Privacy policy

Privacy Policy

La Forfaiterie

Last updated: April 20, 2026

By browsing our website or using our systems or services, you acknowledge that you have read and understood this policy. Where we use your personal information for purposes that require your consent, we will ask for that consent separately, in a clear and distinct manner.

This policy applies to La Forfaiterie and its travel agency division. It is intended to clearly inform you of our practices with respect to the protection of personal information, in accordance with Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25).

Note: This English version is provided for your convenience. In the event of any discrepancy between the French and English versions, the French version shall prevail.

1. Objectives of the privacy policy

Respect for privacy and the protection of personal information are essential to us. Through this policy, we aim to protect that information in accordance with applicable laws, including Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25.

La Forfaiterie is committed to collecting, processing and sharing information that identifies an individual only when that person has consented, unless otherwise permitted or required by law, in which case your consent is not required.

The purpose of this policy is to inform users of the reasons for, and the manner in which, La Forfaiterie — or any person acting on its behalf — will collect and use their personal information. It is written in plain language to support informed consent.

For the purposes of this policy, "personal information" means any information that concerns a natural person and allows, directly or indirectly, that person to be identified. Wherever possible, we anonymize, pseudonymize or aggregate that information so that it no longer identifies a person.

2. Effective date

This policy is effective as of April 20, 2026, and replaces all previous versions, including the version dated June 4, 2024.

3. Person in charge of the protection of personal information

In accordance with Law 25, La Forfaiterie has designated a person in charge of the protection of personal information. This person ensures compliance with and implementation of this policy, handles requests for access, rectification, withdrawal of consent, and complaints.

Person in charge of the protection of personal information:

Mylène Sabourin

La Forfaiterie

107, 1re Avenue, Stoneham (Quebec) G3C 0L3

Phone: 418 780-6484, ext. 2104

Email: [email protected]

4. Personal information we collect

We collect only the information necessary for the purposes described in this policy, in accordance with the principle of data minimization. The nature and sensitivity of the information vary depending on the context of our interactions with you.

4.1 Contact and identity information

First name, last name, mailing address, email address, phone number, language of communication.

4.2 Credentials and account access

Login credentials, passwords, password hints and other security information used to identify you and give you access to your account.

4.3 Demographic data

Information such as your age, gender, country and region, where that information is necessary for the services requested (particularly for travel bookings).

4.4 Payment data

Information necessary to process transactions. Full credit card numbers are not stored on our servers; they are processed by our payment providers, which comply with PCI-DSS standards.

4.5 Travel-related data (travel agency)

For services provided by our travel agency division: passport information, dates of birth, travel preferences, dietary and medical restrictions relevant to the booking, loyalty program membership numbers. This information is collected only to the extent necessary to provide the requested service.

4.6 Images and sound

Audiovisual data captured by video surveillance in our retail locations and at events we organize, for the purpose of safeguarding people and property.

4.7 Interaction and browsing data

Order and purchase history, search queries, content of communications with our customer service, error reports, text and input data you provide. Approximate location data inferred from your IP address or provided by your profile (city, postal code).

4.8 Information collected through technological means

Data automatically collected through our website: IP address, browser type and version, operating system, pages visited, time spent, referring site, analytics data (Google Analytics and similar tools). See section 8 for details about cookies.

5. Purposes of collection and processing

We collect and process your personal information for the following purposes. Each purpose is distinct and, where the law requires, is subject to separate consent.

5.1 Primary purposes (necessary to provide our services)

•      Process your gift package orders, travel bookings and other purchases.

•      Manage your customer account and give you access to our online services.

•      Communicate with you about your transactions, bookings, inquiries and after-sales service.

•      Share the information necessary with our partners and service providers to deliver the services you have booked (establishments, carriers, activities).

•      Process payments and prevent fraud.

•      Ensure the safety of people and property on our premises.

5.2 Legal and regulatory compliance purposes

•      Meet our legal obligations, including the Travel Agents Act and the requirements of the Compensation Fund for Customers of Travel Agents (FICAV).

•      Meet tax, accounting and record-keeping obligations.

•      Respond to lawful requests from competent authorities.

5.3 Secondary purposes (requiring separate consent)

The purposes below are pursued only with your express consent, obtained separately from the primary purposes. You may consent to some and not others, and you may withdraw your consent at any time.

•      Marketing and promotional communications (see section 7).

•      Personalization of experience and recommendations based on your preferences and history.

•      Profiling for advertising purposes (see section 9).

•      Satisfaction surveys and market research.

•      Targeted advertising on third-party sites (remarketing).

5.4 Service improvement

We use de-identified and aggregated data to analyze our operations, improve our products and services, identify usage trends and produce internal statistics. When these activities involve de-identified or anonymized personal information, no additional consent is required, in accordance with section 12 of the Act.

6. How we obtain consent

In accordance with Law 25, the consent we obtain is:

•      Clear (manifest): it results from a clear action on your part. Pre-ticked boxes, silence and inaction do not constitute valid consent.

•      Free: given without pressure. Declining consent to a secondary purpose has no impact on your ability to use our products and services.

•      Informed: we clearly inform you of the purposes, means of collection, categories of third parties involved, whether collection is mandatory or optional, and your rights.

•      Specific and granular: requested separately for each distinct purpose. You may accept some purposes and decline others.

•      Understandable: expressed in plain and simple terms.

If we wish to use your personal information for a new purpose that was not anticipated at the time of collection, we will inform you of that use and ask for your consent again.

You may withdraw your consent at any time, as easily as you gave it, by contacting our person in charge of the protection of personal information or by using the mechanisms provided (in particular the unsubscribe link in our emails).

Certain uses or disclosures do not require your consent, including where they are necessary to perform a contract, prevent fraud, comply with the law, or where information has been de-identified for internal study, research or statistical purposes.

7. Marketing communications and commercial prospecting

This section specifically describes how we use your personal information for marketing and commercial prospecting purposes. In accordance with Law 25, these uses are subject to separate, optional consent.

7.1 Types of marketing communications

With your consent, we may send you:

•      Newsletters featuring our gift packages, experiences and travel destinations.

•      Promotional offers, discounts and exclusive sales.

•      Invitations to events organized by La Forfaiterie or its partners.

•      Personalized recommendations based on your preferences and history.

•      Communications about new products, services or destinations that may be of interest to you.

7.2 Communication channels

Marketing communications may be sent by email, SMS, postal mail, phone, or via notifications in your customer account. You may consent to some channels and decline others.

7.3 How to give your consent

Consent to marketing communications is obtained by means of a non-pre-ticked box, separate from any other purpose, when you:

•      Create a customer account.

•      Make a purchase on our website or in-store.

•      Sign up for our newsletter.

•      Enter a contest or attend an event.

Declining consent to marketing communications has no impact on your ability to purchase our products or use our services.

7.4 How to withdraw your consent

You may withdraw your consent to marketing communications at any time, as easily as you gave it:

•      By clicking the unsubscribe link included in every marketing email.

•      By replying STOP to our SMS messages.

•      By updating your preferences in your online customer account.

•      By contacting our person in charge of the protection of personal information (contact information in section 3).

Consent withdrawals are processed as promptly as possible and are not retroactive: communications already sent before the withdrawal remain compliant.

7.5 Targeted advertising and remarketing

With your express consent, we may use targeted advertising technologies on third-party sites (such as Meta, Google, or other platforms) to show you La Forfaiterie advertisements tailored to your interests. This purpose is distinct from direct marketing communications and is subject to separate consent, in particular through the cookie consent banner described in section 8.

7.6 La Forfaiterie's commitment

We do not sell or rent your personal information to third parties for marketing purposes. Data used for marketing remains under our responsibility and is shared with service providers (e.g., newsletter delivery platforms) only as part of a contractually governed processing arrangement.

8. Cookies and similar technologies

Our website uses cookies and similar technologies (pixels, tags, log files) for various purposes. In accordance with Law 25, we inform you of their use and, for non-essential cookies, we seek your express consent before activation.

8.1 Cookie categories

Strictly necessary cookies: essential to the operation of the site (authentication, shopping cart, security). They do not require consent and are always active.

Performance and analytics cookies: help us understand how users interact with our site (Google Analytics, etc.). Disabled by default; activated only with your consent.

Functionality cookies: remember your preferences (language, region). Disabled by default; activated only with your consent.

Profiling and advertising cookies: track your browsing to display targeted advertising on our site or third-party sites (Meta Pixel, Google Ads, etc.). Disabled by default; activated only with your express consent.

8.2 Managing your cookie consent

On your first visit to our website, a consent banner allows you to accept, decline or customize your choice for each category of non-essential cookies. You may change your preferences at any time through the "Cookie preferences" link available in the footer.

You may also configure your browser to decline cookies or to notify you when cookies are being set. However, disabling cookies completely may affect some features of the site.

8.3 Links to third-party sites

Our site may contain links to third-party sites. This policy no longer applies once you leave our site. La Forfaiterie is not responsible for the collection or processing practices of these third parties.

9. Profiling and automated decision-making

9.1 Profiling for personalization and marketing

With your consent, we may analyze your interactions, preferences, purchase history and browsing data to:

•      Offer recommendations for packages, trips or gifts tailored to your interests.

•      Personalize your experience on our site.

•      Tailor our marketing communications to make them more relevant.

Technological functions that allow you to be identified, located or profiled are disabled by default. You choose whether to activate them through the consent banner or your account preferences.

9.2 Decisions based exclusively on automated processing

La Forfaiterie does not currently make decisions producing legal or significant effects with respect to you based solely on automated processing without human intervention.

If such a practice were introduced in the future, we would inform you no later than the time the decision is communicated to you. You would then have the right to:

•      Be informed of the personal information used to make the decision.

•      Know the reasons, main factors and parameters that led to the decision.

•      Request the rectification of the information used, if inaccurate.

•      Submit observations to a member of our staff who is able to review the decision.

9.3 Artificial intelligence

When we use artificial intelligence tools to analyze aggregated or de-identified data (for example, to identify purchase trends or improve our recommendations), we do so in accordance with the principles of data minimization and de-identification. Training data is, where possible, anonymized or aggregated.

10. Sharing with third parties and transfers outside Quebec

10.1 Sharing with third parties

We do not sell or rent your personal information. We share your information only in the following cases:

With your consent: when you expressly authorize us to share your information.

With our travel partners and service providers: hotels, carriers, activity operators and other providers necessary to deliver the services you have booked.

With our subcontractors: technical providers (cloud hosting, newsletter delivery platforms, payment tools, customer service) that process information on our behalf, under our instructions and subject to contractual arrangements requiring a level of protection equivalent to our own.

For legal reasons: where required by law, regulation, court order or a legitimate request from a competent authority.

As part of a commercial transaction: in the case of a merger, acquisition, asset sale or financing, subject to an agreement requiring confidentiality and limitation of use, in accordance with Law 25.

10.2 Transfers outside Quebec

Some of our providers (particularly for cloud hosting, marketing services and analytics tools) are located outside Quebec, sometimes outside Canada. In such cases, your personal information may be transferred and stored outside Quebec.

In accordance with Law 25, before any transfer outside Quebec, La Forfaiterie conducts a privacy impact assessment (PIA) to ensure that the information will benefit from adequate protection, taking into account:

•      The sensitivity of the information concerned.

•      The purposes for which it will be used.

•      The protection measures implemented by the recipient.

•      The legal framework applicable in the destination jurisdiction.

We enter into contractual arrangements with our providers outside Quebec to govern the protection of information. Despite these measures, you should be aware that information transferred may be subject to local laws and accessible to government authorities in those jurisdictions.

11. Security measures

La Forfaiterie implements reasonable technical, administrative and physical measures to protect personal information against loss, theft, unauthorized access, disclosure, copying, use or modification.

11.1 Technical measures

•      Encryption of data in transit (HTTPS/TLS) and at rest for sensitive information.

•      Payment processing by PCI-DSS-compliant providers.

•      Access controls, authentication and logging.

•      Regular security updates of our systems.

•      Backups and business continuity plans.

11.2 Administrative measures

•      Staff training on the protection of personal information.

•      Confidentiality agreements with employees and subcontractors.

•      Internal policies governing the collection, use, disclosure and destruction of information.

•      Access to information limited to staff who need it to perform their duties.

11.3 Limitations

Despite these measures, no method of transmission or storage is entirely secure. We cannot guarantee absolute security, but we are committed to acting diligently and to notifying you in the event of an incident presenting a risk of serious harm (see section 16).

12. Retention and destruction of personal information

We retain your personal information only for as long as necessary for the purposes for which it was collected or to meet applicable legal obligations.

12.1 Retention periods

12.2 Destruction and anonymization

Once the retention period has expired, personal information is securely destroyed or anonymized in accordance with best practices. Only statistics or analyses based on de-identified data may be retained for longer periods.

13. Roles and responsibilities of staff

Protecting personal information is a shared responsibility within La Forfaiterie.

Person in charge of the protection of personal information: approves policies and practices, oversees their implementation, handles access requests and complaints, participates in privacy impact assessments (PIAs), and coordinates incident response.

Management: ensures that the necessary resources are allocated to the protection of personal information and that the policies are embedded in operations.

Managers: ensure policies are applied within their teams, identify risks and report incidents.

Staff: handle personal information in accordance with policies, respect access controls and report any incident or concern without delay.

Subcontractors: are bound by contractual arrangements specifying their obligations regarding confidentiality, security and incident notification.

Staff receive initial and ongoing training on the protection of personal information.

14. Your rights

In accordance with Law 25, you have the following rights regarding your personal information.

14.1 Right of access

You may request access to the personal information we hold about you, learn its source, the categories of persons who have access to it and the period for which it is retained.

14.2 Right of rectification

You may request the correction of personal information that is inaccurate, incomplete or ambiguous.

14.3 Right to withdraw consent

You may withdraw your consent to any use or disclosure based on that consent, at any time, as easily as it was given.

14.4 Right to data portability

Since September 22, 2024, you may request to receive the computerized personal information that you have provided to us, in a structured, commonly used technological format, or request that it be transmitted to a third party of your choice, to the extent this is not technologically impossible.

14.5 Right to cease dissemination and to de-indexing

You may request that we cease disseminating personal information about you or de-index a hyperlink attached to your name that gives access to that information, where such dissemination causes you harm, contravenes the law or a court order, subject to the exceptions provided by law.

14.6 Rights regarding automated decisions

See section 9.2.

14.7 Right to file a complaint

You may file a complaint with our person in charge of the protection of personal information (see section 15) or directly with the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca).

14.8 How to exercise your rights

To exercise any of these rights, contact our person in charge of the protection of personal information (contact information in section 3). We will respond to your request within 30 days. For security purposes, we may need to verify your identity before processing your request.

Access to your personal information is free of charge. Reasonable fees for transcription, reproduction or transmission may apply; you will be informed of such fees in advance.

In certain circumstances provided by law, we may not be able to grant your request (for example, where access would reveal information about a third party). In such cases, we will notify you in writing with the reasons.

15. Complaint handling process

If you believe that we have not met our obligations regarding the protection of personal information, or if you are dissatisfied with a response we have provided, you may file a complaint.

15.1 Filing a complaint

Submit your complaint in writing to our person in charge of the protection of personal information (contact information in section 3), specifying:

•      Your name and contact information.

•      The nature of the complaint and the relevant facts.

•      Any supporting documents or evidence.

•      The outcome you seek.

15.2 Complaint handling

•      Acknowledgement of receipt within 10 business days.

•      Impartial review of the complaint by the person in charge.

•      A reasoned response within a reasonable period, no later than 30 days after receipt, save in exceptional circumstances.

•      Implementation of corrective measures where the complaint is founded.

15.3 Recourse to the Commission d'accès à l'information

If our response does not satisfy you, you may file a complaint with the Commission d'accès à l'information du Québec:

Website: www.cai.gouv.qc.ca

Phone: 1 888 528-7741

16. Privacy incidents

La Forfaiterie maintains a register of all privacy incidents and applies an incident management plan.

In the event of an incident involving personal information we hold, we take reasonable measures without delay to reduce the risk of harm and to prevent further incidents of the same nature.

Where an incident presents a risk of serious harm, we promptly notify the Commission d'accès à l'information and the persons concerned, in accordance with the requirements of Law 25.

17. Changes to this policy

We amend this policy from time to time to reflect changes in our practices, technologies, legislation, or for other operational, legal or regulatory reasons.

The last-updated date is shown at the top of the document. Any reduction of your rights will require your express consent. In the case of a significant change, we will post a prominent notice on our website and, where appropriate, notify you by email.

We encourage you to review this policy periodically.

— End of policy —