Law 25 compliance
Last updated: May 25, 2026 · SubmitX Inc.
This English version is provided for convenience; in case of discrepancy, the French version prevails.
Law 25 (Act to modernize legislative provisions as regards the protection of personal information) came fully into force in Quebec in September 2023. SubmitX has complied with all applicable obligations. Here is how.
Compliance measures in place
Designated person in charge of the protection of personal information
Documented inventory of personal information
Privacy impact assessment (PIA) completed
Explicit consent collected at sign-up
Data hosted in Canada (Supabase, AWS region ca-central-1, Montreal)
AES-256 encryption at rest + TLS 1.3 in transit
Rights of access, rectification and deletion available
Incident notification policy within 72 hours
Compliant subprocessing agreements with all suppliers
Retention periods defined and applied automatically
Designated person in charge
In accordance with section 3.1 of the Act respecting the protection of personal information in the private sector, SubmitX has designated a person in charge of the protection of personal information:
Rights of the persons concerned
Under Law 25, you can exercise the following rights by contacting us:
- Right of access: obtain a copy of your personal information held by SubmitX
- Right of rectification: correct inaccurate or incomplete information
- Right to deletion: request that your data be erased (subject to legal retention obligations)
- Right to portability: receive your data in a structured, commonly used technological format
- Right to withdraw consent: withdraw your consent to marketing communications at any time
Incident management
In the event of a confidentiality incident (unauthorized access, loss or unintentional disclosure):
- Risk assessment within 24 hours of detection
- Notification to the Commission d'accès à l'information (CAI, Quebec's access to information commission) within 72 hours if the risk of injury is serious
- Notification to the persons concerned as soon as reasonably possible
- Incident register kept in accordance with the Regulation respecting confidentiality incidents
Profiling technologies
SubmitX uses PostHog to analyze platform usage. This tool is configured in anonymized mode: no individual profile is created without consent. Analytics data is used only to improve the product.
Questions and complaints
For any question about our Law 25 compliance, or to exercise your rights, contact our designated person in charge: support@submitx.ca
If you are not satisfied with our response, you can file a complaint with the Commission d'accès à l'information du Québec (CAI) : www.cai.gouv.qc.ca