Privacy Policy

This privacy policy is issued by:

• —

  Name: CM AVOCAT

• —

  Legal form: Law firm (general partnership)

• —

  Main address: 365 Boulevard Saint-Joseph, Suite 107, Gatineau, Québec J8Y 3Y9

• —

  Email: info@cmavocat.ca

• —

  Phone: +1 (613) 716-3448

• —

  Website: https://www.cmavocat.ca

CM AVOCAT is subject to the Act Respecting the Protection of Personal Information in the Private Sector (LPRPS, CQLR c. P-39.1), as amended by the Act to Modernize Legislative Provisions Respecting the Protection of Personal Information (Law 25), and to the Personal Information Protection Act (PIPA, RSA 2003, c. P-6.5) in Alberta.

In accordance with the amended LPRPS (Law 25, in force since September 22, 2022), CM AVOCAT has designated a Privacy Officer:

• —

  Designated officer: Me Charles Mbakop, Founding Lawyer

• —

  Email: info@cmavocat.ca

• —

  Phone: +1 (613) 716-3448

• —

  Response time: 30 calendar days from receipt of your request

This officer oversees the implementation and compliance of this policy, responds to data subject rights requests, and acts as the contact person with the Commission d'accès à l'information (CAI).

We collect only the personal information necessary for the purposes set out below. Here are the categories of information collected by channel:

a) Appointment booking form

• —

  First and last name

• —

  Email address

• —

  Phone number

• —

  Desired legal service

• —

  Preferred date and time

• —

  Brief description of your legal situation

• —

  Urgency level of your file

• —

  Preferred language (French or English)

b) Contact form

• —

  First and last name

• —

  Email address

• —

  Phone number (optional)

• —

  Subject and content of message

c) Newsletter subscription form

• —

  Email address

• —

  First name (optional)

• —

  Language preference

d) Corporate intake form (business clients)

• —

  Contact name and title

• —

  Company name and size

• —

  Email address and phone number

• —

  Description of legal need

e) Virtual assistant (chat)

• —

  First and last name

• —

  Phone number

• —

  Optional message

• —

  Chat content: transmitted to our AI provider solely to generate a response; never stored in our databases

f) Automatically collected data

• —

  IP address (anonymized by Google Analytics)

• —

  Browser type and operating system

• —

  Pages visited and visit duration

• —

  Traffic source (referrer)

• —

  Session data via cookies (see section 8)

Each piece of personal information is collected for a specific, explicit and legitimate purpose. We do not process your data for purposes incompatible with those set out here:

• —

  Appointment management: processing your consultation request, confirmation and reminders

• —

  Legal services delivery: communication within the scope of the retained mandate

• —

  Customer service: responding to your questions and information requests

• —

  Newsletter: sending legal updates if you have expressly consented

• —

  Website analytics and improvement: behavioral analysis (aggregated and anonymized data)

• —

  Legal and professional obligations: compliance with the Code of Professional Conduct for Lawyers and the Bar Act

• —

  Client satisfaction: sending a post-consultation evaluation email (score stored anonymously)

We never sell, rent or commercialize your personal information to third parties.

To operate our website and deliver our services, we engage the following processors. Each is bound by contractual confidentiality and security obligations:

Supabase Inc. — Database and server functions

• —

  Headquarters: San Francisco, California, United States

• —

  Purpose: storage of appointment requests, newsletter subscribers, contact submissions, satisfaction data

• —

  Data location: North American servers (AWS us-east-1)

• —

  Privacy policy: https://supabase.com/privacy

Resend Inc. — Transactional email delivery

• —

  Headquarters: San Francisco, California, United States

• —

  Purpose: sending confirmation emails, appointment reminders, newsletters, satisfaction emails

• —

  Emails contain your name and email address

• —

  Privacy policy: https://resend.com/privacy

Google LLC — Google Analytics 4

• —

  Headquarters: Mountain View, California, United States

• —

  Purpose: audience measurement and behavioral analytics (anonymized data)

• —

  IP anonymization is enabled. No personally identifiable data is transmitted to Google

• —

  Privacy policy: https://policies.google.com/privacy

• —

  Opt-out: https://tools.google.com/dlpage/gaoptout

Vercel Inc. — Website hosting

• —

  Headquarters: San Francisco, California, United States

• —

  Purpose: hosting and delivery of the website; temporary access logs

• —

  Privacy policy: https://vercel.com/legal/privacy-policy

Groq Inc. — Virtual assistant (artificial intelligence)

• —

  Headquarters: United States

• —

  Purpose: generating the virtual assistant (chat) responses

• —

  No conversation retention (zero data retention enabled) and no model training on your data

• —

  Privacy policy: https://groq.com/privacy-policy

Cross-border transfers: some of our processors are based in the United States. These transfers comply with Law 25 requirements (s. 17) and are subject to a Privacy Impact Assessment (PIA). Contractual clauses ensure an adequate level of protection.

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law:

• —

  Appointment files and client correspondence: 7 years from the end of the mandate (s. 119, Code of Professional Conduct for Lawyers, CQLR c. B-1, r. 3.1)

• —

  Contact data (contact form, no subsequent mandate): 2 years

• —

  Chat leads (virtual assistant, no subsequent mandate): 2 years

• —

  Newsletter subscriptions: until unsubscription, then deleted within 30 days

• —

  Satisfaction data (score): 3 years, associated with the appointment file

• —

  Web access logs (Vercel): 30 days

• —

  Google Analytics data (aggregated, anonymized): 14 months (default GA4 setting)

Upon expiry of these periods, data is securely deleted or irreversibly anonymized.

CM AVOCAT implements appropriate technical and organizational measures to ensure the confidentiality, integrity and availability of your personal information:

• —

  TLS 1.3 encryption for all communications between your browser and our servers

• —

  Encryption at rest for databases (AES-256 via Supabase/AWS)

• —

  Data access restricted to authorized personnel with strong authentication

• —

  Access logs and anomaly monitoring

• —

  Security updates applied regularly to all components

• —

  Incident management policy: notification to the CAI and affected individuals within 72 hours of discovering an incident causing serious injury (s. 3.6 LPRPS)

Our website uses the following categories of cookies:

Strictly necessary cookies

• —

  Language preference (localStorage): stores your language choice (FR/EN). No expiry, local to your browser only.

• —

  Visitor session (localStorage): records whether you have completed the visitor form. Not transmitted to third parties.

• —

  Callback session (localStorage): records that you left your contact details with the virtual assistant (kept 30 days, local to your browser only).

Analytics cookies (with your consent)

• —

  Google Analytics 4 (_ga, _ga_*): audience measurement. Duration: 2 years. IP anonymization enabled.

You can configure your browser to block or delete cookies at any time. You can also opt out of Google Analytics tracking by installing the official extension: https://tools.google.com/dlpage/gaoptout.

Under Law 25 (Québec) and PIPA (Alberta), you have the following rights regarding your personal information:

• —

  Right of access (s. 27 LPRPS): obtain a copy of the personal information we hold about you

• —

  Right of rectification (s. 28 LPRPS): have inaccurate, incomplete or ambiguous information corrected

• —

  Right to deletion (s. 28.1 LPRPS, in force Sept. 2023): request erasure of your data when retention is no longer justified

• —

  Right to portability (s. 27 LPRPS, in force Sept. 2024): receive your data in a structured, commonly used technological format

• —

  Right to withdraw consent: withdraw consent at any time, without affecting prior processing

• —

  Right to file a complaint: with the Commission d'accès à l'information (CAI) of Québec or the Office of the Information and Privacy Commissioner (OIPC) of Alberta

To exercise any of these rights, send your written request to our Privacy Officer at info@cmavocat.ca. We will acknowledge receipt within 10 days and respond within 30 calendar days.

If you believe your rights have not been respected, you may file a complaint with the relevant authority:

Québec — Commission d'accès à l'information (CAI)

• —

  Website: https://www.cai.gouv.qc.ca

• —

  Phone: 1 888 528-7741

• —

  Address: 525 boulevard René-Lévesque Est, Suite 2.36, Québec City, QC G1R 5Y4

Alberta — Office of the Information and Privacy Commissioner (OIPC)

• —

  Website: https://www.oipc.ab.ca

• —

  Phone: 1 888 878-4044

• —

  Address: 410, 9925 109 Street NW, Edmonton, AB T5K 2J8

Federal — Office of the Privacy Commissioner of Canada

• —

  Website: https://www.priv.gc.ca

• —

  Phone: 1 800 282-1376

Our website and services are not directed at persons under 14 years of age. We do not knowingly collect personal information from children under 14 without prior parental or guardian consent. If you become aware that a minor has provided us with personal information without parental consent, please notify us at info@cmavocat.ca.

CM AVOCAT reserves the right to amend this policy at any time to reflect legislative, regulatory or operational changes. Any material change will be signalled by a prominent notice on our website for 30 days before taking effect.

The date of the last update appears at the top of this page. We encourage you to review this policy regularly.