Privacy Policy.

1. Introduction and scope

This policy describes the rules governing the collection, use, disclosure, retention and protection of personal information in connection with zomfy.ca and professional communications with ZOMFY.

ZOMFY is a trade name used by 9514-5033 Québec inc., registered in Québec’s enterprise register under number 1179750626. In this policy, “ZOMFY,” “we” and “our” refer to that company.

Personal information is information about an individual that allows them to be identified directly or indirectly.

This policy applies in particular to website visitors, people who contact us, and representatives of our clients and partners.

Where an application or service has its own policy, that policy describes the processing specific to that service. When ZOMFY processes information on a client’s behalf, the applicable agreement also governs responsibilities, without limiting obligations imposed by law.

3. Information collected and collection methods

Information you provide directly

When you complete our form or contact us, you may provide your name, company name, email address, phone number and preferred contact method.

A project inquiry may also include its category, current stage, an existing website address, requested features, an indicative budget, your preferred start date and a description of your needs.

We also receive the contents of messages and documents you choose to send us.

Required fields are identified in the relevant forms. Your company name is optional. Your phone number is optional unless you choose phone as your preferred contact method.

Technical information

Using the site may generate technical information needed for its operation or protection, such as your IP address, browser type, the date and time of a visit, requested pages and certain security events.

Collection depends on the features you use and how the relevant technical services are configured.

Where inquiries originate

An inquiry may include its originating page, referring website and campaign parameters in a web address, including UTM parameters.

This information helps us understand how you found ZOMFY and follow up on your inquiry. It does not automatically determine a project’s price.

Limiting the information you send

Please limit your communications to the information needed for your inquiry.

Do not submit passwords, access keys, authentication codes, social insurance numbers or complete financial information through the general form. If a project requires sensitive information or technical access, an appropriate way to share it must be agreed upon beforehand.

4. Purposes of use

Depending on your relationship with ZOMFY, information is used to:

• understand your inquiry, communicate with you and prepare an estimate or proposal;
• manage a professional relationship and carry out agreed commitments;
• operate the site, diagnose problems and prevent abuse;
• meet applicable obligations and retain documents needed to manage the relationship or exercise rights.

The project inquiry form helps us assess an inquiry. It does not automatically produce a final quote or contract, or oblige ZOMFY to carry out a project.

Information must not be used for a new purpose that is incompatible with the stated purpose without the required consent or authorization provided by law.

5. Consent and choices

When your consent is required, we must provide information that is clear enough for you to understand the proposed processing and express your choice.

Simply visiting the site does not constitute blanket consent to every possible use of your information. Required consents must relate to specific purposes. Express consent is obtained when required by law, including for certain processing of sensitive information. (CAI)

You may decline to provide optional information. However, missing necessary information may prevent us from processing all or part of your inquiry.

You may request to withdraw your consent at admin@zomfy.ca. We will explain the applicable consequences. Withdrawal does not remove retention obligations imposed by law.

Sending a project inquiry does not, by itself, constitute express consent to receive a newsletter. Promotional communications, when sent, must comply with applicable consent, sender identification and unsubscribe requirements. (CRTC)

6. Cookies and similar technologies

Cookies are small files stored on a device when a website is used. Other mechanisms may store information in the browser or send information to a technical service.

Depending on the available features, these technologies may support the site’s operation, protect it or remember preferences.

When an optional technology requiring your consent is offered, its purposes and the available choices must be presented before it is activated. You must be able to refuse that processing and change your choice.

Identification, location or profiling functions covered by law must be disclosed in advance and must not be enabled by default. Describing a technology as a security tool does not automatically exempt it from these requirements. (CAI)

You may also manage certain cookies in your browser settings. Blocking necessary mechanisms may affect some features.

This section does not authorize the addition of tracking technologies without the required information and choices.

Technologies used on this site

• Privacy preference — ZOMFY: browser local storage remembers your preferences by category for up to 180 days, solely to respect your choice. Analytics choices saved with the previous version are preserved until they expire. You can change them below or delete the site’s data in your browser.
• Inquiry origin — ZOMFY: session storage keeps the originating page, referrer and UTM parameters to accompany your inquiry. This information stays in the browser until you submit the form. The session normally ends when the tab closes, although browser restoration features may extend it.
• Cloudflare Turnstile — Cloudflare: this necessary protection verifies forms before submission to limit automated and fraudulent requests. Cloudflare receives the verification token and technical information about the connection and browser, including the IP address. Verification does not activate Google Analytics and may be processed outside Québec. Cloudflare privacy policy.
• Google Analytics — Google: only with your agreement, this service measures page, service and case study visits, reading progress and active reading time, contact clicks, and the steps, errors, closures and successful submissions of project and support forms. Selected service categories and the form type help compare inquiry journeys without transmitting the information you type. It uses _ga and _ga_* cookies to distinguish visits and sessions, configured to expire after 180 days without renewal on each visit. It receives browsing data, UTM campaign codes when present, cookie identifiers and technical information, including the IP address used to connect. Events added by ZOMFY do not include your name, email, phone number or inquiry text. Google advertising features are disabled in the site’s configuration. Processing may take place outside Québec, including in the United States. How Google uses data.
• Site fonts — ZOMFY: the site’s fonts are hosted locally and loading them does not send a request to Google Fonts.

Your privacy preferences

Google Analytics stays inactive until you accept audience measurement. You can browse the site and send an inquiry whatever you decide. On a first visit, or after your choice expires or is cleared, a small card offers “Accept all” and “View preferences.” Its arrow collapses the card without recording a decision or activating optional measurement.

The detailed view presents four categories: “Necessary,” which is always active, plus “Performance,” “Analytics” and “Advertising.” When no choice is saved, the three optional categories are preselected in the interface. This is a suggested selection awaiting confirmation and does not load any tracking tools. “Accept all” confirms all three categories; “Reject all” turns them off; “Save my preferences” applies the displayed selection. Closing or collapsing this view discards unsaved changes.

The “Analytics” category controls Google Analytics. “Performance” and “Advertising” choices are remembered, but no optional tools are currently connected to either category. Google advertising features stay disabled. Necessary functions, including remembering your privacy choice, remain active.

A previously saved choice is reflected in the detailed view. A previous Analytics acceptance keeps only the “Analytics” category active; a previous refusal keeps all three optional categories off. The “Cookie preferences” button in the footer lets you update these choices at any time. Withdrawing agreement stops new measurements and removes Analytics cookies accessible on this site. For requests about information already sent, email admin@zomfy.ca.

Analytics is disabled. Enable JavaScript to manage your choice.

7. Automated processing

The project inquiry form does not, by itself, constitute an automated decision to accept a project or set its price.

If personal information is used to make an exclusively automated decision, ZOMFY must inform the individual no later than when communicating that decision. The explanations required by law must be available on request, along with an opportunity to make observations to a person who can review the decision. (LégisQuébec)

8. Authorized people and service providers

Access to information must be limited to people who need it to perform their duties, including handling inquiries, managing the professional relationship or carrying out authorized technical work.

Certain information may be processed by providers needed for hosting, email, security, inquiry management or professional services related to the purposes described in this policy.

ZOMFY does not sell your personal information.

When information is entrusted to a provider to perform an assignment, the required written commitments concerning confidentiality, use and retention must govern that arrangement. Disclosures authorized or required by law must remain limited to the relevant information. (CAI)

Providers identified for the public site

A validated inquiry is first recorded in a transactional queue encrypted in transit on ZOMFY’s infrastructure. ZOMFY’s internal management console retrieves it through an authenticated server integration and confirms the import. Brevo, a transactional email provider, also delivers an email notification to ZOMFY and processes the message content and the technical information needed for delivery. Brevo privacy policy.

Cloudflare provides Turnstile to protect forms. Google provides only Google Analytics, with your agreement, as described in the cookies section. Site fonts are hosted by ZOMFY. Technical hosting and the professional inbox also support inquiry processing. These services may involve processing outside Québec, as described in the following section.

9. Processing outside Québec

Depending on the providers and services used, personal information may be processed or stored outside Québec, elsewhere in Canada or abroad.

Before processing outside Québec that is covered by law, ZOMFY must carry out the required privacy impact assessment and enter into an appropriate written agreement. Processing may take place only if the legal conditions are met, including adequate protection of the information. (CAI)

The information needed to understand this processing must be provided when required by law. Further details may also be requested at admin@zomfy.ca.

Security configurations and sensitive technical infrastructure details are not generally published. This precaution does not limit information ZOMFY is legally required to disclose.

10. Work on client systems

Under an authorized assignment, ZOMFY may need to access systems, documents or information necessary for development, hosting, maintenance or IT support work.

Access must be limited to the assignment. Accessible information must not be used for purposes unrelated to the work.

The applicable agreement sets out the client’s instructions, responsibilities, authorized access and arrangements for returning or destroying information. Confidentiality notification and verification obligations continue to apply. (CAI)

A one-time intervention does not automatically authorize permanent access. Remote or ongoing access arrangements must be agreed upon as part of the assignment.

A request about information managed on a client’s behalf may require the client’s participation. ZOMFY helps direct it to the appropriate contact without limiting the individual’s rights.

11. Retention and destruction

Personal information must be retained only for as long as necessary for the purposes for which it was collected or used, subject to legal retention obligations.

For project inquiries, the period takes into account handling and follow-up. For contractual or administrative documents, it takes into account applicable obligations and documented needs related to the professional relationship. Technical log retention must be proportionate to operational, diagnostic and security needs.

In the site’s transactional queue, inquiry content is deleted no later than seven days after both its import into the internal console and its email delivery have been confirmed. The remaining technical receipt, without the inquiry content, is deleted after 90 days. The copy imported into the console is retained only for as long as needed to handle and follow up on the relationship with the person making the inquiry, subject to applicable legal obligations.

A particular situation, such as a legal retention obligation, may justify keeping certain documents longer. It does not justify retaining all information indefinitely.

When retention is no longer justified, information must be securely destroyed. Copies and backups must also be covered by retention and destruction rules. (CAI)

You may ask about the retention period applicable to your information at admin@zomfy.ca.

12. Security and governance

ZOMFY commits to applying reasonable administrative, technical and organizational measures proportionate to the sensitivity of the information and the risks associated with its processing.

No system can guarantee the complete absence of errors or incidents. This limitation does not reduce ZOMFY’s protection obligations.

Management oversees information management rules. Authorized people must respect the limits of their access, preserve confidentiality and report concerns.

Governance practices cover responsibilities, retention, destruction and complaint handling. They must suit the company’s activities and be reassessed as processing changes. (CAI)

13. Confidentiality incidents

When there are grounds to believe an incident involving personal information has occurred, ZOMFY must take reasonable steps to limit its consequences, assess the risks and prevent a recurrence.

Incidents must be recorded in a register. When an incident presents a risk of serious injury, the required notices must be promptly sent to the Commission d’accès à l’information and the people concerned, in accordance with applicable rules. (CAI)

Obligations to a client on whose behalf ZOMFY works also continue to apply under the law and the assignment.

To report a concern: admin@zomfy.ca. Avoid attaching unnecessary sensitive information to your first message.

14. Your rights and how requests are handled

Subject to the conditions and exceptions provided by law, you may request access to your personal information, its correction and the withdrawal of consent.

You may also request that computerized personal information collected from you be provided in a structured, commonly used technological format when the conditions for the right to data portability are met. This right does not apply in the same way to information created or inferred by the company. (CAI)

Other remedies may apply in situations provided by law, including concerning the deletion, dissemination or referencing of certain information.

Send your request in writing to admin@zomfy.ca. Reasonable verification of your identity or authority to act may be necessary.

Access or correction requests must receive a response within 30 days of receipt. A refusal must state the reasons and include the required information about available remedies. (CAI)

15. Questions and complaints

A complaint may be sent to admin@zomfy.ca with the subject “Privacy — complaint.”

Describe the situation, the communications or processing involved and the outcome you seek. The person responsible reviews the relevant information, asks for any necessary clarification and communicates the response or appropriate follow-up.

Complaint handling must respect the confidentiality of the people involved and limit access to information needed for its review.

You may also exercise the remedies available through the Commission d’accès à l’information du Québec. ZOMFY’s internal process does not waive those remedies. (CAI)

16. Changes to this policy

This policy may be updated to reflect changes in activities, technologies or applicable obligations.

Any change will be accompanied by an appropriate notice. The published version states its update date.

When new consent is required, publishing an amended policy does not replace obtaining it. (LégisQuébec)