McGinnis & Associé — CRM Investigation Platform
Version: 1.0
Effective date: January 1, 2026
Last updated: April 23, 2026
This platform, referred to as "Polaris CRM Investigation" or simply "the Platform", is operated by:
McGinnis & Associéhereinafter referred to as "McGinnis & Associé", "we", "our" or "us".
The Platform is a customer relationship management (CRM) system for internal and professional use, designed for the management of investigation mandates. It is hosted on Amazon Web Services (AWS) cloud infrastructure on Canadian territory.
These terms of use and privacy policy (hereinafter the "Terms") apply to:
These Terms comply with the following laws:
For the purposes of these Terms, the following terms have the meanings set out below:
Accessing the Platform constitutes full and unconditional acceptance of these Terms. Any user who does not accept these Terms must immediately cease using the Platform and contact McGinnis & Associé to deactivate their account.
Internal users (employees and agents) confirm their acceptance upon account creation and upon any significant update to these Terms.
Subjects whose information is processed are informed of these Terms through the principal who submitted the service request, in accordance with the transparency obligations set out in Law 25.
The Platform is restricted-access. All accounts must be created and authorized by a designated administrator of McGinnis & Associé. There is no public self-registration mechanism.
Access to data is strictly limited based on the role assigned to each user (role-based access control — RBAC). Sensitive text data is only accessible to authorized managers and IT personnel who have undergone a background check (backcheck).
The Polaris CRM Investigation Platform is strictly for professional use, reserved exclusively for authorized employees, agents, investigators and partners of McGinnis & Associé. It is not intended for the general public or minors. Any unauthorized access is strictly prohibited and subject to legal action.
The Platform offers the following services exclusively within the scope of McGinnis & Associé's professional mandates:
McGinnis & Associé does NOT collect:
The personal information collected is used exclusively for the following purposes:
McGinnis & Associé formally commits to NOT:
The processing of personal information is based on the following legal grounds, in accordance with Law 25 and PIPEDA:
Consent may be withdrawn at any time [see section 15], subject to legal retention obligations.
Media files (photos, videos, audio recordings) uploaded in connection with an investigation mandate or a pre-employment request are retained for a maximum period of THIRTY (30) DAYS following the closure of the file or the finalization of the request processing.
Upon expiry of this period, media files are destroyed in a secure and irreversible manner, so that they cannot be reconstituted, in accordance with section 23 of Law 25.
Text data (file information, reports, client data, verification results) is retained in a secure database hosted on certified cloud infrastructure (Canada) for a maximum period of FIVE (5) YEARS following the closure of the file, in order to meet applicable legal, regulatory and accounting obligations.
Upon expiry of this five-year period, text data is destroyed in a secure manner, unless a legal obligation (e.g., ongoing court proceedings) requires extended retention.
Access to this data is strictly limited to authorized managers and IT personnel who have undergone a background check (backcheck), in accordance with the internal access control policy.
Application logs and browsing data collected via Google Analytics 4 are retained for a maximum period of THIRTEEN (13) MONTHS, in accordance with the standard retention settings of Google Analytics 4, then anonymized or automatically deleted.
Data destruction is carried out by:
The Platform's entire infrastructure is hosted on Amazon Web Services (AWS) on Canadian territory, ensuring that data remains in Canada under normal operations.
Hosting with AWS is subject to the Amazon Web Services privacy policy, available at: https://aws.amazon.com/privacy/. AWS acts as a data processor on behalf of McGinnis & Associé and is bound by a Data Processing Agreement (DPA) compliant with Canadian requirements.
McGinnis & Associé uses the following third-party services and institutional partners in the operation of the Platform and the execution of mandates. Each party acts as a legally authorized subcontractor or partner and is subject to contractual or legal obligations for the protection of personal information.
Purpose: Collection and analysis of Platform usage metrics (number of visits, pages viewed, session duration, etc.) for service improvement purposes only.
Data transmitted: IP address (anonymized), browsing data, anonymous session identifiers.
Location: Google servers (potentially outside Canada — United States). See section 14 for applicable contractual guarantees.
Privacy policy: https://policies.google.com/privacy
Opt-out: Users can disable Google Analytics by installing the Google Analytics Opt-out Add-on: https://tools.google.com/dlpage/gaoptout
Purpose: Protection against automated submissions (bots) on Platform forms. Google reCAPTCHA v3 transparently analyzes user browsing behavior to assign a risk score, without any visible interaction.
Data transmitted: IP address, browsing behavior data, existing Google cookies in the browser.
Important note (reCAPTCHA v3): Unlike version v2, reCAPTCHA v3 operates in the background without any visible user action. Behavioral data may be transmitted to Google servers (United States) upon each loading of a protected page.
Privacy policy:
https://policies.google.com/privacy
Terms of service:
https://policies.google.com/terms
Exclusively within the scope of its professional mandates (background checks, investigations, pre-employment), McGinnis & Associé may be required to communicate personal information to the following bodies and partners, depending on the nature of the mandate and applicable legal authorizations:
McGinnis & Associé cooperates with Canadian law enforcement agencies within the legal framework of its mandates, including:
The communication of personal information to these bodies is only carried out upon presentation of a legal warrant, a court order from a competent tribunal, or in cases expressly provided for by law.
McGinnis & Associé may be required to communicate information to the following judicial authorities, in strict compliance with applicable legal procedures:
In the context of credit verification mandates, McGinnis & Associé may consult records at the following agencies, with the subject's express consent where required by law:
These agencies are subject to the Personal Information Protection and Electronic
Documents Act (PIPEDA) and their own privacy policies:
https://www.transunion.ca/en/privacy
https://www.consumer.equifax.ca/personal/privacy/
McGinnis & Associé may engage specialized companies for criminal record checks, court record searches, professional reference checks and employment history verifications, including but not limited to any accredited service provider legally operating in this field in Canada (e.g., Backcheck, Sterling, or certified equivalent).
These providers must have signed a Data Processing Agreement compliant with Law 25 before any communication of personal information.
McGinnis & Associé implements appropriate technical and organizational security measures to protect personal information against unauthorized access, disclosure, alteration or destruction, including:
Every authorized user is responsible for the confidentiality of their login credentials. Sharing credentials with a third party is strictly prohibited. Any security incident (loss, theft, unauthorized use of an account) must be reported immediately to the Privacy Officer (info@mgassocie.com).
In accordance with section 17 of Law 25, before communicating personal information outside Québec, McGinnis & Associé conducts or has conducted a Privacy Impact Assessment (PIA) to ensure that the information receives adequate protection.
McGinnis & Associé ensures that any transfer outside Québec is governed by contractual guarantees equivalent to the requirements of Law 25, in particular through the conclusion of Data Processing Agreements (DPAs) compliant with each relevant subcontractor.
Individuals may object to transfers outside Québec for analysis purposes (Google Analytics) by using the Google Analytics opt-out extension or by exercising their rights as described in section 15.
In accordance with Law 25 (arts. 27 to 40) and PIPEDA, every person whose personal information is processed by McGinnis & Associé has the following rights:
To exercise these rights, please submit a formal request through the dedicated form accessible at the following address:
McGinnis & Associé — Privacy RequestsMcGinnis & Associé commits to responding within thirty (30) days of receiving the request, in accordance with Law 25.
In accordance with articles 3.5 to 3.8 of Law 25, McGinnis & Associé maintains a complete register of privacy incidents as well as a logging system (logs) enabling the production of a detailed report of any incident that occurs on the Platform. This register is accessible upon request from the Commission d'accès à l'information (CAI).
In the event of a privacy incident presenting a risk of serious harm to one or more individuals:
The Platform uses the following categories of cookies:
Users can manage their non-essential cookie preferences through their browser settings. Disabling essential cookies will result in the inability to use the Platform.
All elements constituting the Platform — including source code, graphical interfaces, databases, logos, trademarks and any original content — are the exclusive property of McGinnis & Associé and are protected by Canadian and Québec laws on copyright and intellectual property, in particular the Copyright Act (R.S.C. 1985, c. C-42).
Any unauthorized reproduction, distribution, modification or use of all or part of the Platform is strictly prohibited.
To the extent permitted by applicable law, McGinnis & Associé shall not be held liable for indirect, incidental, special or consequential damages resulting from the use of or inability to use the Platform, including data losses resulting from a technical failure beyond its control.
McGinnis & Associé commits to maintaining the Platform available to the extent reasonably possible, but does not guarantee uninterrupted availability. Service interruptions may occur for maintenance, update or force majeure reasons.
The user is responsible for the accuracy of the information they enter into the Platform. McGinnis & Associé cannot be held responsible for the consequences arising from inaccurate information provided by the user or the principal.
McGinnis & Associé reserves the right to modify these Terms at any time. Users will be notified of any significant changes by email (via Microsoft Office 365) and/or by a notice posted on the Platform.
The version in force is the one accessible on the Platform or transmitted upon request to the Privacy Officer. Continued use of the Platform after notification of changes constitutes acceptance of the new terms.
These Terms are governed by and construed in accordance with the laws of the province of Québec and the federal laws of Canada applicable therein.
Any dispute relating to the interpretation or application of these Terms shall be subject to the exclusive jurisdiction of the courts of the province of Québec, judicial district of Longueuil (registered office located in St-Amable, Québec, J0L 1N0).
In matters of personal information protection, complaints may also be addressed to:
Commission d'accès à l'information du Québec (CAI)In accordance with section 3.1 of the Act respecting the protection of personal information in the private sector of Québec (as amended by Law 25), McGinnis & Associé has designated the following Privacy Officer (PO):
McGinnis & AssociéFor any questions regarding these Terms, the protection of your personal information, or to exercise your rights (section 15), please contact the Privacy Officer at the above address or use the dedicated online form.
END OF DOCUMENT
McGinnis & Associé — All rights reserved © 2026
CRM Investigation Platform
Hosted on certified cloud infrastructure — Canada