Text adopted October 27, 2026.
English version
1. Who we are and how to contact us
HR EXTERMINATION, operated by 9560-8576 QUÉBEC INC. (“we”), provides pest-management services and an application for managing customer and authorized-staff requests, visits and documents. This policy covers those activities, the portal and the proposed application at app.hrextermination.ca. Authentication providers and external services also explain their own processing in their policies.
For privacy questions, complaints, access or correction requests, write to info@hrextermination.ca, attention Ahad Ahmed Rahat, Person in charge of the protection of personal information. Do not send passwords, full payment-card details or identity documents through ordinary email. Where necessary, we arrange a secure way to verify identity or receive documents, limited to what is needed.
2. Information we process
Depending on your relationship with us, we process:
- Identity and access: name, email, authentication identifier, invitation status, role, permissions and customer-record association. Google sign-in supplies authorized basic identity, email and profile information; it does not give us access to your Gmail, contacts, calendar or Drive.
- Contact and service location: telephone, address, relevant property details, authorized contacts, ordinary visit arrangements without access codes or security secrets, and information needed to prepare and safely perform a visit. Limit information about occupants and avoid unnecessary medical details.
- Service and evidence: requests, pest issues, inspections, quotes, acceptance and signatory names, appointments, personnel, findings, products and treatments, quantities, device locations, recommendations, follow-ups, relevant photos and attachments, document versions and change history.
- Administration: invoices, taxes, deposits, manually recorded payment amounts/methods/references, complaints, communications and feedback. The reviewed configuration records payments manually and does not process online card payments.
- Staff and technical operation: assignments, work hours and timers, audit events, and connection/technical logs processed by hosting and authentication services, including IP addresses, timestamps and browser characteristics where those services record them.
We receive information from you, people authorized to manage the property or record, our personnel and necessary technical providers. Anyone submitting another person's information must have appropriate authority; this does not remove our own collection obligations.
Application collection rule
The Railway-hosted application must not be used to intentionally collect or store sensitive or special-category personal information. Necessary customer contact details, service addresses, pest/service history, invoices, ordinary notes and ordinary relevant treatment/property photographs remain permitted. Do not submit unnecessary medical information, government IDs, banking/card credentials, passwords, security credentials, access codes, intimate information unrelated to pest control, unnecessarily revealing private photographs or other information sensitive by context. Review notes and files, crop or redact unnecessary details before sending, or omit the file. If sensitive information seems necessary, consult the privacy lead before entering it; consultation does not create an exception allowing storage in this application.
3. Purposes and choices
We limit information to what is necessary to answer requests, arrange and perform agreed services, protect visit safety, manage access and scheduling, document treatments, prepare documents and billing, resolve complaints, secure systems and meet obligations. Some information is necessary for service or secure access; we explain the effects of refusal without requiring excessive collection.
Where consent is required, we seek it for specific purposes separately from general terms acceptance. Sensitive information receives the safeguards and express consent required by law, unless an applicable exception permits otherwise. You may withdraw consent prospectively by contacting us; this does not erase lawful earlier processing or mandatory retention. We do not sell personal information or use service records for behavioural advertising. Advertising use of identifiable photographs would require separate authorization.
4. Cookies, drafts, maps and automation
Authentication uses cookies and session technologies. The app also uses device local storage and IndexedDB for preferences, drafts and files awaiting synchronization. These copies may remain after sign-out; avoid shared devices and contact us to remove them without losing unsynchronized work. Official records are those saved on the server, not device drafts alone.
The reviewed route interface defaults to a list. Selecting map view loads Google Maps with a service address; opening a route or navigation link sends the necessary addresses to Google, which applies its own terms and may process technical information. We did not identify continuous GPS tracking in this version; a new location feature would require separate review and notice. Login identifiers are not used for advertising profiles. Tax calculations, internal reminders and access controls are not an automated credit or employment eligibility decision. Any future exclusively automated decision subject to legal requirements would receive the required notice and opportunity for human intervention.
5. Access and providers
Authorized personnel receive access appropriate to their duties; customers should access only their own records and approved documents/files. Internal notes are not intended for the customer portal. Necessary information may be shared with authorized service personnel, professional advisers, insurers, authorities where permitted or required, and providers subject to appropriate confidentiality and security obligations.
The independent architecture uses Clerk for authentication, Google for selected sign-in and maps, Railway for the app, PostgreSQL and private files, and the operator's private Google Drive for an encrypted backup copy. Existing business email uses Purelymail. This does not mean the app automatically sends email/SMS: those business integrations are not enabled in the reviewed configuration. Future messaging/payment activation requires appropriate review and disclosure.
6. Processing outside Quebec
Providers may process or permit access to information outside Quebec, including the United States, under those jurisdictions' laws. We do not promise Quebec-only or Canada-only storage. Before communicating information outside Quebec or entrusting processing to an outside provider, we must perform the required privacy impact assessment, evaluate contractual safeguards and enter appropriate agreements. This policy does not substitute for that assessment or presume its result.
7. Retention and security
We follow the approved retention schedule, distinguishing tax records, pesticide registers, contract evidence, security information and working copies. Unneeded information is securely destroyed or lawfully anonymized, subject to legal requirements or documented holds. De-identification is not equivalent to anonymization.
We restrict access, protect transfers, separate secrets from backups and control retained copies. No system guarantees absolute security. Backups may contain earlier information until scheduled expiry; they are not reused as active files, and approved deletions must be reapplied following restoration. Removing account access does not automatically remove legally required records.
8. Your rights, complaints and incidents
You may request confirmation of information held about you, access, correction and, where provided by law, cessation of dissemination, de-indexing or portable delivery of computerized information collected from you, excluding created or inferred information, subject to legal limits. A company-wide export is not an appropriate response to an individual request. We protect others' rights and explain applicable exceptions, refusals, arrangements and review rights in writing. Quebec-law access/correction requests must receive a response within 30 days after receipt. Other complaints receive appropriate follow-up without an arbitrary promised deadline.
You may contact the Commission d’accès à l’information du Québec (cai.gouv.qc.ca); the Office of the Privacy Commissioner of Canada may have jurisdiction over PIPEDA-covered activities. For incidents, we take required protective steps, assess risk, maintain a register and promptly notify the Commission and affected people where a risk of serious injury requires it. Not every incident requires a public notice.
9. Minors, languages and changes
Contractual accounts are intended for adults or authorized representatives. We do not solicit children's information. If a child's information is needed for a service, particular consent and minimization rules apply, including those for children under 14. Property photographs should not unnecessarily include children or personal documents.
This policy is available in French and English. After adoption, we display its version/effective date and give appropriate notice of material changes. Changing this text alone does not authorize a new purpose; required notices and consent must precede the relevant processing.