Privacy Policy

1. Scope of this policy

This policy applies to personal information collected by CORO in the course of its activities, including through getcoro.io, app.getcoro.io, our forms, communications and support services.

Personal information is information about an identifiable individual, whether the individual can be identified directly or indirectly.

2. Information we may collect

Depending on how you interact with CORO, we may collect the following categories of information:

• Identification and contact information such as name, email address, telephone number, professional title or role and represented organization.
• Account information such as login email, user role, language preferences and account settings.
• Professional content entered into the platform, including information relating to projects, buildings, plans, procedures, documents, comments, reviews and approvals.
• Information provided when you contact us, request a demonstration, support or information.
• Technical and security data necessary to operate the service, such as IP address, login and activity logs, browser or device information and security events.
• Administrative or billing information where required to manage a subscription or commercial relationship.

3. Why we use this information

We use personal information only for identified and legitimate purposes related to our activities and the delivery of CORO.

• Create, administer and secure user accounts.
• Provide platform features and allow projects and documents to be managed.
• Respond to demonstration, information, support and service requests.
• Manage subscriptions, customer relationships and, where applicable, billing.
• Maintain security, prevent unauthorized access, diagnose incidents and ensure platform reliability.
• Improve the user experience, performance and functionality of CORO.
• Meet legal, regulatory, contractual and record-keeping obligations.

4. Consent

Where required by law, CORO obtains valid consent before collecting, using or disclosing personal information. Consent is adapted to the nature and sensitivity of the information and the purposes involved.

You may withdraw consent where permitted by law, subject to applicable legal or contractual obligations and reasonable notice.

5. Professional information contained in projects

Customer organizations may enter information required for their projects and documents into CORO. In this context, the customer remains responsible for ensuring it has the necessary authority to provide CORO with any personal information it chooses to include in the platform.

CORO processes that information to provide the requested service, according to account settings, customer instructions and applicable obligations.

6. Disclosure to third parties and service providers

CORO does not sell personal information. We may, however, use service providers that help us operate, secure, maintain or support the platform. Those providers receive only the information necessary to perform their functions and are subject to appropriate contractual or other safeguards.

Information may also be disclosed when required by law, to respond to a valid order, protect our rights, prevent fraud or a security incident, or as part of a business transaction permitted by law.

7. Hosting and data location

CORO hosts platform data in Canada. Our architecture is designed to support data sovereignty and the expectations of Canadian organizations regarding information protection.

If a provider were to process certain information outside Quebec or Canada for a specific function, CORO applies the assessments and safeguards required by applicable legislation before such disclosure.

8. Security safeguards

CORO applies reasonable administrative, technical and organizational safeguards designed to protect personal information against loss, theft and unauthorized access, use, disclosure or modification.

These measures include access controls, encrypted communications, account protection, logging, backups and monitoring mechanisms. Because no system can provide absolute security, safeguards are reviewed and adapted based on risk and the evolution of the platform.

9. Retention and destruction

Personal information is retained only for as long as necessary for the purposes for which it was collected, to provide services, meet contractual and legal obligations, resolve disputes or protect our rights.

At the end of the applicable retention period, information is securely destroyed or anonymized where permitted by law and where the anonymization meets applicable requirements.

10. Cookies and similar technologies

The website and platform may use cookies or similar technologies required for operation, security, session management and user preferences.

Where non-essential cookies require consent, appropriate choices are presented to the user in accordance with applicable requirements. Browser settings may also allow users to control certain cookies.

11. Your rights

Subject to exceptions provided by law, you may request access to personal information CORO holds about you and request correction if it is inaccurate, incomplete or ambiguous.

Depending on applicable legislation, you may also have other rights relating to withdrawal of consent, cessation of dissemination, de-indexation or portability of certain computerized information.

12. Privacy incidents

CORO maintains a privacy incident management process. When an incident creates a risk of serious harm or notification is otherwise required by law, CORO takes the necessary steps, notifies affected individuals and authorities when required, and maintains the records required by applicable legislation.

13. Privacy Officer

Questions, access requests, correction requests or complaints relating to personal information may be directed to CORO’s Privacy Officer:

14. Changes to this policy

CORO may modify this policy to reflect changes to its practices, services or legal requirements. The version in force is the version published on this page and the date of the most recent update appears at the beginning of the document.

15. Applicable privacy laws

CORO processes personal information in accordance with applicable privacy legislation, including Quebec’s Act respecting the protection of personal information in the private sector and, where applicable, Canada’s Personal Information Protection and Electronic Documents Act.