Personal Data Privacy Policy

Access and Distribution

This Personal Data Privacy Policy applies to the clients, users, and administrators of the Kipo platform.

It is accessible to anyone using the application and is publicly available on the Kipo platform.

Objectives

This Personal Data Privacy Policy has the following objectives.

• Identify the personal information collected in connection with the use of Kipo.
• Frame the practices regarding the protection of personal information.
• Ensure the confidentiality and security of the information collected.
• Inform users and their clients of the practices concerning the protection of personal information when a collection is carried out through technological means.

This objective also aims to maintain the trust of users and their clients regarding the protection of their personal information.

Tools Used to Collect Information

Personal information means any information that allows a natural person to be identified, directly or indirectly.

Personal information is collected through the following technological means.

• The Kipo application's web portal.
• Sending surveys by SMS or phone call.
• Sending surveys by email.
• Connection cookies.
• Electronically transmitted forms.

Circumstances of Collection

Kipo collects personal information in the following circumstances.

• When you create an account on the Kipo platform.
• When you add clients in the application.
• When you send a survey to a client.
• When a client responds to a survey.
• While you are browsing the platform.

Information That May Be Collected About Clients

Personal information collected about your clients may include the following elements.

• The client's first and last name.
• The phone number.
• The email address.
• Survey responses, including NPS scores and comments.
• The date added and the history of interactions.

Information Collected While Browsing

While you are browsing the Kipo platform, the following elements may be collected.

• The IP address.
• The browser and language used.
• The operating system.
• The date and time of access to the platform.
• The pages viewed and the duration of consultation.

Audience Measurement

Kipo measures traffic on its marketing site with Umami, a free and open-source tool self-hosted at OVH in Beauharnois, Québec. This measurement does not set any connection cookie and does not create any identifier that persists from one day to the next.

The IP address is used only to infer the country, region, and city of the visit, and it is not retained afterward. The resulting statistics are aggregated and anonymous, and Kipo cannot link a visit to a specific person.

This measurement is used solely to understand how the marketing site is used and to improve it. The data is kept for 25 months, then deleted, and is not shared with any third party.

Use of Data

As part of its mission, Kipo collects information for the following purposes.

• Enable the sending of satisfaction surveys (NPS) to users' clients.
• Display and analyze survey results.
• Generate client satisfaction reports.
• Ensure the proper functioning and performance of the platform.
• Improve the user experience.

Data from Google (Google Business Profile)

An administrator or owner of a client business may choose to connect their business's Google Business Profile (Google My Business) listing to Kipo. Through Google's consent screen, they then authorize Kipo to manage this listing (https://www.googleapis.com/auth/business.manage permission). Kipo requests no other Google permission and never receives the Google account's password or email address. The list of accounts returned by Google may include the account holder's name: Kipo neither stores nor displays it.

Kipo accesses the list of accounts and business listings available to the Google account that authorizes the connection (technical identifiers, listing name and address, Google Maps identifier, and public review link), so that the listing to connect can be chosen. Kipo also accesses the public reviews of the connected listing: the author's public name and profile photo, rating, comment, dates and, where applicable, the business's reply. These reviews are content published publicly on Google.

Reviewers' profile photos are displayed directly from Google's servers: your browser requests them from Google, which then receives your IP address and technical information about your browser.

Kipo uses this data only for the following purposes.

• Display the listing's reviews, average rating, and number of reviews to the users of the business concerned.
• Publish, edit, or delete a reply to a review, only when an administrator or owner of the business explicitly requests it in Kipo.
• Offer, at the end of a survey, the listing's public link to all clients who complete the survey, regardless of their answers. This link is public: Kipo sends no information about the client to Google.

Data from Google: Retention, Withdrawal, and Commitments

Kipo retains and protects data from Google as follows.

• The access tokens provided by Google are encrypted (AES-256) in Kipo's database, hosted in Québec, and are never displayed or sent to the browser.
• For as long as the connection lasts, Kipo keeps the technical identifiers of the listing and of the Google account (in the form accounts/123, without the person's name), the listing name, its Google Maps identifier, and its public review link.
• Reviews are kept in a temporary cache, refreshed from Google when viewed or on request. A cache that has not been refreshed for 30 days is deleted by the next automatic daily cleanup.
• If the connection is abandoned before a listing is chosen, the data received is deleted by the automatic daily cleanup, at the latest about 25 hours after it was abandoned.
• An administrator or owner can disconnect the listing at any time in Kipo. The tokens, identifiers, and stored reviews are then deleted, and Kipo asks Google to withdraw the authorization. If the same Google account is also connected to another business in Kipo, the authorization is kept at Google for that other business.
• The authorization can also be withdrawn at any time from the Google account, at https://myaccount.google.com/permissions.

Kipo uses Google data only to provide the features described above, which are visible in the application. Kipo does not sell this data, does not use it for advertising or to train artificial intelligence models, and does not share it with any third party, except its hosting provider, which acts on its behalf.

Kipo's use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Google's processing of your Google account data is governed by the Google Privacy Policy (https://policies.google.com/privacy).

Access to Personal Information

Personal information is accessible only to authorized persons within the organization using Kipo, who fall into the following categories.

• Kipo users with access to the relevant business.
• Kipo platform administrators.
• Technical service providers engaged to ensure the operation of the platform.

Retention and Security of Information

Kipo has put in place various technical and administrative safeguards designed to preserve the confidentiality and security of personal information. All personal information collected is stored in secure environments that are not accessible to the public.

The measures in place include in particular the following.

• Access control through authentication.
• Encryption of data in transit (HTTPS).
• Restricted access to data based on roles and businesses.
• Keeping systems and security patches up to date.

However, no security measure is absolute or fully guaranteed.

Rights of Data Subjects

Any person concerned by personal information may exercise the following rights.

• Refuse to provide information.
• Request to consult the personal information concerning them.
• Request the correction of inaccurate personal information.
• Withdraw their consent to the use, distribution, or disclosure of personal information.
• Request the deletion of their personal information from the platform.

To exercise these rights, you may contact Kipo's privacy officer, whose contact information appears at the end of this page.

Updates

Kipo reserves the right to change or update this Personal Data Privacy Policy at any time. Where applicable, Kipo will take reasonable steps to notify anyone concerned by significant changes.

The date of the last update appears on this page.

Responsibilities

The person responsible for enforcing this Personal Data Privacy Policy is Kipo's privacy officer (person in charge of the protection of personal information).

To reach the privacy officer, for any question relating to the protection of your personal information or to exercise your rights: Privacy officer, Kipo, 608 avenue Saint-Rédempteur, Matane, Quebec G4W 0E1, or by email at rprp@kipo.ca.

For any other question, you may write to us at support@kipo.ca.