Last updated · April 16, 2026 · Effective date · May 1, 2026
Bill 25 compliance
Our framework for protecting personal information, the commitments we make to syndicate customers, and how you can exercise your rights.
Syndic+ processes personal and financial information daily on behalf of Quebec condominium syndicates. Because trust is at the heart of our product, we go beyond the strict legal minimum: we publicly document our governance, our subprocessors, our transfers outside Quebec, and our incident procedures. This page summarizes our compliance with the Act to modernize legislative provisions respecting the protection of personal information ("Bill 25", fully in force since September 22, 2024).
1. Our commitment
We commit to: (i) limiting collection to what is strictly necessary, (ii) obtaining informed consent when required, (iii) documenting our purposes, (iv) using no advertising cookies, (v) hosting primary data in Canada, (vi) notifying any incident presenting a risk of serious harm, (vii) providing simple mechanisms to exercise your rights, (viii) publicly updating this page whenever our practices evolve.
2. Person in charge of personal information protection
In accordance with section 3.1 of the private sector Act, a designated officer oversees our compliance, handles rights requests, and coordinates incident response.
David Sanchez Person in charge of the protection of personal information Email: confidentialite@syndicplus.ca Address: Montréal, Québec, Canada
3. Governance framework
We have adopted the following internal policies, available on request from our officer:
- Data classification policy (public, internal, confidential, highly sensitive).
- Access management policy (least-privilege principle, quarterly review).
- Subprocessor management policy (prior due diligence and annual reassessment).
- Incident response plan (IRP) with roles, communication channels, and notification templates.
- Data retention and destruction policy.
4. Consent management
When consent is the legal basis for processing, we collect it in a manifest, free, informed, and specific manner. Consent is always distinct for each different purpose. You may withdraw it at any time via your account settings or on request to our officer. Essential transactional communications (invoices, security alerts, reminders of legal obligations) rely on contract performance rather than consent.
5. Privacy Impact Assessments (PIA)
Before any new project or integration involving personal information, we carry out a PIA in accordance with section 3.3 of the Act. The assessment covers: categories of data, purposes, flows (including to subprocessors outside Quebec), risks, mitigation measures, and final decision. PIAs are retained for a minimum of five (5) years and can be shared in summary form with syndicate customers on request.
6. Transfers outside Quebec
Bill 25 requires a prior assessment before any transfer of personal information outside Quebec (section 17). For each relevant subprocessor, we assessed: the legal framework of the receiving country, contractual measures (standard clauses, confidentiality commitments), technical measures (encryption, minimization), and retention duration. Primary data remains in Canada (Supabase, Montreal). Transfers to the United States are limited to strict operational necessities (payment processing, performance analytics, transactional email delivery).
7. Privacy incident response
We maintain a register of privacy incidents as required by section 3.8 of the Act. In case of an incident presenting a risk of serious harm, we promptly notify: (a) the Commission d'accès à l'information (CAI), (b) the individuals concerned, and (c) the affected syndicate customers. The notification includes: the nature of the incident, the date or period, the information concerned, the measures taken to limit the harm, and recommendations for affected individuals. Our commitment: notification within 72 business hours of detection for any incident presenting a serious risk.
8. Exercising your rights
You can exercise the following rights free of charge by writing to confidentialite@syndicplus.ca. A piece of ID may be requested to verify your identity before the response, which will occur within 30 days.
- Access — obtain a copy of the information we hold about you.
- Rectification — correct inaccurate, incomplete, or equivocal information.
- Portability (since September 2024) — receive your information in a structured, commonly used technological format.
- Withdrawal of consent — with future effect.
- Cease dissemination and de-indexation — under the conditions provided by the Act.
- Erasure — when purposes are achieved or consent is withdrawn.
- Information on automated decisions — Syndic+ does not make any, but you may request confirmation.
- Complaint — to the CAI (cai.gouv.qc.ca).
9. Subprocessors and data residency
The up-to-date list of our subprocessors and processing zones appears in section 5 of our Privacy Policy. Before adding any new subprocessor, we perform a PIA and, when the addition affects processing already ongoing for existing customers, we notify in advance.
10. Accountability and audit
We maintain timestamped audit logs (retained 12 months) for all sensitive operations: administrative login, role change, data export, account deletion, finance access. Incident reports, PIAs, and subprocessor reviews can be audited by an enterprise customer under a confidentiality agreement.
11. Filing a complaint
We prefer to resolve concerns directly. Write to us at confidentialite@syndicplus.ca and expect a response within 10 business days. If our response does not satisfy you, you may file a complaint with Quebec's Commission d'accès à l'information (cai.gouv.qc.ca, 1 888 528-7741) or, depending on your jurisdiction, the Office of the Privacy Commissioner of Canada (priv.gc.ca).