Privacy policy

Le Groupe Croo inc. (“Croo”, “we”), incorporated in Québec, is responsible for the personal information it holds in its business activities. This policy explains how we collect, use, disclose and protect that information, and describes your choices and rights.

It covers croo.io, our communications, our cloud communications platform and our other products and services. It updates our previous policy to address Québec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, and other applicable laws. Service contracts remain separate.

When Croo processes information solely on behalf of a client organization, that organization’s instructions and the applicable agreement govern the processing. A request about that information may be referred to that organization. This policy does not limit your statutory rights, and reading it does not constitute blanket consent.

Personal information identifies a person directly or indirectly. We limit collection to information necessary for purposes determined before collection.

• Requests and correspondence: name, email address, organization, country and request content; role, phone number, work tools and people affected if you choose to provide them. The form distinguishes required and optional fields.
• Services and accounts: business contact details, account, billing and transaction information, and usage and support information needed for the service purchased. Specific categories depend on the features used and service-specific notices.
• Recruitment: contact details, résumé and information provided with an application.
• Browsing and security: IP address, browser, device, requested pages, dates, errors and technical signals needed to deliver and protect the site. Optional audience measurement is described below.

Information comes from you, forms, email or telephone exchanges, service use and the technologies described here. Collection from third parties requires your consent or legal authority. You may request the source of information obtained from another business, subject to statutory exceptions.

Please avoid unnecessary sensitive information or information about other people in your request. Our services are intended for organizations. In Québec, collecting information from a child under 14 requires a parent’s or guardian’s consent unless collection is clearly for the child’s benefit.

We use necessary information to answer requests, prepare proposals, provide and administer services, manage billing, provide support and security, handle complaints and meet legal obligations. Applications are used to assess candidates and manage recruitment. A new incompatible purpose requires separate consent or other legal authority.

Contact form: your message and answers, along with the page’s region and language, are sent through Courier and Microsoft 365 to cec@croo.io. That mailbox keeps a copy and forwards messages to Zoho Desk for follow-up. The site does not create a database of your answers; this does not mean messages disappear from mailboxes, support tickets or providers’ systems.

The form does not subscribe you to advertising. Any commercial communications must follow applicable consent rules and offer an unsubscribe option. Audience measurement, when configured, helps us understand site use only after you agree.

Preferences: croo_consent stores your audience measurement choice for 6 months. NEXT_LOCALE stores the region and language you select for 1 year. On arrival at the site root, an estimated country based on the connection and the browser’s language preferences may determine the suggested page; the redirect code does not retain those inputs. It does not request your GPS location.

Optional measurement: Google Analytics 4 loads only after acceptance, when configured. It measures page views and certain actions (clicks, region changes and successful form submissions), without receiving form answers. The _ga and _ga_… cookies can last up to 2 years. Our configuration denies advertising storage and advertising personalization. We do not enable remarketing on this site.

You can accept, refuse or change your choice using the cookie preferences button in the footer. Refusal does not prevent browsing or contacting us. Withdrawal stops measurement and removes Analytics cookies accessible on this domain; it does not automatically delete information already sent. Contact our privacy officer about that information.

Security: Vercel hosts the site. Cloudflare Turnstile loads when you start filling in the form and processes technical signals, including connection and browser signals, to detect abuse. It is separate from audience measurement. To avoid using it, email cec@croo.io directly. We must inform you in advance about new identification, location or profiling functions and how to activate them where the law requires it.

Internal access is limited to people who need information for their work: customer service and support, service delivery and technical staff, sales for request follow-up, accounting, recruitment and the privacy officer.

Providers support hosting and security (Vercel, Cloudflare), delivery and follow-up of requests (Courier, Microsoft 365, Zoho Desk), consented audience measurement (Google) and, depending on the service, communications, hosting, payments and support. They receive the categories of information necessary for their role. Their mandates must address confidentiality, limits on use, protection and the end of retention as required by law.

Information may be processed outside Québec, including elsewhere in Canada, the United States or other countries where providers and their subcontractors operate, and may be subject to local laws. Before a disclosure or outsourcing arrangement outside Québec, Croo must assess privacy impacts, including sensitivity, purposes, safeguards and the applicable legal framework. A transfer must provide adequate protection and be covered by a written agreement addressing the risks. You may request details of recipients, locations and safeguards applicable to your information.

Necessary information may also be disclosed where permitted or required by law, including to comply with an order, protect rights or carry out a business transaction with statutory safeguards. This policy does not authorize selling or sharing information for undisclosed purposes.

Third-party sites and services linked here have their own policies. Read them before providing information. A link is neither consent to data sharing nor an endorsement of their practices. Croo’s obligations regarding providers processing information on its behalf still apply.

Protection must be appropriate to the sensitivity, volume, purposes and medium of the information. The site uses HTTPS and limits form-failure logs to technical codes without reproducing answers. Access must be restricted to authorized people. No system can guarantee zero risk.

Retention: requests, emails and tickets are kept as long as needed to respond, follow up and meet legal obligations. Account, billing and recruitment records depend on the relevant relationship, legal requirements and applicable limitation periods. Provider copies, backups and logs must be included in retention management. Ask the privacy officer for the period applicable to your record; cookie lifetimes do not describe the retention of all information held.

Once purposes are fulfilled and mandatory retention ends, information must be securely destroyed or anonymized for serious and legitimate purposes in accordance with Québec’s regulation. Removing a name alone does not anonymize a record.

Incidents: report unauthorized access, use or disclosure, loss or other privacy breaches to legal@croo.io. Croo must reduce risks, prevent recurrence, assess potential harm with its privacy officer and maintain an incident register. Where there is a risk of serious injury, Québec’s Commission d’accès à l’information and affected people must be notified promptly, subject to statutory exceptions.

Write to the privacy officer below and describe your request. We may verify identity proportionately and help you formulate the request, without requiring excessive information.

• Access and correction: confirm whether we hold information about you, obtain a copy and request correction of inaccurate, incomplete or ambiguous information, or information whose collection, disclosure or retention is not authorized.
• Portability: in Québec, obtain computerized information collected from you in a structured, commonly used format, or have it sent to a person or organization authorized to collect it. Information created or inferred by Croo is excluded, and serious practical difficulties may limit this right.
• Withdrawal, deletion and de-indexing: withdraw consent, request deletion where the law allows, or request that dissemination cease or links be de-indexed or re-indexed under statutory conditions. These rights do not remove mandatory retention obligations.
• Exclusively automated decisions: if such processing is used to make a decision about you, you must be informed no later than when the decision is communicated. You may request the information used, the reasons and main factors and parameters, have information corrected and make observations to a person able to review the decision.

In Québec, a written access or correction request must receive a written response within 30 days of receipt. Any refusal must explain its reasons, applicable provisions, remedies and time limits. Access is free; reasonable transcription, reproduction or transmission fees may be charged only after you have been informed of the approximate amount.

Depending on the country and applicable rules, additional rights may exist, including objection and restriction of processing under the EU GDPR and UK GDPR, or rights under Switzerland’s FADP, Brazil’s LGPD, Colombia’s Ley 1581 de 2012 and Canada’s PIPEDA. You retain the right to contact the competent authority, including Québec’s Commission d’accès à l’information or the Office of the Privacy Commissioner of Canada. The language selected on the site does not by itself determine the applicable law.

The revision date appears on this page. The 3 October 2026 version consolidates the previous privacy pages, updates Croo’s address and clarifies collection, providers, consent and Law 25 rights.

Changes will be identified on this page and communicated through a suitable means to affected people where required. A policy change does not replace consent needed for a new use of information. All four language versions describe the same policy.

Where required, consent must be freely given, informed, clear and tied to specific purposes, with a separate request for each purpose. Written requests must be presented separately from other information. Sensitive information requires express consent where required by law. We can help you understand what is being requested.

You may decline optional information or withdraw consent by writing to legal@croo.io; use the footer preferences for audience measurement. Withdrawal applies to future processing based on that consent and does not make previously authorized processing unlawful. We will explain if it prevents us from responding or providing a feature that needs the information. We must not make a service conditional on unnecessary information except where permitted by law.

Person in charge of the protection of personal information (Privacy Officer)
Le Groupe Croo inc.
4388 rue Saint-Denis, suite 200 #348
Montréal, QC H2J 2L1, Canada
Email: legal@croo.io

The privacy officer oversees information protection and individual rights, approves governance rules and participates in privacy impact assessments required for projects and transfers. This role belongs to the person with the highest authority at Croo unless delegated in writing. Service managers must restrict access, apply retention and destruction rules and report incidents; staff must maintain confidentiality and use information only for their duties.

To complain, write to the officer with your contact details, the facts, relevant dates and the outcome sought. Avoid unnecessary sensitive information. The officer examines the complaint, may request clarification, coordinates necessary checks and communicates a response and any corrective measures. You may also contact the Commission d’accès à l’information du Québec or your competent local authority. An internal complaint is not a condition for exercising statutory remedies.