilities.

Teachers only have access to their own students' contact information, namely the phone number and email address provided by the client company or by VIVALANG. Additional information may be shared directly between the student and the teacher, without VIVALANG managing it. Teachers are bound by the confidentiality obligations stipulated in their contract.

3.2 Third-party service providers

As part of our operations, we share certain information with the following third parties:

• Monday.com: contact management and communication tracking (data hosted in the United States; see section 4)
• Centrix.one: Customer relationship management (data hosted in Canada)
• Tally (tally.so): online form collection (data hosted in the European Union)
• QuickBooks (Intuit Canada): Billing management (data hosted in Canada)
• Google Analytics: website usage analysis (data processed in the USA, see section 4)
• External accountant: processing payments and tax obligations

Some of these providers may process or host personal information outside of Quebec.

These third parties are required to protect the personal information entrusted to them and may only use it for the purposes for which it was shared. We never sell your personal information.

3.3 Legal Exceptions

We may disclose personal information without consent in cases provided for by law, including upon a court order or at the request of a law enforcement agency.

4. OUR PROTECTIVE MEASURES

4.1 Technical Measures

We protect your personal information through the following measures:

• Using Google Workspace for secure access and password management
• Access to the systems is limited to authorized personnel based on their role.
• Encryption of data in transit and at rest via the platforms used
• Secure account authentication and access management

4.2 Administrative Measures

Our teachers sign a confidentiality agreement regarding student data as part of their contract. Access to personal information is granted according to each person's role within the organization.

4.3 Data Transfer Outside Quebec

Some of our technological tools host data outside of Quebec:

• Tally (tally.so): data hosted in the European Union, subject to the General Data Protection Regulation (GDPR)
• Monday.com: data hosted in the United States on Amazon Web Services (AWS) servers
• Google Analytics: data processed in the United States
• Centrix.one: data hosted in Canada
• QuickBooks (Intuit Canada): data hosted in Canada
• Google Workspace: data may be hosted outside of Quebec, particularly in the United States

A Privacy Impact Assessment (PIA) is conducted for any transfer of personal information outside Quebec. The risks associated with these transfers are considered low and acceptable given the nature of the data and the safeguards in place.

For any transfer outside Quebec, we ensure that adequate protection measures are in place to guarantee a level of protection equivalent to that required by Law 25.

4.4 Data retention and destruction

Personal information is kept only for as long as necessary for the purposes for which it was collected, or to comply with legal obligations, including tax obligations.

Information related to billing and tax obligations may be kept for a minimum period of six (6) to seven (7) years.

When personal information is no longer needed for the purposes for which it was collected, it is deleted, anonymized, or securely destroyed, subject to applicable legal obligations. However, some information may be retained for longer periods when necessary for administrative purposes, business relationship management, or to comply with legal obligations.

4.5 Confidentiality Incident Management

In the event of a confidentiality incident posing a serious risk of harm, we undertake to:

• Notify the Access to Information Commission (CAI) as soon as possible
• Inform the people concerned
• Record the incident in our privacy incident log
• Take steps to reduce risks and prevent recurrence

5. YOUR RIGHTS

In accordance with Law 25 and the Act respecting the protection of personal information in the private sector of Quebec, you have the following rights:

5.1 Right of access

You can request to see the personal information we hold about you.

5.2 Right of rectification

You can request the correction of any inaccurate, incomplete or ambiguous information concerning you.

5.3 Right to withdraw consent

You can withdraw your consent at any time, subject to legal obligations that require us to retain certain data.

5.4 Right to portability

You can request to receive your personal information in a structured and commonly used technological format.

5.5 Right to de-indexing

You can request the cessation of the dissemination of your personal information when the conditions provided for by law are met.

5.6 Right to file a complaint

If you believe your rights have not been respected, you can file a complaint with the Commission d'accès à l'information du Québec (CAI): www.cai.gouv.qc.ca

5.7 How to exercise your rights

To exercise any of these rights or for any questions relating to this policy, please contact our Privacy Officer:

• Mikael Bouchereau
• President and CEO
• 2000 McGill College Ave, Montreal, Quebec H3A 3H3

6. UPDATING THIS POLICY

We review this policy regularly to ensure it reflects our current practices and applicable legal requirements. Any changes will be posted on our website.

The date of the last update is shown on the cover page of this document.