Our privacy and cookie policy, terms of service, security statement and sitemap, in one place. Choose a document below.
Privacy & Cookie Policy
This policy explains how Kerson Wallaw Consulting Inc. (“Kerson Wallaw”) and its divisions (Ubitrak, Accel PCI, Accel GRC and KW Consulting), together “Kerson Wallaw”, “we” or “us”, collect, use, share and protect personal information. It applies to this website, our portals and our services. It is written to meet Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
1. Person in charge of the protection of personal information
Our person in charge of the protection of personal information is responsible for this policy and for how we apply it. You can reach this person at privacy@kersonwallaw.com or by mail at 400-3 Place Ville Marie, Montréal QC H3B 2E3, attention: Privacy.
2. What we collect
- Contact details you give us: name, business email, phone, company, role.
- Request details: the content of forms, consultation bookings, support tickets and job applications (including a CV).
- Client engagement data: information processed in our portals and audits on behalf of our clients, under a separate agreement.
- Technical data: IP address, browser type and pages visited, collected through cookies and similar technologies only as described in section 7.
3. Why we collect it
- To answer your request, book a consultation or open a support ticket.
- To deliver and invoice our services and manage the client relationship.
- To send compliance-deadline reminders and news you have subscribed to.
- To evaluate job applications.
- To secure our systems, prevent fraud and meet our legal obligations.
We collect only what is necessary for these purposes. We do not sell personal information.
4. Chat, forms, communications and recordings
Live chat. When you use the chat, we collect what you type, the name and email address you give, the page you were on and basic device information. An automated assistant may answer first; you can ask for a person at any time. If we cannot answer during the chat, we open a support ticket from the conversation so we can follow up. Do not share payment card numbers, passwords or other sensitive information in the chat.
Forms. Each form sends what you enter to the team that handles it:
| Form | Used for | Goes to |
|---|---|---|
| Contact, consultation, callback, speaker request | Answering your request and, if you become a client, managing the relationship | Client records (Zoho CRM) |
| Reminders and newsletter | Sending the updates you asked for | Email communications (Zoho Marketing Automation) |
| Careers | Assessing your application | Hiring system (Zoho Recruit) |
Commercial emails. We send newsletters and reminders only with your express consent, given by ticking a box that is not pre-checked and confirming by email. We keep a record of when and how you consented. Every message identifies us and includes a working unsubscribe link, processed within 10 business days, as required by Canada’s Anti-Spam Legislation (CASL).
Analytics, testing and session recordings. With your permission, we measure how pages are used, test page versions and may record sessions to see where visitors get stuck. Recordings mask what you type in form fields. We use these results only in aggregate to improve the site, never to make decisions about you.
Automated decisions. We do not make decisions about you based exclusively on automated processing. If that changes, we will tell you, as required by section 12.1 of Law 25.
5. Consent
We ask for your consent at the time of collection, in clear terms and for specific purposes. You can withdraw consent at any time, subject to legal or contractual limits, by writing to the person in charge. Withdrawing consent may prevent us from providing a service.
6. Sharing and service providers
We share personal information only with service providers that help us operate (for example hosting, email, CRM and accounting platforms), under written agreements that require confidentiality and adequate security. We may also disclose information when the law requires it.
7. Cookies and similar technologies
We use cookies and similar technologies (local storage, pixels, scripts) only for the purposes below. Apart from strictly necessary cookies, none are placed until you choose to allow them. Technologies that can identify you, locate you or build a profile of you are off by default, as required by section 8.1 of the Act respecting the protection of personal information in the private sector (Law 25).
You can change your choices at any time with the “Cookie settings” link in the footer. Refusing a category does not limit your access to the site.
| Category | Purpose | Provider | Default | Lifetime |
|---|---|---|---|---|
| Strictly necessary | Security, load balancing, remembering your cookie choices, keeping your place in a filtered list | Kerson Wallaw (WordPress, Elementor hosting) | On (cannot be refused) | Session to 12 months |
| Live chat | Running the chat window and keeping your conversation open between pages | Zoho SalesIQ (Zoho Corporation, Canadian data centre) | Off, until you open the chat or allow this category | Up to 12 months, to be confirmed against Zoho’s cookie list |
| Visitor recognition | Recognising a returning visitor so a chat or a request reaches the right person | Zoho SalesIQ | Off | To be confirmed |
| Analytics and testing | Measuring how pages are used, comparing page versions (A/B tests), heatmaps, and session recordings with form fields masked | Zoho PageSense | Off | To be confirmed |
| Marketing | Measuring email and campaign engagement | Zoho Marketing Automation | Off | To be confirmed |
Opening the chat is a choice you make: when you click “Live chat”, we load the chat service and the cookies it needs to run the conversation. Recognition and tracking cookies from the same provider still follow your setting for those categories.
We do not sell personal information and we do not use these technologies for advertising by third parties.
8. Service providers and transfers outside Quebec
We use service providers to run this site and our client relationships. They act only on our instructions, under written agreements that require them to protect your information and use it for no other purpose.
| Provider | What it does for us | Where your information is stored |
|---|---|---|
| Zoho Corporation (CRM, SalesIQ, Desk, Marketing Automation, PageSense, Billing, Books, Recruit, Mail) | Client records, chat, support tickets, email communications, site analytics and testing, invoicing, hiring | Canada (Zoho Canadian data centre) |
| Elementor (website hosting) | Hosting and delivering this website | To be confirmed |
Some of these locations are outside Quebec. Before any personal information is communicated outside Quebec, we carry out a privacy impact assessment, as required by section 17 of Law 25. We proceed only if the information will receive adequate protection, in line with generally recognised principles. Our providers’ support staff may access data from other countries to resolve a technical problem; this is covered by the same assessment and agreement.
You can ask the person in charge of the protection of personal information for more detail on where your information is held.
9. How long we keep information
We keep personal information only as long as needed for the purpose it was collected for, or as the law requires. After that, we destroy it or anonymise it.
| Information | Proposed period | Basis |
|---|---|---|
| Chat transcripts not linked to a client | 24 months after the conversation | Follow-up and service quality |
| Chat transcripts and tickets linked to a client | Kept with the client file | Client relationship |
| Prospect records with no engagement | 24 months after the last contact | Answering your request |
| Client records and engagement files | 7 years after the end of the relationship | Tax and accounting records (6 years), plus margin for professional obligations |
| Email consent records | As long as we send you messages, plus 3 years | Proof of consent under CASL |
| Job applications | 12 months after the hiring decision, unless you agree to a longer period | Assessing applications |
| Session recordings and heatmaps | 90 days | Site improvement |
| Aggregate analytics with no identifier | No limit | Not personal information |
| Confidentiality incident register | 5 years after we become aware of the incident | Quebec regulation on confidentiality incidents |
10. Security and confidentiality incidents
We apply administrative, technical and physical safeguards suited to the sensitivity of the information. We keep a register of confidentiality incidents. Where an incident presents a risk of serious injury, we notify the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada where applicable, and the people affected.
11. Your rights
- Access the personal information we hold about you and request its correction.
- Withdraw your consent.
- Receive computerized information you provided in a structured, commonly used technological format (portability).
- Ask us to stop disseminating information or to de-index a link, where the law allows.
- Be informed when a decision about you is based exclusively on automated processing, and submit observations.
Send requests to privacy@kersonwallaw.com. We will reply within 30 days and may need to verify your identity.
12. Complaints
Write to our person in charge first. If you are not satisfied, you may contact the Commission d’accès à l’information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).
13. Changes
We will publish any update on this page with its revision date, and notify clients of material changes.
Terms of Service
These terms govern your use of the Kerson Wallaw website, operated by Kerson Wallaw Consulting Inc. (“Kerson Wallaw”). By using the site you accept them. Services delivered to clients (audits, portals, consulting) are governed by their own written agreements, which prevail over these terms.
1. Use of the site
You may browse and share the site for lawful, non-commercial information purposes. You agree not to interfere with its operation, attempt unauthorized access, scrape it at scale or use it to send unsolicited messages.
2. Information only, not professional advice
Content on this site, including Insights articles, is general information about compliance, security and financial-reporting topics. It is not legal, accounting or audit advice, and it does not create a client relationship. Laws and standards change; confirm their application to your situation with a qualified professional.
3. Chat and automated answers
Answers given in the chat, by a person or by an automated assistant, are general information. They are not an assessment, an opinion on your compliance, or professional advice, and they create no engagement. An engagement begins only when both parties sign a written agreement. Automated answers can be incomplete or wrong; confirm anything you rely on with our team in writing.
4. Intellectual property
The site, its text, graphics, logos and the names Kerson Wallaw, Ubitrak and Accel belong to Kerson Wallaw Consulting Inc. or its licensors. Third-party standards and marks (for example PCI DSS) belong to their owners. No licence is granted except as stated here.
5. Portals and accounts
Access to client portals requires an account and is subject to the applicable client agreement. You are responsible for keeping your credentials confidential and for activity under your account.
6. Links to other sites
We link to external sites for convenience. We do not control them and are not responsible for their content or practices.
7. Limitation of liability
The site is provided “as is”. To the extent permitted by law, Kerson Wallaw is not liable for indirect or consequential damages arising from use of the site or reliance on its content. Nothing in these terms limits rights that cannot be excluded under the Civil Code of Québec or the Consumer Protection Act.
8. Governing law and jurisdiction
These terms are governed by the laws of Quebec and the federal laws of Canada that apply there. The courts of the judicial district of Montréal have exclusive jurisdiction.
9. Language
These terms are published in French and English. In accordance with the Charter of the French language, the French version is made available first. Les parties ont exigé que ces conditions soient également rédigées en anglais.
10. Contact
Questions about these terms: contact us or write to 400-3 Place Ville Marie, Montréal QC H3B 2E3.
Security
Security is our business, so we hold our own platforms to the standards we audit against. This statement describes our commitments and how to report a vulnerability.
1. How we protect information
- Encryption in transit (TLS) across the site and portals, and encryption at rest for client data.
- Role-based access, multi-factor authentication and least-privilege for staff.
- Logging, monitoring and regular vulnerability scanning of internet-facing systems.
- Vendor due diligence and written security commitments from service providers.
- Backups, tested restoration and an incident response plan.
- Staff confidentiality agreements and annual security and privacy training.
2. Reporting a vulnerability
If you believe you have found a security issue in a Kerson Wallaw site or portal, email security@kersonwallaw.com with a description, the affected URL or component, steps to reproduce and your contact details.
3. Rules of engagement
- Test only systems you own or our public sites; do not access, change or delete data that is not yours.
- No denial-of-service, spam, social engineering or physical testing.
- Give us reasonable time to fix the issue before any public disclosure.
4. Our commitment
We will acknowledge your report within five business days, keep you informed of progress and credit you if you wish. We will not pursue legal action against good-faith research that follows these rules.
5. Phishing and impersonation
We will never ask for your card data, passwords or one-time codes by email or phone. Report suspicious messages using our name to security@kersonwallaw.com.
Never send payment card numbers, passwords, keys or other credentials through the chat, a web form or email. If you do by mistake, tell us and we will delete them and treat it as a potential confidentiality incident.
Sitemap
Every public page on the site, grouped by section. A machine-readable version for search engines is available at /wp-sitemap.xml.