Privacy policy

Person responsible for privacy

StemJee Inc. is responsible for the personal information collected on the stemjee.com website. The company's President is accountable for its protection and for compliance with this policy.

• Steve Johnston, President, person responsible for the protection of personal information
• Email: [email protected]
• Address: StemJee Inc., 266 rue de la Galène, Gatineau, Quebec J8Z 3P5

Contact him with any question about your information, to exercise your rights or to make a complaint.

Our governance

Internal rules govern how we handle your information, from collection to destruction.

• Accountability: our President, Steve Johnston, ensures that these rules and the law are followed. Any new tool that involves personal information is assessed before it is used.
• Access: only the StemJee people who need your information for their work can view it.
• Retention and destruction: we apply the periods listed below, then destroy the information.
• Complaints: write to the person responsible at [email protected]. We acknowledge your complaint, review it and respond in writing within 30 days. If you are not satisfied with our response, you can contact the appropriate authority (see “Your rights”).
• Incidents: we assess every incident, record it in a register and notify the individuals and authorities concerned when the law requires it.

What we collect, why and how

The website does not ask you to create an account or a password. We collect only the information below, for the purposes stated. We do not use it for other purposes without your consent, unless the law permits or requires it, and we do not sell or rent it.

• ÉCO^TM pre-assessment, what we receive: your answers to the questions, anything you type in the free-text fields and your profile. Microsoft also receives the technical data of the connection (IP address). The questionnaire does not ask for your name or email address. Avoid typing personal information in the free-text fields: if you do, we receive it with your answers.
• ÉCO^TM pre-assessment, what we do with it: Microsoft Power Automate sends us your answers, which we store in a StemJee SharePoint list. They carry a randomly generated response number, shown with your assessment. We use them to understand the needs of organizations and to improve the pre-assessment and our services.
• Your profile: it is calculated in your browser from your answers, then sent with them. It is an indicative result: no automated decision is made about you. The “Send by email” button opens your own email program: the message goes to the address you choose, without passing through us.
• Appointments: when you book a meeting in the Calendly calendar (it loads only if you click “Show the calendar”), Calendly collects on our behalf your name, your email address and any details you choose to add. We use them to hold the meeting and to write to you about it.
• Audience measurement, only with your consent: if you accept, Google Analytics collects the pages you visit, where your visit came from, your device and browser type, and an approximate location (city or region) derived from your IP address, without storing that address. We use it to see which pages are useful and to improve the website. Google Signals is turned off: this data is not linked to your Google account or used for advertising. Without your consent, Google Analytics is not even loaded: neither StemJee's nor Calendly's, which can only load once the calendar is shown (see “Cookies”).
• Technical logs: with every visit, your browser sends technical data (IP address, browser type, page requested, date and time). Cloudflare, which protects and delivers the website, processes it to block attacks and bots, keep the website running and count overall traffic. This count uses no cookies; the __cf_bm cookie is used only to detect bots.

The website is intended for business leaders and their teams. It is not intended for children under 14.

Cookies

A cookie is a small file placed in your browser. No audience measurement, advertising or profiling cookie is turned on by default: Google Analytics cookies wait for your consent in the banner, and Calendly's wait until you choose to show the calendar. On your first visit, a banner offers “Accept” and “Decline”, shown with equal weight, or “Choose” to decide in detail.

• __cf_bm (Cloudflare, necessary): helps tell visitors from bots. It expires after 30 minutes of inactivity.
• cc_cookie (StemJee, necessary): remembers your cookie choice for 6 months.
• _ga (Google Analytics, audience measurement): assigns a random identifier to your browser to count visits. Only with your consent; 13 months.
• _ga_<ID> (Google Analytics, audience measurement): keeps track of the state of your visit. Only with your consent; 13 months.

You can change your mind at any time with the “Cookie settings” link at the bottom of the website's pages. If you withdraw your consent, the Google Analytics cookies are deleted. You can also block or delete cookies in your browser settings.

On our booking pages, the Calendly calendar loads only if you click “Show the calendar”: nothing from Calendly loads before that click. Once shown, it is served by Calendly, in the United States. Calendly places its own cookies there and loads services it needs to operate, including Stripe (payments) and Google reCAPTCHA (bot detection). It also uses measurement and marketing tools there, including third-party tools: Google Analytics, the Meta (Facebook) pixel, Segment, Braze and Sprig (which includes a session recording module). Calendly may show you its own cookie banner, which lets you decline these tools. All of this is governed by Calendly's privacy notice. If you would rather not show the calendar, email us at [email protected] to set up a meeting.

Service providers and processing outside Canada

We rely on service providers for some tasks. Each one receives only what it needs for its task.

• OVHcloud (OVH Hosting Inc., Montréal): website hosting, on a server in Canada (Beauharnois data centre).
• Cloudflare (Cloudflare, Inc., United States): network, security and delivery of the website, through a global network of data centres.
• Microsoft (Power Automate and SharePoint): receiving and storing pre-assessment answers, in StemJee's Microsoft 365 environment, hosted in Canada.
• Calendly (Calendly, LLC, United States): appointment booking, only if you show the calendar or open our page on Calendly.
• Google (Google LLC, United States): audience measurement, only with your consent.

Cloudflare, Calendly and Google are U.S. companies: your information may be processed in the United States or elsewhere in the world. We remain responsible for your information when a service provider processes it, and we require by contract a comparable level of protection. We limit the information shared to what is strictly necessary. Information processed outside Canada is subject to the laws of the country where it is processed and may be accessed by that country's courts, law enforcement and national security authorities.

For residents of Quebec, before sending information outside Quebec, we assess the risks to your privacy (a privacy impact assessment) and enter into a written agreement that requires the provider to protect it properly, as Quebec law requires.

We may also disclose information without your consent where the law requires it, for example under a court order.

Retention and destruction

We keep your information only as long as needed for the purposes for which it was collected. After that, we destroy it or anonymize it irreversibly.

• Pre-assessment answers: 24 months after submission, then deleted.
• Appointments: as long as needed to hold the meeting and follow up on it, then deleted.
• Google Analytics cookies: no more than 13 months in your browser.
• Data in Google Analytics: 14 months, then deleted automatically. Aggregated reports, which cannot identify you, may be kept longer.
• Cookie choice (cc_cookie): 6 months.
• Technical logs: under Cloudflare's retention rules, for the security and operation of its network.

Your rights

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you can:

• Access: find out what information we hold about you and receive a copy.
• Correction: have inaccurate or incomplete information corrected.
• Withdraw your consent: at any time, for example to audience measurement, with the “Cookie settings” link.

If you live in Quebec, Quebec's Law 25 (Act respecting the protection of personal information in the private sector) also applies. It adds the right to have the dissemination of information about you stopped or a link to it de-indexed, in the cases it provides for, and the right to receive the information you gave us in a structured, commonly used technological format.

To exercise a right, write to the person responsible for privacy at [email protected]. We will respond in writing within 30 days of receiving your request. We may ask you to confirm your identity. For your pre-assessment answers, give us the response number shown with your assessment (it also appears in the email from the “Send by email” button): since the questionnaire does not ask for your name, this number is how we find your answers. If you have lost it, give us the approximate date you submitted it, your profile and what you wrote in the free-text fields: we will check that the answers match before we share them with you.

If you are not satisfied with our response, you can file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca). If you live in Quebec, you can also file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

Safeguards and privacy breaches

We protect your information with safeguards suited to its sensitivity: encrypted connections (HTTPS) across the website, access to answers limited to the StemJee people who need it, and service providers bound by contract to security measures.

If a breach of security safeguards creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify the individuals affected as soon as feasible. If an incident involving the information of Quebec residents presents a risk of serious injury, we also promptly notify the Commission d'accès à l'information and the individuals concerned. We record every breach, whether or not it must be reported, in a register that we keep for at least five years and provide to the authorities on request.

The ten privacy principles we follow

This policy applies the ten fair information principles set out in PIPEDA:

• Accountability: a person responsible for privacy is designated (see above).
• Identifying purposes: we state why we collect each type of information.
• Consent: audience measurement only with your consent, which you can withdraw.
• Limiting collection: no account, and the pre-assessment does not ask for your name.
• Limiting use, disclosure and retention: only for the stated purposes, for set periods.
• Accuracy: you can have your information corrected.
• Safeguards: protection suited to the sensitivity of the information.
• Openness: this policy describes our practices in plain language.
• Individual access: you can access the information we hold about you.
• Challenging compliance: you can complain to us, then to the Office of the Privacy Commissioner of Canada.

Changes to this policy

We update this policy when our practices change, for example when we add a tool. The last updated date appears at the top of the page, and the history below summarizes each change. If a significant change affects how we use your information, we announce it on the website before it takes effect.

• September 21, 2026: policy rewritten for the new website (hosting in Canada, pre-assessment, appointments, audience measurement with your consent, service providers, cookies, governance).