Privacy policy

This policy explains how Le Groupe Croo inc. ("Croo", "we") handles personal information when you visit croo.io or write to us through its contact form. It is written for visitors in Canada, under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Québec, the Act respecting the protection of personal information in the private sector as amended by Law 25.

Who is responsible

Le Groupe Croo inc. is a company incorporated under the laws of Québec, Canada, located at 33 rue Prince, Montréal, Québec H3C 2M7. The person in charge of the protection of personal information at Croo can be reached at hello@croo.io.

What this policy covers

This policy covers the croo.io website only. The applications that Croo designs, builds or hosts for its clients are governed by the agreement made with each client.

What we collect and why

When you browse the site

• Technical data. Our host, Vercel, receives your IP address, details about your browser, the page you ask for and the time of your request, as every web server does. It uses them to deliver the site and to protect it against abuse.
• Your country and language, on your first visit. When you open croo.io without choosing a region, the site uses the country that Vercel derives from your IP address and the language preferences of your browser to show you the right region and language. Neither is stored.
• Cookies the site needs. croo_consent records your choice about audience measurement, for 6 months. NEXT_LOCALE remembers the region and language you pick in the selector, for 1 year; it is set only if you use the selector. Neither is used to follow you across sites.

Audience measurement, only with your consent

If you accept audience measurement, the site loads Google Analytics 4, a Google service. It sets the _ga and _ga_<ID> cookies, kept for up to 2 years, and records the pages you view, the calls to action you click, a change of region or language, and the fact that a contact message was sent, never its content. Google uses your IP address to estimate your approximate location. Advertising features are turned off.

Until you accept, no Google script is loaded. You can change your choice at any time with the Cookie preferences link at the bottom of every page. If you withdraw your consent, the analytics cookies are deleted.

When you write to us

The contact form asks for your name, email address, organization, country and what you are trying to change. Your role, phone number, where the work lives today and who is affected are optional. When you send the form:

• the site emails your message, with the region and language of the page, to cec@croo.io through Courier, an email delivery service; the site itself keeps no copy;
• we use your message only to reply to you and to follow up on your request; we do not use it for marketing and we do not add you to any mailing list;
• to keep automated spam out, the form uses Cloudflare Turnstile, which loads only once you start filling in the form and uses technical data such as your IP address and browser details to tell a person from a bot. A hidden field serves the same purpose.

If sending fails, the error is recorded in our host's logs with technical codes only, never the content of your message.

Consent

When you write to us, you consent to the use of your information to answer you. Audience measurement needs your express consent and is off until you give it. You may withdraw your consent at any time, subject to legal or contractual restrictions.

Who processes your information

We do not sell or rent personal information. It is processed on our behalf by these service providers:

• Vercel Inc. (United States): hosting of the website;
• Cloudflare, Inc. (United States): the Turnstile anti-spam check;
• Courier (United States): delivery of the contact form email;
• Google (United States): audience measurement, only with your consent;
• our email provider, which hosts the cec@croo.io inbox.

These providers may process information outside Québec and Canada, including in the United States, where it may be accessible to authorities under local law. Before personal information is communicated outside Québec, we assess whether it will be adequately protected, as Québec law requires.

How long we keep it

• Contact messages stay in the cec@croo.io inbox for as long as needed to follow up on your request and any relationship that results from it, and are then deleted.
• croo_consent lasts 6 months and NEXT_LOCALE 1 year.
• Google Analytics keeps event data for at most 14 months.
• Server logs are kept by Vercel for the short period its service provides.

Your rights

You may ask to access the personal information we hold about you, to have it corrected and to withdraw your consent. In Québec, you may also ask to receive the computerized personal information you provided to us in a structured, commonly used technological format. Write to hello@croo.io; we will answer within 30 days.

If you are not satisfied with our answer, you can file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Québec, with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

Security

The site is served over encrypted connections (HTTPS) only, and access to the inbox and to the services above is limited to the people at Croo who need it.

Children

The site is intended for organizations and is not directed at children.

Changes to this policy

We update this policy when the site or the law changes. The date at the top of the page shows the latest version.

Contact

For any question about this policy or your personal information: hello@croo.io, or Le Groupe Croo inc., 33 rue Prince, Montréal, Québec H3C 2M7.