Legal
Privacy policy
Last updated September 29, 2026
Version 1Lire cette politique en français
This policy explains how E-FACTS Inc. (“E-FACTS”, “we”, “us”) handles personal information when you visit efacts.ca or contact us through its forms. It applies to every visitor, wherever you are.
It does not cover the E-FACTS platform services we provide to retailers (such as digital receipts and shopper passes). When we process information in those services on a retailer’s behalf, we act as the retailer’s service provider under contract, and the retailer’s privacy policy applies.
1. Who we are
E-FACTS Inc., a Canadian company located at [REGISTERED ADDRESS], is responsible for the personal information described in this policy. Under European and UK law, we are the “controller”.
Our person in charge of the protection of personal information (privacy officer) is [NAME, TITLE]. They oversee our compliance with this policy and with privacy laws, including Quebec’s Act respecting the protection of personal information in the private sector. You can reach them at privacy@efacts.ca or by mail at the address above.
Privacy questions and requests: privacy@efacts.ca. Anything else: info@efacts.ca.
2. Summary
- Nothing optional runs without your opt-in. Analytics, company insights and error monitoring are off by default and only load after you allow them. “Accept all” and “Reject all” are equally easy to choose.
- We honour Global Privacy Control. If your browser sends a GPC signal, every optional category stays off.
- You can change your mind at any time with the “Privacy choices” link at the bottom of every page.
- We do not sell or share your personal information, and we don’t use advertising trackers, social media pixels, Google Analytics, session replay or fingerprinting.
- Our analytics are cookieless and never store your IP address. Company insights identify organisations, never individual people.
- When you fill in a form, we use your details to respond to your request.
3. Information we collect
Information you give us
Depending on the form (enterprise demo, shopper pass or partner inquiry), we ask for your name, work email, company, role and a message. We also record which form you used and when. If you accepted Analytics, the campaign (UTM) tags of the link that brought you to the site are attached to your submission.
Please don’t include sensitive information (such as health or financial details) in your message.
Information collected automatically for every visit
- Your privacy choices. Stored in the
efacts_consentcookie on your device and as a consent record on our servers: date and time, policy version, your choice for each category, whether your browser sent a GPC signal, the action you took (for example “Reject all”), language, a random consent ID and your country. We never store your IP address in the consent record. - Technical request data. Like every website, our host and network providers receive your IP address, browser user agent and the page you request in order to deliver it. Our host keeps short-lived request logs (see section 9).
- Form security. When you submit a form, we keep your IP address in server memory for up to 10 minutes to limit repeated submissions. It is never written to storage.
- Partner inquiries. When you submit the partner inquiry form, our server looks up who owns the network your IP address belongs to (network number, network name and domain) using IPinfo. We keep only that result with your inquiry and discard the IP address.
- Language. To show the consent banner in French when appropriate, we check your browser language and the region our host derives from your IP address. This is used only to pick the language and is not stored.
Information collected only with your consent
- Analytics. Pages you visit (including campaign tags in the address), the site that referred you, your browser, operating system and device type, and your approximate location (country, region, city) derived from your IP address, which is not stored. For half of browsing sessions, we also measure page speed: loading and responsiveness scores, which page element was involved, the page path, device class, browser family, network type (for example 4G) and approximate location. These measurements contain no IP address, no browser user agent and no identifiers.
- Company inferred from IP address (company insights). Leadfeeder receives your IP address and the pages you view so it can infer which organisation owns the network you are browsing from, such as your employer’s office network. We only see company-level information (for example, “someone from Company X viewed the pricing page”). We never use features that identify individual people or look up contact details. On home or mobile networks, usually no company is identified.
- Error reports. If a page error happens in your browser: the error message, a technical stack trace, the page address, your browser and operating system. No IP address, cookies or session recordings.
What we don’t collect
We don’t collect sensitive information, precise location, payment card details or government identifiers through this website, and we don’t track you across other websites.
4. Why we use it (purposes and legal bases)
The table shows each purpose, the information used and, for visitors in the European Economic Area and the United Kingdom, the legal basis we rely on.
| Purpose | Information used | Legal basis (EEA and UK) |
|---|---|---|
| Remember and prove your privacy choices | The efacts_consent cookie and a consent record (no IP address) | Legal obligation (to be able to demonstrate consent) |
| Deliver the website and keep it running securely | IP address, browser user agent and page requested, in short-lived hosting logs | Legitimate interests (operating a secure website) |
| Prevent form spam and abuse | IP address, held in server memory for up to 10 minutes | Legitimate interests (preventing abuse) |
| Show the consent banner in the right language | Browser language and region derived from your IP address (not stored) | Legitimate interests (informing you in your language) |
| Respond to your demo, shopper pass or partner request and follow up | Name, work email, company, role, message | Steps taken at your request before entering into a contract; legitimate interests (responding to business enquiries) |
| Understand which organisation a partner inquiry comes from | Network owner of your IP address (ASN, network name, domain); the IP address itself is discarded | Legitimate interests (qualifying and screening partner inquiries) |
| Attribute a form to the campaign that brought you | Campaign (UTM) tags | Consent (Analytics) |
| Measure our audience and improve the site | Pages viewed, referrer, campaign tags, browser, operating system, device type, approximate location | Consent (Analytics) |
| Measure page speed | Performance measurements, page path, device class, browser family, network type, approximate location | Consent (Analytics) |
| Learn which organisations visit our site | IP address and pages viewed, used to infer a company name | Consent (Company insights) |
| Detect and fix website errors | Error message, stack trace, page address, browser and operating system | Consent (Error monitoring) |
Under Canadian and Quebec law, we collect only what is necessary for the purposes above. We rely on your express consent for the optional categories, and on the consent you give when you submit a form for the purpose of that form. Delivering the site, keeping it secure and recording your privacy choices are necessary to provide the website you ask to see. We will ask for your consent again before using your information for a new purpose.
6. Global Privacy Control
Global Privacy Control (opens in a new tab) (GPC) is a signal your browser or a browser extension can send to tell websites that you do not want your personal information sold or shared.
We treat GPC as a refusal of every optional category. Analytics, company insights and error monitoring stay off and cannot be switched on while the signal is present, and the banner confirms that we honoured it. To opt in, you would first need to turn off GPC in your browser. We record that a GPC signal was present with your consent record.
7. Service providers
These service providers process information on our behalf, only on our instructions and under written data processing agreements. They may not use it for their own purposes.
| Provider | What they do for us | Information | Where it is stored | Terms |
|---|---|---|---|---|
| Vercel Inc. (United States) | Hosts the website, its forms and our self-hosted Umami analytics | Requests to the site (including IP address in short-lived logs), form submissions in transit, analytics statistics | United States; global delivery network | Data processing agreement (opens in a new tab) |
| Neon (Databricks, Inc.) (United States) | Database for our self-hosted Umami analytics | Analytics statistics (no IP address) | [REGION] | Data processing terms (opens in a new tab) |
| Cloudflare, Inc. (United States) | Cloudflare Web Analytics; runs the service that records consent choices and page-speed measurements | Page views and load times; consent records and page-speed measurements (no IP address stored) | Global network; stored data in [REGION] | Data processing addendum (opens in a new tab) |
| Leadfeeder (Dealfront Group GmbH, Germany) | Company insights: infers the organisation behind a visit | IP address and pages viewed; inferred company name | European Union (Ireland); some subprocessors in the United States | Data processing agreement (opens in a new tab) |
| Sentry (Functional Software, Inc., United States) | Error monitoring | Error message, stack trace, page address, browser and operating system (no IP address) | European Union (Frankfurt, Germany) | Data processing addendum (opens in a new tab) |
| Resend (Plus Five Five, Inc., United States) | Delivers form submissions to our inbox by email | Form content | United States | Data processing addendum (opens in a new tab) |
| Google LLC (United States) | Google Sheets record of inquiries | Form content, campaign tags, partner network lookup result | United States and other Google locations | Cloud Data Processing Addendum (opens in a new tab) |
| IPinfo, Inc. (United States) | Network owner lookup for partner inquiries | IP address (not kept after the lookup) | United States | Data processing agreement (opens in a new tab) |
| [EMAIL PROVIDER] | Hosts our info@efacts.ca and privacy@efacts.ca mailboxes | Form notifications and emails you send us | [REGION] | [LINK] |
Umami is open-source software that we run ourselves on Vercel with a Neon database, so no analytics company receives your data. We also use uptime and performance monitoring (UptimeRobot, Checkly, Lighthouse CI and Google PageSpeed Insights) that tests our site with automated visits and test data; these services receive no information about you. PageSpeed Insights shows Google’s public Chrome UX Report data, which Google collects under its own terms; we send nothing to Google for it.
IP address data powered by IPinfo (opens in a new tab).
8. International transfers
E-FACTS is based in Canada. Our service providers process information in the United States and the European Union (see section 7), so your information may be processed outside your province or country, including outside Quebec. There, it may be accessible to courts and authorities under local law.
- From the EEA and the UK to Canada: the European Commission and the UK recognise Canada as providing adequate protection for organisations subject to PIPEDA.
- To the United States and other countries: we rely on the provider’s certification under the EU-U.S. Data Privacy Framework (and its UK Extension) where available, or on the European Commission’s Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, included in the provider’s data processing agreement.
- From Quebec: before communicating personal information outside Quebec, we carried out a privacy impact assessment, as required by section 17 of Quebec’s private sector privacy act. It considered the sensitivity of the information, the purposes, the protection measures (including contractual ones) and the legal framework of each destination. We communicate information only under written agreements that provide adequate protection.
- Across Canada: our contracts require service providers to protect information at a level comparable to ours.
You can ask for more information about these safeguards at privacy@efacts.ca.
9. How long we keep information
We keep information only as long as needed for the purposes above. When a period ends, we delete the information or anonymise it.
| Information | How long we keep it |
|---|---|
| Consent cookie (efacts_consent) | 12 months on your device, then we ask again |
| Consent records | 3 years, to demonstrate consent |
| Hosting request logs (may include IP address) | No more than 30 days, deleted automatically by our host |
| IP address for form rate limiting | Up to 10 minutes, in server memory only |
| Umami analytics | 13 months, then purged automatically |
| Cloudflare Web Analytics | Up to 6 months (Cloudflare’s retention) |
| Page-speed measurements | 90 days |
| Campaign tags in your browser | Until you close the tab |
| Company insights (Leadfeeder) | Visible to us for 7 days on our current plan; kept by Leadfeeder for [PERIOD] |
| Error reports (Sentry) | 30 days |
| Form submissions, including the partner network lookup result | 24 months after our last contact with you, unless you become a customer or ask us to delete them sooner |
10. Your rights
Depending on where you live, you have some or all of the rights below. Whatever your location, you can ask us any privacy question and we will help in good faith.
European Economic Area (GDPR)
You can ask to access, correct or delete your personal information, restrict or object to its use (including use based on our legitimate interests), and receive the information you gave us in a portable format. You can withdraw consent at any time without affecting earlier processing. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
United Kingdom (UK GDPR and PECR)
You have the same rights as under the GDPR above, and you can complain to the Information Commissioner’s Office.
Canada (PIPEDA)
You can ask to access your personal information and to have it corrected if it is inaccurate or incomplete. You can withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, and challenge our compliance with this policy.
Quebec (Law 25)
- Access your personal information and have it corrected.
- Withdraw your consent at any time.
- Portability: receive the computerised personal information you gave us in a structured, commonly used technological format, or have it sent to a person or organisation you choose.
- De-indexation: ask us to stop disseminating your information or to de-index a link to it, where the law allows.
- Be informed when a decision about you is based exclusively on automated processing. We make no such decisions.
- Be informed of technologies that can identify, locate or profile you. Company insights and approximate location in analytics are off by default and only activated if you opt in.
California (CCPA/CPRA)
You have the right to know what personal information we collect, use and disclose, and to access it; to delete it; to correct it; to opt out of its sale or sharing (we don’t sell or share); to limit the use of sensitive personal information (we don’t collect any); and not to be discriminated against for exercising these rights. You can use an authorised agent.
In the past 12 months we collected: identifiers (name, work email, and IP address used briefly as described above); professional information (company, role); internet activity (pages viewed, referrer, campaign tags, error reports); and approximate location (country, region, city, never precise geolocation). We collected it from you, your browser and the services described in section 7, for the purposes in section 4, and disclosed it only to those service providers for business purposes. Retention periods are in section 9.
How to exercise your rights
- Email privacy@efacts.ca and tell us which right you want to exercise and where you live.
- To protect your information, we verify your identity before acting, usually by confirming that you control the email address you used with us. We won’t ask for more than we need. Because our analytics are anonymous, we may not be able to link them to you.
- We respond within 30 days in Canada and Quebec, one month in the EEA and UK, and 45 days in California. Where the law allows us to extend this period, we will tell you why.
- Requests are free, unless the law allows a reasonable fee (for example for manifestly excessive requests or copies); we will tell you before charging anything.
- An authorised agent can act for you with your signed permission; we may still ask you to confirm your identity.
- If we refuse a request, we will explain why and how you can complain (see section 14).
11. We do not sell or share
We do not sell personal information, and we do not share it for cross-context behavioural advertising (as “sell” and “share” are defined in California law). We don’t use advertising networks, retargeting or social media pixels, and we don’t allow our service providers to use your information for their own advertising. We still honour Global Privacy Control (see section 6).
12. Children
Our website is intended for businesses and adults. It is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has sent us information, contact privacy@efacts.ca and we will delete it.
13. Security
We protect information with measures suited to its sensitivity: HTTPS encryption on every page, collecting as little as possible (no IP address in our analytics, consent records or error reports), access limited to people who need it, and service providers bound by data processing agreements and their own security programs.
We keep a register of confidentiality incidents. If an incident involving your information presents a risk of serious injury or harm, we will notify you and the competent authorities as the law requires. No method of transmission or storage is completely secure, so please contact us if you notice anything unusual.
14. Complaints
Please contact us first at privacy@efacts.ca so we can try to resolve your concern. You can also complain to a privacy authority:
| Where you live | Authority |
|---|---|
| Canada | Office of the Privacy Commissioner of Canada (opens in a new tab) |
| Quebec | Commission d’accès à l’information du Québec (opens in a new tab) |
| United Kingdom | Information Commissioner’s Office (ICO) (opens in a new tab) |
| European Economic Area | Your country’s data protection authority (list published by the EDPB) (opens in a new tab) |
| California | California Privacy Protection Agency (opens in a new tab) |
15. Changes to this policy
We review this policy at least once a year. When we make a material change, such as adding a service provider or a new purpose, we increase the version number and ask for your privacy choices again on your next visit. Previous versions are available on request.
This is version 1 of this policy, last updated September 29, 2026.