Privacy Policy and Personal Information Protection

Privacy Officer and Contact Information

JonaTec is established in Quebec and may serve clients in Quebec and New Brunswick. It is responsible for the personal information it holds and applies the privacy obligations that govern it in the relevant context and territory. The privacy officer function is exercised by JonaTec management unless delegated in writing.

Contact: info@jonatec.ca.

Governance, roles and privacy complaints

JonaTec establishes and implements privacy governance policies and practices proportionate to its activities and covering the full lifecycle of personal information, including collection, access, use, disclosure, retention, destruction, service providers, confidentiality incidents and individual rights. These policies are approved and periodically reviewed by the Privacy Officer.

• Management / Privacy Officer: approves privacy policies, receives and handles access or correction requests and privacy complaints, participates in privacy impact assessments, oversees confidentiality incidents and corrective measures, and periodically reviews service providers and retention rules.
• Authorized personnel and technicians: access only the information needed for their duties, comply with confidentiality and security rules, avoid unnecessary copies and promptly report any incident or unusual access.
• Service providers: receive only the information necessary for the assigned service and are subject to applicable confidentiality, security and processing terms.

To submit a privacy complaint, write to info@jonatec.ca with the subject “Privacy complaint” and describe the facts, service or information concerned and how you can be reached. Sensitive documents do not need to be sent unless JonaTec requests them. The Privacy Officer records and acknowledges the complaint, reviews it impartially, may request information needed for the review, documents the findings and corrective measures, and provides a written response. Complaints are handled confidentially and without retaliation.

Information we may collect

We collect information directly when a client submits a form, calls, writes, signs a document, uses the portal or entrusts us with a device. We may also receive information from an authorized business contact, a provider selected by the client, or our payment and authentication providers.

Depending on the requested service, we limit collection to necessary contact, service, contract, invoice, signature, device, diagnostic and payment-status information. When the JonaTec Windows app is installed and linked to a client file, basic workstation telemetry may also include a technical device identifier, machine name, optional display name or assigned employee, Windows and agent versions, architecture, manufacturer/model/BIOS and device serial number when exposed by Windows, processor model, a graphics-adapter summary, memory-module count and summary, system-disk model/type/reported status, physical-disk inventory (name, type, capacity and, when Windows exposes them, health, temperature, wear and power-on hours), displays, printers and main peripherals, Secure Boot state, TPM presence/readiness, BitLocker protection state, disk and memory information, point-in-time processor usage, uptime and boot time, restart-required status, basic Microsoft Defender and Windows Firewall status, antivirus products reported by Windows Security Center (name, activation state and signature status), Windows Update status together with a limited count and summary of pending updates and recent failures, network-interface type, local IPv4 address, gateway and DNS servers, and, for Wi-Fi when exposed by Windows, the SSID and signal quality plus a limited technical history of observed connection losses (start, end, duration and associated network type/SSID when available). The agent may also transmit installed-software inventory (name, version, publisher and reported install date), the count of Windows startup items, last contact, current and historical technical status, alert reasons and lifecycle, JonaTec intervention mode, the history and summary result of predefined maintenance actions, and messages added to a device-linked support request. The detailed startup-item list stays local to the workstation: the user can disable or re-enable a compatible item with confirmation in a reversible way, while only the count is included in basic server telemetry. Local cleanup may include temporary files, error reports and safe technical caches; the Recycle Bin is emptied only when the user explicitly selects that option and confirms the action. The local performance diagnostic may read the names of the main running processes and their memory use to identify a slowdown; their arguments, windows, files and contents are not read or transmitted to the server. The agent does not transmit browsing history, personal-file contents or network-traffic contents, and it does not accept arbitrary commands or scripts supplied by the server. When JonaTec Protection is enabled, the agent may also transmit the active antivirus protection status, signature age, recent threat names/severity and technical status of a provisioned JonaTec VPN tunnel, including the selected server, assigned VPN address, latest handshake and technical transfer counters, so protection can be summarized in the portal and technical alerts can be raised. The WireGuard private key is generated locally on the workstation, protected by Windows and is never transmitted to JonaTec. This protection telemetry does not include the contents of network traffic or the contents of files scanned by the antivirus engine. If the client chooses to save a reusable signature in the portal, that signature is also stored for that optional purpose and is never applied automatically to a document. The portal may also keep internal logs of sign-ins and the opening of quotes, service or repair orders and invoices, including the date and time, the account concerned and the document reference. Required fields are needed to answer or perform the service; without them, JonaTec may be unable to process the request, create portal access, calculate travel, invoice or perform the work.

When the client voluntarily uses JonaTec Assistant and that feature is included and enabled for the applicable plan, the messages entered by the client, including the recent conversation context needed to continue an exchange, together with a limited, relevant technical context from the workstation may be sent to JonaTec’s artificial-intelligence service provider to generate first-line guidance. This context may include workstation health, Windows, network, security, printers and peripheral information needed for the diagnosis. The Assistant does not receive personal-document contents and is not allowed to execute arbitrary commands, scripts or remote actions. JonaTec configures OpenAI Responses API requests with application-state storage disabled (store:false); provider abuse-monitoring controls and retention remain governed by OpenAI's API data controls. JonaTec’s technical event history records that the Assistant was used and, where applicable, that escalation to JonaTec was suggested, without storing the full question text in that event log.

When the client explicitly enables optional identity monitoring, the email address already associated with the JonaTec account may be sent to Have I Been Pwned (HIBP), JonaTec’s current breach-intelligence provider, to check whether it appears in known data breaches. JonaTec may retain the monitoring state, last-check date, exposure references, breach date, affected domain, exposed-data categories and a calculated risk level needed to present useful results and create follow-up alerts. Where the provider plan and verifiable domains allow it, website domains associated with infostealer traces may also be returned. This integration does not return exposed passwords to JonaTec. The feature can be disabled from the application. JonaTec does not ask the client to provide banking, passport or other highly sensitive identity information for this monitoring feature.

JonaTec does not receive a full payment-card number or security code through its payment processor.

JonaTec Agent authorization and evidence

Before managed supervision is first activated on a device, JonaTec Agent presents a separate notice describing the categories of technical information transmitted, the purposes of monitoring, key exclusions and the right to withdraw authorization. The Agent does not transmit managed telemetry or accept managed remote actions until this authorization is active.

When authorization is granted, JonaTec may retain the notice version, cryptographic text hash, authorizing person’s name, date and time, source and an evidence hash in the device record. Authorization can be withdrawn from JonaTec Agent or the client portal; withdrawal pauses future managed telemetry and remote actions until the Agent is authorized again locally. Withdrawal alone is not an erasure request for information already retained.

For a business-owned or shared device, the person authorizing the Agent confirms that they have authority to do so. The business remains responsible for any notices it must provide to employees or other users of its devices.

How JonaTec Uses Personal Information

Information is used to answer requests, provide and document IT services, diagnose/configure/repair systems, manage quotes and payments, communicate about the client file, secure our systems, document portal access and document-opening activity for traceability, and, when JonaTec Agent is enabled, show linked workstations, recent online presence and basic technical status, associate support requests with the correct device, support preventive follow-up, and, when requested by an authorized JonaTec administrator, execute a maintenance action from the application’s fixed allow-list, present the device-protection state, provision and display the enabled JonaTec VPN connection, and, if identity monitoring is later enabled in production and the client opts in, check the account email against the configured breach-intelligence service and present known exposures and supported infostealer signals. Identity monitoring is not currently enabled in JonaTec's production environment. Where JonaTec Assistant is offered and used, information may also be used to provide first-line guidance from the client’s description and relevant technical context, suggest only simple and safe steps, and make it easier to create a JonaTec support request when human intervention is appropriate. It is also used to comply with legal/accounting obligations and protect legitimate rights.

Temporary device, file and account access

When an intervention requires access to files, accounts, settings or other personal information, JonaTec limits access to what is reasonably necessary for the requested service and its duration.

Where possible, the client enters their own passwords. Personal passwords are not stored in the service file. Any exceptional temporary access created for a service should be revoked or changed at the end of the mandate.

Consent and Privacy Choices

Where consent is required, it is requested for a specific purpose in clear language. Written consent requests concerning access to personal information are presented separately from general service terms. Consent may be withdrawn prospectively where the processing relies on consent, subject to legal requirements and the technical consequences of being unable to continue a service that requires access.

Service providers and transfers

JonaTec uses Vercel and Render for hosting, TiDB Cloud for the database, Supabase for authentication and private storage, Resend for transactional email, Stripe for online payments, Geoapify for address search and route calculations, Google Ads for campaign measurement, loaded only after express consent to optional measurement, Have I Been Pwned (HIBP) only if optional identity monitoring is put into production and enabled (it is not currently active in production) and, when the AI-based JonaTec Assistant is enabled, OpenAI to process recent conversation messages and the limited technical context needed to generate the response. Only information necessary for each mandate is shared, and required confidentiality/security terms apply. JonaTec does not sell or rent personal information for advertising.

Some providers may be located outside Quebec. Before communicating personal information outside Quebec, JonaTec completes the privacy impact assessment and written agreement required where applicable. The communication proceeds only if the assessment concludes that the information will receive adequate protection.

Security safeguards

JonaTec uses reasonable administrative, technical and physical safeguards based on the sensitivity, purpose, quantity, distribution and medium of the information. Access is limited to people who need it for their functions.

Retention and destruction

Information is retained only as long as necessary or required by law. JonaTec’s operating schedule normally reviews unconverted prospects after 12 months; ordinary operational service/quote records after 3 years; attachments linked to those records after 3 years through a manual review rather than automatic deletion; portal notifications after 12 months when read and no later than 24 months; completed, declined or expired remote-signature requests after 90 days while the final signed document is retained separately; a reusable signature voluntarily saved in the portal while the portal account remains active or until the client deletes it; and portal sign-in and document-opening logs, as well as ordinary administrative logs, after 24 months. Historical JonaTec Agent health samples are automatically deleted after 90 days, while the current state needed to manage an active workstation remains in its device record. Technical records for revoked JonaTec Agent workstations are also deleted automatically after 24 months; an active workstation remains linked while it has not been revoked or the client file has not been deleted. Separate JonaTec Agent authorization and withdrawal evidence is normally retained for up to 7 years to document the authorization that applied, subject to a legal hold, dispute or another documented retention reason. Invoices, payments, contracts, signed service orders, supplemental authorizations and other commercial or tax records are retained for 7 years before destruction review. The confidentiality-incident register is retained for at least five years after awareness of the incident. Personal passwords are not retained in the service file.

A legal obligation, tax objection, dispute, investigation or other documented reason may extend a retention period. Once the applicable period ends and no justification remains, information is securely destroyed or, where legally permitted, anonymized for a serious and legitimate purpose.

Confidentiality incidents

JonaTec records confidentiality incidents, acts to reduce harm and recurrence, and provides the notices required by law to the Commission d’accès à l’information and affected individuals when there is a risk of serious injury.

Your Privacy Rights and Requests

Subject to applicable law, individuals may request access and correction, information about access categories and retention, withdrawal of consent for future processing where relevant, and review of a privacy complaint. Where the right to portability applies, an individual may also request computerized personal information collected from them in a structured and commonly used technological format and, where permitted, have it communicated to an authorized person or organization.

Write to info@jonatec.ca. JonaTec may reasonably verify the requester’s identity before disclosure. A formal access or correction request is recorded, reviewed by the Privacy Officer and answered in writing diligently and no later than 30 days after receipt, subject to the rules and exceptions provided by law. Its administrative system supports a structured JSON export to assist with portability requests when applicable, subject to review of the request and applicable exceptions. Individuals may also contact the Commission d’accès à l’information du Québec.

Website technologies

The public website stores the selected language and privacy preference in browser local storage. The optional statistics choice is saved with its date, consent version and expiry date for a maximum of 180 days, after which the website asks again. The portal uses technical items strictly necessary for secure sign-in, the session and portal preferences. JonaTec also offers optional Vercel Web Analytics and Vercel Speed Insights to measure anonymized traffic and real-world website performance, and Google Ads to measure whether a request, phone call or subscription followed an advertising campaign. When this measurement is accepted, the website may retain campaign parameters such as source, campaign, ad content, keyword, device type and landing page. Form content, names, email addresses and phone numbers are not sent by JonaTec's Google Ads conversion code. Vercel Web Analytics, Vercel Speed Insights and Google Ads remain disabled by default and are loaded or enabled only after the visitor expressly accepts them. Secure signature pages are excluded from measurement. Visitors may refuse or change this choice at any time through Privacy preferences in the footer; refusing does not prevent use of the website or essential services. Address search and route calculation run only after the user enters an address or requests the function. Online payment redirects to Stripe; its payment page is operated by that provider and may use its own technologies required for payment and fraud prevention.

Privacy Policy Updates and Changes

This policy may be updated as practices, providers or legal obligations change. The version date appears on this page. Material new purposes are handled in accordance with applicable consent rules.