Privacy at Stellé

Last updated: 27.04.26

What data do we process?

Personal Data
We may process Personal Data that you have provided to us voluntarily while using the Platform or Website. Personal Data encompasses all personal information collected, processed, stored, or transmitted by Brio, including but not limited to: customer data, employee data, vendor data, and any other personally identifiable information, regardless of format or storage medium.

Technical data
We and/or our authorized external service providers may automatically collect technical data when you visit or interact with our Website and Platform for statistical and analytical purposes. The technical data may include, in particular, the URL of the website you visited before using our service, the time and date of user visits, surfing habits, IP address, browser name, type of computer or device accessing our service, time spent on the website and more similar technical information. In certain cases, it would be possible to use the technical data to identify you as an individual, making it Personal Data in accordance with applicable law. However, we never use technical data to identify you as an individual.

Processing Purposes
We process your Personal Data for the purpose of:Performance of the contract concluded with you based on your decision to use the PlatformThis purpose includes the following processing activities:Informing about updates and new functions of our services;Answering your queries about our services;Resolving any problems and disputes related to the contract between us.

Training our algorithmic models
For this purpose, we process your anonymized Personal Data that you have voluntarily provided to us when using the Platform for model training. The legal basis for such processing is the performance of the contract in accordance with SOC 2. You may opt-out at any time of your anonymized Personal Data being used to train our models.

Improving our services
For this purpose, we collect anonymized information about how you use the Platform, such as your clicks, the features you use, the time you spend on each screen, and other analytical data. The legal basis for such processing is the performance of the contract in accordance with SOC 2.

Third Parties
Your Personal Data is primarily processed by us. We do not share your Personal Data with any recipients unless one of the following circumstances occurs:It is necessary in order for us to fulfill our obligations to youIn the event that our subcontractors with whom we work to operate our Platform need access to your Personal Data, we have taken appropriate contractual and organizational measures to ensure that your Personal Data is processed in accordance with all applicable laws and regulations.

We only use third party providers that maintain the same or above levels of data protection and security.It is necessary for legal reasons.We may share your Personal Data with recipients outside of the Company if we believe in good faith that specific access to your Personal Data and the corresponding use is proportional and necessary to (i) comply with all applicable laws; (ii) detect, prevent and resolve fraud and security or technical problems; and/or (iii) protect the interests, property or safety of the Company, our users or the public, in accordance with the law. If possible, we will inform you of such processing.

Cross-Border Data Transfers
We may transfer your Personal Data to countries outside the European Union and the European Economic Area, where we cooperate with external subcontractors. We transfer your Personal Data only to a country that is considered to have an adequate level of Personal Data protection in accordance with the European Commission's decisions, or there are appropriate measures to protect your Personal Data, such as standard contractual clauses and/or binding internal company rules. Regardless of the country in which your Personal Data is processed, the Company will take appropriate technical, legal, and organizational measures to ensure that the level of protection is the same as in the European Union and the European Economic Area. If you want to know more about the international transfer of your Personal Data and the relevant guarantees we have in place, you can contact us at security@brioplatform.com.If we participate in a merger, acquisition, or other reorganization, your data may be transferred as part of this transaction. We will inform you about each such transaction (for example, via a message to the e-mail address associated with your account) and explain your options in this situation.

Data Security
We take all proportional and appropriate security measures to protect us and our customers from unauthorized access or unauthorized alteration, disclosure, or destruction of Personal Data. Measures include, where appropriate, encryption, firewalls, secure devices, and access rights systems.Privacy compliance activities will be regularly monitored and audited to ensure compliance with this Policy and applicable regulations. This includes annual reviews of processing activities, data subject rights fulfillment, and privacy impact assessments.Should a data breach occur despite security measures that are likely to adversely affect your privacy, we will notify you as soon as reasonably possible.Privacy incidents and data breaches are handled according to established procedures:Swift identification and evaluation of privacy incidentsNotification to supervisory authorities within required timeframes Communication to affected individuals when requiredDocumentation of incident response and remedial actionsPost-incident review and process improvement

Data Subject Rights
Brio will respect and facilitate data subject rights as required by applicable privacy laws:Right of access to your Personal Data - you may at any time ask us to confirm whether or not your Personal Data is being processed, and if so, for what purposes, to what extent, to whom it is made available, for how long we will process it, whether you have the right to correct, delete, limit the processing or raise an objection from where we obtained Personal Data from and whether there is automatic decision-making based on the processing of your Personal Data, including possible profiling. You also have the right to obtain a copy of your Personal Data, the first provision being free of charge, and for the next provision, we may require a reasonable payment of administrative costs.Right to rectification - you may at any time request we correct or add to your Personal Data if it is inaccurate or incomplete.Right to erasure - you can also request the deletion of your Personal Data from our systems. We will comply with these requests unless we have a legitimate reason not to delete your Personal Data.Right to restrict processing - you can ask us to restrict certain processing of your Personal Data. If we restrict certain processing of your Personal Data, this may lead to limits on the use of our Platform and Website.Right to data portability - you have the right to receive your Personal Data from us in a structured, commonly used, and machine-readable format for the purpose of transferring Personal Data to another processor.How to exercise your rights - you can exercise your rights listed above free of charge via e-mail to security@brioplatform.com. Depending on your request, we may require verification of your identity.Can you file a complaint? If you believe that our processing of your Personal Data is not in accordance with applicable data protection laws, you may file a complaint with your local authorities.

Changes to This Privacy Policy
Brio may update this Privacy Policy from time to time.

In case of significant changes, we will notify users via email or platform notifications.
Contact InformationFor privacy-related inquiries, contact us at: security@brioplatform.com
Mailing Address: Brio Platform, 300-4 Place Ville-Marie, Montreal, QC, H3B 2E7

Last updated: 01.01.22

In this Privacy Policy (this “Policy”), LOSANGE FINANCE INC (“LOSANGE”) explains how the Client Data (as defined below) is collected, used, maintained, disclosed and transferred by LOSANGE. LOSANGE operates as a data processor of its customers, and as such, will process all Client Data (as defined below) according to its contractual agreements with its customers (“Customer Agreements”) and as otherwise required by law.  

“Client Data” is defined as information relating to an identified or identifiable living individual that LOSANGE customers and their end-users input or upload into the software and other products, solutions or services offered by LOSANGE (collectively, “LOSANGE Products”) for processing. It does not include data LOSANGE collects from visitors to its websites, nor data LOSANGE collects about its customers or prospective customers, vendors, service providers, professional advisors, consultants, and other third parties otherwise in the course of doing business; for example, to manage LOSANGE customer accounts or to communicate with them or to engage LOSANGE vendors.  If you have any questions regarding this Policy, please email us at admin@losangefinance.com or contact LOSANGE as described in the “How to Contact Us” section below. ​‍

SCOPE
This Policy only applies to Client Data for which LOSANGE is a data processor. ​‍

COLLECTION PURPOSES, USE OF CLIENT DATA
The Client Data transferred to LOSANGE for processing is determined, directed and controlled by customers, in their sole discretion. As such, LOSANGE has no control over the type, volume or sensitivity of Client Data processed through the LOSANGE Products as input by its customers or their end users. LOSANGE only processes Client Data on behalf of its customers and in accordance with their instructions provided in the applicable Customer Agreements with LOSANGE.  The Client Data processed may include the following categories of data for data subjects: Identification information for customer’s employees, contractors, agents, end users or other third parties, including contact information (name, business entity, address, telephone number (fixed and mobile), e-mail address, fax number), employment information (job title, employer), username, geographic location, area of responsibility and IT information (IP addresses, usage data, cookies data, online navigation data, location data, browser data); Identification information for anyone who uses the LOSANGE Products at the request of and in connection with the business of LOSANGE customers. Any other Client Data that LOSANGE customers or their users choose to input into the LOSANGE Products or in the content of the communications that are sent to and received by LOSANGE.  LOSANGE acts as a data processor or sub-processor with respect to this Client Data. LOSANGE limits the interaction with Client Data to the following purposes: To provide and deliver the contracted services; To provide customer service or support; To respond to customer’s requests To address technical issues; and To respond to lawful requests.  LOSANGE customers are responsible as data controllers for ensuring that (i) their end-users receive proper notice of the applicable customer’s privacy practices, (ii) Client Data is obtained in accordance with all applicable laws, and (iii) their end-users are given a choice regarding LOSANGE’s processing activities with respect to Client Data. If a customer’s end-user has any questions or concerns related to the handling of Client Data, the end-user may contact LOSANGE as described in the How to Contact Us section and LOSANGE will work with the customer to address the end-user concerns.  ‍

DATA TRANSFERS TO THIRD PARTIES ‍
LOSANGE does not sell or loan Client Data to any third parties; however, LOSANGE may share Client Data with third parties as follows: Within LOSANGE consistent with this Policy; and With subcontractors and other third parties under contract subject to appropriate confidentiality obligations in each case as necessary to perform business-related functions such as to help support and improve the LOSANGE Products on behalf of or at the direction of LOSANGE.  

OTHER DISCLOSURES
Under certain circumstances, LOSANGE may be required to disclose Client Data in response to valid requests by governmental authorities, including to meet national security or law enforcement requirements.  LOSANGE will attempt to refer any request for disclosure of Client Data by governmental authorities, including those received for national security or law enforcement reasons, to the customer. LOSANGE may, where legally obligated to do so, disclose Client Data to law enforcement or other government authorities, in which case LOSANGE will notify its customer of such a request (unless prohibited by law to do so) and will furnish only that portion of the Client Data that is legally required. LOSANGE is liable for appropriate onward transfers of Client Data to third parties.  ‍

SECURITY
LOSANGE maintains, as part of its contracts with technology vendors, appropriate physical, technical, administrative, and organizational security measures to protect Client Data from loss, misuse, and unauthorized access, disclosure, alteration, and destruction, including where appropriate: the encryption of Client Data; the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; the ability to restore the availability and access to Client Data in a timely manner in the event of a physical or technical incident; and a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.  While LOSANGE employs security measures to protect Client Data in the LOSANGE Products, LOSANGE customers, and their end-users, should only access the LOSANGE Products within a secure environment and take appropriate steps to always ensure that login credentials and passwords are always kept safe. Customers should notify LOSANGE as soon as possible if they become aware of any misuse of their user IDs, passwords, or accounts, and immediately change their passwords within the LOSANGE Products in accordance with the “How to Contact Us” section below.  ‍

RETENTION
LOSANGE retains Client Data and any other data collected through the LOSANGE Products in accordance with the timeframes set out in the relevant Customer Agreements with its customers. LOSANGE’s retention periods may change: If there is a legal obligation (or change to a legal obligation) applicable to LOSANGE (for example, certain laws require LOSANGE to keep records of transactions for a certain period before LOSANGE can delete them); and If retention is advisable based on legal opinion (such as, for statutes of limitations, litigation or regulatory investigations).  ‍

CROSS BORDER TRANSFERS
Client Data will not be transferred outside of the European Economic Area or Canada without additional contractual or extra contractual measures.  ‍

DATA ACCESS
LOSANGE takes reasonable steps to determine who gains access to Client Data. LOSANGE’s User Access Management guidelines are based on the “Principle of Least Privilege,” and access to Client Data shall be limited by that principle, which requires that privileged access must be provisioned with the minimum level of access to non-public data which is required to satisfy a user’s job responsibilities.  

GENERAL DATA REQUESTS
If any data subjects have questions or concerns about the processing of Client Data, they should contact LOSANGE’s customer (i.e., the controller) directly or read their privacy policy. Similarly, an individual who seeks to access Client Data, or to correct, amend, or delete Customer Data, should direct their query to the customer. If a customer asks LOSANGE to retrieve, amend or remove the Client Data, LOSANGE will do so in accordance with the Customer Agreements with such customer and LOSANGE’s Privacy Shield commitments.  LOSANGE’s customers who want to find out more about the data security settings on their account can refer to their agreement or other applicable Customer Agreements with LOSANGE or contact LOSANGE directly for further information.  

DISPUTE RESOLUTION
LOSANGE commits to resolve complaints regarding processing, use and disclosure of Client Data in accordance with this Policy. Individuals with inquiries or complaints regarding LOSANGE’s compliance with this Policy should first contact LOSANGE at: admin@losangefinance.com. LOSANGE will investigate and attempt to resolve all complaints and disputes.  

HOW TO CONTACT US
If you have any questions regarding this Policy or if you need to request access to or update, change or remove personal information that LOSANGE processes on your behalf, you can do so by contacting:  LOSANGE FINANCE at: 4 Place Ville Marie, Montreal, QC H3B 2L4 Email: admin@losangefinance.com  

AMENDMENTS
LOSANGE reserves the right to change, modify, add or remove portions of this Policy from time to time and in its sole discretion but will update the public that changes have been made by indicating on this Policy the date it was last updated.​​