This page explains, in plain terms, how Data Sciences Inc. manages the personal information it holds: who is responsible for it, how long we keep it, how we destroy it and how we handle complaints. Quebec’s Act respecting the protection of personal information in the private sector (section 3.2) requires us to publish this information.
Who is responsible
Our person in charge of the protection of personal information makes sure we comply with the law and answers any question, request or complaint.
- Title: Chief Executive Officer
- Email: compliance@datasciences.ca
- Mail: Data Sciences Inc., 780 Av. Brewster, Suite 2-130, Montréal, QC H4C 2K1
- Phone: 514-501-9100
Our rules apply to all the personal information we hold, on paper or in digital form: people who visit our websites, write to us or subscribe to our emails, job applicants, contacts at our clients and suppliers, and our staff. For information we process on behalf of our clients, for example in surveys, we also follow the rules in our contracts, and the client remains responsible for that information.
Our staff’s roles
Everyone who handles your information has specific responsibilities, from collection to destruction.
| Who | What they are responsible for |
|---|---|
| Chief Executive Officer | Making sure we comply with the law. The CEO is currently our person in charge of the protection of personal information. |
| Person in charge of the protection of personal information | Approving our policies, answering requests for access, correction and portability, handling complaints, managing privacy incidents and keeping our registers. Being consulted at the start of any technology project that involves personal information. |
| Managers | Limiting their team’s access to the information it needs, and applying our retention periods. |
| Operations manager and technology team | Putting security measures in place, setting retention periods in our tools and destroying data securely. |
| Human resources | Managing staff files and job applications. |
| Marketing and communications | Getting your consent for our emails and cookies, and respecting your choice to unsubscribe. |
| Client project teams | Using our clients’ information only for the work entrusted to us, then destroying or returning it. |
| All staff | Accessing only the information they need for their work, keeping it confidential, and reporting any incident, complaint or request to the person in charge without delay. |
How long we keep your information
We keep your information only as long as we need it for the purpose it was collected for, or longer if the law requires it. When that period ends, we destroy it or, in exceptional cases, anonymize it.
A few rules always apply:
- information used to make a decision about you, such as turning down a job application, is kept at least one year after the decision, as the law requires;
- if we refuse a request for access or correction, the information concerned is kept long enough for you to use your recourses;
- destruction is put on hold if the information is the subject of an ongoing request, complaint, investigation or legal case.
| Information | How long we keep it |
|---|---|
| Messages sent through our contact forms | 2 years after our last exchange |
| Unsuccessful job applications | 36 months |
| Staff files | As long as tax and employment laws require after employment ends |
| Business contact details of our clients, prospects and suppliers | 2 years after the business relationship ends or our last exchange |
| Email subscribers | Until you unsubscribe. After that, your address stays on an exclusion list so we keep respecting your choice. |
| Web analytics data | Up to 14 months |
| Advertising audiences (Google, Meta, LinkedIn) | Up to 14 months |
| Technical logs of our websites (IP address, browser) | Up to 30 days |
| Requests to exercise your rights, and complaints | 2 years after the file is closed |
| Privacy incident register | At least 5 years |
| Information we process on behalf of our clients | As set out in the contract, at the latest until the end of the mandate |
| Information received for research purposes | As set out in the research agreement |
How we destroy or anonymize your information
When the retention period ends, we destroy your information securely and permanently. Anonymization is the exception.
Destruction. Information is deleted permanently, including from trash folders, or shredded if it is on paper.
Providers. Our providers’ terms require them to delete or return our data at the end of the service.
Anonymization. Anonymized information can no longer identify anyone, irreversibly. We only anonymize for serious and legitimate purposes, such as statistics on how our websites are used, and we follow Quebec’s anonymization regulation: a re-identification risk analysis, periodic reassessment and an entry in our anonymization register. Our person in charge approves each anonymization beforehand. When in doubt, we destroy.
How to make a complaint
If you believe we mishandled your personal information, you can make a complaint. Every complaint receives a written answer from our person in charge.
Write to us
Send your complaint in writing to our person in charge, at compliance@datasciences.ca or by mail to the address above. Describe the situation and, if possible, the information involved. If you need help writing your complaint, our person in charge will help you.
Acknowledgment
We confirm receipt within 5 business days and tell you when to expect an answer. We may ask you to confirm your identity if the complaint is about your own information.
Review
Our person in charge reviews the facts with the teams involved and may ask you for details. Your complaint is handled confidentially.
Answer
You receive a written answer within 30 days of receipt. It explains our decision and any corrective measures. If we need more time, we tell you the new date.
If you’re not satisfied with our answer, you can contact the Commission d’accès à l’information du Québec or, where applicable, the Office of the Privacy Commissioner of Canada.
No one, including a member of our staff, faces retaliation for making a complaint in good faith.
Complaint or request? If you want to see, correct or get a copy of your information, that is a request to exercise your rights. We answer in writing within 30 days of receipt, and any refusal gives our reasons and your recourses. Access is free. If transcription, copying or sending fees apply, we tell you in advance.
Our other practices
Other rules guide our day-to-day work.
- Providers. Every provider that processes your information for us is bound by written terms: it must protect it, use it only to provide its service to us, and delete it at the end of the service.
- Where your information is stored. Our rule is to keep personal information in Canada whenever possible. The exceptions are listed in our privacy policy.
- Privacy incidents. Any incident is reported to our person in charge without delay, who takes steps to reduce the risk. If an incident creates a risk of serious harm, we promptly notify you, the Commission d’accès à l’information and, where the law requires it, the Office of the Privacy Commissioner of Canada. All incidents are recorded in our register.
- Automated decisions. We do not make decisions based solely on automated processing of your information without telling you and letting you submit your observations.
- Research and statistics. We only share or receive information without consent for research purposes under the conditions set by law, after a privacy impact assessment and an agreement sent to the Commission d’accès à l’information.
Updates
We update this page when our practices change. To learn more about the information we collect and your rights, see our privacy policy.
Last updated: Nov 11, 2026