Privacy Policy

Last updated: April 23, 2026
Effective date: April 23, 2026

This policy explains how Steven Bourgoin Inc., doing business as Bourgoin Services Financiers ("we", "our", or "Bourgoin"), collects, uses, discloses, and retains personal information from visitors to bourgoin.ai, in accordance with Quebec's Act respecting the protection of personal information in the private sector (commonly known as Law 25) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

This English version is provided for convenience. In case of discrepancy, the French version prevails.

1. Privacy Officer

In accordance with section 3.1 of Law 25, we have designated a person responsible for the protection of personal information:

• Name: Steven Bourgoin
• Title: President, Steven Bourgoin Inc.
• Email: steven.b@bourgoinsf.com
• Mailing address: 241, rue des Balbuzards, Victoriaville (Québec) G6T 2K7

Any question, access request, rectification request, withdrawal of consent, or complaint regarding this policy must be directed to this person.

2. Information we collect

When you visit our site, we may collect the following categories of information:

2.1 Technical information (automatic)

• IP address (anonymized by Google Analytics before storage)
• Browser type and version, operating system, device type
• Screen resolution and preferred language
• Pages visited, time of visit, session duration, referring page
• Session identifier and client identifier (_ga cookie)
• Approximate geographic region (country, province, city), derived from IP address

2.2 Information you provide voluntarily

When you submit the "Dossier — Application for access" form on the homepage, we collect the following:

• First and last name
• Email address
• Phone number (optional)
• Type of mandate contemplated (tax strategy, wealth defense, strategic growth, transmission and succession, or global advisory)
• Free-text message describing your interest

Submitting the form is voluntary and constitutes your consent to the processing of this information for the purposes described in section 3. We recommend that you not include sensitive financial information in the "message" field: those exchanges will take place later via a secure portal once our collaboration is established.

If you email us directly at an address shown on the site, we collect the information you transmit (name, email address, message content, and any additional information you include).

3. Purposes of collection

We use your personal information only for the following purposes:

• Application review and initial contact: processing the information submitted via the "Application for access" form to evaluate your situation, contact you, schedule an initial briefing, and determine whether your case fits our approach.
• Traffic statistics: understanding how visitors use the site (most-viewed pages, referrers, time spent) to improve content and user experience.
• Security: detecting and preventing abuse, attacks, automated submissions, and fraud attempts (including via a "honeypot" decoy field).
• Communication: responding to questions you send us by email or through the form.
• Legal obligations: retaining the information necessary to meet our applicable legal, regulatory, and tax obligations as a financial services firm.

We do not engage in automated decision-making or marketing profiling. We do not sell or rent your personal information.

4. Means of collection: cookies and similar technologies

We use cookies and similar technologies. In accordance with Law 25, non-essential cookies (analytics, marketing) are activated only after your explicit consent, obtained via the consent banner that appears on your first visit.

4.1 Essential cookies

No essential cookies are currently set by the site itself. Our host (Netlify) may set technical cookies necessary for page delivery (attack protection, caching). These cookies do not identify you personally and are necessary for the site to function.

4.2 Analytics cookies (consent required)

Google Tag Manager (identifier GTM-KP7TN73Z) is used to load these cookies. Tag Manager itself does not set any persistent cookies.

5. Disclosure to third parties

We disclose certain information to the following providers, who act as agents and are bound by contractual confidentiality commitments:

• Netlify, Inc. — site hosting, content delivery network (CDN), and processing of "Application for access" form submissions (Netlify Forms service). Form submissions are stored in Netlify's infrastructure and transmitted to us by email. Netlify's privacy policy · Data protection commitments.
• Google LLC (Google Analytics 4, Google Tag Manager) — traffic statistics only, subject to your consent. Google's privacy policy.

We do not sell or rent your information. We do not disclose your information to any other party, except as required by law (e.g., court order) or with your express authorization.

6. Disclosure of information outside Quebec

Netlify's and Google's services process and store data on servers located primarily in the United States, and potentially in other countries where these providers operate data centers. This includes:

• Information submitted via the "Application for access" form (first name, last name, email, phone, mandate type, message), processed by Netlify Forms
• Technical logs and analytics data (if you have consented), processed by Netlify and Google

Before entrusting your information to these providers, we assessed the following factors, in accordance with section 17 of Law 25:

• The sensitivity of the information: low to moderate (identification and contact data voluntarily provided, without sensitive financial information)
• The purpose of use (hosting, form delivery, traffic statistics)
• The protection measures offered by the providers: HTTPS encryption in transit and encryption at rest, SOC 2 Type II certifications, GDPR compliance, standard contractual clauses, documented compliance programs
• The legal regime applicable in the destination jurisdiction

We consider that the information disclosed receives adequate protection. You may refuse disclosure for analytics purposes by refusing consent in the consent banner. If you do not want your form information processed outside Quebec, we invite you to contact us directly by email rather than through the form.

7. Retention and destruction

• Cookies in your browser: up to 24 months (see table in section 4.2). You can delete them at any time in your browser settings.
• Google Analytics data: retained for the period defined in our Google Analytics account (14 months by default), then irreversibly destroyed or anonymized.
• "Application for access" form submissions: retained for up to 24 months after last contact, then destroyed. If a service relationship is established, relevant information is transferred to our client files and retained in accordance with applicable legal, regulatory, and tax obligations applicable to a financial services firm in Quebec.
• Netlify access logs: approximately 30 days, then automatically purged.
• Emails you send us: retained as long as necessary to process your request and to meet our applicable legal, regulatory, and tax obligations.

8. Your rights

Subject to the exceptions provided by law, you have the following rights regarding your personal information:

• Right of access: obtain a copy of the information we hold about you.
• Right of rectification: request correction of inaccurate or incomplete information.
• Right to withdraw consent: withdraw your consent to analytics cookies at any time, without affecting the lawfulness of previous processing. To change your preferences, click "Cookie preferences" in the site footer.
• Right to de-indexation: request that the dissemination of information about you be stopped if it causes you serious harm.
• Right to portability (as of September 22, 2024): receive, in a structured and commonly used technological format, the computerized information you have provided to us.

9. How to exercise your rights

To exercise your rights, write to us at steven.b@bourgoinsf.com indicating:

• Your name and contact information
• The nature of your request (access, rectification, withdrawal, de-indexation, portability)
• The information covered by your request, with sufficient detail to identify it

We will respond to your request within a maximum of 30 days. No fees are charged, except if your request requires a transcription, reproduction, or special transmission, in which case we will inform you in advance of the amount requested.

We may ask you to prove your identity before acting on your request.

10. Complaint to the supervisory authority

If, after contacting us, you believe your rights have not been respected, you may file a complaint with the:

Commission d'accès à l'information du Québec (CAI)
Quebec City office: 525, boulevard René-Lévesque Est, Bureau 2.36, Québec (Québec) G1R 5S9
Montreal office: 2045, rue Stanley, Bureau 900, Montréal (Québec) H3A 2V4
Phone: 1 888 528-7741
Website: cai.gouv.qc.ca

11. Security of information

We have implemented reasonable technical and organizational measures to protect your personal information against loss, unauthorized access, disclosure, modification, or destruction. These include: HTTPS (TLS) encryption for all communications with the site, strict HTTP security headers (Content Security Policy, HSTS, clickjacking protection), and the choice of providers recognized for their security practices.

As no method of transmission or storage on the Internet is absolutely secure, we cannot guarantee absolute security. In the event of a confidentiality incident presenting a serious risk of harm, we will notify the CAI and the affected persons in accordance with the law.

12. Changes to this policy

We may modify this policy to reflect changes in our practices or in applicable regulation. The last-updated date appears at the top of the page. On a substantial change, we will display a notice on the site and, where appropriate, reset the consent banner to collect your agreement again.