Privacy Policy

This Privacy Policy describes how Captain.Legal collects, uses, discloses, retains and protects your personal information, in accordance with Canada's Personal Information Protection and Electronic Documents Act (“PIPEDA”) and, in Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25. It explains the choices available to you regarding your personal information and how you may contact us.

Captain Legal LLC, the publisher of the site, is the organisation responsible for the personal information collected through this website. In accordance with PIPEDA and Quebec's Law 25, we have designated a Privacy Officer responsible for ensuring our compliance with applicable privacy laws. For any question, to make a request, or to contact our Privacy Officer, please use our contact form.

“Personal information” means information about an identifiable individual. We only collect the personal information necessary for the purposes described below:

• Identification data: email address, first name, last name
• Data entered in forms: information needed to generate a document (which may relate to third parties, under your responsibility)
• Order and billing data: documents purchased, amount, date, history
• Payment data: processed directly by PayPal and Stripe; we never access your full payment card details
• Technical and connection data: IP address, access logs, pages visited, session duration

Under PIPEDA and Law 25, we collect, use or disclose your personal information only with your knowledge and consent, or where collection, use or disclosure without consent is permitted or required by law. By providing your personal information to us and using our services, you consent to the collection, use and disclosure of your personal information for the purposes set out in this Policy.

Consent may be express or, where appropriate and consistent with the sensitivity of the information, implied. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting us through our contact form; we will inform you of the likely consequences of withdrawal before processing your request.

In accordance with the identifying-purposes and limiting-collection principles under PIPEDA and Law 25, we collect, use and disclose your personal information only for the purposes identified to you at or before the time of collection:

• Processing and delivering your order, and sending your invoice
• Managing your account and the customer relationship
• Retaining invoices to meet our legal and tax obligations
• Security, fraud prevention and service improvement
• Marketing communications and non-essential cookies — with your consent, withdrawable at any time

Your personal information is never sold. It may be disclosed to service providers acting on our behalf and bound by confidentiality and data-protection obligations: PayPal and Stripe (payments), OVH SAS (hosting), an email delivery provider, technical and analytics providers. Personal information may also be disclosed where permitted or required under PIPEDA, Law 25 or any other applicable law, or at the request of a competent authority.

Where we transfer personal information for processing outside Canada, we remain accountable for it and use contractual or other means to ensure a comparable level of protection while the information is being processed by a third party. Hosting is carried out within the European Union by OVH SAS. Where required by Law 25, we conduct a privacy impact assessment before transferring personal information outside Quebec.

In accordance with the limiting-retention principle, we retain personal information only as long as necessary to fulfil the identified purposes or to meet legal requirements, after which it is destroyed or anonymised:

• Account data: up to 3 years after the last activity
• Order and billing data: 10 years (legal obligation)
• Data entered in forms: for the time of the service, unless linked to an order
• Marketing data: 3 years from the last contact
• Connection data: 12 months

After these periods, personal information is deleted or anonymised.

In accordance with the safeguards principle, we implement reasonable security measures (HTTPS/TLS encryption, access control, secure hosting, PCI-DSS compliant payment providers) appropriate to the sensitivity of the information to protect your personal information against loss or theft and unauthorised access, disclosure, copying, use or modification. In the event of a breach of security safeguards involving a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada (OPC) — and, in Quebec, the Commission d'accès à l'information — and affected individuals, as required by law.

Under PIPEDA and Law 25 you have the right to request access to the personal information we hold about you and an account of how it has been used or disclosed, and the right to request correction of any inaccurate, incomplete or out-of-date information. Quebec residents also benefit from rights to data portability and to the de-indexing of certain information.

To exercise these rights, submit a request through our contact form. We will respond within the statutory time limit. Access requests are generally provided at minimal or no cost; we will inform you in advance of any applicable fee.

We send commercial electronic messages only in accordance with Canada's Anti-Spam Legislation (CASL), based on your express or implied consent, and every such message identifies us and includes a working unsubscribe mechanism. You may opt out of our marketing communications at any time through that mechanism or through our contact form.

Our site uses cookies whose nature, purpose and duration are detailed in our Cookie Policy. Non-essential cookies are only set after obtaining your consent, which you may withdraw at any time.

The site is not intended for children. We do not knowingly collect the personal information of minors without the consent of a parent or guardian. Where consent is required from a minor, we rely on the consent of the person having parental authority.

This policy may be modified at any time; the date of the latest update is shown at the top of the document. For any question, to contact our Privacy Officer, or to make a complaint, please use our contact form. You may also file a complaint with the Office of the Privacy Commissioner of Canada (OPC) or, in Quebec, with the Commission d'accès à l'information (CAI).