Privacy and Personal Information Protection Policy

Effective date: July 21, 2026
Last updated: July 21, 2026

1. Our commitment

Fondation Héritage Montréal, hereinafter referred to as “Héritage Montréal,” places great importance on respecting your privacy and protecting your personal information.

This policy clearly explains:

what personal information we collect;
how and why we use it;
with whom it may be shared;
how it is retained and protected;
what rights you have regarding your information;
how to contact us to ask a question, exercise a right or submit a complaint.

This policy applies to personal information collected by Héritage Montréal through its website, subdomains, forms, electronic communications and the platforms used for its activities, ticketing, online store, donations and memberships.

It does not apply to third-party websites and services that have their own privacy policies.

2. What is personal information?

Personal information is any information about an individual that directly or indirectly identifies that person.

Depending on the nature of your interaction with Héritage Montréal, we may collect the categories of information described below.

3. Information we collect

3.1 Identification and contact information

We may collect:

your first and last name;
your mailing address;
your email address;
your telephone number;
your preferred language of communication;
the name of your organization, your position or your professional title, when relevant.

3.2 Information relating to activities and events

When you purchase a ticket or register for an activity, we may collect:

the selected activity or event;
the date of the activity;
the number and category of tickets;
information relating to your registration or reservation;
your membership status, when a special rate applies;
any accessibility or other specific needs you choose to share with us;
information relating to a cancellation, transfer or refund;
your communication preferences.

3.3 Information relating to donations and memberships

When you make a donation, become a member or renew your membership, we may collect:

the amount and date of the donation;
the type of donation or membership;
your membership status;
your recognition or anonymity preferences;
the information required to issue an official receipt;
your history of donations, memberships or communications with Héritage Montréal.

3.4 Information relating to purchases and payments

When you make a donation, purchase a ticket, pay for a membership or place an order through our online store, we may collect or receive:

your name and contact information;
your billing address;
your shipping address, when required;
the products, tickets, memberships or services purchased;
the amount, taxes, date and status of the transaction;
limited information about the payment method used;
information relating to a refund, cancellation or dispute.

The information required to process the payment is transmitted to the payment service provider used for the transaction.

The full details associated with your payment card are normally collected and processed directly by the payment service provider, in accordance with its own privacy and security practices.

3.5 Information submitted through forms

We may collect the information you choose to provide when you:

complete a form on our website;
contact us;
submit a question, comment or request;
submit an alert or report concerning a heritage site;
submit an application;
register as a volunteer;
participate in a survey, contest or consultation;
send us a document, photograph or other file.

We ask that you provide only the information required to process your request.

3.6 Technical and browsing information

When you use our digital services, certain information may be collected automatically, including:

your IP address;
the type of device used;
your operating system;
the type and version of your browser;
the date and time of your visit;
the pages viewed and actions performed;
the website or page that referred you to our site;
identifiers associated with cookies;
an approximate geographic location determined from your IP address.

4. How do we collect your information?

We primarily collect your information directly from you when you:

complete a form;
contact us by email, telephone or another method;
subscribe to our newsletter;
purchase a ticket or register for an activity;
make a donation;
become a member or renew your membership;
place an order through our online store;
participate in an activity, survey, contest or consultation;
submit a heritage alert;
browse our website and accept certain cookies.

We may also receive certain information from our technology service providers when they act on our behalf and the information is required to provide the requested service.

5. Why do we use your information?

We use personal information only for the purposes identified at the time of collection or for other purposes authorized by law.

We may use it to:

process a registration, reservation or ticket purchase;
organize and manage our activities, events and guided tours;
process donations, memberships and renewals;
produce and send receipts, confirmations, tickets and invoices;
process and deliver orders from our online store;
manage our relationships with members, donors, volunteers, partners and participants;
respond to questions, comments, complaints and requests;
process heritage alerts and reports;
assess an application or request to participate;
send our newsletter or other communications to which you have consented;
conduct fundraising, awareness or mobilization campaigns;
manage communication preferences and unsubscribe requests;
improve our programming, communications and services;
ensure the operation, maintenance and security of our digital services;
understand how our website is used and produce statistics;
detect and prevent errors, abuse, fraud and security incidents;
maintain our administrative, accounting and tax records;
comply with our legal, regulatory and contractual obligations.

We may also use aggregated, de-identified or anonymized information for statistical, planning and service improvement purposes, in accordance with applicable law.

6. Platforms and service providers used

Héritage Montréal uses various specialized service providers to operate its website, manage its activities, communicate with the public and process transactions.

6.1 Tuxedo ticketing platform

Héritage Montréal uses Tuxedo, a Groupe iCible solution, for ticket sales and the management of certain activity registrations.

During a transaction, Tuxedo may process information required for the purchase, including:

your name and contact information;
the selected tickets or activities;
billing information;
the amount and status of the transaction;
information required to process the payment;
information relating to a cancellation or refund.

Information relating to your registration or purchase is made available to Héritage Montréal so that we can manage your reservation and provide the requested service.

Tuxedo’s practices are also governed by its own policies and terms.

6.2 Prodon and JeDonneEnLigne by Logilys

Héritage Montréal uses Prodon, software developed by Logilys, to manage:

donations and fundraising campaigns;
donor records;
memberships and member records;
receipt production;
communication preferences;
certain communications and follow-up activities.

Donation, membership or renewal forms may be hosted on JeDonneEnLigne, also operated by Logilys.

Information submitted through these forms may be added to the corresponding record in Prodon in order to process the transaction, issue a receipt and manage your relationship with Héritage Montréal.

6.3 Stripe

Héritage Montréal uses Stripe to process certain online payments.

As part of a transaction, Stripe may process:

your name and contact information;
your billing or shipping address;
the amount, date and status of the transaction;
information about the product or service purchased;
information required to process the payment;
technical information used to secure the transaction and prevent fraud.

Stripe processes this information in accordance with its own privacy policy and legal obligations.

6.4 Online store and Square

Héritage Montréal uses Square to operate its online store and process payments associated with orders.

When you place an order, Héritage Montréal and Square may process:

your name;
your email address and telephone number;
your billing address;
your shipping address;
the products ordered;
the amount, taxes and status of the transaction;
information required to process the payment;
information relating to delivery, refunds or customer service;
information required to send a digital receipt.

Square processes this information in accordance with its own policies and obligations.

Héritage Montréal uses Cakemail, also known as Courrielleur, to manage its newsletter and certain electronic communications.

When you subscribe to our newsletter, we may collect:

your email address;
your first and last name;
your preferred language of communication;
your subscription preferences;
information relating to the receipt and viewing of our communications.

This information is used to:

send you our newsletter;
inform you about our activities, campaigns, positions and news;
manage your communication preferences;
measure the receipt and viewing of our communications;
manage unsubscribe requests and comply with our legal obligations.

You may unsubscribe at any time by using the link provided at the bottom of our emails or by writing to contact@heritagemontreal.org.

Unsubscribing from our newsletter will not prevent you from receiving communications required for a transaction or requested service, such as a ticket, confirmation, receipt or notice concerning an activity for which you have registered.

6.6 Hosting by Rocket.net

Héritage Montréal’s website is hosted using the services of Rocket.net.

As part of the hosting, maintenance, security and operation of the website, Rocket.net may process certain technical information, such as IP addresses, connection logs and information relating to devices and requests sent to the website.

6.7 Google Analytics

Subject to your cookie preferences, Héritage Montréal uses Google Analytics to better understand website traffic and usage.

Google Analytics may process information concerning:

the pages viewed;
the duration and timing of visits;
interactions performed on the website;
the type of device, browser and operating system used;
the general source of visits;
an approximate geographic location;
identifiers associated with cookies or the device used.

This information helps us produce statistics, assess the performance of our content and improve navigation on our website.

7. Cookies

Our website uses cookies and similar technologies.

A cookie is a small file stored or read on your device when you visit a website.

7.1 Necessary cookies

Certain cookies are required for the operation and security of the website. They may be used to:

maintain a session;
protect forms;
enable a transaction;
remember your privacy choices;
detect certain malicious activities.

Because these cookies are required for the website to operate, they generally cannot be disabled through our cookie management tool.

7.2 Preference cookies

These cookies allow the website to remember certain choices, such as your language or display preferences.

7.3 Audience measurement cookies

Audience measurement cookies allow us to understand how people use our website, including which pages are viewed and how visitors navigate between them.

When your consent is required, these cookies are activated only after you have indicated your choice.

7.4 Managing your preferences

You may accept, refuse or change your preferences using the cookie management tool available on our website.

You may also limit or delete cookies through your browser settings. Refusing certain cookies may, however, reduce some website functionality.

External platforms to which we direct you, including Tuxedo, JeDonneEnLigne, Stripe and Square, may use their own cookies in accordance with their respective policies.

When required by law, Héritage Montréal obtains your consent before collecting, using or disclosing your personal information.

We seek to collect only the information required for the stated purposes.

Certain information is required in order for us to provide a service. For example, without your contact information and the information required for payment, we will not be able to process a ticket purchase, donation, membership or order.

Optional information may be left blank.

You may withdraw your consent to certain uses or disclosures, subject to applicable legal and contractual restrictions.

Withdrawing your consent may prevent us from continuing to provide a service that depends on the use of the information concerned. It does not invalidate uses or disclosures lawfully made before the withdrawal.

To withdraw your consent, you may contact us at contact@heritagemontreal.org.

Access to personal information is limited to staff members, authorized volunteers, consultants and service providers who require the information to perform their duties or carry out their mandate.

We may disclose information to the following categories of third parties:

ticketing and registration management service providers;
payment service providers;
online store and delivery service providers;
donation and membership management service providers;
newsletter and communication service providers;
website hosting, maintenance and information security providers;
analytics and audience measurement service providers;
backup and storage providers;
accountants, auditors, insurers, legal counsel and other professional advisers;
partners directly involved in organizing an activity, when necessary and appropriate;
government bodies, tax authorities, courts or law enforcement authorities, when permitted or required by law.

Our service providers may use the information entrusted to them only to the extent required to provide their services, subject to their contractual and legal obligations.

Héritage Montréal does not sell or rent your personal information.

10. Processing outside Québec

Certain service providers, their affiliates, subcontractors or technological infrastructures may be located outside Québec or Canada.

This may apply to certain services involving:

hosting;
payment processing;
ticketing;
online stores;
electronic communications;
audience measurement;
storage, backup or technical support.

As a result, certain personal information may be disclosed, processed or stored in another jurisdiction and be subject to the laws applicable there. Authorities in that jurisdiction may, in certain circumstances, have access to the information in accordance with the law.

Before disclosing personal information outside Québec, Héritage Montréal takes the reasonable measures required to assess privacy risks and to govern its use, disclosure, retention and protection.

11. Retention and destruction of information

Héritage Montréal retains personal information only for the period required to fulfil the purposes for which it was collected and to comply with its legal, tax, accounting, administrative and contractual obligations.

The retention period varies depending on:

the nature of the information;
the reason it was collected;
the sensitivity of the information;
applicable legal and regulatory requirements;
the limitation periods applicable to legal proceedings;
Héritage Montréal’s reasonable administrative needs.

Information relating to a donation, membership, transaction or receipt may need to be retained longer than information relating to a general request.

When the information is no longer required, it is securely destroyed or anonymized in accordance with applicable requirements.

Héritage Montréal also governs the retention and destruction of information held by its service providers, according to the nature of the service and the applicable terms.

12. How do we protect your information?

Héritage Montréal takes reasonable administrative, technical and physical measures to protect personal information against:

loss;
theft;
unauthorized access;
unauthorized use or disclosure;
alteration;
copying;
unauthorized destruction.

These measures may include:

limiting access based on roles and responsibilities;
using individual accounts and authentication mechanisms;
managing access permissions for systems and platforms;
protecting devices and accounts used by our staff;
providing staff awareness training on confidentiality;
confidentiality obligations and commitments;
retaining information in protected systems;
backup and recovery mechanisms;
updating and maintaining technological tools;
reviewing and removing access that is no longer required;
procedures for managing confidentiality incidents;
securely destroying or anonymizing information that is no longer required.

Héritage Montréal also relies on the security measures implemented by its specialized service providers, including Rocket.net, Tuxedo, Logilys, Stripe, Square, Cakemail and Google.

Depending on the services used, these providers may implement their own mechanisms for:

encrypting communications;
controlling and managing access;
protecting and monitoring infrastructure;
backup and recovery;
detecting and preventing fraud;
managing vulnerabilities;
managing incidents;
complying with standards applicable to payment processing.

These measures are managed by each provider in accordance with its own policies, contractual commitments and legal obligations.

Héritage Montréal seeks to select service providers that are appropriate for the nature and sensitivity of the information processed and to limit the information disclosed to them to what is required to perform their mandate.

Despite the measures implemented, no computer system, cloud service or method of transmission over the Internet can guarantee absolute security.

In the event of a confidentiality incident, Héritage Montréal will take reasonable measures to reduce the risks and prevent a similar incident from occurring again. When required by law, Héritage Montréal will notify the individuals concerned and the Commission d’accès à l’information du Québec.

13. Governance and responsibilities

Héritage Montréal has implemented practices governing the management and protection of personal information throughout its life cycle.

These practices are intended to govern:

the collection, use and disclosure of information;
access granted to staff members;
the use of external service providers;
the retention, destruction and anonymization of information;
the prevention and management of confidentiality incidents;
the processing of access and correction requests;
the handling of questions and complaints;
the roles and responsibilities of staff members.

The person responsible for the protection of personal information oversees the application of these practices.

Staff members must protect the confidentiality of the information to which they have access and may use it only in the course of their duties.

14. Information concerning minors

Héritage Montréal does not seek to collect personal information directly from individuals under the age of 14 without the consent of the holder of parental authority or the guardian, except in circumstances permitted by law.

When an activity is intended for children or school groups, the required information is normally collected from the parent, guardian, educational institution or an authorized person.

15. Your rights

Subject to the conditions and exceptions provided by law, you may request:

confirmation as to whether Héritage Montréal holds personal information about you;
access to that information and a copy of it;
correction of inaccurate, incomplete or ambiguous information;
an update to your contact information;
withdrawal of your consent to certain uses or disclosures;
information about how your information is collected, used, retained and disclosed;
information about the categories of individuals who have access to your information within Héritage Montréal;
where applicable, certain computerized information in a structured and commonly used technological format;
that the dissemination of personal information cease or that a link be de-indexed, when the conditions provided by law are met;
to submit a complaint concerning our personal information protection practices.

Any request must be made in writing and contain enough information to allow us to:

confirm your identity;
locate the information concerned;
understand the nature of your request.

We may ask you to provide appropriate proof of identity. It will be used only to verify your identity.

Héritage Montréal will respond to your request within the time limits provided by law. Certain requests may be refused or limited in circumstances authorized by law. If so, we will explain the applicable reasons.

16. Questions and complaints

You may contact the person responsible for the protection of personal information to:

ask a question about this policy;
request access to your information;
request a correction;
withdraw consent;
report a confidentiality concern;
submit a complaint concerning the collection, use, disclosure, retention or protection of your information.

A complaint should clearly describe:

the situation concerned;
the personal information involved;
the relevant dates or events;
the desired solution or follow-up, when applicable.

Héritage Montréal will review the complaint confidentially and impartially. The person responsible may contact you to obtain additional information or supporting documents.

After reviewing the complaint, Héritage Montréal will provide its response and, where appropriate, describe the measures taken or being considered.

A person who is dissatisfied with the handling of a request or complaint may also contact the Commission d’accès à l’information du Québec.

17. Person responsible for the protection of personal information

The person responsible for the protection of personal information oversees compliance with this policy and applicable laws.

Robert Turgeon
Executive Director and Person Responsible for the Protection of Personal Information
Fondation Héritage Montréal
3575 Saint-Laurent Boulevard, Suite 480
Montréal, Québec H2X 2T7
Telephone: 514-286-2662
Email: contact@heritagemontreal.org

Requests should preferably include “Protection of Personal Information” in the email subject line or on the envelope.

18. Third-party websites and services

Our website may contain links to websites, social networks, applications or services operated by third parties.

When you leave Héritage Montréal’s digital services, information collected by these third parties is governed by their own privacy policies and terms.

Héritage Montréal is not responsible for the privacy practices of external websites and services. We encourage you to review their policies before providing them with personal information.

19. Changes to this policy

Héritage Montréal may amend this policy to reflect:

changes to its activities;
changes to its services or service providers;
changes to its technological practices;
new legal or regulatory requirements.

The date of the most recent update appears at the beginning of the policy.

When changes are significant, Héritage Montréal will take reasonable steps to inform the individuals concerned, for example through a notice on its website or an electronic communication.