Privacy policy
Privacy policy
Privacy policy
How the Coopérative de solidarité Baseline en intelligence artificielle handles personal information related to its Website, its services and the self-service AI Readiness Audit, under the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as amended by Law 25.
The purpose of this Privacy Policy is to describe our practices regarding the collection, use, disclosure, sharing and management of personal information provided on the Website of La coopérative de solidarité Baseline en intelligence artificielle (Baseline) or otherwise collected in the context of Baseline's activities. Our Privacy Policy also describes the measures we take to protect the security of this information, as well as how you can access, modify or delete your personal information.
"Baseline": the Coopérative de solidarité Baseline en intelligence artificielle. For the purposes of this policy, Baseline also includes its suppliers or licensors, as well as their respective employees, officers, directors, shareholders, agents, subcontractors and other representatives. The expressions "we", "our" and "us" also refer to Baseline;
"personal information": any information about an individual from which that person can be identified. This does not include information from which identity has been removed (anonymous data);
"Website": the site accessible at baseline.quebec and all of its subdomains.
We collect the personal information that you provide to us in various ways, described in the following three subsections.
Direct exchanges include, in particular:
Communicating with us through a form available on the Website;
Communicating with us about the services and products we offer;
Communicating with us to ask a question, submit a comment or make a complaint (customer service);
Use of social media.
When you use our Website, we automatically collect certain technical data (described in more detail below) about your equipment and your Internet browsing.
Our Website uses a technology called "web beacons" or "invisible pixels". This technology allows us to understand which pages of our Website you view. We use these web beacons to optimize and tailor our Website for you and other potential visitors. We may also collect certain technical information about you if you visit other websites that use our cookies.
We may obtain information about you from other sources, including clients, service providers and business partners, and combine that information with the information we have collected about you. Accordingly, we may use third parties, for example Google, to:
Carry out remarketing, which consists of displaying advertising to people who have already visited our Website, on websites other than our own, including through Google Analytics (an Internet audience analysis solution). In such a case, the third parties concerned, including Google, may display our advertisements on sites across the Internet;
Use the following Google Analytics features: the creation of reports on the recorded impressions of our advertisements (i.e. a solution for placing ads across a set of news sites, blogs and other specialized websites) in order to attract more potential clients; integration with any management tool comprising a set of features used for the delivery, targeting and verification of ads for our advertising campaigns on websites and mobile devices, as well as related reports; and the creation of reports on the demographics and interests of Internet users;
Collect, analyze and/or aggregate your personal information (such as the IP address, gender, age and interests of Internet users), including through the creation of reports on the demographics and interests of Internet users, in order to help us understand how visitors interact with our Website and to improve our Website and our products and services.
Companies providing remarketing may combine the use of first-party cookies (for example, the Google Analytics cookie) and third-party cookies (for example, the DoubleClick cookie) to (i) collect personal information; and (ii) inform, optimize and display advertisements based on your previous visits to our Website, and (iii) determine the relationship between visits recorded on our Website and advertising impressions, other uses of advertising services, and interactions with those advertising impressions and advertising services. These companies may also use web beacons or invisible pixels to report certain information about your visits to our Website and to websites that contain links to our site and advertise it, in order to measure the effectiveness of our advertisements.
We may collect, use, store and transfer different types of personal information about you, which we have grouped as follows:
Contact details include your last name, first name, email address, title, telephone number, mailing address and contact preferences;
Social media data includes information associated with any social media account that you hold and its related profile, such as your name, username, email address, profile picture, date of birth and gender;
Technical data includes the IP (Internet Protocol) address, your login data, the number of clicks and other related information, such as the websites you visited immediately before and after your visit to our Website, your time zone and geographic location settings, the Internet service provider you use and the other technologies on the devices you use to access our Website;
Usage data includes the number of visits to our Websites, the date and average time spent on our Websites, as well as information about how you use our products and services;
Marketing and communication data includes your preferences for receiving marketing from us and from third parties related to us, and your communication preferences;
Self-assessment information includes the answers you give to the self-service AI Readiness Audit questionnaire, the targets you declare, the scores, the maturity phase and the gaps calculated from those answers, as well as the description of your organization: sector, size, region, your role in it, declared maturity and declared use of artificial intelligence agents.
By way of example, certain information may be requested from you when you visit the Website, in particular your name and email address when you decide to communicate or otherwise establish a connection with us through one of the various means offered on our Website.
We also collect, use, store and share aggregated information, such as statistical or demographic information. Aggregated information may be derived from your personal information, but is not considered personal information if it does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific feature of our Website. However, if we combine or connect aggregated information with your personal information in order to directly or indirectly identify you, we treat it as personal information that will be used in accordance with this Policy.
We limit the collection of personal information to what is reasonably required to achieve the purposes for which it is collected. Most often, we will use your personal information in the circumstances described below.
Where we need to perform the contract we are about to enter into or have entered into with you: performance of a contract means processing your personal information where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract;
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. A legitimate interest means the interest of Baseline in conducting and managing our business to enable us to give you the best service or product. This includes, in particular, the need to communicate with you and to maintain a cordial relationship.
We make sure to consider and balance any potential impact on you (both positive and negative) and your rights before processing your personal information for our legitimate interests. We do not use your personal information for activities where our interests are overridden by the impact on you (unless we have your consent or the law requires or authorizes us to do so). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting our person in charge of the protection of personal information.
Where we need to comply with a legal obligation: complying with a legal obligation means processing your personal information where it is necessary for compliance with a legal obligation to which we are subject
Internal access to this information is restricted to the categories of persons named in the section "Disclosure of personal information".
We describe below all the ways in which we plan to use your personal information and the legal grounds on which we rely to do so. We have also identified our legitimate interests, where applicable. Note that we may process your personal information on more than one legitimate ground, depending on the specific purpose for which we use your information.
Communicating with us through the form available on the Website. We use the information you provide in the form to respond to your request, whether about our services or otherwise, which constitutes a legitimate interest.
By submitting the form to Baseline, you give us your implied consent to retain and use the information contained in the form.
Social media. We may offer you the possibility of enjoying our content from, or through, networking sites owned by third parties, plug-ins and applications. When you enjoy our content in this way, you may also allow us to access certain information associated with your social media accounts, as described in the section "Types of information collected", in order to distribute that content or in the course of operating our Website, plug-ins and applications. When you provide information about your social media accounts, we may use that information to personalize your browsing on our Website and on third-party networking websites, plug-ins and applications, and to provide you with other products or services that you may request.
This constitutes a legitimate interest by making it possible to analyze how our clients (current or potential) use our products and services, to improve our marketing strategies, to develop our range of products and services, and to operate and grow our business.
Visiting our Websites. When you view our Website, Baseline will collect certain information about you.
This is the technical data and usage data described in the section "Types of information collected". We use this information to administer our Website, monitor and improve our services and our Website, determine how our Website is used, understand which portions of our Website are popular, and analyze trends and usage patterns.
This information is necessary because of our legitimate interests in operating our business, providing administrative and technical services and preventing fraud, but also to comply with a legal obligation.
Customer relationship management (CRM) databases. When you take part in one of the activities described above, we collect the personal information provided in the course of those activities to complete and update our databases relating to customer relationship management. In this context, the personal information collected is used to generate reports for internal use on the relationships between Baseline and its clients or potential clients in order to monitor and improve our product and service offerings and our Website.
This constitutes the same legitimate interest as that set out under the item "Social media" above.
Generative artificial intelligence tools. We may process your personal information using generative artificial intelligence tools, in particular those built into our customer relationship management (CRM) database, our email and our workspaces, to summarize our exchanges with you, prepare our communications, classify and qualify your requests and follow up on our business relationships. This processing is subject to the following rules:
only the tools authorized in the register that Baseline maintains under its responsible artificial intelligence use policy may be used for this processing;
we submit to them only the information necessary for the task, and never sensitive information without your express consent;
the tool provider acts as a service provider within the meaning of the section "Disclosure of personal information": a written mandate prohibits it from using your information for its own purposes, including to train its models;
where the tool processes your information outside Quebec, we first carry out a privacy impact assessment, as the law requires;
a person at Baseline checks what the tool produces before it is used. No decision concerning you is based exclusively on automated processing without you being informed; you may then find out what information was used and the reasons for the decision, and ask that a person review it.
Self-service AI Readiness Audit and Quebec AI maturity index. When you complete our self-assessment questionnaire, we use your answers to calculate your scores, produce your report and send it to you. Your report also places your organization in relation to comparable organizations, based on aggregated values. This use is based on your consent, collected by means of a checkbox: without it, the report cannot be produced and the submission is not processed.
When you separately consent, we also use your answers to feed an artificial intelligence maturity index of Quebec organizations, which Baseline publishes. This purpose is distinct from the production of your report and is optional: a submission lacking this consent does not enter into any aggregate.
The index publishes only aggregated values, never an individual answer. No statistic is published on a capability for which fewer than thirty organizations have responded. As long as your answers still carry the email address you provided, they are grouped with those of your organization, which then counts as only one voice, regardless of the number of times it completes the questionnaire; once that address has been erased, an answer is no longer linked to any organization and counts for itself. When a segment is too thin, the comparison falls back to the sector, all sizes combined, and failing that we indicate that the comparison is not available. Answers collected under another version of the questionnaire are aggregated separately.
You may withdraw this consent at any time by writing to confidentialite@baseline.quebec (privacy@baseline.quebec). Once your answers have been stripped of what identifies you, they can no longer be withdrawn, since nothing links them to you any longer.
Please contact us if you need more details about the specific legal ground on which we rely to process your personal information.
Where you consent, Baseline sends you commercial communications: news from the Cooperative, its offers of services and training, and follow-up by an advisor regarding a report you have requested.
This consent is separate and optional. It is collected by means of its own checkbox, and it is never a condition for obtaining your report: a person who completes the self-service AI Readiness Audit receives it whether or not they consent to being contacted for commercial purposes.
We identify ourselves in each of these communications. You may withdraw your consent at any time, free of charge and without justification:
from the unsubscribe link at the bottom of our commercial emails;
or by writing to confidentialite@baseline.quebec (privacy@baseline.quebec).
The withdrawal is applied by our customer relationship management (CRM) database and applies to all of our commercial communications. We then stop using your personal information for these purposes. The withdrawal does not prevent communications necessary for a request you have made to us or for a service we are providing to you.
Unless explicitly indicated in this Policy, we do not sell, rent, transfer or disclose your personal information to third parties for undisclosed purposes without your consent. Access to your personal information is restricted to Baseline, in particular to the members of staff, management and the marketing team who need to access this personal information in the course of their duties for Baseline. Subcontractors' access is limited to what their mandate requires and governed by the written mandate that the law requires.
We may share some of the personal information to which we have access with various third parties, depending on the context. The following are the three types of parties to which we may transfer your data:
To service providers, that is, third parties that provide services on our behalf in Canada, the United States or abroad, including Google, for the purpose of using the various Google Analytics features described herein. The information collected by the self-service AI Readiness Audit is also entrusted to our Web host, to Google's data warehouse, email and workspaces, to our automation platform, to our report validation tracking database, to our internal messaging tool, and to HubSpot, our customer relationship management (CRM) database, which receives your contact record and a copy of your report. We provide our service providers with the information they need to fulfil their mandate, and we do not authorize them to use or disclose this personal information for their own commercial or other purposes;
To entities, bodies and authorities for judicial purposes. In other words, we and our third-party service providers may disclose your personal information to comply with a search warrant or another request or order that is lawful, or to respond to an investigative body in the event of a breach of an agreement or a violation of the law, or as otherwise required or authorized by law. We may also disclose personal information as needed to assert or exercise legal claims or to raise a defence against such claims, or in order to prevent actual or suspected losses or to avoid bodily injury or property damage;
To another entity, in the event that we sell all or part of our business or if we sell or transfer assets or otherwise take part in a merger or a business transfer. In such a case, we may transfer the personal information concerning you to a third party as part of the transaction.
We have established and apply administrative, technical and physical security measures designed to protect your personal information in our custody and control against unauthorized access, use, modification and disclosure.
We also take special measures to assess the potential risks associated with the disclosure of your personal information. In the event of a security breach, that is, if your personal information is lost, disclosed without your authorization or becomes accessible to an unauthorized person, we will notify you of such a breach if it presents a real risk of serious injury. For example, a real risk of serious injury includes bodily harm, humiliation, loss of professional opportunities, financial loss or identity theft. If the breach gives rise to a real risk of serious injury, we will notify you directly as soon as possible. If we cannot notify you directly, we will notify you of the breach by means of a public communication. We will provide you with the information necessary to understand the significance of the security breach and to take the steps necessary to reduce the risks of injury that may result from it. We will also report the security breach to the Commission d'accès à l'information and to any other organization that, in our opinion, can reduce the risk of injury that may result from the breach. We keep a register of all security breaches. Following a security breach, Baseline investigates its causes and reviews the protective measures in place to prevent future breaches.
We have put in place procedures concerning the retention of personal information that are designed to keep personal information only for as long as necessary to fulfil the purposes described in this Privacy Policy or to otherwise comply with legal requirements.
The following periods apply to the personal information collected by the self-service AI Readiness Audit.
For twenty-four months from your submission, we retain your answers, your contact details, the description of your organization and a fingerprint of your IP address. The address itself is never retained in clear text.
At the end of these twenty-four months, the link to your report stops working, and we erase from our response warehouse what identifies you: first name, last name, email address, email address domain, role, organization name, IP address fingerprint, as well as the token and the address of the private page of your report. The respondent identifier there is replaced by an identifier that is not derived from anything.
The following in particular remain there, because they are what make up the Quebec AI maturity index described in the section "Use of personal information": the sector, size and region of the organization, the version of the questionnaire administered, the maturity and use of artificial intelligence agents that you declared, your answers, the targets you declared, the scores, the maturity phase and the calculated gaps, the date of your submission, the parameters of the campaign that brought you to the questionnaire, if applicable, as well as the record of the consents you gave or refused, which determines whether your answers continue to feed the index.
At the end of sixty months from your submission, this row is deleted.
These twenty-four months apply wherever we retain this information, and not only in the response warehouse.
Your report is also filed in PDF format in our workspaces, in our customer relationship management (CRM) database and in the internal validation thread used to review it before sending, where it bears your name and that of your organization. These copies are deleted at the end of the same twenty-four months.
A copy of your answers and your contact details also remains in the questionnaire application's warehouse and in our validation tracking database. It is deleted there, not anonymized, at the same term.
The information that the audit records on your contact record is removed from it at the same term.
You have the rights detailed below regarding your personal information:
Request access to your personal information. This allows you to receive a copy of the personal information we hold about you and to verify that we are processing it lawfully.
Request correction or updating of the personal information we hold about you. This allows you to correct or update incomplete, inaccurate or outdated data that we hold about you. However, we may need to verify the accuracy of the new data you provide to us.
Request erasure of your personal information. This allows you to ask us to delete or remove personal information where there is no good reason for us to continue processing it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information to comply with applicable law. Note, however, that we may not always be able to comply with your erasure request for specific legal reasons that will be notified to you, if applicable, at the time of your request.
Objection to the processing of your personal information. Where we rely on our legitimate interest (or that of a third party), you may object to this processing where there is something about your particular situation that leads you to believe that the processing infringes your fundamental rights and freedoms. You also have the right to object where we process your personal information for direct marketing purposes. In some cases, we may be able to demonstrate that we have legitimate grounds to process your information that override your rights and freedoms and, in such cases, we may decide to continue processing your personal information. This reservation does not apply to commercial prospecting: when you withdraw your consent to the use of your personal information for commercial prospecting purposes, we stop that use. The section "Commercial communications and unsubscribing" describes how to exercise this withdrawal.
Request restriction of the processing of your personal information. This allows you to ask us to suspend the processing of your personal information in the following cases:
If you want us to verify the accuracy of the information;
Where our use of the information is unlawful but you do not want us to erase it;
If you need us to retain the information even if we no longer need it, because you need it to establish, exercise or defend legal actions;
You have objected to the use of your information, but we must verify whether we have legitimate grounds to use it.
Request transfer of your personal information to yourself or to a third party. We will provide you, or a third party of your choice, with your personal information in a structured, commonly used, machine-readable format. Note that this right applies only to automated information that you initially consented to provide to us for our use or where we used that information to perform a contract with you.
Withdraw your consent to the disclosure or use of the information collected. This will not, however, affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide you with certain products or services, which could prevent us from responding to inquiries, providing you with technical support or assisting you in any other way in the use of our products and services. We will inform you if this is the case at the time you withdraw your consent.
If you wish to exercise any of the rights set out above, please contact our person in charge of the protection of personal information (see next section).
You will not have to pay a fee to access your personal information (or to exercise any of the other rights).
If you wish to exercise any of the aforementioned rights, we may need to ask you for specific information to allow us to confirm your identity and thus allow you to access your personal information (or to exercise your other rights). This is a security measure intended to ensure that personal information is not disclosed to a person who has no right to receive it. We may also contact you to ask for further information about your request in order to speed up our response.
We will respond to all legitimate requests within thirty (30) days.
If you have any questions or comments about how we process your personal information, including any request to exercise your rights, please contact our person in charge of the protection of personal information by email at confidentialite@baseline.quebec (privacy@baseline.quebec). This function is performed by Baseline's Executive Director.
You may also, through these contact details, withdraw your consent to the use or disclosure of your personal information. The section "Your rights regarding your personal information" sets out this right and the consequences of exercising it.
If you believe that your rights have not been respected, you may file a complaint with the Commission d'accès à l'information du Québec, the supervisory authority for the protection of personal information, at cai.gouv.qc.ca. The section "Complaint handling process model" in the annex describes how we handle a complaint we receive.
| Version | Date | Changes |
|---|---|---|
| 4 | November 2, 2026 | Version adopted and signed by the board of directors; in force December 1, 2026. Additions: self-service AI Readiness Audit and Quebec AI maturity index, commercial communications and unsubscribing, set retention periods, generative artificial intelligence tools, named service providers, recourse to the Commission d'accès à l'information. |
| 1 | December 13, 2025 | First version published on the Website. |