Privacy policy

Who this policy covers

This policy applies to the two related enterprises that operate our activities: Groupe Écorécréo (which operates the Écorécréo, Aquazilla, Îlots76 and Patin Patin brands) and Voiles en Voiles. Whichever brand location you visit, this policy applies. Your information may be shared between these two enterprises, only for the purposes stated below.

Who is responsible

The person responsible for the protection of personal information for both enterprises is Jean-Philippe Duchesneau, designated in writing by each enterprise. For any question, request or complaint about your personal information: [email protected] or by mail at 350, rue St-Paul Est, bureau 300, Montréal (Québec) H2Y 1H2.

What we collect and why

When you sign a risk acceptance or rental waiver, we collect the information needed to identify the signatory and the participants, to establish valid consent, and to be able to prove it in case of an incident or claim: name, date of birth, email, phone, address, emergency contact, declared health conditions (only when the activity requires it, with your express consent given by checking the boxes yourself), signature, date and IP address. For surveys, we collect your ratings and comments. Marketing consent is separate, optional, and never checked by default.

Minors

Personal information about a minor under 14 is collected only with the consent of the holder of parental authority. Our forms require the parental consent confirmation for each child, and a group leader signing for a group certifies having obtained the parents' or guardians' consent.

Purposes

Managing risk acceptance and rental waivers; safety of participants; responding to a claim or incident; post-visit satisfaction surveys; and, only if you agree, sending you offers and news. We make no automated decisions about you and we never sell your information.

Who receives it, and where

Your information stays within our application, hosted in Montréal (Québec). Only anonymized aggregates (counts, averages, no personal information) are shared with our management dashboard. Some information is communicated outside Québec to service providers: Brevo (email service, France/European Union) receives your email address and first name to send confirmations and surveys; Dropbox (United States) stores our backups, which are encrypted in Québec before sending, so their content cannot be read; Cloudflare (international network) carries the site's traffic in transit, protected by TLS encryption. A privacy impact assessment has been carried out for these communications, as required by Québec's Law 25.

Cookies and similar technologies

This site uses only cookies that are strictly necessary for it to work: a session cookie, a security token, and a Cloudflare security cookie. Kiosk mode uses local storage on the device, without tracking. We use no advertising, analytics or tracking cookies, and no profiling or geolocation technology. This is why no cookie consent banner is displayed: there is nothing to consent to.

How long we keep it

By purpose: marketing data about 12 months; a signed risk acceptance 3 years after the visit (for a minor: until they reach adulthood, plus 3 years); group waivers 21 years after the activity date; surveys 24 months; internal audit logs 24 months. After the delay, the information is anonymized automatically, every day.

Your rights

You may ask, at any time and free of charge: to access your personal information; to receive it in a structured, commonly used technological format (portability); to have it corrected; to have it deleted; or to withdraw your marketing consent. Write to [email protected]. We respond within 30 days. If you are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

Security and incidents

Data is stored in Québec, protected by role-based access controls, encryption of off-site backups, signed links, an integrity seal on every signed waiver, and an audit log. A register of confidentiality incidents is kept, and incidents presenting a risk of serious injury are reported to the Commission d'accès à l'information and to the persons concerned, as required by law.