Security & Law 25 Compliance
How BatiCore protects your data and helps you comply with Law 25 — Last updated: July 15, 2026
Trust first
BatiCore handles your estimates, your job sites and your clients' information. Here is concretely what protects that data — and, transparently, what is still to come.
Measures in place
What is Law 25?
The Act to modernize legislative provisions as regards the protection of personal information (Law 25, formerly Bill 64) has come into force progressively since 2022 in Québec. It applies to every business that collects, uses or discloses the personal information of Québec residents.
As a general contractor, you collect personal information (names, addresses, phone numbers, emails, banking details) from your clients and employees. Law 25 imposes obligations on you.
What BatiCore does for you
Your obligations as a business
| Obligation | Status | How BatiCore helps |
|---|---|---|
| Designate a privacy officer (RPRP) | In effect | Compliance module → Law 25 → Configure the RPRP |
| Register of privacy incidents | In effect | Dedicated space under Compliance → Law 25 |
| Privacy impact assessment (PIA) | In effect | PIA template provided under Compliance → Law 25 |
| Explicit consent for sensitive data | In effect | Client portal: consent recorded at each signature |
| Right to erasure on request | In effect | On request to privacy@baticore.ca — handled within 30 days (deletion or anonymization) |
| Transparency of automated decisions | In effect | Detailed in the Privacy Policy (Automated decisions section) |
| Transfers outside Québec covered (PIA) | In effect | Hosting (application, API, database, files) in Quebec — OVHcloud, Beauharnois data centre (Montérégie); backup copies encrypted before upload, kept in Montréal (Amazon Web Services, ca-central-1 region). Transfers outside Quebec to service providers, mostly in the United States (full list in the Privacy Policy), covered by s. 17 of Law 25 / PIA. At your initiative only: your own QuickBooks Online (Intuit, USA) if you connect it, and your own Stripe account (USA) if you turn on online payment of your invoices. |
BatiCore acts as your agent (mandataire)
For the information about your clients, employees and subcontractors, you are responsible. BatiCore processes it on your behalf, under a service contract, only to provide you with the service — our commitments are set out in Schedule A of the Terms of Use.
BatiCore undertakes to:
- Never sell your data to third parties
- Use your data only to provide the BatiCore service
- Notify you without delay of any confidentiality incident affecting your information
- Provide you with a full export of your data on request
- Anonymize the personal information in your account 30 days after the end of your subscription
Full transparency
We would rather be honest about what is not yet in place than over-promise:
- Encryption at rest of client contact details (email, phone, address): planned, in addition to the encryption already applied to the most sensitive data.
- External penetration test (pentest) and OWASP review: planned before scaling up.
Write to us at support@baticore.ca
This content is provided for informational purposes only and does not constitute legal advice. To assess your compliance, consult the Commission d'accès à l'information or a legal advisor.
Questions about Law 25 compliance: privacy@baticore.ca
Privacy officer (RPRP): Cliford Saint-Natus, founder · privacy@baticore.ca · Solutions BatiCore Inc. · Saint-Basile-le-Grand, Québec, Canada