Law 25 / GDPR
Last updated: May 2026
This page details how Profil-e applies Quebec's Law 25 (An Act to modernize legislative provisions as regards the protection of personal information) and the General Data Protection Regulation (GDPR) when it applies to data subjects residing in the European Economic Area.
1. Overview
Law 25 applies to any Quebec business that collects, uses or discloses personal information. The GDPR applies to the processing of data of subjects located in the European Union, regardless of the place of establishment of the data controller. Profil-e applies all the principles common to both regimes: minimization, purpose limitation, transparency, security and accountability.
2. Data controller
Profil-e acts as data controller for data collected directly from certified coaches (account creation, billing, support). For emotional profiles generated at the request of a client firm, Profil-e and the firm are joint controllers: the firm determines the purposes of use towards its own clients, Profil-e determines the technical means and the security of the platform.
3. Legal bases
Processing is based on one of the following: (a) performance of the service contract for certified coaches and their firms; (b) legitimate interest for platform security and fraud prevention; (c) explicit, free, informed and specific consent for the processing of individual clinical data (questionnaire responses, emotional score, relational signature).
4. Data collected
Categories of data processed: identity (last name, first name), contact (professional email, phone), account data (hashed password, language preferences), psychometric questionnaire responses, derived emotional scores and signatures, technical data (IP address, audit log), billing data. No sensitive data within the meaning of GDPR article 9 is processed outside the strict clinical context supervised by a certified coach.
5. Your rights
You have, at any time, the following rights: (a) right of access to your personal information; (b) right of rectification; (c) right to portability in a structured, commonly used format; (d) right to erasure (subject to legal retention obligations); (e) right to restriction of processing; (f) right to object. Any request is processed within a maximum period of 30 days from receipt. Address your requests to info@profil-e.ca.
6. International transfers
All data is hosted in Canada (AWS ca-central-1 region). Profil-e does not systematically transfer personal data to any third country. Where an occasional transfer becomes necessary (for example for technical support by a provider), it is governed by Standard Contractual Clauses (SCCs) approved by the European Commission and by equivalent safeguards provided by Law 25.
7. Retention
Client profile data is retained for five (5) years from the last use of the service. Audit logs related to clinical data are retained for seven (7) years, in accordance with applicable ethical requirements. Billing data is retained for seven (7) years to meet tax obligations. Erasure requests are subject to a 30-day cooldown during which the deletion can be cancelled at the request of the data subject.
8. Consent and withdrawal
Consent to clinical processing is obtained explicitly during the invitation sent by the coach (/onboarding page or equivalent). You may withdraw your consent at any time, without justification, in one click from your personal space or by writing to info@profil-e.ca. Withdrawal does not call into question the lawfulness of prior processing, but results in the immediate cessation of any subsequent processing.
9. Cookies
Profil-e uses only cookies strictly necessary for the operation of the service (session, security, language preference). No audience-measurement, advertising or profiling cookies are placed without your prior explicit consent, which may be withdrawn at any time from the consent banner. See the Privacy Policy for the detailed list of cookies used.
10. Privacy incident
In the event of an incident presenting a risk of serious harm, Profil-e notifies the Commission d'accès à l'information du Québec and, where applicable, the relevant European supervisory authority, as well as the data subjects. Notification is made as soon as possible and no later than 72 hours after becoming aware of the incident, in accordance with GDPR article 33 and the equivalent provisions of Law 25.
11. Privacy officer
The role of person responsible for the protection of personal information (equivalent to the data protection officer) is held by Profil-e management. For any question, exercise of rights or complaint, write to info@profil-e.ca specifying the subject of your request. A response will be sent to you within a maximum period of 30 days.
12. Complaints
If you believe your rights have not been respected, you may lodge a complaint with the Commission d'accès à l'information du Québec, 525, boulevard René-Lévesque Est, bureau 2.36, Québec (Québec) G1R 5S9, or with your national supervisory authority within the European Union. Profil-e undertakes to cooperate fully with these authorities in the course of any complaint procedure.