Personal information governance
Quebec's Law 25 requires every business to set written rules on how it handles personal information, and to publish the essentials. This page is that publication. It says what we actually do, not what sounds good.
1. Who is responsible
Éric Fillion, president of Bronko Marketing Inc., is the person responsible for the protection of personal information. The role is not delegated. He approves our rules, decides on privacy assessments, answers requests and complaints, and keeps the incident register. You can write to him at admin@bentops.com.
2. How we decide to collect anything
Our first question is not « do we have consent », it is « do we really need this ». Consent does not make a collection legitimate if it was not necessary. That is also the product's principle: what you create in bentops stays on your computer, we have no access to it. The only information we handle is what surrounds the sale and the running of the service.
Before any new project involving personal information, and before any disclosure outside Quebec, we carry out a written privacy impact assessment. It sets out the reasoning, not just the conclusion.
3. How long we keep information
Each type of information has a set duration, based on why we hold it:
- Purchase (name, email, province, invoice): 7 years after the fiscal year, because tax laws require keeping supporting documents.
- Licence and activation (keys, device fingerprint): as long as the licence is active, then 12 months.
- Partner link (visitor identifier, click): 24 months after the click. The cookie placed in your browser lasts 48 hours.
- Emails you send us: 24 months.
- Incident register: 5 years from the moment we became aware of the incident.
At the end of those periods, the information is destroyed. We do not use the word « anonymized » in place of « destroyed »: true anonymization follows separate rules that we do not practise. To be transparent: automatic deletion is not built yet. Until it is, destruction is done by hand, at our annual review.
4. Who does what
The business has no employees. Éric Fillion alone handles the entire life cycle of the information: what is collected, access, security, answering requests, incidents. If the business hires or mandates a third party with access to personal information, that person will be informed in writing of their obligations, limited to what is strictly necessary, and their access removed at the end of the mandate.
5. Our providers and outside Quebec
We rely on Stripe (payments), our web host (site, database, email), Google (traffic measurement, with your consent), Cloudflare (protecting forms against bots), Meta (ad measurement, with your consent) and Anthropic (only if you turn on the optional assistant connection in the software yourself). Several of them process information outside Quebec. Before any such disclosure, we carry out a written assessment and we keep the version of the provider's terms in force at that time. We never sell or rent your information. Details are in our privacy policy.
6. How we protect
Keys and passwords live outside the code and outside web-accessible folders. Exchanges use HTTPS. Card numbers never pass through our servers: Stripe handles them directly. Technical identifiers we log are turned into fingerprints. Two-factor authentication is on wherever it exists. The software we distribute is signed, so you know it really comes from us.
7. If an incident occurs
We keep a register of confidentiality incidents, even when it is empty, and we provide a copy to the Commission d'accès à l'information on request. An incident is not only a hack: it is also unauthorized access, use or disclosure, or a loss. If an incident presents a risk of serious injury, we notify the Commission and the people concerned promptly.
8. Your rights and our deadlines
You may ask for access to your information, its correction, the withdrawal of your consent, the release of your computerized information in a commonly used format, or de-indexing in the cases provided by law. Write to admin@bentops.com. We answer in writing within 30 days. A refusal is reasoned, cites the section of law relied on and your remedies. One limit to know: what you create in bentops is on your computer, we can neither provide it nor destroy it, since we do not have it.
9. How to file a complaint
Any dissatisfaction regarding the protection of your information is treated as a complaint, whether you call it that or not. Write to admin@bentops.com. Here is what happens next:
- We acknowledge receipt within 5 business days.
- The responsible person examines what is alleged, what happened and what the law says.
- We answer in writing, with our reasons, within 30 days of receipt.
- If warranted, we fix the problem, and record it in the incident register if the complaint reveals one.
If our answer does not satisfy you, you may contact the Commission d'accès à l'information du Québec. We keep each complaint and its answer for 3 years.
10. Review
These rules are reviewed once a year, and sooner if something important changes: a new provider, a new advertising channel, a new software feature involving personal information, a hire, or a change in the law. Each review is dated and approved by the responsible person.