1. Data controller
This privacy policy is published by SDC Grande Allée(hereinafter “SDC,” “we,” or “our”), a business development company incorporated and operating in Quebec (Canada).
As an organization that collects, uses, and discloses personal information in the course of its activities, SDC Grande Allée is subject to the An Act to modernize legislative provisions respecting the protection of personal information (L.Q. 2021, c. 25), commonly referred to as "Bill 25", as well as the Act respecting the protection of personal information in the private sector(LPRPSP, RLRQ, c. P-39.1).
Our website is hosted in Quebec by Horizon-Cumulus (Joliette, Quebec), which means that data related to the operation of the website remains within Quebec, subject to the exceptions described in sections 4 and 5 of this policy.
2. Personal information collected
Depending on how you interact with our website, we may collect the following categories of personal information:
2.1 Navigation and Technical Identification Information
- IP address (approximate)
- Device identifiers and advertising identifiers
- Visited pages, session duration and browsing behavior
- Approximate location (derived from IP address)
- Cookie consent preferences (stored locally)
2.2 Information Provided Voluntarily
- First and last name (contact or registration forms)
- Email address (contact forms, newsletter)
- Any other information you choose to provide to us
2.3 Information collected by third parties (with your consent)
- Analytics: device identifiers, pages visited, session duration, browsing behavior, and approximate location — collected by Google Analytics 4.
- Marketing: device identifiers, advertising identifiers, social identifiers, pages visited, browsing behavior, and transaction data — collected by Meta Pixel (Facebook).
We do not collect sensitive information such as health data, biometric data, or Social Security numbers in connection with the operation of this website.
3. Purposes of processing
We use your personal information solely for the purposes described below. For each purpose, we indicate the legal basis on which we process your information.
3.1 Website Operation and Consent Management
Purpose: To ensure the proper functioning of the site, remember your cookie consent choices, and host this privacy policy.
Service: Moelleux (by Horizon-Cumulus).
Legal basis: Legitimate interest and legal obligation (Act 25 — obligation to document consents).
3.2 Audience Measurement and Website Improvement
Purpose: analyze visitor behavior, measure page performance, and improve the browsing experience on our site.
Service: Google Analytics 4 (Google LLC, United States).
Legal basis: Consent (you can opt out of analytics cookies via our consent banner).
3.3 Targeted Advertising and Retargeting
Purpose: To measure conversions from our advertising campaigns and show you relevant ads on Meta platforms (Facebook, Instagram) based on your browsing behavior on our site.
Service: Meta Pixel (Meta Platforms, Inc., United States).
Legal basis: Consent (you can opt out of marketing cookies via our consent banner).
3.4 Communications and Newsletter
Purpose: To send you news, events, and promotions related to Grande Allée and its member merchants, once you have subscribed.
Legal basis: Consent (you can unsubscribe at any time via the link included in each email).
We do not use your personal information for automated decision-making or individual profiling for purposes other than those described above.
4. Third parties and subcontractors
The following table lists all third-party services integrated into our website, their purpose, their category, and the location where your information may be processed.
| Service name | Purpose | Catégorie | Transfer outside Québec |
|---|---|---|---|
| Soft (by Horizon-Cumulus) | Cookie consent management and hosting of the privacy policy. Data hosted in Quebec (OVH Beauharnois). | Essential | No — data stored in Quebec |
| Google Analytics 4 (Google LLC) | Audience measurement and visitor behavior analysis to optimize website performance. | Analytical | Yes - United States |
| Meta Pixel / Facebook (Meta Platforms, Inc.) | Conversion tracking and remarketing on Meta platforms. | Marketing | Yes - United States |
| Horizon-Cumulus (Web Hosting) | Website hosting and DNS infrastructure management. Data stored in Quebec. | Essential | No — data stored in Quebec |
| Microsoft 365 (Microsoft Corporation) | Business email used for internal communications and responding to visitor inquiries. | Functional | Yes - United States |
We do not sell your personal information to third parties. We only share it with the service providers listed above, to the extent necessary to fulfill the purposes described in Section 3.
5. Transfers outside Québec
Some of our subcontractors are based in the United States. In accordance with section 17 of Act 25, we hereby inform you that your personal information may be disclosed outside of Quebec in the following situations:
- Google Analytics 4 — United States: When you accept analytics cookies, information such as your IP address (anonymized), the pages you visit, and your browsing behavior is transmitted to Google LLC, whose servers are primarily located in the United States. Google LLC is subject to U.S. data protection laws, including the Cloud Act. Google provides standard contractual clauses that comply with international data protection standards.
- Meta Pixel (Facebook) — United States: When you accept marketing cookies, information such as your advertising identifiers, the pages you visit, and your browsing behavior is transmitted to Meta Platforms, Inc., whose servers are primarily located in the United States. Meta provides standard contractual clauses to govern these transfers.
- Microsoft 365 (business email) — United States: When you contact us by email, your message passes through Microsoft Corporation’s servers, located in the United States. Microsoft offers standard contractual clauses and is certified under recognized data protection frameworks.
Before any transfer outside Quebec, we conduct a privacy impact assessment (PIA) to ensure that the recipient country or organization provides an adequate level of protection, in accordance with section 17 of Bill 25. These assessments are available upon request from our Privacy Officer (see Section 8).
Our website and its core infrastructure are hosted in Quebec by Horizon-Cumulus (Joliette, Quebec). The consent records managed by Moelleux are also stored in Quebec (OVH Beauharnois). This data does not leave Quebec.
Technical note : Our business email system uses Microsoft 365 (United States) for internal communications and Horizon-Cumulus Email (Quebec) for certain email services. Your contact information submitted via email may therefore be processed in the United States depending on the service used to respond to you.
6. Shelf life
We keep your personal information only as long as necessary for the purposes for which it was collected, or as required by law.
| Type of information | Shelf life | Reason |
|---|---|---|
| Cookie consent preferences (Soft cookie) | 13 months | Standard period of validity for consent to the use of cookies, in accordance with the recommendations of the Commission d'accès à l'information (CAI). |
| Analytics data (Google Analytics 4) | 14 months (Google default setting) | Analysis of website trends and performance over a rolling one-year period. |
| Marketing data (Meta Pixel) | 180 days (Meta default setting) | Standard retargeting window for remarketing campaigns. |
| Email addresses (newsletter) | Until unsubscribed, then deleted within 30 days | Sending communications to which you have consented. Deletion upon request or unsubscription. |
| Email correspondence (requests, questions) | 3 years | Reasonable retention period for tracking requests and managing relationships with visitors and partners. |
| Server logs (access logs) | 90 days | IT security, incident detection, and technical troubleshooting. |
Once these time limits have expired, your information is securely destroyed or irreversibly anonymized, in accordance with section 23 of Act 25.
7. Your rights
Bill 25 grants you several rights regarding the personal information we hold about you. Here is an overview of those rights and how to exercise them.
7.1 Right of access
You have the right to know whether we hold any personal information about you and, if so, to obtain a copy of that information, as well as details about its source, how it is used, and the third parties to whom it has been disclosed.
7.2 Right of rectification
If your personal information is inaccurate, incomplete, or misleading, you may request that it be corrected. You may also request that the corrections be shared with any third parties to whom this information has been disclosed.
7.3 Right to erasure (right to be forgotten)
In situations provided for by law—such as when your information was collected while you were a minor, or when it is no longer necessary for the purposes for which it was collected—you may request that it be deleted from our systems.
7.4 Right to portability
You have the right to receive, in a structured, commonly used, and machine-readable format, the personal information you have provided to us electronically, so that you may transfer it to another organization if you wish.
7.5 Right to withdraw consent
When the processing of your personal information is based on your consent, you may withdraw it at any time without any adverse consequences. For cookies, you can change your preferences via our Moelleux consent banner at the bottom of the page. For the newsletter, use the unsubscribe link included in every email.
7.6 File a complaint with the CAI
If you believe that your rights have not been respected or that your personal information has been processed in a manner that does not comply with the law, you may file a complaint with the Commission d'accès à l'information du Québec (CAI) :
- Website : www.cai.gouv.qc.ca
- Telephone: 1-888-528-7741
To exercise any of these rights, please contact our Privacy Officer, whose contact information is provided in Section 8. We will respond to your request within 30 days, in accordance with Act 25.
8. Privacy Officer
In accordance with section 8.1 of Bill 25, SDC Grande Allée has appointed a Privacy Officer (PO). This person is your point of contact for any questions, requests, or concerns regarding the protection of your personal information.
- Name : André Verreault
- Title : Director, SDC
- E-mail : info@votregrandeallee.com
- Phone : 418 704-4763
We undertake to acknowledge receipt of your request as soon as possible and to respond within a maximum of 30 days within 30 days of receipt, as required by Act 25. If your request is complex or voluminous, we will notify you of any additional time required.
Technical note : Your DMARC policy is currently configured in monitoring mode (p=none). To strengthen the authentication of your emails and reduce the risk of email spoofing, we suggest you switch it to p=quarantine or p=rejectwith the help of your DNS administrator.
9. Effective date and versioning
This Privacy Policy is effective as of juin, 11 2026and constitutes the version 4 of this document.
We reserve the right to update this policy at any time to reflect changes in our practices, in the third-party services we use, or in applicable legal requirements. In the event of a substantial change, we will notify you via a prominent notice on our website or, if applicable, by email if you have subscribed to our newsletter.
We encourage you to check this page periodically. The effective date listed above always corresponds to the most recent version of the policy.
This policy was generated and is hosted by Moelleux, a consent management and Bill 25 compliance platform developed by Horizon-Cumulus (9322-8310 Québec inc.), Joliette, Quebec. Consent records and the policy are stored in Quebec.