In short: GIR Canada only collects the data necessary to deliver its proxy voting advisory services. We never sell your personal data to third parties. You have the right to access, correct, or request the deletion of your data at any time.
01
Who we are
GIR Canada Inc. (hereinafter "GIR", "we", "us" or "our") is an independent Canadian firm specializing in proxy voting advisory services and ESG research for institutional investors. Our registered office is located at:
This policy describes how we collect, use, retain and protect your personal data in compliance with Quebec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
02
Data we collect
We collect personal data only when necessary to deliver our services or communicate with you. The categories of data we may collect include:
- Contact information: first name, last name, email address, phone number, job title and organization.
- Correspondence data: messages you send us via our contact form, by email, or during scheduled calls and meetings.
- Contractual data: information related to the delivery of our services, including mandates, voting instructions and policy parameters.
- Subscription data: your communication preferences (newsletter, webinars, publications).
- Browsing data: IP address, browser type, pages visited and session duration, collected via cookies on our website.
We do not collect sensitive data (ethnic origin, political opinions, health data, biometric data) and do not process data belonging to minors.
03
How we use your data
Your personal data is used solely for the following purposes:
- Service delivery: processing your requests, managing proxy voting mandates, and transmitting ESG recommendations and reports.
- Communication: responding to your inquiries, sending confirmations, and managing your client account.
- Marketing (with consent): sending our newsletter, webinar invitations and publications if you have consented to receive them.
- Service improvement: anonymized analysis of website usage to enhance the user experience.
- Legal obligations: compliance with applicable regulatory and legal requirements.
04
Legal basis for processing
In accordance with Law 25 and PIPEDA, we process your personal data on one of the following legal bases:
- Explicit consent: for sending marketing communications, newsletters and webinar invitations. You may withdraw your consent at any time.
- Contract performance: where processing is necessary to deliver the services you have requested.
- Legitimate interests: to improve our services, prevent fraud and ensure the security of our systems, to the extent that these interests do not override yours.
- Legal obligation: where the law requires us to process certain data.
05
Sharing your data
We never sell, rent or share your personal data for commercial purposes with third parties. We may, however, transmit certain data in the following circumstances:
- Technology service providers: our CRM platform (HubSpot), email delivery tools and hosting services, only to the extent necessary to operate our services. These providers are bound by confidentiality agreements.
- Institutional partners: within the scope of specific mandates and with your authorization, certain data may be shared with third parties involved in service delivery.
- Legal authorities: where required by law or to protect our legal rights.
Cross-border transfers: some of our service providers (notably HubSpot, whose servers are located in the United States) may process your data outside Quebec. We ensure that these transfers are governed by appropriate contractual safeguards, in accordance with Law 25 requirements.
06
Data retention
We retain your personal data for as long as necessary for the purposes for which it was collected, or as required by law:
- Active client data: for the duration of the mandate and up to 7 years after its end, in accordance with fiscal and accounting obligations.
- Prospect and contact form data: 24 months from the last contact, unless a contractual relationship is established.
- Communications subscription data: until you unsubscribe or withdraw your consent.
- Browsing data (cookies): as defined in our cookie policy (generally 12 months).
Upon expiry of the retention period, data is securely deleted or irreversibly anonymized.
07
Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration or destruction. These measures include:
- Encryption of data in transit (TLS/HTTPS) and at rest
- Strict access controls based on the principle of least privilege
- Regular staff training on security best practices
- Use of SOC 2-certified platforms for our CRM and email delivery tools
- Periodic review of our security practices
In the event of a privacy incident likely to cause serious harm, we commit to notifying you within the timeframes set out under Law 25, and to reporting the incident to the Commission d'accès à l'information du Québec (CAI) if required.
08
Your rights
Under Law 25 and PIPEDA, you have the following rights regarding your personal data:
- Right of access: obtain a copy of the personal data we hold about you.
- Right to rectification: have any inaccurate, incomplete or ambiguous data corrected.
- Right to erasure: request the deletion of your data, subject to our legal retention obligations.
- Right to portability: receive your data in a structured, machine-readable format.
- Right to withdraw consent: withdraw your consent to marketing communications at any time, without affecting the lawfulness of prior processing.
- Right to object: object to the processing of your data in certain circumstances.
To exercise any of these rights, please contact us using the information provided in section 11. We will respond to your request within 30 days.
If you believe your rights have not been respected, you may file a complaint with the Commission d'accès à l'information du Québec (CAI) at www.cai.gouv.qc.ca or the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.
09
Cookies
Our website uses cookies to ensure its proper operation, analyze its usage and, where applicable, offer you personalized content. The types of cookies we use are:
- Essential cookies: necessary for the website to function. They cannot be disabled.
- Analytics cookies: help us understand how visitors interact with our site (via HubSpot Analytics). These cookies are only placed with your consent.
- Functional cookies: remember your preferences (language, region) to improve your experience.
You can manage your cookie preferences at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of the site.
10
Changes to this policy
We reserve the right to update this privacy policy at any time to reflect changes in our practices or applicable legislation. In the event of a material change, we will notify you by email (if you are subscribed to our communications) or through a prominent notice on our website.
The date of the last update is indicated at the top of this page. We encourage you to review this page periodically.
11
Contact us
For any questions regarding this policy or to exercise your rights, please contact our Privacy Officer:
