GDPR COMPLIANCE

Article 1 — Scope of Application

This compliance policy with the General Data Protection Regulation (Regulation (EU) 2016/679, hereinafter the "GDPR") applies to the processing of personal data of natural persons located in the European Union (EU) and the European Economic Area (EEA) who access the website nhchosting.ca or use the services of North Hosting Canada Inc.

Although North Hosting Canada Inc is a Canadian company, it acknowledges the applicability of the GDPR in accordance with its Article 3, paragraph 2, when it offers goods or services to persons located in the EU/EEA or when it monitors the behaviour of such persons.

Article 2 — Data Controller

The data controller for personal data within the meaning of Article 4, paragraph 7, of the GDPR is:

• Legal name: North Hosting Canada Inc (12051672 Canada Inc)
• Address: 410-9160 Boulevard Leduc, Brossard, QC J4Y 0E3, Canada
• Email: admin@nhchosting.ca
• Phone: +1.514.297.3022

Article 3 — Legal Bases for Processing

In accordance with Article 6 of the GDPR, North Hosting Canada Inc processes personal data on the basis of one or more of the following legal bases:

1. Performance of a contract (Art. 6, par. 1, al. b): Processing is necessary for the performance of the web hosting services contract, domain name registration or any other service subscribed to by the data subject, or for the implementation of pre-contractual measures taken at their request.
2. Legal obligation (Art. 6, par. 1, al. c): Processing is necessary for compliance with a legal obligation to which North Hosting Canada Inc is subject, particularly in tax, accounting or connection data retention matters.
3. Legitimate interests (Art. 6, par. 1, al. f): Processing is necessary for the purposes of the legitimate interests pursued by North Hosting Canada Inc, such as fraud prevention, IT system security, service improvement and commercial communications, provided that such interests do not override the fundamental rights and freedoms of the data subject.
4. Consent (Art. 6, par. 1, al. a): Where processing is based on the consent of the data subject, particularly for sending commercial communications or using non-essential cookies. Consent may be withdrawn at any time without affecting the lawfulness of processing based on consent given prior to its withdrawal.

Article 4 — Data Collected and Purposes

North Hosting Canada Inc collects and processes the following categories of data for the purposes indicated:

4.1 Identification Data

Last name, first name, postal address, email address, phone number — for the creation and management of your customer account, service delivery and communications related to your account.

4.2 Payment Data

Credit card information, transaction data — for payment processing and billing. Payment data is processed by PCI-DSS certified payment providers.

4.3 Technical Data

IP address, browser type, operating system, pages visited, timestamps — for system security, statistical analysis and website improvement.

4.4 Communication Data

Support tickets, emails, correspondence history — for processing your requests and improving customer service.

4.5 WHOIS Data

Information required by domain name registries — for the registration and management of domain names in accordance with ICANN policies and national registries.

Article 5 — Rights of Data Subjects

In accordance with Articles 15 to 22 of the GDPR, any data subject located in the EU/EEA has the following rights:

1. Right of access (Art. 15): You have the right to obtain confirmation as to whether or not personal data concerning you is being processed and, where it is, access to such data as well as the information provided for in Article 15.
2. Right to rectification (Art. 16): You have the right to obtain the rectification of inaccurate personal data concerning you without undue delay. You also have the right to have incomplete data completed.
3. Right to erasure — "right to be forgotten" (Art. 17): You have the right to obtain the erasure of your personal data without undue delay, subject to the exceptions provided for by the GDPR, particularly where processing is necessary for compliance with a legal obligation.
4. Right to restriction of processing (Art. 18): You have the right to obtain the restriction of processing in the cases provided for in Article 18, particularly where you contest the accuracy of the data.
5. Right to data portability (Art. 20): You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, and to transmit it to another data controller.
6. Right to object (Art. 21): You have the right to object at any time, on grounds relating to your particular situation, to the processing of your data based on legitimate interest. You may also object to the processing of your data for direct marketing purposes at any time.
7. Right not to be subject to automated decision-making (Art. 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

To exercise any of these rights, please send your request by email to admin@nhchosting.ca, specifying your identity and the right you wish to exercise. We undertake to respond to your request within one (1) month of receipt, in accordance with Article 12, paragraph 3, of the GDPR.

Article 6 — Data Transfers Outside the European Union

Personal data collected from persons located in the EU/EEA is transferred to and stored in Canada, where the servers and head office of North Hosting Canada Inc are located.

This transfer is governed by the European Commission's adequacy decision of December 20, 2001 (Decision 2002/2/EC), which recognizes that Canada provides an adequate level of protection for personal data within the meaning of Article 45 of the GDPR, in the context of commercial activities subject to the Personal Information Protection and Electronic Documents Act (PIPEDA).

North Hosting Canada Inc undertakes to:

• Store data in datacentres located in Canada;
• Implement appropriate technical and organizational security measures to protect transferred data;
• Ensure that any sub-processor with access to the data provides sufficient guarantees in accordance with Article 28 of the GDPR.

Article 7 — Data Protection Officer

For any questions regarding the protection of your personal data or to exercise your rights, you may contact our Data Protection Officer:

• Email: admin@nhchosting.ca
• Postal address: North Hosting Canada Inc — Data Protection, 410-9160 Boulevard Leduc, Brossard, QC J4Y 0E3, Canada
• Phone: +1.514.297.3022

Article 8 — Cookies and Tracking Technologies

The Website uses cookies and similar technologies. In accordance with Article 5, paragraph 3, of Directive 2002/58/EC (ePrivacy Directive) and the GDPR:

8.1 Strictly Necessary Cookies

These cookies are essential for the operation of the Website (session, authentication, security). They do not require your consent.

8.2 Analytical Cookies

These cookies (e.g., Google Analytics) allow us to measure website traffic and analyze navigation. They are only placed with your prior consent.

8.3 Functionality Cookies

These cookies allow us to remember your preferences (language, region). They are placed with your consent.

You can manage your cookie preferences at any time through your browser settings. Disabling certain cookies may affect the operation of the Website.

Article 9 — Data Retention Period

Personal data is retained for the period necessary for the purposes for which it was collected:

• Customer account data: for the duration of the contractual relationship and up to three (3) years after account termination;
• Billing data: for the period required by applicable tax and accounting obligations (generally six (6) years);
• Connection data and logs: for a maximum period of twelve (12) months;
• Backups: up to nine (9) months after account termination;
• Commercial prospecting data: until consent is withdrawn or for three (3) years from the last contact.

Upon expiry of these periods, data is deleted or irreversibly anonymized.

Article 10 — Complaints to a Supervisory Authority

If you believe that the processing of your personal data constitutes a violation of the GDPR, you have the right to lodge a complaint with a competent supervisory authority, in accordance with Article 77 of the GDPR.

You may in particular contact:

• In France: Commission Nationale de l'Informatique et des Libertés (CNIL) — www.cnil.fr
• In another Member State: The supervisory authority of your habitual residence, your place of work or the place of the alleged infringement.

However, we encourage you to contact us first at admin@nhchosting.ca so that we may attempt to resolve your concern directly.

Article 11 — Concordance with Quebec's Law 25

As a Quebec-based company, North Hosting Canada Inc is also subject to the Act to modernize legislative provisions as regards the protection of personal information (Law 25, 2021, chapter 25), which amends in particular the Act respecting the protection of personal information in the private sector (RLRQ, c. P-39.1).

Quebec's Law 25 provides for obligations similar to the GDPR, including:

• The designation of a person responsible for the protection of personal information;
• The conduct of privacy impact assessments (PIAs);
• The obligation to report confidentiality incidents to the Commission d'accès à l'information du Québec (CAI);
• The right to data portability;
• Express, free and informed consent for the collection and use of personal information;
• The right to de-indexation (digital right to be forgotten).

The rights conferred by Law 25 apply to all users, regardless of their place of residence. For any request related to Law 25, please contact admin@nhchosting.ca.

Article 12 — Changes to This Policy

North Hosting Canada Inc reserves the right to modify this GDPR compliance policy at any time. Any substantial modification will be communicated to data subjects by email or by a visible notice on the Website. The version in effect is the one published on the Website at the date of your consultation.

We invite you to regularly consult this page to stay informed of any changes.