Last updated: May 16, 2026

Privacy Policy

This policy describes how Espace Global PME (operating the "CRM PME" service, the "Provider") collects, uses, discloses and protects personal information. It complies with Québec's Act respecting the protection of personal information in the private sector (Law 25 / Bill 64) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

Plain-language summary We collect the minimum needed to run your account. Your customer data stays in your private tenant. We host in Canada (Québec). We don't sell your data, we don't train AI on it, and you can request access, correction or deletion at any time.

1. Person responsible for personal information protection

In accordance with Law 25, the person responsible for the protection of personal information at Espace Global PME is:
Privacy Officer
Espace Global PME — Québec, Québec, Canada
Email: [email protected]

2. Two distinct roles: Provider vs Customer

The Provider operates in two distinct roles:

Controller for account information (information of the person who creates the account: name, email, company, billing details, IP at signup). The Provider determines the purpose and means of this processing.
Processor (custodian) for Customer Data (contacts, deals, quotes, invoices, files uploaded by the Customer). The Customer determines the purpose; the Provider only stores and serves this data on the Customer's behalf.

This policy primarily addresses our role as Controller. For our role as Processor, the Customer is responsible for its own privacy notice to its contacts.

3. What we collect (Controller role)

Account information: full name, email, hashed password (bcrypt), preferred language, IP address and user-agent at signup, two-factor authentication secret (if enabled).
Company information: company name, business number (NEQ, GST/QST) if entered, subscription plan, number of seats.
Billing information: invoices, payment receipts, Stripe customer ID. Card numbers are processed and stored by Stripe directly; we do not see or store them.
Usage logs: login timestamps, IP of login, browser, audit log of administrative actions (rate-limited, retained for security and compliance).
Support communications: email exchanges with our support team.

4. Why we collect it

Create and operate your account, authenticate you, secure your access.
Bill your subscription and process payments via Stripe.
Notify you about your trial, your invoices, security events and product updates.
Provide technical support and resolve incidents.
Comply with our legal and tax obligations.
Detect and prevent fraud, abuse and security threats.

5. Legal basis (PIPEDA) and consent (Law 25)

We rely on the following legal bases:

Performance of contract (operating the Service after signup).
Compliance with legal obligations (tax records, security incidents).
Legitimate interest (fraud prevention, security monitoring, product improvement on aggregated/anonymized data only).
Explicit consent (marketing emails after signup — you can withdraw consent at any time via the unsubscribe link).

6. Cookies and similar technologies

We use strictly necessary cookies for authentication (Laravel session cookie, CSRF token) and analytics cookies are used only on the public landing pages (crmpme.ca) to count visits. No advertising or tracking cookies. No third-party cross-site tracking.

7. Who we share with (third parties)

We share personal information with the following processors strictly to operate the Service:

OVH Cloud Canada — hosting (Beauharnois, Québec).
Stripe Inc. — payment processing (data may transit through the United States but billing data of Canadian customers is kept in Canadian/EU regions where possible).
Mailjet (Sinch Email) — transactional emails (login notifications, password reset, billing emails).
Cloudflare Inc. — CDN, DDoS protection, DNS.

We never sell or rent personal information. We do not share information with advertisers. We do not allow our processors to use the data for their own purposes.

8. International transfers

Primary hosting and Customer Data reside in Canada (Québec). Some processors (Stripe, Cloudflare, Mailjet) may process data outside of Canada (typically United States and European Union). These transfers are made under contractual data protection clauses comparable to those required by Law 25 and PIPEDA. A more detailed list is available upon written request.

9. Retention

Active account data: retained as long as the account is active.
After cancellation: a backup of the tenant is kept for 90 days (Law 25 evidence requirement), then permanently destroyed.
Billing records: 7 years (Québec/Canada tax retention requirements).
Audit logs: 24 months.
Support email exchanges: 24 months.

10. Your rights (Law 25 / PIPEDA)

Subject to applicable conditions and exceptions, you have the right to:

Access the personal information we hold about you.
Correction of inaccurate or incomplete information.
Withdraw consent for marketing communications at any time.
Deletion (cessation of dissemination, de-indexation) when permitted by law.
Portability — receive your information in a structured, commonly used format.
Object to automated decision-making — we do not engage in fully automated decision-making having a significant effect on individuals.
File a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

To exercise these rights, write to [email protected]. We will respond within 30 days.

11. Security

We apply technical and organizational measures including: HTTPS/TLS in transit, encrypted backups, bcrypt password hashing, optional 2FA, role-based access control, database isolation between tenants, security monitoring, principle of least privilege, employee confidentiality obligations. In the event of a personal information breach that poses a real risk of serious harm, we will notify affected individuals and the Commission d'accès à l'information without delay, in accordance with Law 25.

12. Children

The Service is intended for businesses and is not directed at individuals under 14. We do not knowingly collect personal information from children.

13. Changes to this policy

We may update this policy. Material changes will be notified by email at least 30 days before they take effect. The most current version is always published at this URL.

14. Contact

Espace Global PME — Privacy Officer
Québec, Québec, Canada
Email: [email protected]