Privacy Policy

Version 2026-07 · Effective July 1, 2026

Formation RCR et Secourisme Québec ("FRSQC", "we"), which operates First Aid & CPR Nunavut (firstaidcprnunavut.ca), protects your personal information in accordance with Quebec's Act respecting the protection of personal information in the private sector (Law 25).

1. Person in charge of the protection of personal information

Person in charge of the protection of personal information, FRSQC · [email protected]

Write to this person with any question, access request or complaint.

2. Information collected, purposes and retention

  • Name and email address: to create your account, identify you and print your name on the certificate. Kept while the account is active; an account with no activity and no valid certificate is deleted or anonymized 3 years after the last activity (limitation period, Civil Code of Québec, art. 2925).
  • Google or Microsoft sign-in identifier: to sign you in without a password. Kept while the account is active.
  • Phone number and mailing address (if you provide them): to verify a certificate and contact you. Kept while the account is active.
  • Progress, answers and assessment results: to track your course and issue the certificate. Kept until the certificate expires, plus 3 years.
  • Certificate (name, course, date, number): to prove your training and allow it to be verified. Kept until it expires, plus 3 years.
  • Purchases and invoices: accounting and tax obligations. Kept 6 years after the end of the tax year concerned (Tax Administration Act, s. 35).
  • IP address, browser, device and sign-in country: account security and fraud prevention. Kept 12 months.
  • Acceptance of the terms (version, date, IP address): proof of the contract. Kept for the duration of the contract, plus 3 years.

At the end of the retention period, information is destroyed or anonymized (Law 25, s. 23). We do not collect your card number: Stripe processes it directly.

We never sell your information. We only entrust it to the service providers needed to run the service (hosting, payment, email delivery, audience measurement), bound by contract. Some of these providers are located outside Quebec; we make sure they protect your information adequately.

Details of these providers and of the assessment of their safeguards are available on request from the person in charge (section 1).

3. If your employer enrols you

If an organization (your employer, for example) assigns you a seat, its administrators can see your name, email, progress, completion date and certificate. They do not see your detailed assessment answers.

4. Cookies

  • Essential cookies: sign-in session, language and security. The site does not work without them.
  • Analytics and advertising cookies (Google Analytics, Google Ads): off by default. They are turned on only if you accept them in the banner shown on your first visit. You can change your mind at any time with the 'Manage Cookies' button at the bottom of the screen.

5. Communications

We send you the emails needed for your course (confirmation, invoice, certificate, renewal reminders). We may also call or write to you to verify that a certificate was earned by its holder. Promotional emails require your consent, which you can withdraw at any time.

6. Your rights

At any time, you can:

  • access your information and get a copy, including in a structured technological format (portability);
  • have it corrected;
  • ask for it to be deleted or withdraw your consent, except for what the law requires us to keep (invoices, for example);
  • file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

We respond within 30 days. Write to the person in charge (section 1).

7. Security

Communications with the site are encrypted (HTTPS). Access to data is limited to people who need it. In the event of a confidentiality incident presenting a risk of serious injury, we will notify you and the Commission d'accès à l'information.

8. By place of residence

  • Canada (outside Quebec): the Personal Information Protection and Electronic Documents Act (PIPEDA) applies. You may file a complaint with the Office of the Privacy Commissioner of Canada.
  • European Union, European Economic Area, United Kingdom and Switzerland: the GDPR (or its UK or Swiss equivalent) applies. Our legal bases are performance of the contract (account, course, certificate), our legal obligations (invoices), our legitimate interest (security, fraud prevention) and your consent (advertising, newsletter). Canada benefits from an adequacy decision of the European Commission; for providers in the United States, transfers rely on the Data Privacy Framework or standard contractual clauses. You also have the right to request restriction of processing and to object, and to lodge a complaint with your country's data protection authority.
  • United States: we do not sell your information. You can exercise your rights of access, correction and deletion by writing to the person in charge (section 1).
  • Other countries: we respect the rights granted by your country's law, for example POPIA in South Africa, the NDPA in Nigeria, the DPDP Act in India or the PDPA in Singapore. Write to the person in charge (section 1) to exercise them.

9. Minors

For a person under 14, or under the age set by the law of their country if higher, the consent of a parent or guardian is required.

10. Changes

We will notify you by email or at your next sign-in of any significant change. The date of the version in effect is shown at the top of the page.

Last updated: October 2026