PIPEDA & Law 25 compliance

• PIPEDA / LPRPDE (federal):Canada's Personal Information Protection and Electronic Documents Act applies to commercial activities across provincial and international borders.
• Quebec Law 25 / Act respecting the protection of personal information in the private sector: applies to all private-sector organizations operating in Quebec that collect information about Quebec residents.

Both frameworks apply to Mariez. Where they conflict, we apply the standard most protective of individuals.

Mariez designates a privacy officer responsible for compliance with Law 25 (Art. 3.1). This officer oversees compliance, handles rights requests, manages incidents and maintains the register of processing activities. Contact: privacy@mariez.ca. Response time: 30 days.

We collect only the personal information necessary for the declared purposes: operating wedding planning features, managing accounts, processing subscriptions and providing customer support. Each data field has a documented purpose. We do not collect sensitive information (health data, ethnic origins, political opinions) without explicit consent. Purposes are communicated before or at the time of collection.

• Explicit consent is required for: account creation, non-essential cookies and marketing communications.
• Implied consent applies to: essential features of the subscribed service.

Consent may be withdrawn at any time — withdrawal does not affect past processing. We do not use consent obtained through deceptive practices or under duress.

Pursuant to Art. 17 of Law 25, a Privacy Impact Assessment (PIA) is conducted before any transfer of personal information outside Quebec. The following providers involve transfers to the United States:

• Supabase — database and file storage (AWS us-east servers).
• Stripe — payment processing (US and Canadian servers).
• Resend / Sendgrid — transactional email delivery (US servers).
• PostHog — behavioural analytics (US servers).

Data processing agreements (DPAs) with contractual privacy protections are in place with each provider. Data is transferred only to the extent necessary to deliver the service.

We apply TLS 1.2+ encryption in transit and AES-256 encryption at rest. Access to personal data follows the principle of least privilege. We log and monitor access, and detect anomalies. All service providers are bound by contract to equivalent confidentiality and security obligations and may only use personal information for the authorized service purposes.

You may exercise the following rights by emailing privacy@mariez.ca. We respond within 30 days.

• Access (Art. 27): obtain a copy of your personal information held by Mariez.
• Rectification: correct inaccurate or incomplete information.
• Withdrawal of consent: withdraw consent for a specific processing activity with future effect.
• Erasure (Art. 28): request deletion of personal information collected for purposes that are no longer necessary, subject to legal exceptions.
• Portability (Art. 27): receive your personal information in a structured, commonly used and machine-readable technological format.
• De-indexing (Art. 28.1): request the cessation of dissemination or the de-indexing of information about you published online.

Identity verification may be required. Legal exceptions apply (e.g., tax obligations, public security).

We maintain an internal register of all confidentiality incidents as required by Law 25 (Art. 8.1). When an incident presents a serious risk of harm:

• We notify the Commission d'accès à l'information (CAI) within 72 hours.
• We notify affected individuals as quickly as possible.
• Corrective measures are documented and applied promptly.

Pursuant to Law 25, a Privacy Impact Assessment is conducted before: any new project involving sensitive personal information; any transfer of personal information to a new provider outside Quebec; any material change to processing systems. PIA findings inform design and deployment decisions.

If you believe your rights have not been respected, you may file a complaint with the Commission d'accès à l'information du Québec (CAI) for Quebec obligations, or the Office of the Privacy Commissioner of Canada (OPC) for federal obligations. We encourage direct contact at privacy@mariez.ca first.