Privacy policy

This Privacy Policy (the “Policy”) was adopted by Géodonnée Inc. (hereafter “we”, “our” or “the Company”), a legal person constituted under the laws of Québec, whose address is in Québec City, province of Québec, Canada.

Géodonnée Inc. develops and operates LIZPACK, a cloud platform (SaaS) for the automated deployment of Lizmap instances together with a QGIS Server and a PostgreSQL/PostGIS spatial database, intended for GIS professionals, public bodies, companies and institutions wishing to publish interactive maps without complex configuration.

This Policy applies to any natural person who visits our website lizpack.geodonnee.com, creates an account, takes out a subscription or interacts in any way with the LIZPACK services. It does not apply to the data processed by your own Lizmap instances deployed through our platform, for which you remain solely responsible.

For the purposes of this Policy, the following terms have the meaning given below:

Géodonnée Inc. collects only the information strictly needed for the declared purposes (the minimisation principle). The following categories may be collected:

3.1 Identification and account

3.2 Billing and contractual information

3.3 Technical information

3.4 Usage and performance data

In order to calculate usage-based billing and to keep the service healthy, LIZPACK collects aggregated metrics about your deployed instances: CPU and RAM use as a percentage, disk space consumed, number of WMS/WFS requests, availability (up/down), component versions (QGIS Server, PostGIS). These metrics are tied to your account identifier, not to an identified natural person.

3.5 Communications and support

3.6 User content (geospatial data)

The QGIS projects, vector layers, rasters, attribute data, styles and settings you upload to your Lizmap instances are your own content. Géodonnée Inc. acts solely as a technical processor for that content: we do not analyse it, we do not index it for commercial purposes and we disclose it to no third party.

3.7 Information we do not collect

• Social insurance number (SIN) or any foreign equivalent
• Health or biometric data
• Data on ethnic or racial origin
• Political opinions, religious beliefs
• Data concerning minors under 14
• The content of private communications unrelated to support

Every processing of personal information by Géodonnée Inc. rests on a determined, explicit and legitimate purpose, and on a legal basis identified under the applicable laws.

Under section 23 of Law 25, Géodonnée Inc. has a formal retention and destruction policy. The periods below are counted from the last relevant interaction, unless stated otherwise.

5.1 Destruction procedures

Physical media are destroyed by certified shredding. Digital data is deleted following the NIST SP 800-88 standard. A destruction certificate is kept for every deletion of sensitive data.

Géodonnée Inc. never sells, rents or assigns your personal information to third parties for commercial prospecting, advertising profiling or any other undeclared commercial purpose.

6.1 Technical processors

Géodonnée Inc. uses the following processors, all bound by a data processing agreement (DPA) compliant with Law 25 and/or the GDPR.

6.2 Transfers outside Québec and outside Canada

Under section 17 of the Québec Act as amended by Law 25, any transfer of personal information outside Québec is subject to an assessment of whether the protection is comparable to that offered by Québec law.

• Standard contractual clauses (SCCs) approved by the European Commission (decision 2021/914)
• Contractual clauses giving equivalent protection within the meaning of the Québec Act and of PIPEDA
• A documented transfer impact assessment (TIA)
• Minimisation of the data transferred (prior pseudonymisation where possible)

6.3 Legally required disclosure

Géodonnée Inc. may be legally compelled to disclose personal information to the competent authorities (police, courts, the Commission d'accès à l'information du Québec, the CRTC, and so on) in answer to a court order, a warrant, a subpoena or any valid legal requisition. As far as the law allows, we will tell you beforehand.

6.4 Corporate transactions

In the event of a merger, acquisition, sale of assets, restructuring or bankruptcy involving Géodonnée Inc., personal information may be part of the assets transferred. The people concerned will be informed, and the obligations of this Policy will continue to apply.

Under the applicable laws, you have the following rights over the personal information Géodonnée Inc. holds about you. Exercising them is free of charge, save where the law provides otherwise.

7.1 How to exercise your rights

LIZPACK is a professional platform intended for adult users (18 and over) in the course of their professional work in GIS and geomatics.

Géodonnée Inc. does not knowingly collect personal information about people under 18. If you are a parent or guardian and have reason to believe that a minor has given us personal information without your consent, contact us at once at [email protected].

Géodonnée Inc. applies organisational, administrative, physical and technical security measures suited to the level of risk, in line with section 10 of the Québec Act as amended by Law 25 and with industry best practice (ISO/IEC 27001, NIST CSF, CIS Controls).

9.1 Technical measures

9.2 Organisational measures

• Mandatory annual training of all staff on the protection of personal information
• A data classification policy and rules for handling confidential information
• Confidentiality agreements signed by every employee and processor
• A documented procedure for handling confidentiality incidents
• A PIA for every new project involving personal information

9.3 Handling confidentiality incidents

1. Detection and containment: immediate steps to limit the impact
2. Risk assessment: determining whether there is a serious risk of harm
3. Notice to the CAI: as soon as possible where the risk is serious
4. Notice to the people concerned: where there is a serious risk of harm
5. Entry in the register: every incident is recorded for at least 5 years
6. Post-mortem analysis: corrective and preventive measures documented

In line with Law 25 and the rules on cookies, Géodonnée Inc. informs you of the following use on the LIZPACK platform.

10.1 Strictly necessary cookies

10.2 Functional cookies (with consent)

10.3 Analytics cookies

LIZPACK uses Plausible Analytics, an open-source solution hosted in Europe, which sets no cookie at all and collects no directly identifiable personal data. The statistics are entirely aggregated and anonymous. No data is shared with advertisers.

LIZPACK may contain links to third-party websites or services (the QGIS documentation, OpenStreetMap, QGIS.org, and so on). This Policy does not apply to those third-party sites. Géodonnée Inc. cannot be held responsible for their privacy practices.

The third-party integrations available in LIZPACK (SSO through Google Workspace or Microsoft Azure AD, webhook integrations) transmit only the data strictly needed for them to work. Turning such an integration on amounts to consenting to the sharing of the corresponding data with the supplier concerned.

• Support assistance (generative AI): AI tools may help our support agents draft answers. The data in your tickets is never used to train third-party models without prior anonymisation.
• Anomaly detection: automated algorithms analyse access logs to spot abnormal behaviour. These analyses do not lead to automated decisions without human review, except for a preventive suspension in the face of an obvious attack.
• Resource tuning: the allocation of resources (CPU, RAM) to instances is automated, following deterministic rules.

Under section 12.1 of the Québec Act (Law 25), if an important decision concerning you is taken solely on the basis of automated processing, you will be told and may ask for a review by a human being.

This Policy is written in French, the official language of Québec and the working language of Géodonnée Inc. English, Spanish and Portuguese versions are also available. In the event of any discrepancy, the French version prevails.

If you believe Géodonnée Inc. has not complied with this Policy or with the applicable laws, we invite you to contact us first, so the matter can be settled amicably.

Géodonnée Inc. reserves the right to amend this Policy at any time, to reflect legal, regulatory, technological or organisational changes. Where a change is substantial, you will be notified by e-mail (at least 30 days before it takes effect), by a notice in your LIZPACK dashboard, and by a banner on geodonnee.com.