Kainen personal information governance policy
Adopted on November 14, 2026 by the privacy officer (the founder) · Version française
1. Purpose
This policy sets out how Kainen governs the collection, use, communication, retention and destruction of personal information, as Quebec's Act respecting the protection of personal information in the private sector (Law 25) requires. It applies to everyone who works for Kainen and to all information Kainen holds: that of users, of site visitors, and the information customers enter about their employees (for the latter, Kainen acts as the customer's service provider).
2. Roles and responsibilities
- Person in charge of the protection of personal information: the founder, reachable at [email protected]. The title and contact details are published in the privacy policy. The role can be delegated in writing.
- The officer makes sure this policy is applied; approves every new provider and every new collection; carries out privacy impact assessments (PIAs); handles requests and complaints; keeps the incident register and decides which notices to give.
- Anyone who works for Kainen in future signs a confidentiality undertaking, reads this policy on arrival and then every year, and has access only to the information their tasks need.
3. Principles
- Necessity. We collect only what is needed to provide, secure or improve Kainen, for purposes stated in advance in the privacy policy.
- Consent. Consent is asked for each purpose, in plain terms, separately from other information. Product news email needs a separate choice, unticked by default.
- Privacy by default. New maps private; sharing defaults to view only; view links expire after 30 days; no profiling, no location tracking, no automated decisions.
- Transparency. The privacy policy, the Security page and the provider list are public and kept current.
- No sale. No information is sold, rented or used for advertising.
4. Information life cycle
| Stage | Rule |
|---|---|
| Collection | Only the information listed in the privacy policy. Any new collection: the policy is updated first. |
| Use | Only for the stated purposes. A new purpose needs new consent, unless the law provides an exception. |
| Communication | Only to listed providers, to the people the user chooses, or where the law requires it. |
| Retention | Per the schedule below. |
| Destruction | Deletion from the database, then backups expire (30 days). Expired logs and backups are destroyed automatically. |
Retention schedule: account and content, while the account exists, then 30 days in the database and 30 days in backups; trash, 30 days; sessions, end after 14 days unused, expired sessions deleted; security-log IP addresses and typed emails, 12 months; server logs (shortened IP), up to 30 days (a hosting setting); expired or revoked links, 90 days; support email, 24 months after the last message, or sooner on request; consent records, kept after the account is deleted until a period is set; billing, as tax rules require; incident register, at least 5 years after the date the incident became known.
5. Providers and communication outside Quebec
- Before engaging a provider that will receive personal information: a PIA (sensitivity, purpose, protection measures, legal regime of the location), a written contract (confidentiality, limited use, security, incident notice, destruction at the end) and addition to the public list, before it receives any data (D1021).
- Current providers: DigitalOcean (Toronto), Cloudflare, Resend (email, once switched on), Have I Been Pwned (password check) and, later, Stripe.
- The list and the PIAs are reviewed every year and with each new provider (next planned: Google and Microsoft sign-in, an artificial intelligence provider).
6. PIAs for projects
A PIA is carried out for any project that acquires, develops or redesigns an information system or electronic service involving personal information (for example an artificial intelligence feature, a new sign-in method, a new measurement tool). It is kept with the register.
7. Requests for access, correction, portability and deletion
- Receive the request (Account page or [email protected]) and log it in the request register (date, person, subject).
- Verify identity (the request comes from the account's email, or a verification question).
- Answer within 30 days, free of charge. A refusal gives reasons in writing and states the recourse to the Commission d'accès à l'information.
- If the request concerns information a customer entered about its employees, pass it to the customer and help them answer.
8. Complaints
Complaints go to the officer ([email protected]), who acknowledges them, examines them and answers in writing within 30 days, stating the possible recourse to the Commission d'accès à l'information.
9. Confidentiality incidents
An incident is any unauthorised access to, use or communication of personal information, its loss, or any other breach of its protection.
- Same day: record it in the incident register and alert the officer.
- Contain: cut access, revoke links or sessions, rotate secrets, restore a backup if needed.
- Assess the risk of serious injury (sensitivity, possible misuse, consequences). Internal target: within 72 hours (our choice, not a legal deadline).
- If the risk is serious: promptly notify the Commission d'accès à l'information (CAI form) and the people concerned; tell affected customers without undue delay (section 6 of the terms).
- Afterwards: record the measures taken, fix the cause, update this policy if needed.
10. Security measures
Described on the Security page: hosting in Toronto, encrypted connections, hashed passwords, an access check on every opening, a security log, secrets kept out of the code.
11. Awareness
The officer rereads this policy, the register and the provider list every year and runs one incident exercise (a restore and a mock notice) a year.
12. Review
This policy is reviewed every year, with each new provider or new collection, and after any incident.