01 — Selection principles
A provider receives only what its service requires.
Before assigning processing, we consider the nature and purpose of the information, confidentiality commitments, safeguards, incident handling, deletion, and possible processing locations. Contractual obligations are adapted to the provider’s role and risk.
Information may be processed in Canada, the United States, or another jurisdiction. Before processing outside Quebec, we assess relevant privacy factors and use reasonable contractual or organizational protections.
02 — Service categories
Functions that may rely on specialized providers.
| Category | Purpose | Possible information |
|---|---|---|
| Service operations | Provide accounts, retain records, process requested operations, and maintain availability. | Account, company, file, and technical information necessary for the service. |
| Artificial intelligence | Generate a requested answer, summary, draft, or assistance within an activated feature. | Limited instructions and context required for the request. |
| Communications | Deliver SMS, email, or notifications and report status. | Contact details, message content, status, time, and delivery information. |
| Booking and calendar | Display availability and organize an appointment. | Name, contact details, time zone, responses, and selected time. |
| Public website and security | Deliver the website, maintain availability, and prevent abusive use. | IP address, request, device, browser, and security event information. |
The identity and processing location of an active provider may be disclosed to a Customer with a legitimate compliance need, subject to applicable confidentiality and security measures.
03 — Customer-connected services
Some information moves because the Customer enables a connection.
An advertising platform, calendar, payment service, or other business tool may provide or receive information when the Customer connects it to Fondation Flow. The external service may act as a separate organization and its own terms continue to apply. The Customer is responsible for fields, notices, access, and consent.
04 — Changes and continuity
A material provider change is documented.
We may replace or add a provider to improve security, reliability, or functionality. The page date is updated when a material change affects personal information processing. Where an agreement requires it, the Customer receives notice and may exercise the stated remedy.
Privacy officer
A question, complaint, or access request?
Write to Fondation Flow’s privacy officer. We may need to confirm your identity before disclosing or correcting information.