PIPEDA & Quebec Law 25
How EnkiLabs handles your personal data under Canada's federal privacy law and Quebec's Law 25 — including your rights, data retention, and how to contact our Privacy Officer.
Last updated: May 2026 · EnkiLabs Technologies
This page applies to all users in Canada. EnkiLabs Technologies is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) at the federal level, and Quebec Law 25 (Bill 64) for Quebec residents. Both laws govern how we collect, use, store, and disclose your personal information.
1. What Personal Information We Collect
Enki App handles the following categories of personal data:
| Data Type | Purpose | Retention |
|---|---|---|
| Full name & email | Account creation and authentication | Until account deletion + 30 days |
| Location (GPS) | Last-known location for emergency contacts on trigger | Overwritten on each check-in; purged on deletion |
| Emergency contacts Names, phone numbers, relationships | Trigger notification recipients | Until account deletion |
| Digital Legacy Vault Documents, instructions, messages | Delivered to designated contacts on trigger activation | Until explicitly deleted or account closed |
| Master PIN hash | Identity confirmation on each check-in | Until account deletion; never stored in plain text |
| Check-in history | Audit trail and contract verification | Rolling 90 days |
| Device tokens | Push notification delivery | Until logout or permission revocation |
2. Legal Basis for Collection (PIPEDA Principle 3)
We collect personal information only with your knowledge and consent. Consent is obtained at account creation. You may withdraw consent at any time by deleting your account — however, withdrawal may make it impossible to provide the core safety service.
We do not collect information beyond what is necessary to provide the Enki App service (principle of data minimisation).
3. Quebec Law 25 — Additional Requirements
Quebec's Act Respecting the Protection of Personal Information in the Private Sector (modernised by Bill 64) imposes additional obligations:
- Privacy Impact Assessment (PIA): Conducted before any new data processing feature is deployed.
- 72-hour breach notification: The Commission d'accès à l'information (CAI) and affected individuals are notified within 72 hours of a confirmed breach involving sensitive data.
- Right to data portability: Quebec residents may request a copy of their personal data in a structured, machine-readable format.
- Right to erasure: You may request deletion of all personal data. We fulfill these requests within 30 days.
- Privacy officer: EnkiLabs has designated a Privacy Officer responsible for PIPEDA and Law 25 compliance (contact below).
4. Your Rights Under PIPEDA
Request a copy of the personal information we hold about you, including how it has been used and disclosed.
Challenge the accuracy or completeness of your information and request corrections.
Withdraw consent to data collection at any time, subject to legal and contractual restrictions.
File a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca, or with the CAI at cai.gouv.qc.ca for Quebec matters.
5. Data Storage & Cross-Border Transfers
EnkiLabs primarily processes data on servers located in Canada and the United States (via Firebase / Google Cloud). When data is transferred outside Canada, we ensure equivalent protection through contractual safeguards (Data Processing Agreements) with each processor.
Quebec Law 25 requires a written agreement before personal information is communicated outside Quebec. EnkiLabs maintains such agreements with all third-party processors.
6. Contact — Privacy Officer
For access requests, corrections, or complaints under PIPEDA or Quebec Law 25, contact:
EnkiLabs Technologies — Privacy Officer
Email: privacy@enkilabstech.com
Address: Montreal, Quebec, Canada
We will respond within 30 days of receiving your request.