Ndule Privacy Policy

Ndule is committed to respecting the privacy of its users and to protecting their personal information in accordance with Quebec’s Law 25. This Ndule privacy policy sets out in full the types of information we collect, the ways in which we use it, the security measures in place and the rights you hold over that information. It applies to every digital and contractual interaction between Ndule and its clients, prospects, partners and visitors to our website.
1. Collection of Personal Information We collect only the personal information required to deliver our services, manage the client relationship, keep our operations secure and meet our legal obligations. The information collected may include:
First and last name
Email address
Mailing address
Phone number
Contract information
Banking or payment details (through Zoho Invoice)
Voice recording data captured during phone calls
IP addresses and browsing data when you visit our website
2. Use of the Data Personal information is used for the following purposes:
• Responding to information requests and to messages from users
• Processing payments and issuing refunds through Zoho Invoice (banking data is not hosted on our servers)
• Managing electronic signatures on legal documents through Zoho Sign
• Handling client relationship management through Zoho CRM
• Managing appointment booking and scheduling through Zoho Bookings
• Sending newsletters and commercial communications with prior consent
• Improving the user experience and the usability of our website
• Preventing fraud, abuse and disputes by using call recordings as evidence of good faith or of a verbal agreement
2.1 Sharing Information with Business Partners
In the course of its activities, Ndule may pass certain personal information (first name, last name, email address, phone number) on to selected business partners, for the following purposes:
• Referring prospects to partners whose services match the needs they have expressed
• Working with trusted third parties on joint or complementary offers
• Allowing an accredited partner to follow up commercially when Ndule judges that such a referral is in the interest of the person concerned
This sharing rests on Ndule’s legitimate interest in providing a quality referral service, and follows an internal assessment confirming that the transfer does not infringe the rights and freedoms of the people concerned. It is subject to the following conditions:
• Prior assessment: before any sharing takes place, Ndule weighs how relevant and proportionate the transfer is in light of the needs the prospect has expressed and the nature of the services the partner offers
• Qualified partners: only partners who have signed a confidentiality agreement and who undertake to apply equivalent protection standards are allowed to receive this data
• Limited purpose: partners may use the information only for the purposes for which it was passed to them, with no possibility of resale or redistribution
• Right to object: anyone may object to their information being shared with partners by contacting our Privacy Officer at admin@Ndule.ca. Ndule undertakes to process any objection request within 30 business days.
Ndule remains responsible for making sure that its partners meet the obligations set out in Law 25.
3. Legal Grounds for Processing Our processing activities rest on:
• The free, informed and specific consent of the person concerned
• The performance of a contract between the user and Ndule
• Compliance with our legal obligations (for example, retaining tax records)
• The pursuit of legitimate interests, in particular security, fraud prevention and the continuous improvement of our services, without infringing the fundamental rights of individuals
4. User Rights Under Law 25, anyone whose personal information is collected may:
• Access their personal data
• Ask for it to be corrected
• Ask for it to be deleted, where this is permitted
• Object to its use for prospecting purposes
• Withdraw their consent at any time, where the processing rests on that consent
• Exercise their right to portability: in that case, we will create a secure, restricted Google Drive folder for you containing the requested information in a structured, commonly used, machine-readable format
5. Transferring Data Outside Quebec We use third-party platforms whose servers sit outside Quebec, notably in the United States, including:
• Zoho Sign (electronic signatures)
• Zoho Invoice (invoicing and payment processing)
• Zoho CRM (client management)
• Zoho Bookings (appointments)
• Google Workspace (business email, internal documents)
Before using these services, a privacy impact assessment was carried out, confirming that adequate security measures are in place, including encryption, access controls and compliance with international certifications (ISO 27001, SOC 2). Contractual clauses and contractual data protection mechanisms govern every one of these transfers.
6. Data Retention Unless otherwise provided or required by a specific legal obligation, personal information is kept for a maximum of three (3) years following its collection or the end of the contractual relationship. Recorded calls are kept for up to ten (10) years, so that evidence remains available in the event of a challenge or a contractual claim. That period rests on the principle of proportionality and on the legitimate aim of protecting both parties.
7. Recording of Phone Calls Ndule may record all incoming and outgoing calls for quality, training and contract validation purposes. This practice is disclosed through our privacy policy and applies to anyone who communicates with us. These recordings are:
• Encrypted and secured through a restricted-access system
• Kept for a maximum of ten (10) years
• Used only to enforce a verbal agreement, to establish the absence or the existence of liability, or to serve as evidence in a dispute
• Accessible only to authorized people and, in certain cases, to judicial authorities
An opt-out mechanism is available: anyone may ask for their recording to be deleted, provided this does not undermine the legitimate purpose for keeping it, by writing to admin@Ndule.ca or to our head office, whose address is listed with the Registraire des entreprises du Québec. Where a request comes through the courts, a strict protocol will be followed, including authentication of the requester and, if needed, an in-person meeting. Reasonable fees may be charged.
8. Cookies Our site uses cookies to improve the user experience and to measure how well our campaigns perform. On your first visit, a consent banner lets you:
• Accept the essential cookies, which are enabled by default
• Accept or refuse analytics and advertising cookies (Google Analytics, Facebook Pixel and others)
• Manage your preferences at any time through a link in the page footer No cookie is enabled without your explicit consent, apart from those strictly necessary for the technical operation of the site.
9. Data Security Ndule applies strict security measures, both technical and administrative:
• SSL/TLS encryption for all communications
• Restricted access to sensitive data through two-factor authentication
• Regular automatic backups
• Logging of connections to our systems
• Regular staff training on confidentiality and the secure handling of information
10. Privacy Officer (RPRP) Antoine Côté, president of Ndule, is the designated Privacy Officer, the person in charge of the protection of personal information. He oversees:
• The application of Law 25 within the company
• Responses to access, correction and deletion requests
• The handling of privacy incidents
• The assessment of risks tied to third-party tools He can be reached:
• Through the form on our “Contact Us” page
• By email at admin@Ndule.ca
• By phone at (418) 431-7824 extension 101
11. Complaint Procedure Anyone who wishes to file a complaint or a request concerning their personal information may do so in writing to the designated officer. We undertake to process any request within a maximum of 30 business days. If you are not satisfied with the outcome, you may file a recourse with the Commission d’accès à l’information du Québec (CAI).
12. Notification of a Privacy Breach In the event of a personal information breach likely to present a high risk to rights and freedoms, Ndule will report the incident to the CAI within 72 hours, unless the risk is judged negligible. Where the risk is high, the people concerned will also be informed by whatever means is judged appropriate, along with the measures taken to limit the consequences.
13. Updates to This Policy This privacy policy may be amended at any time to reflect legislative, technological or organizational changes. If substantial changes are made, a notice will be published on our site. We invite you to check this page regularly.
14. General Information Ndule is registered with the Registraire des entreprises du Québec under NEQ: 1171593842. Our head office is located at 2828 Ste-Anne, Lévis, G6J 1H8, Canada. All of the content on our site, including text, photographs, logos and visual elements, is protected by copyright law.
15. Intellectual Property and Use of the Site This website and its content are the exclusive property of Ndule. You undertake not to reproduce, distribute, modify or transmit any part of this site without our prior written authorization. Any fraudulent or abusive use will result in immediate exclusion and may give rise to legal action.