Privacy Policy

This policy explains what personal information OTS Steel Solutions inc. / Solutions d’Acier OTS inc. (NEQ 1180711583), 7 Summit Circle, Westmount, Québec H3Y 1B4, collects through its customer portal, why, where it is held and what you can ask us to do with it.

The person in charge of the protection of personal information at OTS may be reached in writing at the address above, marked for the attention of the Person in charge of the protection of personal information, or by email at vieprivee@otssteelsolutions.com.

We sell to businesses. Most of what we hold about a person is their name, job title and work contact details in their capacity as an employee of a customer, which Québec law treats differently from information about their private life. We still handle all of it under this policy.

There are two points where information reaches us, and they are different.

When you create an account to get a price, we collect your first and last name, your company, your telephone number and your email address. Your company name becomes the name of your account.

When you fill in a quote request, we collect what the questions ask. Contact details are stored apart from the rest of the answers. The answers themselves include information about your business and your site, and can include personal information where you type it:

• the site address and postal code, and the coordinates our mapping provider returns for it;
• the name, role, telephone and email of the person we should speak to;
• the legal name of the company and anything you write in a free-text box, including descriptions of damage;
• the name typed on the notices step, and the fact that the terms were accepted, when, and in which language.

Photographs you attach to a repair request reach us. While you are filling the request in, the wizard keeps them in your browser so you can move between steps, and clears that local copy after seven days. When you send the request they are uploaded to the same private area as the rest of your documents, which no address on the internet can reach directly. They are served only to people signed in to your account, through a link that re-checks that entitlement on every request, and every one of those reads is recorded. They are kept with the quote they belong to.

Photographs taken by our inspectors during an inspection are held the same way. They show the inside of your building, and they are stored in a private area that no address on the internet can reach directly. They are served only to people signed in to your account and only once the report they belong to has been published.

If a photograph shows a person, tell us and we will replace it.

We use personal information only for the following purposes:

• to prepare a price for the work you asked about, and to review it before you see it;
• to contact you about your request, your quote and your job;
• to carry out the inspection or repair and to produce the report or certificate that results;
• to manage your account, the people you invite to it and what each of them may see;
• to invoice the work and to keep the records an engineering firm is required to keep.

When you give us information after being told what it is for, you consent to our using it for those purposes. You do not need to give us anything more than the questions ask.

We do not sell personal information, we do not share it for anyone else’s marketing, and we do not send marketing by text message. If we ever ask to send you marketing email, it will be a separate, unticked box and refusing it will not affect your quote.

Within OTS, our staff can see the accounts, quotes and reports they need in order to price, carry out and invoice the work.

Within your company, what a colleague sees depends on the role you give them. Somebody invited as a viewer sees less than an administrator, and a guest scoped to one site sees only that site.

We disclose personal information outside OTS only to the service providers named below, or where the law obliges us to.

The database, its backups and the private area holding inspection photographs are hosted in Canada, in the Montréal region of our hosting provider. Our email is sent from Montréal as well.

The application itself runs on servers in the United States, so information is processed there even though it is stored in Canada. Our mapping and anti-robot providers also operate outside Québec.

Before communicating personal information outside Québec we assess whether it will receive adequate protection, and we agree in writing with each provider how it may be used. That assessment is on file and can be produced.

We use a small number of service providers, each for one job:

• Supabase, our database and file hosting, which keeps everything in Canada (Montréal);
• Vercel, which runs the application itself, from the United States;
• Google, whose mapping service suggests addresses: the site-address box sends what you type there, with your network address, and sends nothing before you type;
• Cloudflare, whose anti-robot check confirms that a sign-up is a person and receives your network address and details of your browser;
• Amazon Web Services, which sends your sign-in links and the messages about your quote, from its Canadian region.
• Twilio, which carries the urgent text message that reaches our staff when you report a damaged rack, and receives the callback number inside it.

We keep a quote request that never became a job, and the account created with it, for 24 months from your last contact with us. After that we remove what identifies a person from it and keep only what is needed to understand our own pricing.

We keep everything connected to work we actually carried out — the request, the offer you accepted, the report or certificate and the photographs behind it — for 10 years. That is the period an engineering firm must be able to answer for its work, and it is also what tax records require.

Where we are asked to destroy information sooner, we do so unless a rule above requires us to keep it, and we say which one.

Write to the person in charge, at the address in the first section. We answer within 30 days and we do not charge for it.

• see the personal information we hold about you, and be told where it came from;
• have it corrected if it is wrong, or completed if it is incomplete;
• receive the information you gave us in a structured, commonly used electronic format, or have it sent to someone else;
• withdraw a consent you gave, and have information destroyed where nothing above requires us to keep it.

If our answer does not satisfy you, you may complain to the Commission d’accès à l’information du Québec, which supervises this Act.

Your price is prepared by a model from the answers you give, and it is then read and released by a person at OTS. No price reaches you without someone here having looked at it.

If you want to know how a price was arrived at, or want it looked at again, ask us and a person will.

We set only what the portal needs to work: a cookie that keeps you signed in, one that remembers your language, and one that remembers you have already seen the introduction.

We do not use advertising cookies, tracking pixels, session recording or third-party analytics.

Two technologies belonging to other companies run in your browser. Google Maps suggests addresses on the site-address step: it loads only once you type in that box, and receives what you type there along with your network address. Cloudflare's anti-robot check runs on the sign-in and sign-up forms.

Neither one locates your device. The portal never asks for your position, and the page instructs your browser to refuse any such request. If you would rather send nothing to Google, tick “My address is not in the list” on that step and fill in the fields yourself.

Access is decided by the database itself rather than by the screens, so a page cannot show somebody a record they are not entitled to even if it asks for one. Documents and photographs are served only after that check.

Sign-in is by a link sent to your email address; there is no password to be guessed or reused.

We keep a register of confidentiality incidents. If one presents a risk of serious injury we notify the Commission d’accès à l’information and the people concerned, promptly, and we take what steps we can to reduce the harm.

Person in charge of the protection of personal information, OTS Steel Solutions inc., 7 Summit Circle, Westmount, Québec H3Y 1B4.

vieprivee@otssteelsolutions.com

This policy is dated. When we change it we publish the new version here and change the date at the top.