Privacy Policy

1. Introduction

Atelier Flowrider (hereinafter « the Workshop ») places great importance on protecting the personal information of its clients, partners and employees. This policy aims to transparently explain how we collect, use, retain and protect your information, in accordance with the Act to modernize legislative provisions as regards the protection of personal information (Bill 25, Quebec).

2. Personal information collected

As part of our watercraft repair, maintenance and performance activities, we may collect the following information:

• First and last name
• Mailing address
• Phone number
• Email address
• Watercraft information (brand, model, serial number, repair history)
• Contractual information (quotes, service contracts, work orders)
• Billing and payment information

This information is collected only to the extent necessary for the performance of our services.

3. Collection methods

Personal information may be collected through the following means:

• Phone or text message
• Email
• Contractual forms and signed work orders
• In person at the workshop

4. Use of information

The personal information collected is used exclusively for the following purposes:

• Assessing the client’s needs and preparing quotes
• Performing the work agreed upon in the service contract
• Providing follow-up and communication regarding ongoing work
• Managing billing and payments
• Complying with our legal and tax obligations

No personal information is sold, rented or transferred to third parties for commercial purposes.

5. Disclosure of information

Your information may be shared, in a strictly professional context and only when necessary, with:

• Parts suppliers or technical partners involved in the performance of work
• Our accounting and administration department
• Legal or tax authorities, if required by law

6. Digital tools and transfers outside Quebec

Atelier Flowrider uses the following tools to manage and store personal information:

• Google Workspace (Gmail, Google Drive) — communications and document management
• QuickBooks Online — billing and accounting
• HubSpot CRM — client relationship management

As these tools are hosted on servers located outside Quebec, a privacy impact assessment (PIA) was conducted in accordance with section 17 of Bill 25. The conclusions of this assessment are as follows:

Data subject to transfer — The information transferred is limited to the data necessary for the operation of these tools: name, email, phone number, address, and billing information for clients and employees. No sensitive data within the meaning of Bill 25 (health, biometric or judicial data) is stored in these systems.

Level of protection of the tools used — Google (Alphabet Inc.), Intuit (QuickBooks Online) and HubSpot Inc. are all subject to strict regulatory frameworks for data protection, including the European Union’s General Data Protection Regulation (GDPR). These providers apply recognized security measures: encryption of data in transit and at rest, two-factor authentication, strict access controls, and contractual confidentiality commitments. Their privacy policies are public and regularly updated.

Additional measures applied by Atelier Flowrider

• System access limited to authorized personnel based on their role
• Secure authentication for each tool
• No storage of personal data on unsecured media
• No superfluous data collected beyond operational needs

Conclusion — In light of this assessment, Atelier Flowrider considers that the tools used provide an adequate level of protection within the meaning of Bill 25, and that transfers outside Quebec are justified by the company’s operational needs.

7. Data retention

Personal information is retained for the period necessary for the performance of services and compliance with our legal obligations. As a general rule:

• Active client files: duration of the business relationship
• Closed client files: 7 years (tax and legal obligations)

Upon expiry of this period, the information is securely deleted or anonymized.

8. Information security

We implement reasonable measures to protect your personal information against unauthorized access, loss or disclosure, including:

• Access limited to authorized personnel based on their role
• Use of secure digital tools with authentication
• Account protection with strong passwords
• Exclusive storage in approved digital environments

9. Your rights

In accordance with Bill 25, you have the right to:

• Access the personal information we hold about you
• Request the correction of inaccurate or incomplete information
• Withdraw your consent to certain uses, within the limits provided by law
• Request the deletion of your information, where permitted by law

To exercise any of these rights, please contact our privacy officer directly at the contact information provided in section 11.

10. Privacy incidents

In the event of an incident involving your personal information (unauthorized access, loss, disclosure), Atelier Flowrider undertakes to:

• Take immediate measures to limit the impacts
• Record the incident in the privacy incident register
• Notify the Commission d’accès à l’information du Québec (CAI) if a risk of serious harm is identified
• Inform the individuals concerned as soon as possible

11. Privacy officer

Masha Rossignol
Privacy Officer — Atelier Flowrider
info@atelierflowrider.com

12. Policy updates

This policy may be amended at any time to reflect legal or operational changes. The current version is always the one available on our website or provided upon request.

Last updated: May 2026