tonia privacy policy.

1 · Privacy Officer

tonia has designated a Privacy Officer under Bill 25 art. 3.1. Contact: privacy@tonia.ca. Title and coordinates are published on this page and kept current.

2 · Scope

This policy describes how tonia processes personal information about website visitors, sales prospects, clients, client administrators, and end users of deployed on-site tonia installations where tonia acts as processor under a data processing agreement.

3 · What we collect

We may collect identity and contact data (name, email, organisation), usage and audit metadata from the admin console, support correspondence, and truncated analytics on tonia.ca when you opt in to analytics cookies.

4 · Purposes and lawful basis

We process data to respond to inquiries, deliver and support products, meet Bill 25 obligations, maintain security logs, and improve documentation. Marketing emails are sent only with consent.

5 · Retention

Prospect records are retained while the relationship is active and deleted on request unless law requires longer retention. Client audit logs remain on-site under your retention policy. Website analytics retention is described in our cookie policy.

6 · Your rights

Under Bill 25 you may exercise the following rights free of charge:

• Access to the personal information we hold about you (art. 27)
• Correction of inaccurate, incomplete, or equivocal information (art. 28)
• Deletion where collection was unnecessary or consent was withdrawn (art. 28.1)
• Portability in a structured, commonly used format (art. 27)
• Complaint about how we handle your personal information

7 · Cross-border transfers

On-site Tonia processing stays in Canada by default. Opt-in tonia queries may cross borders under your PIA and our cloud-provider DPA. We document sub-processors in your compliance pack.

8 · Updates

We review this policy when processing changes. The effective date appears at the top of this page. tonia responds to access requests within thirty calendar days of receipt, per art. 32.