Privacy policy

Delpacto is a brand operated by Phonio Technologies Inc. ("Delpacto," "we," "our" or "us"), a Quebec company registered under NEQ 1180390438. We value the protection of your personal information and are committed to handling it responsibly, transparently and securely.

This policy explains what personal information we collect, why, how we use it, with whom we may share it, how long we keep it and what your rights are. It applies to our website delpacto.com (including delpacto.ca), to our contact and appointment request form, and to our communications with you by email, telephone or any other channel.

It should be read together with our Terms of Use and our Cookie Policy.

1. Who is responsible for your personal information?

Phonio Technologies Inc. is responsible for the personal information under its control, including information processed on its behalf by its service providers.

Questions, requests to exercise your rights and complaints regarding the protection of personal information may be addressed to this person.

2. Scope of the policy

Delpacto provides services to businesses. Some information about a business, such as its legal name or general business address, may not constitute personal information. However, information that relates to an individual, including a sole proprietor, an officer, an employee, a representative or a contact person, may be protected under applicable laws.

This policy does not apply to irreversibly anonymized information or to information that does not allow an individual to be identified.

3. Information we collect

We limit collection to information reasonably necessary for the purposes set out in this policy.

a) Contact and appointment requests

When you fill out our form or write to us, we may collect your name, email address, telephone number, your company's name and website, your job title, the content of your message, information about your store or project, and your appointment availability.

b) Business relationship and performance of engagements

When you become a client, we may collect the information needed to prepare a quote, enter into a contract and carry out the engagement: contact details of the people involved, business or tax numbers, billing address, documents and content you send us, and access to your tools (for example, collaborator access to your Shopify store).

While carrying out an engagement, we may have access to information about your own customers (for example, orders or store data). We access it only to the extent necessary for the engagement, we do not use it for other purposes, and we invite you to give us access only to the data required.

c) Billing and payment

We keep the information needed for billing and payment tracking (invoices, amounts, dates, payment method, transaction references). We do not receive or keep the full number of a payment card; card payments, where applicable, are processed by specialized providers. A bank transfer or Interac e-Transfer may, however, reveal information such as the payer's name, their financial institution or the transaction reference.

d) Communications and marketing

We keep our exchanges with you, your communication preferences, your consent to receive commercial communications and, when this feature is enabled and permitted, data on the delivery and opening of our emails.

e) Technical information and use of the site

When you browse our site, we or our providers may automatically collect certain information: IP address and the approximate location that can be inferred from it, device type, browser, operating system, language, pages viewed, clicks, scrolling, access times, originating site or campaign, as well as online identifiers, cookies and similar technologies.

4. How do we collect information?

• Directly from you, when you fill out a form, book an appointment, contact us, accept a quote or enter into a contract.
• Automatically, when you use the site, through cookies, server logs, pixels and similar technologies.
• From service providers, including Shopify and the measurement and communication platforms we use.
• From professional or public sources (your company's website, business registry, professional profiles), when necessary to prepare for a conversation or verify information, and where the law permits.

On request, we will tell you the source of information collected from a third party, subject to the exceptions provided by law.

5. Why do we use your information?

• to respond to your requests and to schedule and hold an appointment;
• to prepare quotes and to enter into and perform service contracts;
• to invoice, collect payments and keep our accounting and tax records;
• to communicate with you about an engagement, an account or a request;
• to ensure the security, operation and improvement of our site and services;
• to understand how the site is used and measure the effectiveness of our communications and campaigns, only where the required consent has been obtained;
• to send you commercial communications, with your consent;
• to comply with our legal obligations and to establish, exercise or defend our rights.

We will not use your personal information for a new purpose incompatible with those described above without obtaining the required consent or other legal authorization.

6. Consent and choices

We collect, use and disclose personal information with your consent, except where the law permits or requires otherwise. Consent may be express or implied depending on the nature and sensitivity of the information and the context. Where the law requires it, in particular for sensitive information, consent is express.

Some information is necessary to respond to a request or perform an engagement. If you refuse to provide it or withdraw your consent, we may not be able to provide the service concerned.

Commercial communications and non-essential analytics, advertising or profiling technologies are used with the required consent. You may withdraw your consent at any time, subject to legal or contractual restrictions and a reasonable period to process the request. Withdrawal does not affect the validity of processing carried out beforehand.

7. Cookies and similar technologies

Our site uses cookies and similar technologies, grouped into four categories: strictly necessary, functional, analytics and performance, advertising and measurement.

For now, our site uses only Shopify cookies (store operation and visit statistics) and no advertising cookies. If we add third-party analytics or advertising tools, they will be activated only with your consent, by means of a banner that will let you accept, decline or change your choices at any time. Declining non-essential technologies will not prevent you from using our site or contacting us.

For the detailed list of cookies, their lifespans and how to manage them, see our Cookie Policy.

8. Services and technologies we use

We currently use the services below. The information processed varies depending on the features used, your privacy choices and our settings.

Service	Main use	Information that may be processed
Shopify	Operation and hosting of the site, contact and appointment request form, email notifications	Information entered in the form (name, email, telephone, message), device and browsing, IP address

Shopify processes certain information under its own responsibility. You can consult its privacy notice: Shopify.

We will add a third-party analytics or advertising tool only after obtaining your consent where the law requires it.

We may replace a provider or add a tool as our activities evolve. Before doing so, we assess the information involved, the necessity of the service and the protective measures, and we update this policy when the change materially affects the practices described here.

9. With whom may we share information?

We do not sell or rent your personal information. We may share only the information reasonably necessary with the following categories of recipients:

• our e-commerce platform and our hosting, storage, security and IT support providers;
• our email, communication, form management and customer relationship providers;
• our analytics or advertising providers, where the required consent has been obtained;
• our partners and subcontractors who collaborate on an engagement, under a confidentiality obligation;
• our accountants, insurers, legal advisors and other professional advisors bound by confidentiality obligations;
• tax, administrative, judicial or law enforcement authorities where the law requires or permits it;
• a party to a contemplated or completed business transaction (financing, reorganization, merger or sale of assets), subject to appropriate confidentiality measures.

Our providers are authorized to process the information only for the services entrusted to them, in accordance with their contractual and legal obligations.

10. Processing outside Quebec

Delpacto is based in Quebec, but some of our providers may process or store information elsewhere in Canada, in the United States or in other jurisdictions. In that case, the information may be subject to the laws of the jurisdiction where it is processed and be accessible to the authorities that have jurisdiction there.

Before entrusting personal information to a provider outside Quebec, we assess the privacy factors required by law (sensitivity of the information, purpose, protective measures, applicable legal regime) and we put in place contractual, organizational and technical measures suited to the risks identified.

11. Retention and destruction

We keep information only for the period necessary for the purposes for which it was collected, subject to legal obligations and the time needed to protect our rights.

Category	General period
Contact or appointment request with no follow-up	Up to 24 months after the last exchange
Prospects and quotes not accepted	Up to 24 months after the last communication
Client file (contract, communications, deliverables)	During the business relationship and generally up to 24 months after the end of the engagement, except for items that must be kept longer
Invoices, payments, taxes and accounting documents	Generally 6 years after the end of the last fiscal year to which they relate, or longer if required by law, a claim or a dispute
Access to clients' tools	Removed at the end of the engagement or at the client's request
Consents, unsubscribes and marketing preferences	For as long as necessary to honor your choices and demonstrate our compliance
Cookie-related data	According to the lifespan of the cookie or tool concerned, as indicated in our Cookie Policy, after which it is deleted or aggregated

These periods may be extended where required by law, where a dispute or investigation is ongoing, or where information is necessary to exercise or defend a right. Once the purpose has been fulfilled and the applicable period has expired, the information is securely destroyed or anonymized in accordance with applicable requirements.

12. Security measures

We use administrative, technical and physical measures that are reasonable given the sensitivity, quantity, purpose and medium of the information, including, as applicable:

• limiting access to people who need it to perform their duties;
• the use of strong passwords, multi-factor authentication and access controls;
• encryption of site communications;
• confidentiality undertakings from the people and partners who have access to information;
• backups, updates and incident management procedures;
• reasonable selection and oversight of the providers that process information on our behalf.

No method of transmission or storage is completely free of risk. We therefore cannot guarantee absolute security.

13. Privacy incidents

We maintain a process to detect, contain, assess and document privacy incidents, and we keep a register of these incidents. When an incident presents a risk of serious injury, we promptly notify the Commission d'accès à l'information du Québec and the individuals concerned, as well as any other authority that must be notified, in accordance with applicable laws. We also take reasonable steps to reduce the risk of harm and to prevent a similar incident from recurring.

14. Your rights

Subject to the conditions and exceptions provided by law, you may:

• ask whether we hold personal information about you and obtain access to it or a copy of it;
• have inaccurate, incomplete or equivocal information corrected;
• request the deletion of information when its collection, disclosure or retention is not authorized, or when it is no longer necessary and no obligation justifies keeping it;
• withdraw your consent to certain uses or disclosures;
• request that certain computerized information collected from you be disclosed in a structured, commonly used technological format, or transmitted to an authorized person or body (portability);
• request, in the situations provided by law, that the dissemination of personal information cease or that a link providing access to it be de-indexed;
• unsubscribe from commercial communications;
• file a complaint about our personal information protection practices.

We make no decision based exclusively on automated processing of your personal information.

Any request must be submitted in writing to the person in charge identified in section 1. We may take reasonable steps to verify your identity before responding, and we will use the information provided for that purpose only to process and secure the request. We will respond promptly and, in the case of an access or rectification request subject to Quebec law, no later than 30 days after receiving it. If we refuse a request in whole or in part, we will explain the reasons and the remedies available.

You may also contact the Commission d'accès à l'information du Québec if you believe your rights have not been respected: www.cai.gouv.qc.ca.

15. Commercial communications

With the consent required by law, we may send you information about our services, content and offers. Each commercial electronic message states our identity, our contact details and a simple way to unsubscribe; you may also write to us at contact@delpacto.com. Your unsubscribe request will be processed without delay and no later than 10 business days. It does not prevent the sending of communications necessary for an ongoing engagement, for billing or for a contractual obligation.

16. Minors

Our site and services are intended for businesses and their representatives. They are not designed for children, and we do not knowingly seek to collect personal information from a minor under 14 without the required consent. If you believe a minor has provided us with personal information, contact us so that we can take appropriate action.

17. Third-party sites and services

Our site may contain links to third-party sites or services. Their practices are governed by their own policies and are not the responsibility of Delpacto. We encourage you to read their privacy notices before providing them with information.

18. Changes to the policy

We may amend this policy to reflect changes in our practices, providers, technologies or applicable laws. The current version is published on our site with the date of the last update. In the event of a significant change, we will post a prominent notice on the site or inform you directly where the law or the nature of the change requires it. A new use of information already collected will require the required consent, unless the law otherwise permits that use.

19. Questions and complaints

To ask a question, exercise a right or file a complaint, contact:

Please provide enough detail to allow us to understand and process your request. A complaint will be reviewed impartially and confidentially, and the person in charge will inform you of the outcome of the review within a reasonable time.