1. Data controller
This privacy policy is published by Guidi.co (hereinafter "we" or "us"). It describes how we collect, use, disclose and store your personal information in connection with the operation of our website.
Guidi.co is subject to the An Act to modernize legislative provisions respecting the protection of personal information (L.Q. 2021, c. 25), commonly referred to as "Bill 25", as well as any other law applicable to the protection of personal information in Quebec.
We are committed to treating your personal information seriously, transparently and with respect for your rights.
2. Personal information collected
Depending on how you interact with our site, we may collect the following categories of personal information:
- Technical and device identifiers - IP address, device identifiers, advertising identifiers, session identifiers. This information is collected automatically during your visit.
- Navigation data - pages visited, session duration, browsing behavior, site navigation.
- Approximate location - derived from your IP address (region, country). No precise geolocation is performed.
- Form data - information you voluntarily enter in our contact or registration forms (name, e-mail address, message, etc.).
- Social and advertising identifiers - collected by third-party marketing tools when you have consented to their use, to enable conversion tracking and remarketing.
We do not collect sensitive personal information such as health data, biometric data or social insurance numbers in the normal course of operating this site.
3. Purposes of processing
We use your personal information only for the purposes described below. Each purpose is associated with a legal basis in accordance with Law 25.
- Site operation and safety - To ensure the availability, performance and security of our website (IP address, device identifiers, pages visited). This processing is based on our legitimate interest to maintain a secure and functional site. This service is provided by Cloudflare.
- Management of tracking tags - Deploy and manage the measurement and conversion tools present on the site (device identifiers, IP address, pages visited, form data). This processing is carried out by Google Tag Manager and is based on your consent for non-essential tags.
- Audience measurement and traffic analysis - To understand how visitors use our site in order to improve content and experience (device identifiers, IP address, pages visited, session duration, browsing behavior, approximate location). This processing is carried out by Google Analytics 4 and is based on your consent.
- Targeted advertising and remarketing - To measure the effectiveness of our advertising campaigns and present you with relevant ads on Meta platforms (Facebook, Instagram) (device identifiers, IP address, pages visited, transaction data, advertising identifiers, social identifiers). This processing is carried out by Meta Pixel and is based on your consent.
- Font display - Load custom fonts required for correct site display (device identifiers, IP address, pages visited). This processing is carried out by Adobe Fonts (Typekit) and is based on our legitimate interest to provide a consistent visual experience. You can refuse this processing via our consent manager.
- Responding to your requests - Process messages you send us via our contact forms (name, e-mail, message content). This processing is based on your consent expressed at the time of submitting the form.
We do not use your personal information for purposes incompatible with those set out above without obtaining your prior consent.
4. Third parties and subcontractors
In the course of our business, we use the following third-party suppliers. Each of them is bound by contractual obligations to protect personal information.
| Service name | Purpose | Category | Transfer outside Québec |
|---|---|---|---|
| Cloudflare | Security, performance and availability of site infrastructure | Essential | Yes - United States |
| Google Tag Manager | Manage the deployment of tracking tags and conversion pixels | Functional | Yes - United States |
| Adobe Fonts (Typekit) | Supply of custom fonts for site display | Functional | Yes - United States |
| Google Analytics 4 | Audience measurement and visitor behavior analysis | Analytical | Yes - United States |
| Meta Pixel (Facebook) | Conversion tracking and remarketing on Meta platforms | Marketing | Yes - United States |
| Horizon-Cumulus (accommodation) | Website hosting and server infrastructure | Essential | No - Quebec, Canada |
| Google Workspace | Business e-mail communications management | Functional | Yes - United States |
Our site is hosted by Horizon-Cumulus (Joliette, Quebec). Data related to the hosting of your site is kept in Quebec.
5. Transfers outside Québec
Some of our third-party suppliers are based in United States. As a result, your personal information may be transferred, processed or stored outside Quebec, in accordance with section 17 of Bill 25.
Transfers outside Quebec involve the following suppliers:
- Google Analytics 4 (United States) - navigation analysis data
- Google Tag Manager (United States) - tracking beacon management
- Meta Pixel / Meta Platforms (United States) - conversion and remarketing data
- Adobe Fonts (Typekit) (United States) - device IDs and IP address when loading fonts
- Cloudflare (United States) - safety and network performance data
- Google Workspace (United States) - business e-mail communications
Prior to any transfer, we ensure that personal information is adequately protected, including through contractual agreements that comply with the requirements of Bill 25. A Privacy Impact Assessment (PIA) may be carried out when required by the nature of the transfer.
Your personal information transmitted to these suppliers may therefore be processed in their respective jurisdictions, i.e. the United States, where laws different from those of Quebec apply to the protection of personal information.
On the other hand, our website is hosted by Horizon-Cumulus (Joliette, Quebec): lodging data remain in Quebec.
6. Shelf life
We keep your personal information only as long as it is required for the purposes for which it was collected, or to meet our legal obligations.
| Type of information | Shelf life | Reason |
|---|---|---|
| Analysis data (Google Analytics 4) | 14 months (Google default setting) | Analysis of traffic trends over a rolling period |
| Remarketing data (Meta Pixel) | 180 days (default Meta setting) | Duration of personalized audiences for advertising campaigns |
| Security logs (Cloudflare) | Up to 30 days | Threat detection and security incident analysis |
| Contact form data | 2 years following last exchange | Follow-up on customer service requests and obligations |
| Email communications (Google Workspace) | 3 years | Business exchange retention and legal obligations |
| Cookies | Varies by type (session to 24 months) | See our consent manager for details by witness |
At the end of these periods, personal information is securely destroyed or anonymized, so that it is no longer possible to identify an individual from this data.
7. Your rights
Under Bill 25, you have the following rights with respect to your personal information held by us:
- Your right of access - You may ask to see the personal information we hold about you, as well as information about how it is used and disclosed.
- Right of rectification - If information concerning you is inaccurate, incomplete or ambiguous, you may request that it be corrected.
- Right to erasure (right to be forgotten) - In the situations provided for by law, you may request the deletion of your personal information, in particular when the purpose for which it was collected has been fulfilled.
- Right to portability - You may request to receive, in a commonly used technological format, the personal information you have provided to us, in order to transmit it to another data controller.
- Right to withdraw consent - Where the processing of your information is based on your consent, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of the processing carried out prior to the withdrawal. You can manage your preferences directly via our consent manager (cookie banner) or by contacting us.
To exercise any of these rights, please contact our Privacy Officer as indicated in section 8 below. We will respond within 30 days following receipt of your request, in accordance with Bill 25.
If you feel your rights have not been respected, you can file a complaint with the Commission for Access to Information (CAI) :
- Website : www.cai.gouv.qc.ca
8. Privacy Officer
In accordance with section 8.1 of Bill 25, Guidi.co has designated a person responsible for the protection of personal information. This person is responsible for ensuring compliance with the company's obligations with regard to the protection of personal information and is your point of contact for any questions or requests you may have in this regard.
| Name | Marie-Eve Guidi |
|---|---|
| Title | President |
| marieeve@guidi.co | |
| Phone | 450 394-5515 |
You may contact our Privacy Officer with any questions you may have regarding this policy, to exercise your rights, or to report any concerns you may have regarding our handling of your personal information. We undertake to respond to all requests within a maximum of two working days 30 days following receipt, as required by Bill 25.
9. Effective date and versioning
This Privacy Policy is effective as of May, 14 2026 and constitutes the version 4.
We reserve the right to modify this policy at any time to reflect changes in our practices, in the services we use, or in applicable legal requirements. In the event of a material change, we will notify you by posting a notice on our Web site before the change takes effect. The date of the update will always appear at the top of this page.
We encourage you to review this policy periodically to stay informed about how we are protecting your personal information.
