DNS\u00a0maintains\u00a0internal governance policies, including access controls, privacy impact assessments where applicable, employee confidentiality obligations, and vendor due diligence.<\/span>\u00a0<\/span><\/p>

We have\u00a0designated\u00a0a person responsible for the protection of personal information (“PRP”), who also serves as Data Protection Officer (“DPO”). This function is held by the person with the highest authority at DNS,\u00a0in accordance with\u00a0Law 25.<\/span>\u00a0<\/span><\/p>

Privacy complaints are handled by the compliance team and escalated where necessary to legal counsel. DNS will investigate and respond to all privacy-related complaints within 30 days as required under Law 25.<\/span>\u00a0<\/span><\/p>

\n\t\t\t\t
\n\t\t\t\t\t
3. Information We Collect <\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tDNS\u00a0collect only the information necessary\u00a0to\u00a0fulfil\u00a0legitimate business purposes\u00a0in accordance with\u00a0consent and applicable laws.\u00a0We\u00a0do not knowingly collect personal information from minors under age 14. If such information is discovered, it will be securely\u00a0deleted\u00a0unless retention is legally required.\u00a0<\/span>\u00a0<\/span>\n\nIn situations where your consent is\u00a0required, DNS will ask for it explicitly. You may withdraw your consent at any\u00a0time, unless\u00a0we are legally required to\u00a0retain\u00a0certain\u00a0information.<\/span>\u00a0<\/span>\n
\n \t
Information You Provide\u00a0Directly<\/span><\/b>\u00a0<\/span>\n
\n
Name, email address, phone number <\/li>\n
Company, job title <\/li>
Information submitted through forms, contracts, or support requests <\/li>
Account credentials when registering for services <\/li>\n<\/ul>\n<\/li>\n \t
Information from Third Parties<\/span><\/b>\u00a0<\/span>
\n
Service providers, vendors, or partners assisting us with IT, analytics, or marketing activities <\/li>\n<\/ul><\/li>\n<\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
4. Purpose of Processing <\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
We process personal information for the following purposes:<\/span>\u00a0<\/span><\/p>
To provide,\u00a0maintain, and improve our products and services<\/span>\u00a0<\/span><\/li><\/ul>
To communicate with customers, partners, and vendors<\/span>\u00a0<\/span><\/li><\/ul>
To\u00a0fulfil\u00a0contractual and legal obligations<\/span>\u00a0<\/span><\/li><\/ul>
To protect against unauthorized access, misuse, or security incidents<\/span>\u00a0<\/span><\/li><\/ul>
To\u00a0comply with\u00a0audit and record-keeping requirements under ISO 27001 and Law 25<\/span>\u00a0<\/span><\/li><\/ul>
\u00a0<\/span><\/p>
Access is limited to employees and\u00a0authorized\u00a0sub-contractors based on the least privilege principle.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
5. Legal Basis for Processing <\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
DNS processes personal information only when a lawful basis applies under Law 25 and applicable privacy laws. These include:<\/span>\u00a0<\/span><\/p>
Consent \u2014 when you voluntarily provide information or authorize processing (e.g., forms, cookies, newsletters, marketing communications, or account registration).<\/span>\u00a0<\/span><\/li><\/ul>
Contractual necessity\u00a0\u2014\u00a0when processing is\u00a0required\u00a0to provide access to DNS services,\u00a0maintain\u00a0accounts, support customers, or fulfil contractual obligations.<\/span>\u00a0<\/span><\/li><\/ul>
Legitimate business interests\u00a0\u2014\u00a0when processing is\u00a0required\u00a0for internal operations (e.g., fraud prevention, product analytics, security monitoring, or service improvement) and when such interests do not override an individual’s privacy rights.<\/span>\u00a0<\/span><\/li><\/ul>
Legal or regulatory obligations\u00a0\u2014\u00a0when DNS must\u00a0retain\u00a0or disclose information to\u00a0comply with\u00a0tax laws, audit requirements, legal requests, or incident reporting obligations.<\/span>\u00a0<\/span><\/li><\/ul>
\u00a0<\/span><\/p>
Where consent is the lawful basis, it is freely given, informed, and revocable at any time. DNS evaluates the legal basis for each processing activity and uses contract or legitimate interest instead of consent whenever consent is not legally required, to ensure transparency and minimize consent fatigue.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
6. Retention and Destruction <\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Personal information is\u00a0<\/span>retained<\/span>\u00a0only as long as necessary for the purposes\u00a0<\/span>stated<\/span>\u00a0above or as required by law.<\/span>\u00a0<\/span>Retention schedules are managed through DNS\u2019s\u00a0<\/span><\/span>Information Retention and Disposal Policy<\/span>.<\/span><\/span>\u00a0Once no longer needed, data is securely\u00a0<\/span>deleted<\/span>\u00a0or anonymized.<\/span><\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
7. Security Measures <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
DNS applies administrative, technical, and physical safeguards to protect personal information, including:<\/span>\u00a0<\/span><\/p>
Encryption in transit and at rest<\/span>\u00a0<\/span><\/li><\/ul>
Role-based access controls and least-privilege principles<\/span>\u00a0<\/span><\/li><\/ul>
Multi-factor authentication<\/span>\u00a0<\/span><\/li><\/ul>
Regular vulnerability and risk assessments<\/span>\u00a0<\/span><\/li><\/ul>
Secure data-handling and disposal procedures<\/span>\u00a0<\/span><\/li><\/ul>
Privacy by design \u2014 privacy requirements are integrated into the development and procurement of systems and processes from the outset,\u00a0in accordance with\u00a0Law 25<\/span>\u00a0<\/span><\/li><\/ul>
\u00a0<\/p>
These controls are reviewed and tested as part of our\u00a0ISMS\u00a0and\u00a0Law 25 privacy governance program.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
8. Your Rights <\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Under\u00a0<\/span>Loi 25<\/span><\/b>\u00a0and applicable privacy laws, you have the following rights:<\/span>\u00a0<\/span><\/p>
Right of access<\/span><\/b>\u00a0\u2014\u00a0to know whether we hold personal data about you and obtain a copy.<\/span>\u00a0<\/span><\/li>
Right to rectification<\/span><\/b>\u00a0\u2014\u00a0to correct inaccurate or incomplete information.<\/span>\u00a0<\/span><\/li>
Right to withdraw consent<\/span><\/b>\u00a0\u2014\u00a0to stop processing where consent is the legal basis.<\/span>\u00a0<\/span><\/li>
Right to data portability<\/span><\/b>\u00a0\u2014\u00a0to receive your data in a structured format, when applicable.<\/span>\u00a0<\/span><\/li>
Right to deletion (erasure)<\/span><\/b>\u00a0\u2014\u00a0to request deletion of your data where retention is no longer justified.<\/span>\u00a0<\/span><\/li>
Right to be informed of automated decision-making<\/span><\/b>, if applicable.<\/span>\u00a0<\/span><\/li>
Right to file a complaint<\/span><\/b>\u00a0\u2014\u00a0you may file a complaint with the Commission\u00a0d’acces\u00a0a\u00a0l’information\u00a0du Quebec (CAI) at\u00a0<\/span>www.cai.gouv.qc.ca<\/span><\/a>\u00a0if you believe your privacy rights have not been respected.<\/span>\u00a0<\/span><\/li><\/ul>
\u00a0<\/p>
Data portability requests may be sent through:\u00a0<\/strong><\/span>NextIT Portability Request<\/a>.\u00a0<\/strong><\/p>
All other requests may be sent to\u00a0<\/span>security@datanextstep.com<\/a>.\u00a0<\/strong><\/p>
We will\u00a0respond to all requests within 30 days of receiving the information required to process them,\u00a0in accordance with\u00a0applicable law.\u00a0Additional\u00a0time may be\u00a0required\u00a0where\u00a0permitted\u00a0by law, in which case you will be notified.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
9. Disclosure of Personal Information <\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
We do not sell or rent your personal information. Disclosure occurs only when:<\/span>\u00a0<\/span><\/p>
Required by law or court order<\/span>\u00a0<\/span><\/li><\/ul>
Necessary for service delivery by authorized third-party providers\u00a0(such as hosting providers, authentication services, analytics platforms, payment processors, and customer support tools), under\u00a0written agreements ensuring confidentiality and security<\/span>\u00a0<\/span><\/li><\/ul>
Explicit consent has been obtained<\/span>\u00a0<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
10. International Transfers <\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Data Next Step primarily stores data in Canada.<\/span>\u00a0<\/span><\/p>
Prior to any transfer of personal information outside Quebec, DNS conducts a Privacy Impact Assessment (PIA \/ Evaluation des\u00a0facteurs\u00a0relatifs\u00a0a la vie\u00a0privee\u00a0\u2013 EFVP) to evaluate the level of protection offered in the destination\u00a0jurisdiction. Transfers\u00a0proceed\u00a0only when\u00a0appropriate protection\u00a0is confirmed and are governed by written agreements with the receiving party, as required under Law 25.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
11. Cookies and Tracking Technologies <\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Our website uses cookies for functionality and analytics. Non-essential cookies (including analytics and marketing cookies) are only placed with your prior, explicit consent, obtained through our consent management tool before any such cookies are set.<\/span>\u00a0<\/span><\/p>
You may withdraw or\u00a0modify\u00a0your consent at any time through the cookie preference\u00a0center\u00a0available on our website. Note that disabling certain cookies may affect site functionality. Essential cookies\u00a0required\u00a0for the operation of the site do not require consent.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
12. Incident Response and Breach Notification <\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
In the event of\u00a0a privacy or security incident involving personal information, DNS will follow its\u00a0<\/span>Incident Response Plan\u00a0and, where required by Law 25, notify the Commission\u00a0<\/span>d\u2019acc\u00e8s\u00a0\u00e0\u00a0l\u2019information\u00a0du Qu\u00e9bec (CAI) and affected individuals\u00a0within applicable statutory timelines.<\/span>\u00a0<\/span><\/p>
DNS\u00a0maintains\u00a0a confidentiality incident register\u00a0in accordance with\u00a0its obligations under Law 25.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
13. Updates to this Policy <\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. The updated version will be posted on our website with a revised “Effective Date.”<\/span>\u00a0<\/span><\/p>
For material changes to this Policy, DNS will provide advance notice via email or a prominent notice on our website. Where required by law, renewed consent will be\u00a0sought\u00a0before such changes take effect.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
14. Contact Us <\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
If you have questions or wish to exercise your privacy rights, please contact:<\/span>\u00a0<\/span><\/p>
Data Next Step<\/span><\/b>\u00a0
Attn: Data Protection Officer<\/span>\u00a0
security@datanextstep.com<\/span><\/a>\u00a0
https:\/\/datanextstep.com<\/span><\/a>\u00a0<\/span><\/p>
In the event that<\/span>\u00a0any discrepancy exists between the English\u00a0original\u00a0version\u00a0of the privacy policy\u00a0and the French version;\u00a0the English version\u00a0shall prevail.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"
Effective Date:\u00a0April 1, 2026\u00a0 Last Updated:\u00a0April 1, 2026\u00a0 1. Purpose and Scope Data Next Step (\u201cDNS\u201d,\u00a0\u201cwe\u201d,\u00a0\u201cour\u201d,\u00a0or \u201cus\u201d) is committed to protecting the privacy of all individuals whose personal information we collect and process\u00a0in the course of\u00a0our operations.\u00a0 This Privacy Policy explains how\u00a0DNS\u00a0collects, uses,\u00a0retains, discloses, and protects\u00a0personal information\u00a0in accordance with:\u00a0 Quebec\u2019s Act to modernize legislative provisions […]<\/p>","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"open","template":"elementor_header_footer","meta":{"footnotes":""},"class_list":["post-3","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/dev.dns.mtlti.com\/fr\/wp-json\/wp\/v2\/pages\/3","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.dns.mtlti.com\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/dev.dns.mtlti.com\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/dev.dns.mtlti.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.dns.mtlti.com\/fr\/wp-json\/wp\/v2\/comments?post=3"}],"version-history":[{"count":10,"href":"https:\/\/dev.dns.mtlti.com\/fr\/wp-json\/wp\/v2\/pages\/3\/revisions"}],"predecessor-version":[{"id":9726,"href":"https:\/\/dev.dns.mtlti.com\/fr\/wp-json\/wp\/v2\/pages\/3\/revisions\/9726"}],"wp:attachment":[{"href":"https:\/\/dev.dns.mtlti.com\/fr\/wp-json\/wp\/v2\/media?parent=3"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

9. Disclosure of Personal Information <\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\t\t\t\t\tWe do not sell or rent your personal information. Disclosure occurs only when:<\/span>\u00a0<\/span><\/p>