Tely Solutions Inc. holds the protection of personal information to the same standard as its deliverables. This policy describes what we collect, why, who we share it with, and the rights available to you. It is drawn up under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Law 25, and the European Union's General Data Protection Regulation (GDPR).
1 · Controller.
Tely Solutions Inc., 819 Woodroffe Avenue, Ottawa, Ontario K2A 0B4, Canada.
Tely acts as controller for information collected through its sites and its client portal.
Where we process personal information on behalf of a client under a development, integration or hosting engagement, we act as processor. That processing is governed by the agreement with that client, not by this policy.
2 · Person in charge of the protection of personal information.
Under section 3.1 of Quebec's Law 25, the person in charge of the protection of personal information at Tely Solutions Inc. is Pacôme Azih, Partner.
To exercise a right or report an incident: hello@tely.ca, or by post at 819 Woodroffe Avenue, Ottawa, Ontario K2A 0B4.
3 · What we collect.
Public site (tely.ca) — we collect no personal information. There is no audience measurement on this site, no advertising cookie and no behavioural tracking. Our host's logs hold an IP address, a timestamp and the page requested for a limited period, for security and operations only.
Client portal (my.tely.ca) — for the people our clients invite: name, email address, language preference, and the messages, comments and approvals they write there. This information is necessary to carry out the engagement.
Billing — when a payment is made, our payment provider processes the card details. Tely neither sees nor stores them: we receive only the amount, the status and the last four digits.
Engagements — information exchanged by email, video call and documents during an engagement.
We collect no sensitive information through our sites, and they are not directed at persons under 14.
4 · Purposes and legal bases.
Carrying out the engagement and providing portal access — contractual necessity.
Operating and securing our systems — legitimate interest, and a necessary purpose under Law 25.
Issuing and collecting invoices — contractual necessity and legal obligation.
Meeting our accounting and tax obligations — legal obligation.
No decision is made about you based solely on automated processing, and your information is not used for profiling. Disclosure required by section 12.1 of Law 25.
We never sell or rent personal information, under any circumstance.
5 · Processors and hosting.
We use the following providers, each contractually bound to process information only on our instructions: Netlify (site hosting), Neon (PostgreSQL database, us-east-2), Auth0 · Okta (authentication), Amazon Web Services S3 (deliverable file storage, us-east-2), Resend (transactional email) and Stripe (payments).
These services host their data in the United States. The Canadian or EU data residency we offer in our engagements applies to the products we build for clients, where it is set by their constraint — not to our own sites' infrastructure. We would rather say so than let it be assumed.
We may also disclose information where required by law, or in a corporate reorganisation, with equivalent protection maintained.
6 · Transfers outside Quebec and the EU.
Information handled by the providers listed above is hosted in the United States. That is a communication outside Quebec within the meaning of section 17 of Law 25.
Outside the EU, transfers rely on Canada's adequacy decision for organisations subject to PIPEDA or, failing that, on the European Commission's standard contractual clauses.
Write to hello@tely.ca for the safeguards applicable to a specific processing operation.
7 · Retention.
Client portal accounts and content: the duration of the engagement, then seven years, to meet the accounting and tax obligations that apply to contractual records and invoices.
Security logs: retained by our host under its own retention policy, for security purposes only.
Engagement correspondence: the duration of the engagement, then seven years.
At the end of these periods, information is securely deleted or irreversibly anonymised.
8 · Your rights.
Access to your personal information. Correction of information that is inaccurate, incomplete or equivocal. Deletion or withdrawal where the law provides. Portability, in a structured and commonly used technological format (Law 25 s. 27; GDPR art. 20). Withdrawal of consent at any time, free of charge. Objection to processing based on legitimate interest. Cessation of dissemination and de-indexing where Law 25 provides.
To exercise a right, write to hello@tely.ca. We respond within 30 days (Law 25, PIPEDA) or one month (GDPR). Reasonable proof of identity may be requested first.
If our response does not satisfy you: the Commission d'accès à l'information du Québec (cai.gouv.qc.ca), the Office of the Privacy Commissioner of Canada (priv.gc.ca), or your EU supervisory authority.
9 · Security.
TLS in transit across our sites and portal. Encryption at rest for production data. Least-privilege access control: a client sees only their own organisation's data, and that boundary is enforced server-side on every request, never only in the interface.
Authentication is delegated to a dedicated identity provider — Tely stores no passwords. Access logging, encrypted backups.
Where a confidentiality incident presents a risk of serious injury, we notify the individuals concerned and the relevant authorities without delay — within 72 hours where the GDPR applies.
10 · Cookies.
Only strictly necessary cookies are set, and none serves advertising, audience measurement or behavioural tracking. There are just three families:
Your language preference (“tw-lang”), kept for a year and shared across tely.ca, my.tely.ca and admin.tely.ca, so a choice made in one place holds everywhere.
Which project you are viewing in the client portal (“tw-proj”), kept for a year, which only remembers what to show you when several projects are open.
The session and cross-site request forgery (CSRF) cookies for the client portal and the admin console, issued by our authentication layer, valid for twenty-four hours, alongside very short-lived technical cookies used by the sign-in protocol itself.
Your light or dark theme is not a cookie: it stays in your browser’s local storage and is never sent to our servers. The same is true of your acknowledgement of the cookie notice.
Because none of these cookies is optional, the law does not require us to obtain your prior consent: the notice shown on your first visit is information, not a request for permission, and so it does not offer a refusal that would change nothing.
Under Law 25, privacy settings default to the highest level of protection.
11 · Changes.
Material changes are posted on this page and, where appropriate, notified by email to the people concerned. The effective date appears at the top of this document.
12 · Contact.
hello@tely.ca — personal information matters and exercise of rights.
Tely Solutions Inc., 819 Woodroffe Avenue, Ottawa, Ontario K2A 0B4, Canada.