Privacy Policy

I. INTRODUCTION

MilanChase ("Company," "We," "Our," "Us") respects Your privacy and is committed to protecting Your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website (milanch.se), mobile application, and related services (collectively, the "Platform").

We are committed to complying with the Personal Information Protection and Electronic Documents Act ("PIPEDA"), the federal private-sector privacy law applicable to Canadian organizations, and An Act to modernize legislative provisions respecting the protection of personal information (Quebec's Law 25), including its ten fair information principles and enhanced consent, transparency, and accountability requirements.

The Company is committed to adhering to ethical standards regarding the collection, usage, and safeguarding of information provided by you. We do not sell any user information or data to third parties.

By accessing and using the Platform, You unconditionally agree to the terms and conditions of this Privacy Policy. If You do not agree with these terms, please do not use the Platform. Please read this policy carefully before proceeding.

II. DEFINITIONS

For the purposes of this Privacy Policy:

• "User," "You," "Your," "Yourself" means any natural person who accesses or uses the Platform. Where applicable to a business entity, "personal information" includes information relating to an identified or identifiable individual.
• "Personal Information" means any information about an identifiable individual as defined under PIPEDA and Quebec's Act respecting the protection of personal information in the private sector, including name, contact details, financial data, and identification numbers.
• "Sensitive Personal Information" means information that entails a higher risk of harm if compromised, such as health information, biometric data, government identification numbers, and financial account credentials.
• "Consent" means your voluntary, specific, informed, and revocable agreement to the collection, use, or disclosure of your personal information for the purposes identified at the time of collection.
• "Privacy Officer" means the person designated by MilanChase under Law 25 to oversee the protection of personal information and handle access and complaints.
• "Platform" means our website, mobile application, and associated online services.

III. ACCOUNTABILITY AND PRIVACY OFFICER

MilanChase is accountable for the personal information under its control and has designated a Privacy Officer as required by PIPEDA and Quebec Law 25. The Privacy Officer is responsible for:

• Overseeing compliance with PIPEDA, Law 25, and this Privacy Policy
• Developing and implementing privacy policies, procedures, and practices
• Conducting privacy impact assessments ("PIAs") for any project involving the collection, use, or disclosure of personal information, or the acquisition, development, or redesign of an information system or service
• Managing breach response and notifications
• Responding to requests regarding access, correction, and complaints
• Maintaining a register of privacy incidents as required by Law 25

When personal information is transferred to a third party for processing, MilanChase remains accountable and ensures, through contractual or other reasonable means, that a comparable level of protection is provided.

IV. INFORMATION WE COLLECT AND PURPOSES

V. CONSENT

Knowledgeable and voluntary consent is the cornerstone of our privacy practices. In accordance with PIPEDA and Law 25:

• We obtain your consent at the time of collection, use, or disclosure of your personal information
• Consent must be clear, free, informed, and for a specific purpose — we explain the purposes in a clear and accessible manner
• Consent may be express (e.g., checking a box) or implied where the purpose is obvious and reasonable
• For the collection, use, or disclosure of sensitive personal information, we require express consent
• You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal does not retroactively invalidate prior processing carried out with valid consent.
• We do not, as a general rule, collect, use, or disclose personal information without your knowledge or consent, except where permitted or required by law

VI. HOW WE USE YOUR INFORMATION

We limit the collection, use, and disclosure of your personal information to the purposes for which it was collected, except with your consent or as required by law. We use your information for:

• Providing legal services, consultations, and incorporation support
• Processing your requests and maintaining your account
• Communicating with you about services, updates, and changes to our policies
• Sending marketing and promotional materials — only with your separate, specific consent, which you may withdraw at any time
• Verifying your identity and preventing fraud
• Complying with legal obligations and regulatory requirements
• Improving and optimizing the Platform
• Analyzing usage patterns to enhance user experience
• Resolving disputes and handling customer service inquiries
• Conducting compliance checks and due diligence
• Commercial transactions involving the sale or merger of all or part of MilanChase's business, where your personal information may be part of the transferred assets, subject to confidentiality obligations

We do not use your personal information for any new purpose that is incompatible with the original purpose for which it was collected, without obtaining your consent.

VII. LIMITING USE, DISCLOSURE, AND RETENTION

We retain personal information only as long as necessary to fulfill the stated purposes or as required by law. Retention periods vary based on the type of information:

• Account Information: Retained for the duration of your account and for a reasonable period thereafter for record-keeping
• Legal Documents: Retained for 7 years (per legal and professional requirements)
• Transaction Records: Retained for 7 years for tax and compliance purposes
• Marketing Data: Retained until you withdraw consent or request deletion
• Backup Data: Retained for up to 90 days for disaster recovery

Once retention periods expire, we securely destroy, erase, or anonymize your personal information in accordance with our data destruction policies. We document the personal information we hold, its location, and its retention schedule.

VIII. DATA SHARING AND DISCLOSURE

We do not sell your personal information to third parties. We only disclose personal information for the purpose for which it was collected, with your consent, or as required by law. Circumstances where disclosure may occur include:

• Service Providers: With vendors who assist us in providing services under agreements that ensure a comparable level of protection (payment processors, email providers, analytics services, cloud storage)
• Legal Requirements: When required by law, court order, or government request, and only to the extent necessary
• Business Transfers: In the event of a merger, acquisition, or sale of assets, subject to confidentiality and continued application of this Privacy Policy
• Consent: When you explicitly consent to sharing with specific parties
• Protection of Rights: To enforce our terms, protect our rights, or prevent illegal activity
• Professional Services: With lawyers, accountants, or consultants assisting with your services, subject to professional confidentiality obligations
• Persons Authorized by You: To persons you have authorized to receive information on your behalf

We do not disclose personal information to government institutions without your consent unless we are legally required to do so.

IX. ACCURACY OF PERSONAL INFORMATION

Personal information shall be as accurate, complete, and up-to-date as necessary to minimize the possibility that inappropriate information may be used to make a decision about you. We rely on you to keep your information current and will make reasonable efforts to correct any inaccuracies you identify. You may request correction of your personal information at any time (see Section XVI).

We are not liable for the authenticity of any information provided by you. You confirm that all information you provide is valid, true, and accurate to the best of your knowledge, and you are responsible for updating it if circumstances change.

X. SAFEGUARDS

We implement comprehensive security safeguards appropriate to the sensitivity of the personal information collected:

• Physical safeguards: Restricted access to facilities, secure data centers
• Organizational safeguards: Role-based access controls, employee confidentiality agreements, privacy training
• Technological safeguards: SSL/TLS encryption for data in transit, encryption at rest, secure password hashing, firewalls, and intrusion detection
• Regular security audits and vulnerability assessments
• Incident response and breach notification procedures (see Section XIV)

The level of protection is proportionate to the sensitivity of the information: more sensitive information receives a higher level of protection. However, no method of transmission over the internet is completely secure, and while we strive to protect your information, we cannot guarantee absolute security.

XI. PAYMENT INFORMATION

We do not directly process or store your debit/credit card information. All payment transactions are processed through secure third-party payment service providers (Stripe) using industry-standard encryption (SSL/TLS technology). Your payment information is handled in accordance with PCI DSS compliance standards and is governed by the payment processor's privacy policy.

XII. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to enhance your experience on the Platform. In accordance with Law 25, we obtain your consent before placing non-essential cookies on your device:

• Essential Cookies: Necessary for the Platform to function (authentication, security). These do not require consent.
• Analytics Cookies: To understand how users interact with the Platform. These require your consent.
• Preference Cookies: To remember your language and display preferences. These require your consent.
• Marketing Cookies: To track campaign effectiveness. These require your separate, specific consent.

We provide a cookie consent banner that allows you to accept, reject, or manage specific categories of cookies. You can control cookie settings at any time through your browser preferences. However, disabling essential cookies may limit your ability to use certain features of the Platform.

When using tracking or profiling technologies, or when communicating personal information outside Quebec, we inform you and obtain your consent as required by Law 25.

XIII. AUTOMATED DECISION-MAKING AND PROFILING

In accordance with Law 25, you have the right to be informed of any decision made solely on the basis of automated processing of personal information, including profiling, that produces legal effects concerning you or significantly affects you.

MilanChase may use automated tools for certain functions (e.g., document generation, compliance checks). Where such tools make or assist in decisions that produce legal effects or significantly affect you, we will:

• Inform you of the use of automated processing and profiling in the decision-making process
• Provide you with the principal reasons and criteria used
• Allow you to submit observations and request a review of the decision by a natural person

We do not use biometric or physiological characteristics to identify or authenticate you without your consent, except where required for security purposes and authorized by law.

XIV. PRIVACY INCIDENTS AND BREACH NOTIFICATION

In the event of a privacy incident involving a risk of serious injury to the individuals concerned, MilanChase will:

• Take reasonable steps to reduce the risk of injury and prevent a new incident
• Notify the Commission d'accès à l'information du Québec ("CAI") without delay, in accordance with Law 25
• Notify the affected individuals without delay, providing them with information necessary to understand the situation and the steps they can take to protect themselves
• Maintain a register of privacy incidents, as required by Law 25

"Serious injury" includes, but is not limited to, financial loss, identity theft, reputational harm, or humiliation. The assessment of risk takes into account the sensitivity of the information, the context of the incident, and the number of individuals affected.

XV. PRIVACY IMPACT ASSESSMENTS (PIA)

In accordance with Law 25, MilanChase conducts a privacy impact assessment before:

• Disclosing personal information to a person or body outside Quebec without an agreement, for study or research purposes
• Disclosing personal information for a purpose not previously identified, where the new purpose is for study or research purposes
• Assigning a symbol or another identifier to a person for the purpose of offering goods or services
• Using personal information to make decisions based on automated processing or profiling
• Using personal information outside the usual course of business
• Acquiring, developing, or redesigning an information system or service that involves personal information

PIAs are conducted by the Privacy Officer and document the project, the personal information involved, the risks to privacy, and the measures to mitigate those risks.

XVI. YOUR RIGHTS

In accordance with PIPEDA, Law 25, and other applicable laws, you have the following rights regarding your personal information:

• Right of Access: Request access to and a copy of your personal information held by us
• Right to Correction: Request correction of inaccurate or incomplete personal information
• Right to Erasure/Deletion: Request the deletion of your personal information, subject to legal and professional retention obligations
• Right to Portability: Request a copy of your personal information in a structured, commonly used, and machine-readable format, and transmit it to another organization
• Right to Withdraw Consent: Withdraw your consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions
• Right to Object: Object to the collection, use, or disclosure of your personal information for certain purposes, including marketing
• Right to Information on Automated Decisions: Be informed of decisions made solely on the basis of automated processing or profiling (see Section XIII)
• Right to Notification: Be notified in the event of a privacy incident involving a risk of serious injury (see Section XIV)
• Right to File a Complaint: File a complaint with our Privacy Officer or with the CAI or the Office of the Privacy Commissioner of Canada

To exercise these rights, please contact our Privacy Officer using the information in Section XIX. We will respond to your request within 30 days. If we refuse or cannot grant your request, we will inform you of the reasons and your recourse options.

XVII. PRIVACY BY DESIGN

In accordance with Law 25, MilanChase embeds privacy by design into its practices. We:

• Minimize the collection and use of personal information to what is strictly necessary
• Limit the retention period for personal information to the minimum necessary
• Minimize access to and sharing of personal information within the organization
• Limit to what is necessary the use of personal information, the persons who may use it, the persons to whom it may be disclosed, and the purposes of the disclosure
• De-identify or anonymize personal information where feasible
• Implement technological and organizational measures that are proportionate to the sensitivity of the information

XVIII. DEIDENTIFICATION AND ANONYMIZATION

When we use personal information for study, research, or statistical purposes, we de-identify it before use, to the extent possible, in accordance with Law 25. Where re-identification is necessary, we ensure appropriate safeguards and only proceed with authorization.

XIX. CONTACT US AND PRIVACY OFFICER

If you have questions about this Privacy Policy, wish to exercise your rights, or wish to file a complaint, please contact our Privacy Officer:

You may also file a complaint with:

• Commission d'accès à l'information du Québec (CAI): cai.gouv.qc.ca
• Office of the Privacy Commissioner of Canada (OPC): priv.gc.ca

We will first attempt to address your complaint directly. If you are not satisfied with our response, you have the right to escalate to the CAI or the OPC.

XX. CHALLENGING COMPLIANCE

In accordance with PIPEDA's accountability principle, an individual is able to challenge MilanChase's compliance with the above principles by contacting our Privacy Officer. We have procedures in place to:

• Receive, investigate, and respond to complaints or inquiries about our policies and practices relating to the handling of personal information
• Take appropriate corrective action where warranted
• Document the complaint, the investigation, and the outcome

We make information about our policies and practices easy to understand and accessible.

XXI. INTERNATIONAL DATA TRANSFERS

Your personal information may be transferred to, stored in, and processed in countries other than your country of residence, including countries outside Canada. In accordance with Law 25, when communicating personal information outside Quebec, we inform you and obtain your consent. We implement appropriate safeguards, such as Standard Contractual Clauses and service provider agreements, to ensure a comparable level of protection during international transfers.

XXII. CHILDREN'S PRIVACY

The Platform is not intended for children under the age of 14. We do not knowingly collect personal information from children under 14. Under Law 25, where applicable, we obtain consent from the holder of parental authority for the collection of personal information from a minor under 14, and from the minor if 14 or older. If we become aware that we have collected information from a child without proper consent, we will immediately delete such information and take appropriate action.

XXIII. POLICY UPDATES

We may update this Privacy Policy from time to time. Material changes will be notified to you via email or a prominent notice on the Platform before the changes take effect. Where Law 25 requires, we will obtain your consent for material changes to the purposes for which your personal information is used. Your continued use of the Platform following such notification constitutes your acceptance of the updated Privacy Policy.