Compliance with Québec Law 25
Our commitment to personal information protection, Canada-based hosting, and rights you can actually exercise from the app
This is the English version. The authoritative version is French, as required by Quebec's Charter of the French Language (Bill 96). Read the French version.
1. Our approach
2Toits adopts a proactive compliance approach to Quebec's Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as amended by Law 25. In Quebec, there is no mandatory certificate issued by a government body or regulatory authority to attest compliance. Responsibility rests entirely with the person responsible for personal information protection (RPRP). 2Toits engages in rigorous self-attestation, supported by internal documents and ongoing evaluation.
2. Our Privacy Officer (RPRP)
- Operator: 2Toits (sole proprietor, Quebec, Canada)
- Role: RPRP function (designated officer)
- Email: privacy@2toits.ca
- Legal contact: legal@2toits.ca
In accordance with article 3.1 of Law 25, the RPRP function is formally designated and is the point of contact for all questions relating to personal information protection.
3. Compliance measures (summary)
| Law 25 Requirement | Our implementation |
|---|---|
| Designation of a RPRP (art. 3.1) | RPRP function designated |
| Published and accessible policy (art. 3.2) | See Privacy Policy |
| Privacy Impact Assessment — PIA (art. 3.3) | Completed, internal document |
| Incident register (art. 3.5) | Maintained and up to date |
| Data minimisation (art. 13) | Principle applied — see details |
| Explicit consents (art. 12) | 4 consents at sign-up + optional, revocable notifications consent (push/email) |
| Support and user rights | Support, account deletion, and rights exercise available from the app |
| User rights (art. 27–28.1) | All mechanisms available |
| Account deletion (art. 28.1) | Anonymization ≤ 24 h + purge 90 days |
| Multi-layer security (art. 10) | TLS 1.3, encryption, RLS, JWT, etc. |
| Hosting in Quebec/Canada | Supabase ca-central-1 (Montreal) |
| Assessment of transfers outside Quebec (art. 17) | PIA completed |
| Incident notification to CAI (art. 3.5) | 72-hour procedure in place |
4. Public documents
5. Self-declaration of compliance
2Toits operates under a self-attestation regime for compliance with Law 25. The RPRP function attests that 2Toits' personal information processing practices comply with the requirements of Quebec's Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as amended by Law 25, as of July 15, 2026.
The complete attestation document (Attestation_Conformite_Loi25_RPRP.md) is available on request at privacy@2toits.ca.
6. Exercise my rights
You have rights regarding your personal information: access, rectification, deletion, portability, withdrawal of consent, and opposition to automated processing.
7. Contact the Privacy Officer
RPRP function — 2Toits (sole proprietor, Quebec, Canada)
privacy@2toits.ca
Last review: July 15, 2026 — Next review: July 15, 2027