Governance Policies and Practices for Personal Information
Studio Envol · Effective [À COMPLÉTER : date d’entrée en vigueur] · Last updated: October 28, 2026
This page explains, in plain language, the rules Studio Envol follows to protect personal information, from collection to destruction. We publish it as required by section 3.2 of the Act respecting the protection of personal information in the private sector. It complements our privacy policy, which explains what information we collect, why and who we share it with.
Studio Envol is a sole proprietorship. Our rules are therefore simple and proportionate to the nature and scope of our activities, as the law provides.
Who is in charge
Théo Isabel, founder of Studio Envol, is the person in charge of the protection of personal information. The law gives this role to the person with the highest authority in the enterprise; at Studio Envol, that person is Théo Isabel. He ensures that the law is complied with and that these policies and practices are applied. To reach him:
- Email: studioenvol7@gmail.com
- Phone: 581-231-5444
- Mailing address: 2 Rue du Cosmos, Fermont, QC G0G 1J0
Roles and responsibilities, from collection to destruction
Théo Isabel is the only person at Studio Envol who has access to personal information. He is therefore responsible for every stage of the information’s life cycle:
- Collection: collect only the information that is needed and inform people at the time of collection, in particular through our privacy policy.
- Use: use information only for the purposes set out in our privacy policy, unless the person consents or the law requires otherwise.
- Access and security: protect information with reasonable security measures and allow no one else at Studio Envol to access it.
- Communication: share information only with the providers named in our privacy policy, for the purposes described there, unless the person consents or the law requires otherwise.
- Retention and destruction: apply the retention periods described below, then destroy the information.
- Requests and complaints: handle requests for access, rectification, withdrawal of consent and portability, as well as complaints.
- Incidents: assess any confidentiality incident, take the necessary measures and give the notices required by law.
- Providers and new projects: carry out the privacy impact assessments required by law (see below).
If another person ever needs access to the information (for example, an employee or a subcontractor), we will update this page to describe their role and responsibilities.
Retention and destruction
Here is how long we keep personal information:
- Requests from people who do not become clients (form, email, phone call, text message or Messenger): 6 months after our last exchange, then destruction.
- Client information: for the full term of the contract, then 6 years after the contract ends, then destruction.
If a law requires certain documents to be kept longer, that period applies. For example, Québec and Canadian tax laws generally require a business to keep its records and supporting documents (such as contracts, invoices and emails related to transactions) for 6 years after the end of the last year they relate to.
At the end of the retention period, we commit to destroying the information wherever we keep it: emails in Gmail (including the trash), submissions in the Web3Forms dashboard, text messages and call history on our phone, Messenger conversations on our Facebook Page, and any other document. We commit to doing so securely, in a way suited to the medium: permanent deletion of digital files and, where applicable, shredding of paper documents.
Some copies may, however, remain with our providers under their own rules, such as Google’s backup copies or data kept by Meta and TELUS. Our privacy policy describes what we know about their retention periods.
To do this, we commit to keeping an up-to-date list of the places where we keep personal information, including with our providers.
Providers, communication outside Québec and new projects
We use providers to run our website, our form and our means of communication. Our privacy policy names them. Several of them are located, or process information, outside Québec.
Before communicating personal information outside Québec, or entrusting a provider outside Québec with collecting, using, communicating or keeping it on our behalf, we commit to carrying out a privacy impact assessment. This assessment takes into account the sensitivity of the information, the purposes for which it will be used, the protection measures, including contractual ones, and the legal framework that applies where it would be communicated.
We commit to communicating information outside Québec only if this assessment shows that it would receive adequate protection, and to covering that communication with a written agreement, as required by law.
Before adopting or changing a tool or service that involves personal information, we also commit to assessing its privacy impacts, in a proportionate way, and to updating our privacy policy.
Security
We take reasonable security measures, suited to the sensitivity of the information, the purposes for which it is used, its quantity, its distribution and its medium. Our privacy policy describes the main measures in place.
Confidentiality incidents
A confidentiality incident is access to, use of or communication of personal information that is not authorized by law, or the loss of personal information or any other breach of its protection.
If we have reason to believe that an incident has occurred, Théo Isabel will take reasonable measures to reduce the risk of harm and to prevent a similar incident from happening again. To assess the risk, he will consider, in particular, the sensitivity of the information, the anticipated consequences of its use and the likelihood that it will be used for harmful purposes.
If the incident presents a risk of serious harm, we will promptly notify the Commission d’accès à l’information and the people affected.
We commit to recording every incident in a register, even if it does not present a risk of serious harm, and to keeping these records for at least 5 years after we become aware of the incident. If the Commission asks, we will send it a copy of this register.
These obligations remain ours even when the information is kept by a provider, such as Google or Web3Forms.
Handling complaints
Anyone can make a complaint about how Studio Envol protects their personal information. Here is how we handle complaints:
- You write to our person in charge, Théo Isabel, at studioenvol7@gmail.com or at our mailing address. Describe your concern and tell us how to reply to you.
- Théo Isabel reviews your complaint and replies in writing within 30 days of receiving it.
- If you are not satisfied with our reply, you can file a complaint with the Commission d’accès à l’information du Québec (CAI), in writing, using its online form: formulaire.cai.gouv.qc.ca. You can also file a complaint directly with the CAI about our practices, even anonymously.
This 30-day period is a commitment made by Studio Envol. It should not be confused with the 30-day legal deadline for access and rectification requests, described in our privacy policy.
We commit to taking the complaints we receive into account to improve our practices.
Access requests and other rights
Théo Isabel also handles requests to exercise your rights: access, rectification, withdrawal of consent and portability. He replies in writing to access and rectification requests within 30 days of receiving them, as required by law. Our privacy policy explains how to make a request.
Approval and updates
These policies and practices are approved by Théo Isabel, the person in charge of the protection of personal information, as required by law.
We commit to reviewing them when our activities, our providers or the law change, and to updating this page. The date of the last update appears at the top of this page.