Quebec Privacy LawGuide for Small Business
What we collect on law25.ca, how it's used, and how to reach our Privacy Officer.
· IT & cybersecurity for Quebec SMBs since 1995
This Privacy Policy explains what personal information is collected on law25.ca, why, and how you can exercise your privacy rights. law25.ca is published and maintained by MTech Cyber as a free educational resource about Quebec's Law 25 for small and medium businesses.
law25.ca uses Google Analytics to understand how visitors use this site: pages viewed, approximate location, device and browser type, and how you arrived here. Google Analytics only runs if you accept the cookie banner shown on your first visit; if you decline, it never loads. Google Analytics uses cookies and collects your IP address to do this. Beyond that, the only personal information you provide directly is through the Self-Assessment tool's results form or the Checklist PDF download form: your name and email address.
The Self-Assessment tool also stores your answers temporarily in your browser's local storage, so the Checklist page can highlight which sections need attention if you return to it. This information stays on your own device; it is never transmitted to us or to any third party, and it's automatically cleared if you clear your browser data.
We use your name and email address to send you your Law 25 self-assessment results (your score and a summary of any gaps) or the Checklist PDF you requested. Because closing those gaps often takes some help, MTech Cyber may also follow up by email to see whether you'd like assistance with your compliance gaps. We do not sell, rent, or share your information with any third party for their own marketing purposes, and you can opt out of any follow-up at any time by letting us know. We use Google Analytics data in aggregate to understand which pages and topics are useful to visitors, and do not use it to identify individuals.
To deliver your self-assessment results or the Checklist PDF by email, we use EmailJS, a third-party email delivery service. Submitting either form sends your name and email address (and, for the self-assessment, your score and a summary of your gaps) to EmailJS, which relays that information to us. Under the EmailJS plan we use, submitted data is automatically retained by EmailJS for up to 7 days and then deleted. We do not maintain our own database of form submissions beyond what arrives in our inbox.
We also use Google Analytics, provided by Google, to measure site traffic, but only after you accept the cookie banner. Declining the banner, or not responding to it, keeps Google Analytics turned off for that visit. Google processes any data collected under its own privacy policy and retention settings. You can also opt out of Google Analytics tracking on any site by installing Google's browser opt-out add-on.
law25.ca itself does not store form submissions in a database. Information exists in a few places, each with its own retention: (1) your browser's local storage, until you clear it, (2) EmailJS's temporary retention of up to 7 days, and (3) Google Analytics data, retained according to Google's own settings. Emails delivered to our inbox are kept in line with our normal business email retention practices, and you may ask us to delete them at any time (see below).
You have the right to access the personal information we hold about you, request corrections, withdraw your consent at any time, and ask that we delete information we no longer need. To exercise any of these rights, contact our Privacy Officer below.
Our designated Privacy Officer can be reached at: privacy@mtechcyber.com
If you have concerns about how your personal information is handled that we haven't resolved to your satisfaction, you may file a complaint with Quebec's privacy regulator, the Commission d'accès à l'information (CAI), at cai.gouv.qc.ca.
We may update this policy from time to time to reflect changes in our practices or in Law 25. The date below reflects the most recent update.
Last updated: July 20, 2026