Compliance isn't a layer applied at the end of a project. It's a design constraint, like performance or accessibility — and like them, it costs ten times less built in than bolted on. This page covers two distinct things: how we hold ourselves to these frameworks, and how we build them into what we make for you.
What we apply to ourselves.
A designated person in charge — Pacôme Azih, Partner, is the person in charge of the protection of personal information within the meaning of section 3.1 of Law 25. Contact details are published in our privacy policy.
Minimisation — we collect only what a stated purpose needs. A field nobody can name a use for doesn't make it onto the form. Our public site carries no audience measurement and no advertising cookie: we have no use for them, so we don't set them.
Privacy by default — settings on our products and sites sit at the highest level of protection without the user having to do anything.
Tenancy that is actually tested — in our client portal, every read and every write is confined to the session's organisation, server-side, and that boundary is covered by automated tests that fail if it gives way. A rule no test protects is not a rule, it is an intention.
Honesty about hosting — our own services are hosted in the United States, and we write that in our privacy policy rather than leaving it to be assumed.
What we build into your product.
At scoping — the regulatory constraint is identified in week 1, alongside the problem and the market. It shapes the data model, not the final week of the project.
In the data model — legal basis per data category, retention period per table, deletion and anonymisation designed in, access logging on sensitive data.
In the interface — granular, revocable consent; refusal as easy as acceptance; working mechanisms for access, correction and portability. Built, not promised in a policy.
In the infrastructure — data residency in Canada or the EU as your constraint requires. Encryption in transit and at rest, least-privilege access, encrypted backups, tested restore.
In the documents — privacy policy, terms, processing register and incident procedure delivered with the product, in French and English.
Bilingualism.
French and English carry equal legal weight and equal editorial quality. Our documents aren't translated afterwards — they're written in both languages.
For a product serving Quebec, that isn't a preference. It's the law.
What we are not.
We are neither a law firm nor a certification body. We build systems designed to withstand regulatory scrutiny, and we document our choices so your counsel can validate them quickly.
The legal decisions are yours, and the legal advice is your lawyer's. We work well alongside them — and scoping is the right moment to bring them in.
Contact.
To exercise a right or report an incident: hello@tely.ca.
For a question about compliance on a project: hello@tely.ca.