Skip to content
FR CRM Login Book a demo

Privacy Policy

Last updated: October 20, 2026

This page sets out Maubius’s personal information protection policy, as well as how our website uses cookies and the information sent through the demo request form. In case of discrepancy, the French version prevails.

1. Purpose

This policy (the “Policy”) sets out the general principles adopted by Maubius (the “Organization”) for the collection, use, disclosure, retention and destruction of personal information, in accordance with applicable personal information protection laws. It defines how responsibilities are shared among the people who apply the principles set out in the Policy.

2. Scope

The Policy applies to all employees, agents and service providers of the Organization, in particular those involved in handling personal information as part of their employment, mandate or service contract.

3. Definitions

The following definitions apply to the Policy.

3.1 Act: means the laws and regulations governing the protection of personal information in the private sector, including Quebec’s Act respecting the protection of personal information in the private sector and substantially similar laws in Canada, as well as any other applicable law or regulation governing the collection, use, disclosure or any other handling of Personal Information.

3.2 Confidentiality incident: means access to, use of or disclosure of Personal Information not authorized by the Act, as well as its loss or any other breach of its protection.

3.3 Serious injury: means an act or event likely to harm the person concerned or their property and to adversely affect their interests in a non-negligible way. It may lead, for example, to identity theft, fraud, a danger to life or safety, damage to reputation or autonomy, harassment, financial loss, negative consequences on a credit record or loss of employment.

3.4 Personal information: means any information that relates to a natural person and allows that person to be identified, directly or indirectly. This includes information in any form (written, graphic, audio, visual, computerized or other), including name, age, identification numbers, marital status, income, ethnic origin, location data, IP addresses, cookies, political opinions, religious beliefs, performance reviews, disciplinary measures, employee files, credit files, medical files, etc.

Any information concerning the performance by the person concerned of a duty within an organization, such as their name, title and duties, as well as the address, email address and telephone number of their place of work, is Personal Information of a public nature.

3.5 Sensitive personal information: means any information that, due to its medical, biometric or otherwise intimate nature, or due to the context of its use or disclosure, entails a high level of reasonable expectation of privacy. Examples include health, biometric or banking information, sexual orientation, ethnic origin, political opinions, religious beliefs, etc.

3.6 Person in charge of the protection of Personal Information (the “Privacy Officer”): means the person with the highest authority within the Organization, or the person to whom that function has been delegated in writing.

4. General principles

4.1 Accountability for the protection of Personal Information

The Organization is responsible for protecting the Personal Information it collects, uses, discloses, retains and destroys in the course of its activities.

The Privacy Officer ensures compliance with applicable legislation on the protection of Personal Information. In particular, this person is responsible for implementing the Policy and for ensuring that it is known, understood and applied by the people involved in handling this information.

4.2 Consent

As a general rule, the Organization collects Personal Information directly from the person concerned and with their consent, unless the Act provides for an exception.

Consent may be implied or express. When a person chooses to provide their Personal Information after receiving the information required by the Act (for example, through the privacy policy on the Organization’s website), they are presumed to consent to its use and disclosure for the purposes stated therein.

Consent given by a person to the use and disclosure of their Personal Information must be manifest, free and enlightened, given for specific purposes and for each of those purposes, understandable, given for a limited time, and requested separately from any other information in a written document.

As a general rule, the consent of the person concerned must be obtained before collecting their Personal Information from third parties, before disclosing it to third parties, or for any secondary use. However, the Organization may act without consent in certain cases provided for by the Act and under the conditions it sets out.

Subject to applicable legal and contractual restrictions, the persons concerned may withdraw their consent to the disclosure or use of the information collected.

4.3 Collection

Collection is the point at which Personal Information is gathered, created or inferred. It may be carried out by various means from the person concerned, such as a verbal request, a paper form or digitally.

The Organization collects only the Personal Information needed to fulfil the purposes determined before collection, based on a serious and legitimate interest.

In certain situations, the Organization may also collect Personal Information from third parties without the consent of the person concerned, where the Act allows it. It may do so, in particular, if the collection is in the person’s interest and cannot be made from them in a timely manner, or if the collection is necessary to ensure that the information is accurate.

Finally, the Organization may collect Personal Information indirectly, notably through third parties (for example, service providers).

4.4 Access and use

The Organization has put measures in place to limit access to Personal Information to people within the Organization who are entitled to know it and who need it to perform their duties.

The Organization ensures that the information it holds is up to date and accurate when used to make a decision about the person concerned.

The Organization may use a person’s Personal Information only for the reasons given at the time of collection. Whenever it wishes to use this information for another purpose, new consent must be obtained from the person concerned, and that consent must be express in the case of Sensitive Personal Information.

The Organization may use information for secondary purposes without the consent of the person concerned in the following cases, when the use:

  1. is for purposes consistent with those for which it was collected;
  2. is clearly for the benefit of that person;
  3. is necessary to prevent and detect fraud or to assess and improve protection and security measures;
  4. is necessary to supply or deliver a product or provide a service requested by the person concerned; or
  5. is necessary for study, research or statistical purposes and the information is de-identified.

4.5 Disclosure

As a general rule, the Organization obtains the consent of the person concerned before disclosing their Personal Information to a third party, unless an exception is set out in the Policy or otherwise provided for by the Act. In addition, where consent is required and Sensitive Personal Information is involved, the express consent of the person concerned is obtained before the information is disclosed.

However, disclosing Personal Information to third parties is sometimes necessary. Personal Information may therefore be disclosed to third parties without the consent of the person concerned in certain cases, including but not limited to:

  1. The Organization’s attorneys;
  2. The Director of Criminal and Penal Prosecutions, if the information is required for the prosecution of an offence under a law applicable in Quebec;
  3. A person or body responsible by law for preventing, detecting or repressing crime or statutory offences who requires it in the performance of their duties, if the information is necessary for the prosecution of an offence under a law applicable in Quebec;
  4. A person to whom the information must be disclosed under a law applicable in Quebec or for the application of a collective agreement;
  5. A public body (such as the government) that, through one of its representatives, collects it in the exercise of its functions or the implementation of a program under its management;
  6. A person or body with the power to compel its disclosure who requires it in the performance of their duties;*
  7. A person to whom the disclosure must be made because of an emergency threatening the life, health or safety of the person concerned;*
  8. A person, if the information is needed to collect a debt owed to the Organization;*
  9. Service providers to whom the information must be disclosed, without the person’s consent (for example, cloud service providers).* In this case, a written contract must be entered into with the provider, specifying the following:
    • the measures the provider must take to protect the confidentiality of the information disclosed;
    • that the information must be used only to perform the contract;
    • that the provider may not keep the information after the contract expires;
    • that the provider must notify the Privacy Officer of any breach or attempted breach of the confidentiality obligations regarding the information disclosed;
    • that the provider must allow the Privacy Officer to carry out any verification relating to confidentiality obligations.
  10. The other party, when the disclosure is necessary to conclude a commercial transaction to which the Organization intends to be a party, subject to a written agreement containing the provisions required by the Act.*

Before a document or file containing Personal Information is disclosed to a third party without the consent of the person concerned, the Privacy Officer is consulted to ensure the disclosure complies with the Act. The Privacy Officer records disclosures made under the paragraphs marked with an asterisk in a register or other appropriate place.

Personal Information held by the Organization may need to be disclosed outside Quebec, for example when using cloud service providers hosted outside Quebec. In that case, a privacy impact assessment (“PIA”) must be carried out to ensure the Personal Information is adequately protected in the jurisdiction concerned. The disclosure must also be covered by a written agreement with the third party that takes into account, in particular, the results of the PIA and, where applicable, the terms agreed upon to mitigate the risks identified.

4.6 Retention

Unless a minimum retention period is required by the Act or applicable regulations, the Organization keeps Personal Information only for as long as necessary to fulfil the purposes for which it was collected, in accordance with its document retention schedule.

Personal Information is kept in the following places, depending on its nature and medium:

  1. Paper: in locked filing cabinets accessible only to authorized persons;
  2. Digital: in cloud solutions whose access is protected by a strong password and two-factor authentication where available.

4.7 Destruction

At the end of the retention period, or when Personal Information is no longer needed, the Organization destroys it or anonymizes it (that is, it irreversibly no longer allows the person to be identified and it is no longer possible to link the person to the Personal Information) to use it for serious and legitimate purposes.

Destruction is carried out securely so that the Personal Information cannot be recovered or reconstructed. The procedure for destroying Personal Information is as follows:

  1. Paper: it must be completely shredded;
  2. Digital: it must be completely deleted from devices (computers, phones, tablets, external hard drives), servers and cloud solutions.

The Policy may be supplemented by any procedure adopted by the Organization regarding the retention and destruction of Personal Information, where applicable.

4.8 Privacy impact assessment (PIA)

A PIA is a preventive process required by the Act to protect Personal Information and respect individuals’ privacy. It consists of considering all the factors that will have a positive or negative impact on the privacy of the persons concerned.

The Organization carries out a PIA for any project to acquire, develop or overhaul an information system (for example, implementing a new CRM or a computerized human resources management system) or electronic service delivery involving the collection, use, disclosure, retention or destruction of Personal Information.

It also carries out a PIA before disclosing Personal Information for study, research or statistical purposes without the consent of the persons concerned, or before disclosing Personal Information outside Quebec.

4.9 Protecting the confidentiality of Personal Information

The Organization implements security measures to protect the Personal Information it manages. These measures must be reasonable given the sensitivity, purpose, quantity, distribution and medium of the information. This means that Sensitive Personal Information will be subject to stronger security measures and better protected.

The Organization applies physical, technical and organizational security measures, described in its security program.

Employees receive regular training on the Policy and on the risks associated with privacy breaches. This also includes awareness of good data security practices and the importance of following established procedures.

4.10 Handling requests and complaints

Any person whose Personal Information is collected, used, disclosed, retained or destroyed by the Organization has rights regarding that information and must be able to exercise them freely.

The Organization receives, reviews and responds to any request (e.g., access, correction, withdrawal of consent to the use and/or disclosure of Personal Information) and to any complaint made by a person concerned or authorized under the Act.

All requests and complaints must be sent to the Privacy Officer (see “Contact us”) and are handled in accordance with the Procedure for handling requests and complaints regarding personal information.

4.11 Managing confidentiality incidents

When the Organization has reasonable grounds to believe that a Confidentiality Incident has occurred, it takes reasonable measures to reduce the risk of injury and to prevent new incidents of the same nature.

If the Confidentiality Incident presents a risk of Serious Injury, the Organization promptly notifies, in writing, the Commission d’accès à l’information (“CAI”) and any person whose Personal Information is concerned.

Any report of a Confidentiality Incident must be sent to the Privacy Officer and is handled in accordance with the Procedure for managing a confidentiality incident involving personal information.

5. Roles and responsibilities

5.1 Employees, agents and service providers

  1. Preserve the confidentiality of Personal Information: all these persons must handle the Personal Information they obtain or have access to in the course of their employment, mandate or contract securely and responsibly, and keep it confidential at all times. This includes:
    • collecting only the Personal Information needed to perform a job, mandate or contract;
    • always making sure informed consent has been obtained from the person from whom the Personal Information is collected;
    • not disclosing to any unauthorized person the Personal Information of customers, employees or any other person dealing with the Organization;
    • not using such Personal Information for their own benefit or for the benefit of a third party or any other person, directly, indirectly, through an intermediary or otherwise;
    • keeping Personal Information in such a way that it cannot be accessed by unauthorized persons, in accordance with the Policy;
    • disposing of any waste paper containing Personal Information by shredding, and of any computer file by digital destruction and physical erasure, in accordance with the Policy;
    • returning, at the end of their employment, mandate or contract, any copy of Personal Information in their possession, in any form, subject to applicable document retention rules, and maintaining their duty of confidentiality regarding it, in accordance with the Policy.
  2. Report any Confidentiality Incident: any Confidentiality Incident occurring in the course of their employment, mandate or service contract must be reported immediately, regardless of its importance, extent or severity, in accordance with the confidentiality incident management procedure.
  3. Forward to the Privacy Officer, upon receipt, any request or complaint regarding Personal Information, in accordance with the procedure for access requests and complaint handling.

5.2 Privacy Officer

  1. Ensure compliance with and implementation of the Act within the Organization;
  2. Approve the policies and practices governing Personal Information that the Organization must establish and implement to protect that information;
  3. Prescribe Personal Information security measures for any project to acquire, develop or overhaul an information system or electronic service delivery involving Personal Information;
  4. Receive, review and respond to requests and complaints regarding Personal Information, and assist requesters as needed;
  5. Manage Confidentiality Incidents;
  6. Ensure employees are made aware of and trained on Personal Information protection obligations and practices.

6. Information collected by our website

Demo request form. When you request a demo, we collect your name, your dealership’s name, your job title, your mobile phone number, your email address, your preferred meeting format and your availability. This information is used only to schedule and hold the requested demo and to follow up on your request. It is sent by email to the Maubius team. The required fields are your name, your dealership’s name and your email.

Cookies and tracking technologies. Our website uses cookies and similar technologies. Some of these technologies can identify you, locate you or profile you. These features are turned off by default: they are only turned on if you accept them in the consent banner shown on your first visit. You can change or withdraw your consent at any time with the “Manage cookies” link at the bottom of every page.

Google and Meta may process this information outside Quebec, including in the United States.

7. Policy owner

The Privacy Officer is responsible for applying, reviewing and updating the Policy.

8. Contact us

For any question about the Policy, to exercise your rights of access and correction, to withdraw your consent or to file a complaint, contact Maubius’s Privacy Officer: