Privacy Statement (CA)

1. Person in Charge of Processing

This privacy policy applies to the website and digital services operated by Parc Régional des Chutes Monte-à-Peine-et-des-Dalles (hereinafter "we," "us," or "our organization"). We are subject to Quebec Law 25 — formally known as An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25) — which governs how we collect, use, communicate, and protect the personal information of anyone who visits our website or interacts with our services.

As a nonprofit organization operating in Quebec, we take our obligations under Quebec Law 25 seriously. This policy explains, in plain language, what personal information we collect, why we collect it, who we share it with, and what rights you have over your own information.

2. Personal Information Collected

We collect personal information in several ways depending on how you interact with our website and services. Below is a summary of the categories of personal information we may collect.

• Identity and contact information: Your name, email address, mailing address, and phone number — collected when you make a purchase, register for an activity, sign up for our newsletter, or submit a contact form.
• Transaction and payment information: Order details, items purchased, billing address, and payment confirmation data — collected when you make an online purchase through our store. Note: full payment card numbers are processed directly by our payment processor and are not stored by us.
• Navigation and device information: Your IP address, browser type, device identifiers, pages visited, session duration, approximate geographic location, and browsing behavior — collected automatically when you visit our website through cookies and similar tracking technologies.
• Form and communication data: Any information you voluntarily provide when filling out forms on our site, including messages, questions, or requests you submit to us.
• Advertising identifiers: Identifiers associated with your device or browser used to measure the effectiveness of our advertising campaigns and to deliver relevant ads — collected only with your consent through marketing cookies.
• User preferences: Your cookie consent choices and navigation preferences, stored locally in your browser to remember your settings across visits.

We do not knowingly collect sensitive categories of personal information such as health data, financial account credentials, or information about minors without appropriate safeguards.

3. Purposes of Processing

We collect and use your personal information only for specific, legitimate purposes. The table below outlines each purpose, the personal information involved, the third-party services used, and the legal basis under Quebec Law 25.

• Operating the website and ensuring security (Essential): We use your IP address and session data to deliver our website reliably and protect it against threats. This is handled through Cloudflare (content delivery and security infrastructure) and Moelleux by Horizon-Cumulus (consent management and privacy policy hosting). This processing is necessary for the operation of our website and does not require your consent.
• Processing online orders (E-commerce): We use your identity, contact, and transaction information to process purchases made through our online store, send order confirmations, and manage returns or inquiries. This processing is necessary to fulfill the contract you enter into with us when placing an order. WooCommerce Analytics is used to analyze sales performance and purchasing behavior.
• Sending our newsletter (Communications): If you subscribe to our newsletter, we use your email address to send you updates about our park, events, and activities. This processing is based on your consent, which you may withdraw at any time. Our email communications are handled through Horizon-Cumulus Email (Quebec-based) and Microsoft 365 (United States — see Section 5 for details on cross-border transfers).
• Measuring website audience and improving user experience (Analytics): We use analytics tools to understand how visitors use our site, which pages are most visited, and how we can improve our content and navigation. This is done through Google Analytics 4 and Hotjar (session recordings and heatmaps). This processing is based on your consent, which you may manage through our cookie preference center.
• Running targeted advertising campaigns (Marketing): We use marketing tools to measure the effectiveness of our advertising and to show relevant ads to people who have visited our site. This is done through Meta Pixel (Facebook) and HubSpot (marketing automation and email nurturing). This processing is based on your consent, which you may withdraw at any time through our cookie preference center.
• Displaying embedded content and web fonts (Functional): We use YouTube to display videos embedded in our site and Google Fonts to render our website's typography. These services may collect your IP address when content loads. This processing is based on your consent for non-essential functional elements.
• Remembering your consent preferences (Preferences): We store your cookie choices in a preference cookie named moelleux_{site_key} for a period of 13 months so that you do not have to re-confirm your preferences on every visit. This is managed by Moelleux (Horizon-Cumulus) and is considered essential to the proper functioning of our consent management system.

4. Third Parties and Processors

We work with the following third-party service providers who may access your personal information in the course of providing their services to us. We require all processors to handle your personal information in a manner consistent with applicable privacy law.

5. Transfers Outside Quebec

Several of the third-party services we use are operated by companies based in the United States. When your personal information is transferred to or processed in the United States, it becomes subject to the laws of that jurisdiction, which may differ from Quebec privacy law.

The following services involve transfers of personal information outside Quebec to the United States:

• Google Analytics 4 (United States) — navigation data, device identifiers, IP address, approximate location
• Hotjar (United States) — session recordings, navigation behavior, device identifiers, IP address
• WooCommerce Analytics (United States) — transaction data, navigation behavior, device identifiers
• Meta Pixel (Facebook) (United States) — device identifiers, advertising identifiers, transaction data, social identifiers, IP address
• HubSpot (United States) — form data, communication data, navigation behavior, IP address
• Google Fonts (United States) — IP address
• YouTube (United States) — device identifiers, IP address, session duration, navigation behavior
• Cloudflare (United States) — IP address
• Microsoft 365 (United States) — email communications data

For your email communications specifically: our primary business email is operated by Horizon-Cumulus Email, which is based in Quebec. However, we also use Microsoft 365 (United States) for certain organizational email functions. As a result, some email-related personal information may be processed in the United States.

In accordance with section 17 of Quebec Law 25, before communicating personal information outside Quebec, we assess whether the destination jurisdiction offers an adequate level of protection. We rely on contractual safeguards — including data processing agreements and, where applicable, standard contractual clauses — with each of our third-party processors to protect your personal information during such transfers.

Where required by Quebec Law 25, we conduct or rely on a Privacy Impact Assessment (PIA) — known in French as an évaluation des facteurs relatifs à la vie privée (EFVP) — to evaluate the risks associated with cross-border transfers and to implement appropriate protective measures before any transfer takes place.

You may request information about the safeguards in place for specific transfers by contacting our Person responsible for the protection of personal information (see Section 8).

6. Retention Period

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. The following table outlines our retention practices by data type.

Once the applicable retention period has expired, personal information is securely destroyed, anonymized, or de-identified in a manner that prevents re-identification.

7. Rights of Data Subjects

Under Quebec Law 25, you have the following rights with respect to your personal information. To exercise any of these rights, please contact our Person responsible for the protection of personal information (see Section 8). We will respond to your request within 30 days of receipt.

• Right of access: You have the right to ask us whether we hold personal information about you, and to receive a copy of that information in a clear and understandable format.
• Right of rectification: If any personal information we hold about you is inaccurate, incomplete, or ambiguous, you have the right to ask us to correct it. If the information has been communicated to third parties, we will notify them of the correction where feasible.
• Right of erasure (right to be forgotten): You may ask us to delete personal information that was collected without a valid legal basis, that is no longer necessary for the purposes for which it was collected, or where you have withdrawn your consent and no other legal basis applies. Certain information may be retained where required by law (for example, financial records).
• Right to data portability: You have the right to receive personal information that you provided to us in a structured, commonly used, and machine-readable format, and to request that it be transmitted to another organization where technically feasible.
• Right to withdraw consent: Where our processing of your personal information is based on your consent — including consent to analytics, marketing, or functional cookies — you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. You can manage your cookie preferences at any time through our consent preference center on the website.

If you believe that your rights have not been respected, or that we have not handled your personal information in accordance with Quebec Law 25, you have the right to file a complaint with the Quebec Information Access Commission (CAI):

• Website: https://www.cai.gouv.qc.ca

We encourage you to contact us first so that we have the opportunity to address your concern directly before a formal complaint is filed.

8. Person Responsible for the Protection of Personal Information

In accordance with section 3.1 of Quebec Law 25, we have designated a Person responsible for the protection of personal information who oversees our compliance with applicable privacy obligations and serves as your point of contact for any privacy-related request or concern.

• Name: Alexis Castonguay Laplante
• Title: Directeur Général
• Email: info@parcdeschutes.com
• Phone: 450 883-6060

You may contact this person to exercise your rights under Quebec Law 25, to ask questions about this policy, or to raise any concern about how your personal information is handled. We are committed to responding to all requests within 30 days, as required by Quebec Law 25.

If your request is complex or if we receive a large volume of requests, we may extend this period by an additional 30 days, in which case we will notify you of the extension and the reason for it before the initial deadline expires.

9. Effective Date and Versioning

This privacy policy takes effect on 16 juin 2026 and replaces any previous version of our privacy policy.

Version: 1

We review and update this policy periodically to reflect changes in our practices, the services we use, or applicable legal requirements. When we make material changes, we will update the effective date above and, where appropriate, notify you through our website or by email. We encourage you to review this policy regularly to stay informed about how we protect your personal information.

The most current version of this policy is always available on our website. Archived versions are available upon request by contacting our Person responsible for the protection of personal information.