PRIVACY POLICY
The Agence de mobilité durable de Montréal (hereafter the “Agence”) is committed to the protection of your personal information. This Privacy Policy (hereafter the “Policy”) describes the current practices of the Agence relating to the collection, use, disclosure and retention of personal information that the Agence collects from stakeholders through its applications or website (hereafter the “Website”) or any other service, feature, tool or service delivery method developed by the Agence, collectively referred to as the “Services”. The Policy also informs stakeholders of their rights in relation to their personal information they entrust to the Agence.
In the event of inconsistency, the French version of this Policy shall take precedence over any other version.
1. To whom does this Policy apply?
This Policy applies to any person who accesses or uses the Services, who submits an unsolicited application on the Website or who communicates or interacts with the Agence in any other way, regardless of the means used.
By accessing or using the Services or providing their personal information to the Agence, stakeholders consent to its collection, use, disclosure and retention in accordance with this Policy. In some cases, consent may be implied, meaning authorization is presumed on the basis of the stakeholder’s action or inaction when personal information is collected. A stakeholder who does not agree with this Policy must refrain from using the Services of the Agence. The collection of personal information in accordance with this Policy may be required for the Agence to provide the requested Services; therefore, the Agence may not be able to offer these Services if the stakeholder decides not to disclose personal information to the Agence.
2. Collection of personal information
The expression “personal information” means any information that concerns a natural person and makes it possible, separately or in combination with other information, to identify that person. It may include the person’s name, contact details and email address, credit card information, telephone number and transaction history. Information that is anonymized is not considered personal information if, at all times, it is reasonable to foresee that, in the circumstances, such information no longer makes it possible, in an irreversible manner, to identify the person, whether directly or indirectly.
The Agence collects personal information that the stakeholder provides directly to it in the following situations:
- When the stakeholder creates and uses an account that identifies them for one of the Services, the Agence collects the stakeholder’s full name, phone number, email address and payment data, as well as transaction and Service usage data ;
- When the stakeholder fills out a form to obtain one of the Services offered or managed by the Agence, the Agence collects the information necessary to provide the Service;
- When the stakeholder sends the Agence a request for information relating to the Services or any activity of the Agence, or when the stakeholder files a complaint or replies to any survey that the Agence may send from time to time, or registers for an Agence event or participates in an Agence contest, the Agence collects the stakeholder’s name and contact details;
- When the stakeholder contacts customer service or interacts with the Agence, the Agence may collect information necessary to process and follow up on the request, including the stakeholder’s contact details, information related to their account or transactions, the content of their communications, follow-up notes recorded by authorized employees, the timestamped history of their communications with the Agence, and, where applicable, the recording of certain telephone calls. This information may be recorded in the Agence's internal customer relationship management tools;
- When the stakeholder applies for a job with the Agence, it collects the stakeholder’s name and other information contained in the application.
The Agence also collects certain technical data when the stakeholder uses its Services through a digital interface, including the Agence’s Website, a mobile application, a digital assistant or another IT platform. This data may include, as applicable, the device's IP address, browser type, URL from which the interaction with the Service originated, operating system, device type, application’s technical identifiers, pages or screens viewed, usage events, diagnostic data, notification preferences and, when the feature is offered and enabled by the stakeholder, certain location data necessary for the use of this feature.
The Agence may use measurement and analytics tools to understand how its digital Services are used, to measure Services performance, to improve operation, security, and user experience of the Services, and to detect certain technical issues. Where possible or required, the information used for these purposes is processed in an aggregated, de-identified or anonymized form.
The Agence considers this data to be personal information when it allows the stakeholder to be identified.
3. Use of personal information
The Agence uses personal information for the following or other purposes with the stakeholder’s consent or as permitted or required by law:
- To offer the Services and to process payment transactions related to the Services,
- To respond to and to follow up on requests regarding the Services, questions or comments sent to it by the stakeholder;
- To personalize and to improve the stakeholder’s experience with respect to the Services, in particular by developing new features and components;
- To communicate with the stakeholder concerning new products and services or invitations to participate in surveys and market research;
- To manage promotions and contests;
- To assess an application when the stakeholder applies for a job with the Agence; and
- To prevent and to detect fraud and to improve the security measures of the Agence.
The stakeholder can unsubscribe from the commercial electronic messages sent by the Agence at any time by following the process described in the message received or by contacting customer service. The stakeholder may have to specify which email address is to be unsubscribed. In all cases, the Agence undertakes to process the unsubscribe request within a maximum of 10 business days.
The stakeholder may also withdraw consent to the use of personal information by the Agence for certain purposes, subject to legal or contractual restrictions. To do so, please contact the Agence at the address at the end of the Policy.
4. Disclosure of personal information
The Agence does not share personal information with third parties except in the following limited circumstances or otherwise with the stakeholder’s consent or as permitted or required by law:
- The Agence may share certain personal information with service providers, consultants and other subcontractors who assist the Agence in carrying out mandates. Such third parties include suppliers of services for messaging (postal and electronic), payment processing, applications related to the fulfilment of the Services, market research, business intelligence and data hosting.
- The Agence may share personal information with public or government bodies that are authorized by law to obtain such information, or when the Agence has reasonable grounds to believe that such information may be useful in the context of an investigation relating to illegal activity, or to comply with a subpoena, an arrest warrant or an order from a court, a person or a competent body requiring the production of information, or to comply with the rules of a court regarding the production of records or information, or to protect the rights and property of the Agence.
- The Agence may share personal information when necessary for the purposes of evaluating or entering into a business transaction, including the sale or transfer of assets, merger, restructuring, dissolution or a similar transaction, with the other party to the transaction in accordance with applicable legal requirements.
The Agence ensures the storage of personal information in Quebec or, when that is not possible, in Canada. However, information transferred, stored, accessed or used by service providers may be outside Canada (particularly in Europe and the United States) and may, therefore, be subject to the laws of those countries, including any law allowing government authorities to access it. Before disclosing any personal information to a third party, the Agence requires, through a contract, that such third party take the necessary measures to reasonably protect the information, in accordance with the privacy practices detailed below.
5. Cookies and similar technologies
The Agence uses cookies and similar technologies (such as pixels, beacons or identifiers) to collect certain technical information when the stakeholder visits the Website. This information is used for ensuring the operation and security of the Website, facilitating access, measuring Website performance and usage, improving content and the browsing experience, and, where applicable, supporting targeted communications and campaigns.
Some cookies and technologies are strictly necessary for the operation of the Website and cannot be disabled. All other cookies and technologies that are not necessary are disabled by default and are only enabled once the stakeholder has consented. The Agence provides the stakeholder with a cookie management tool that is accessible at all times via a permanent
The cookie management interface presents, for each category, an up-to-date list of cookies and technologies used, as well as detailed information about them, including the name, domain and expiration period, along with a description. The categories, explanations and list of cookies and technologies presented in this interface may evolve to reflect the tools actually used on the Website and their purposes.
When the Agence uses measurement and analytics tools (including processes that may, in some cases, use cookies, pixels or server-side processing), the purpose of these tools is to collect, analyze, measure and present data on visits made in order to understand and optimize the use of the Website and to detect technical issues. The tools used by the Agence are identified in the cookie management interface, and all unnecessary tools are disabled by default and only enabled with the stakeholder's consent, when required.
Depending on the tools and settings selected in the cookie management interface and based on the consents the stakeholder has given, some data may be processed by service providers and hosted, stored, accessed or otherwise processed on the servers of service providers located outside of Quebec or Canada, and may thus be subject to the laws of those countries or territories, including any law allowing government authorities to access them.
Finally, some features (for example, interactive maps) may offer a geolocation option. The stakeholder can enable or disable geolocation at any time from their device or browser settings.
6. Retention of personal information
The Agence strives to ensure that the personal information it holds remains reliable, accurate, complete and up-to-date and to protect the confidentiality and security of its databases. The Agence retains personal information only for the period reasonably necessary to fulfill the purposes identified in this Policy or any other purposes referred to during collection, or as permitted or required by applicable law. Personal information that is no longer necessary for the stated purposes is destroyed or anonymized in accordance with applicable law, so that it can no longer identify the stakeholder, directly or indirectly.
Only the employees of the Agence and, where applicable, those of its suppliers, who need access to stakeholders’ personal information in the course of their duties, may access such personal information. The Agence ensures that those who need access to stakeholders’ personal information have been trained to handle such information appropriately and in accordance with its security protocols, access policies and strict confidentiality standards. The Agence is committed to using commercially reasonable efforts to prevent the loss, misuse, unauthorized disclosure, modification or destruction of personal information.
7. Privacy measures
The Agence has adopted governance rules regarding personal information to ensure the protection of such information throughout its lifecycle, in compliance with applicable law. Depending on the volume and sensitivity of the information, the purposes for which it is used and the format in which it is retained, the Agence implements a combination of privacy measures, including the following:
- The establishment of a committee on access to information and privacy protection and the designation of a Privacy Officer who ensures that the Agence complies with applicable laws regarding the protection of personal information;
- Internal policies and procedures that define the roles and responsibilities of employees throughout the information lifecycle and ensure that only employees who need to see such information in the context of their duties have access to it;
- Training and awareness activities for employees regarding privacy protection and information security;
- High-level security measures to protect the personal information the Agence holds against loss or unauthorized use, including through network address translation, compliance with card industry data security standards, such as the Payment Card Industry Data Security Standard (PCI DSS), and password protection;
- A process for processing complaints and requests from individuals regarding the processing of personal information by the Agence;
- Specific protection measures when personal information is collected or used in surveys;
- A process by which the Agence strives to protect personal information disclosed or retained by third parties under contractual agreements by requiring such third parties to adhere to privacy protection and security methods and to implement mechanisms that are, at the very least, equivalent to those the Agence uses. For example, the Agence requires its service providers to limit their use and retention of personal information to what is necessary to provide their services and to notify the Agence in the event of a violation or attempted violation of any obligation relating to the confidentiality of information communicated. The Agence also tries to monitor and to verify their compliance with these requirements in various ways.
8. Access to personal information and rectification
Stakeholders may request access to their personal information and its rectification, modification or deletion. They can also obtain more information about how the Agence collects, uses and discloses their personal information, subject to the limits prescribed by law. Stakeholders can write to the Privacy Officer to make a request at
Once the Agence receives the written request, it will disclose to the stakeholder the personal information the Agence holds concerning the stakeholder, unless legal restrictions apply. The Agence will also rectify, modify and delete any personal information if it is inaccurate, incomplete or ambiguous or if its collection, disclosure or retention is not authorized by law, and it will notify any third party of the necessary modifications, unless such statutory exceptions do not apply.
9. Hyperlinks to other services
The Services may include hyperlinks to websites that are not operated or overseen by the Agence. This Policy does not apply to personal information collected on such websites, and the Agence urges stakeholders to review any privacy policy posted on a site they visit before using the website or providing their personal information.
Please note that this Policy does not cover personal information collected by the device (or its manufacturer) on which the stakeholder installed the service.
10. Modification of the Privacy Policy
This Policy is accessible through the Services, among other means. The Agence may make changes or additions to the Policy at any time; therefore, the Agence encourages the stakeholder to review it periodically. If changes are made to the Policy, the Agence will notify the stakeholder by changing the effective date above. If the Agence makes material changes, the stakeholder will receive a notice in accordance with applicable laws.
11. Contact the Agence
Stakeholders can contact the Privacy Officer to exercise their rights and to inform the Agence of their concerns, questions or comments regarding its practices for processing personal information at:
In the event of inconsistency, the French version of this Policy shall take precedence over any other version.
Version history: May 28, 2026, May 29, 2025, October 10, 2024, August 31, 2023, June 26, 2020, October 4, 2019