Privacy Policy

This Privacy Policy describes how Waiver Counsel Inc. (a Canadian federal corporation) and its affiliated U.S. law firm [Attorney Name] PLLC collect, use, disclose, and protect personal information. It is designed to comply with the federal Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec Law 25 (An Act respecting the protection of personal information in the private sector), and the California Consumer Privacy Act (CCPA) for California residents.

1. Data controllers and contact

We operate as two legally separate entities. The table below describes which entity acts as controller for each category of personal information.

Privacy Officer / Person-in-Charge (Quebec Law 25): [Privacy Officer Name], reachable at privacy@waivercounsel.ca.

2. Information we collect

We collect only the information required to provide the service and to meet our regulatory obligations. Specifically:

• Contact information (name, email, phone, mailing address) that you submit to the contact form or the consult booking form.
• Post-retainer legal-file data (court records, RCMP C-216C, personal statement) that we collect and process on behalf of [Attorney Name] PLLC.
• Technical and usage data (IP address, browser, referrer, consent choices) that our consent-gated analytics tooling captures only if you accept analytics cookies.

3. Purposes

• Respond to your inquiry and prepare your file.
• Coordinate your I-192 filing (post-retainer) with [Attorney Name] PLLC.
• Comply with Canadian and U.S. regulatory obligations (tax records, retention, anti-money-laundering where applicable).
• With your explicit CASL opt-in, send you occasional marketing updates about Waiver Counsel service changes and regulatory developments.

4. Legal basis

We rely on your consent for every use of your personal information beyond what is strictly necessary to provide the service you requested. Consent for marketing communications is double-opt-in under CASL. You can withdraw consent at any time by emailing privacy@waivercounsel.ca.

5. Retention

• Marketing and intake data: retained for 24 months of inactivity, then automatically deleted.
• Legal-file data: retained by [Attorney Name] PLLC for seven years post-matter close under [State] bar rules.
• Error telemetry (Sentry): retained for 90 days rolling.
• Call metadata (CallRail): retained for 12 months rolling.

6. Subprocessors

The current subprocessor list is maintained in /legal/subprocessors (placeholder) and in infrastructure/docs/data-map.md. We notify users 30 days in advance of adding a new subprocessor that processes personal information of Quebec residents.

7. Cross-border transfers

Legal-file data is transferred to [Attorney Name] PLLC in [State], U.S.A. under the signed retainer — because CBP adjudicates the I-192 and only a U.S.-licensed attorney can file via e-SAFE. Marketing data is processed by U.S. subprocessors (HubSpot, Resend, Intercom, ActiveCampaign, DocuSign, Stripe). These transfers are disclosed explicitly and consent is captured via CookieYes for non-essential categories.

8. Your rights

• Access, correction, and deletion of your personal information (PIPEDA § 9).
• Portability of the data you provided (Quebec Law 25 § 27).
• Withdrawal of consent at any time.
• To exercise any of these rights, email privacy@waivercounsel.ca. We respond within 30 days (or 45 days where CCPA applies).

9. Security and breach notification

We maintain reasonable administrative, technical, and physical safeguards. Every subprocessor handling personal information is SOC 2 Type II certified. Our 72-hour breach-notification runbook is documented in our internal incident-response procedures.

10. Automated decision-making

We do not use automated decision-making with legal or similarly significant effect on you, within the meaning of Quebec Law 25 §12.1. The attorney's merit opinion is authored by a licensed lawyer.

11. Contact

Privacy Officer · Waiver Counsel Inc. · [Street Address], [City], [Province], [Postal Code] · privacy@waivercounsel.ca