Privacy notice

1. Who we are

This notice explains how Vega Security / Vega Telecom (Vega, "Vega", "we", "us"), a low-voltage, security and telecommunications integrator based in Montréal, Québec (RBQ licence 5858-3865-01), collects, uses, shares and protects personal information about its customers, portal users and website visitors. It applies to our customer portal, our billing and customer management system, our invoices and emails, and the services we deliver to you. We comply with the Act respecting the protection of personal information in the private sector (Québec, "Law 25") and, where applicable, the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

• Postal address: 8457 Newman Blvd, PO Box 272, LaSalle, Quebec, Canada, H8N 0A2
• Phone: 833-330-8080 · Email: info@vega-group.ca

2. Personal information we collect

• Identity and contact: name, company name, email address, phone number, billing address, additional contacts you ask us to add (for example an accounts-payable contact).
• Service information: service and installation address, unit number, the plans you subscribe to, prices, start and end dates, service identifiers (for example a phone number or circuit ID), installed equipment and its serial numbers, and technical notes about your service.
• Account and login data: your portal email, a securely hashed password (we never see or store it in clear), two-factor settings, sign-in history (date, IP address, browser and device type), trusted devices, language preference and your privacy choices.
• Invoices and payments: invoices, payment history, receipts, credits and refunds, the payment method you prefer, and for saved cards or bank accounts only the brand or bank name, the last 4 digits and the expiry date. Your full card or bank account number is entered directly with our payment processor Stripe and is never stored by us.
• Communications: messages you send us, support requests, follow-up notes, and emails we send you (with their delivery status).
• Technical data: security and audit logs, IP addresses, browser type and the cookies described below.

We collect this information from you, from people you authorize (for example a property manager), and from our own records of the services we provide. We do not buy personal information from data brokers.

3. Why we use your information and on what basis

• To provide, install, support and bill the services you request (performance of our contract with you).
• To manage your account, verify your identity and keep the portal secure (contract, our legitimate interest in security, and legal obligations).
• To issue invoices, collect payments, handle refunds and keep the accounting and tax records the law requires (legal obligations).
• To send you service notices, invoices, reminders and security alerts (contract and legal obligations).
• To answer your questions and complaints and to improve our services (legitimate interest and your request).
• To send you news and offers, only if you have given your consent. You can withdraw it at any time.
• To detect, prevent and investigate fraud, abuse and security incidents, and to protect our rights.

We only collect the information that is necessary for these purposes and we do not use it for a different purpose without informing you or, where the law requires, obtaining your consent.

4. Consent

When the law requires it, we ask for your consent in clear and simple terms, separately for each purpose. Your consent to marketing messages is optional and does not affect the services you receive. You can change your marketing choice yourself on the Privacy & data page of the portal, or by using the unsubscribe instructions in a message or by writing to us. Withdrawing consent does not affect processing done before, and we may still need to send you service and billing messages.

5. Who we share your information with

We do not sell your personal information. We share it only as needed, with:

• Stripe (payment processor) to collect card and pre-authorized debit payments and issue refunds. Stripe acts under its own security and privacy commitments and the card or bank details you enter go directly to Stripe.
• Email delivery: Microsoft 365 (Microsoft) to send invoices, notices and support emails from our mailboxes.
• Hosting and infrastructure providers that run our servers, backups and network under contracts that require them to protect the information.
• Installers, technicians and subcontractors, only the information needed to install or repair your service (for example name, service address, phone and equipment).
• Professional advisers, auditors, insurers and financial institutions when needed to run our business, under confidentiality obligations.
• Authorities and other parties when the law requires it or a court orders it, and, with your knowledge, in connection with a sale or reorganization of our business.

Where we entrust information to a provider we do so under a written agreement that limits its use to our purposes and requires appropriate security.

6. Where your information is stored

All personal information we hold is hosted and stored in Canada (Québec). We do not transfer it outside Canada, except to the processors named in this notice, only to the extent needed to provide the service to you: Stripe (payment processing) and Microsoft 365 (email delivery). These processors handle only the limited information needed for their function (for example the amount and payment details you enter with Stripe, or the content and addresses of an email) under their own security commitments and our agreements. Before any other communication of personal information outside Québec we would assess its sensitivity, the purposes, the safeguards and the legal framework of the destination, and we would inform you where the law requires it. You can contact our Privacy Officer for details.

7. How long we keep your information

We keep personal information only as long as needed for the purposes above or as the law requires, then we destroy or anonymize it.

• Account and service records: while your service is active and for up to 3 years after it ends.
• Invoices and payment records: 6 years after the end of the fiscal year in which they were issued (tax and accounting rules).
• Support and email communications: 2 years.
• Technical and security logs: 12 months.
• Backups: rolling backups are kept for up to 90 days.

When you ask us to erase your personal data we anonymize your identity and contact information; we keep the financial records (invoices, payments) that the law requires us to retain, without any use beyond that obligation.

8. How we protect your information

We apply security measures suited to the sensitivity of the information: encrypted connections (HTTPS), hashed passwords, optional and recommended two-factor authentication, session time limits and sign-out controls, role-based access for our staff, an activity log of actions on customer data, encrypted storage of secrets and API keys, regular backups, and restricted network access to our servers. Our staff and providers with access to personal information are bound by confidentiality. No system is perfectly secure; please choose a strong password and tell us right away if you suspect unauthorized access.

9. Cookies and similar technologies

The portal only uses cookies that are needed to run it: a session cookie that keeps you signed in, an optional "remembered device" cookie for two-factor authentication (up to 30 days, only if you choose it), a language preference cookie, and a security (CSRF) cookie that protects forms. We do not use advertising or cross-site tracking cookies. You can block cookies in your browser, but the portal will not work without the necessary ones.

10. Automated decisions

We do not make decisions about you based exclusively on automated processing of your personal information, and we do not use profiling or technology that identifies, locates or profiles you. If this ever changes we will tell you and explain your rights before it starts.

11. Your rights

You have the right to:

• access the personal information we hold about you and get a copy;
• have it corrected if it is inaccurate, incomplete or out of date;
• have it erased or anonymized when it is no longer needed and we are not required to keep it (see retention);
• receive it in a structured, commonly used technological format (data portability) or ask us to send it to another organization;
• withdraw your consent to the use or communication of your information, and object to marketing at any time;
• ask how your information was used and, where the law provides it, to review a decision made about you;
• file a complaint as explained below.

12. How to exercise your rights

Sign in to the customer portal and open Privacy & data: you can view your information, download it (JSON or PDF), change your marketing consent, and ask us to close your account or erase your personal data. You can also write to our Privacy Officer (below). We may need to confirm your identity first. We answer within 30 days of receiving your request, and we do not charge for access or correction requests except reasonable fees where the law allows and only after telling you the amount.

13. Privacy Officer

We have designated a person in charge of the protection of personal information:

• Company Administrator, Person in charge of the protection of personal information
• Email: info@vega-group.ca
• Mail: Privacy Officer, Vega, 8457 Newman Blvd, PO Box 272, LaSalle, Quebec, Canada, H8N 0A2

14. Complaints

Please contact our Privacy Officer first so we can try to resolve the matter. You may also file a complaint or ask for a review with:

• Commission d'accès à l'information du Québec (cai.gouv.qc.ca), 1 888 528-7741;
• Office of the Privacy Commissioner of Canada (priv.gc.ca), 1 800 282-1376.

15. Privacy incidents

We keep a register of confidentiality incidents. If an incident involving your personal information presents a risk of serious injury, we will promptly notify you, the Commission d'accès à l'information and, where required, the Privacy Commissioner of Canada, and we will take measures to reduce the risk of harm.

16. Changes to this notice

We may update this notice. Each version has a number and an effective date shown at the top of this page, and we will notify you of important changes (for example by email or in the portal) before they apply when the law requires it. The English and French versions have the same value; if they differ, the version that best protects your rights applies.