Law 25 and your personal information.

Last updated: November 8, 2026

Quebec’s Law 25 modernized the protection of personal information in the private sector. This page summarizes, in plain language, the policy that governs how Karzen handles personal information. The details of what we collect and why are in our privacy policy.

Person in charge

The person in charge of the protection of personal information at Karzen is its President. Contact: hello@karzen.io, KARZEN Technologies Inc., Montréal, Quebec, Canada.

Roles and responsibilities

  • The person in charge sees that this policy is applied, answers requests and complaints, and approves privacy impact assessments.
  • Each team member only accesses the personal information their work requires, and is trained on these practices.
  • Service providers are bound by contract to protect the information and use it only for Karzen.

For shops that use Karzen

Each shop is responsible for the personal information of its own customers and staff. Karzen acts as its service provider: we keep the data on the shop’s PC, back it up encrypted in Canada, and only use it beyond that once de-identified and aggregated, to improve Karzen. The app helps shops meet their obligations, for instance by keeping internal notes off documents given to customers. A shop’s customer who wants to exercise a right should contact the shop; we help it respond.

Privacy by default

  • On karzen.io, tools that can identify, locate or profile visitors are off until the visitor agrees.
  • Usage data used to improve Karzen is de-identified first, and only shared as aggregated statistics.
  • Backups are encrypted on the shop’s PC before they leave it.

Privacy impact assessments

Before acquiring or building a system that handles personal information, and before communicating personal information outside Quebec, we assess the privacy risks and the protection it will receive, and we document the assessment.

Retention and destruction

We keep personal information only as long as needed for its purpose or as the law requires, then destroy or anonymize it securely. Retention periods are listed in our privacy policy.

Confidentiality incidents

If personal information is accessed, used, disclosed or lost without authorization, we act quickly to reduce the harm. We keep a register of every incident and, when there is a risk of serious injury, we notify the Commission d’accès à l’information and the people concerned.

Your rights

  • Be informed of what we collect, why, and who it is shared with.
  • Access your information and have it corrected.
  • Withdraw your consent.
  • Have the dissemination of your information stopped or a link de-indexed when the law allows.
  • Receive your information in a structured, commonly used technological format.

Requests and complaints

Send a request or a complaint about how we handle personal information to hello@karzen.io. We confirm receipt, may ask you to confirm your identity, and answer in writing within 30 days. If you are not satisfied, you can turn to the Commission d’accès à l’information du Québec.