Security & Law 25 Compliance
How BatiCore protects your data and helps you comply with Law 25 — Last updated: July 15, 2026
Trust first
BatiCore handles your estimates, your job sites and your clients' information. Here is concretely what protects that data — and, transparently, what is still to come.
Measures in place
What is Law 25?
The Act to modernize legislative provisions as regards the protection of personal information (Law 25, formerly Bill 64) has come into force progressively since 2022 in Québec. It applies to every business that collects, uses or discloses the personal information of Québec residents.
As a general contractor, you collect personal information (names, addresses, phone numbers, emails, banking details) from your clients and employees. Law 25 imposes obligations on you.
What BatiCore does for you
Your obligations as a business
| Obligation | Status | How BatiCore helps |
|---|---|---|
| Designate a privacy officer (RPRP) | In effect | Compliance module → Law 25 → Configure the RPRP |
| Register of privacy incidents | In effect | Dedicated space under Compliance → Law 25 |
| Privacy impact assessment (PIA) | In effect | PIA template provided under Compliance → Law 25 |
| Explicit consent for sensitive data | In effect | Client portal: consent recorded at each signature |
| Right to erasure on request | In effect | On request to privacy@baticore.ca — handled within 30 days (deletion or anonymization) |
| Transparency of automated decisions | In effect | Detailed in the Privacy Policy (Automated decisions section) |
| Transfers outside Québec covered (PIA) | In effect | Hosting (application, API, database, files) in Canada — Amazon Web Services, Montréal region (ca-central-1). Transfers outside Quebec limited to U.S. subcontractors (Stripe, Resend, Anthropic) and a European one (Geoapify — address geocoding), covered by s. 17 of Law 25 / PIA (see Privacy Policy). |
BatiCore acts as a processor
Within the meaning of Law 25, BatiCore acts as a processor — you are the controller of your client data. BatiCore processes your data only on your instructions and to provide the service.
BatiCore undertakes to:
- Never sell your data to third parties
- Use your data only to provide the BatiCore service
- Notify you within 72 hours of any security incident
- Provide you with a full export of your data on request
- Permanently delete your data within 30 days of termination
Full transparency
We would rather be honest about what is not yet in place than over-promise:
- Encryption at rest of client contact details (email, phone, address): planned, in addition to the encryption already applied to the most sensitive data.
- External penetration test (pentest) and OWASP review: planned before scaling up.
Write to us at support@baticore.ca
This content is provided for informational purposes only and does not constitute legal advice. To assess your compliance, consult the Commission d'accès à l'information or a legal advisor.
Questions about Law 25 compliance: privacy@baticore.ca
Privacy officer (RPRP): Cliford Saint-Natus, founder · privacy@baticore.ca · Solutions BatiCore Inc. · Saint-Basile-le-Grand, Québec, Canada