Privacy Policy

In Brief

• This policy explains what personal information the newera.atlantisstrength.app website collects, why, who receives it, where it is kept and how to exercise your rights.
• The Website has no user accounts and sells nothing online. What we collect is mostly what you send us through our forms: contact or quote requests, distributor or job applications, product registration, newsletter.
• Your requests are recorded on our server, hosted by OVH in Canada, except those you will send through a HubSpot form embedded in a page, once these forms are in place: they will go directly to HubSpot, which will keep them in its Montreal data center, in Canada, and may also process them in the United States. Our product image server is hosted by Hostinger in the United States.
• No advertising tool is loaded on the Website. The HubSpot tracking code, which measures the Website’s audience, loads only if you accept it in the consent banner; the HubSpot forms embedded in the pages, once they are in place, will however count their own displays as soon as the page opens, whatever your choice. Our own measurements (page traffic and speed, A/B tests, error reports) stay on our server, without cookies; only the summary of a fault, without any information about any individual visitor, may be passed to HubSpot.
• If you accept it, the tracking code of HubSpot (United States), which provides our customer relationship management system, records the pages you visit and the content of the forms you send us, but never a job application. If you decline, or if your browser sends the Global Privacy Control signal, this code does not load and sends nothing to it; only the HubSpot forms embedded in the pages and the booking calendar displayed directly in a page, once they are in place, will still contact it, as soon as the page opens.
• The other HubSpot services (forms connected directly to HubSpot, meeting booking, campaign pages, forms embedded in the pages) and the internal email notice of your requests run only once we switch them on; this policy describes what each of them collects. The HubSpot forms embedded in the pages will not be put in place before this policy takes effect.
• Some external content appears on certain pages: the OpenStreetMap map on our contact pages and the large images of three “Industries” pages, served by our atlantisstrength.com website through Cloudflare, load automatically; YouTube videos load only if you click.
• We do not sell or rent your personal information.
• You can access your information, have it corrected or deleted, object to some processing and withdraw your consent by writing to privacy@atlantisstrength.com.
• Any substantial change to this policy is announced at least 30 days before it takes effect.

Who We Are

The Website is operated by Atlantis Strength Inc. (Atlantis Force Inc. in French), a corporation incorporated under the Canada Business Corporations Act (corporation number 207503-2), whose registered office is at 4745 avenue des Industries, Laval, Quebec H7C 1A1, Canada (“Atlantis”, “we”, “us”). We are responsible for the personal information collected by the Website; under the General Data Protection Regulation of the European Union (GDPR) and the UK GDPR, we are its “controller”.

This policy applies to the newera.atlantisstrength.app website (the “Website”) and to the information it collects. It concerns people who visit it, write to us or ask us for a quote, register a product, apply for a job or to become a distributor, as well as people named in our case studies. It is an information notice separate from the Terms and Conditions of the Website, and it is not part of them.

Person in Charge of the Protection of Personal Information

For any question about this policy, to exercise your rights or to make a complaint, write to our Privacy Officer, the person in charge of the protection of personal information:

Diego Fernandez, Privacy Officer
Atlantis Strength Inc.
4745 avenue des Industries, Laval, Quebec H7C 1A1, Canada
privacy@atlantisstrength.com

What We Collect, Why, and on What Basis

We only collect the information needed for the purposes described below, and we do not use it for other purposes without your consent, unless the law permits or requires it.

In Quebec and elsewhere in Canada, when you give us information after being informed as described in this policy, you consent to its use and disclosure for the stated purposes; you can withdraw this consent at any time (see “Your Rights”). For people in the European Union, the European Economic Area (EEA) or the United Kingdom, the legal basis of each processing activity under Article 6 of the GDPR is given in the following table and in the sections that detail it.

The table summarizes each processing activity: the people concerned, the information, the purpose, the legal basis and the retention period.

Requests Sent Through Our Forms

The Website has six forms: contact, quote request (a single screen, the same on three pages), distributor application, product registration for the warranty, newsletter subscription and job application. What you enter in our forms (depending on the form: your name, email, phone, organization, city or address, website, order number, your message and, for a job application, your résumé and cover letter; for a quote request, the machines in your “My project” list) is recorded on our own server. The server adds the date and time, a reference number, the language and page from which you sent it, the description of your browser, a fingerprint of your IP address (see “Protection Against Abuse”), the campaign parameters of the link that brought you, if any (see “Campaign Parameters”), and the version of the page you saw if an A/B test was running. Where one of these forms is replaced by a HubSpot form, the above does not apply: see “HubSpot Forms Embedded in the Pages”.

We use this information to answer your request and follow up on it: call you back, prepare a quote, review an application, register the warranty of your equipment. The members of our team in charge of your request have access to it. When the internal notice described in the processing table is switched on, a copy of your request is also sent to them by email. The fields marked as required are needed to process your request: without them, we cannot answer it. The quote request form also requires you to tick an agreement box; we keep a record of that agreement and its date.

Legal basis (GDPR): steps taken at your request before entering into a contract, or the performance of a contract such as the warranty of your equipment (Article 6(1)(b)); for a simple question, our legitimate interest in answering you (Article 6(1)(f)); for the quote request, the checkbox records your agreement to these pre-contractual steps, which remain the legal basis; for the newsletter, your consent (see “Newsletter”).

What HubSpot receives from our forms. If you accepted the HubSpot tracking code (see “Consent Banner and HubSpot Tracking Code”), this code also collects the content of the Website forms you send and passes it to HubSpot, which links it to the pages you visited. It never collects job applications, forms with an attached file or a password, bug reports or our internal tools. If you declined the tracking code, have not made a choice yet, or if your browser sends the Global Privacy Control signal, HubSpot receives nothing from the Website forms: your requests stay on our server (the HubSpot forms embedded in the pages follow other rules: see “HubSpot Forms Embedded in the Pages”).

Forms connected directly to HubSpot (once this service is switched on). Once this service is switched on, some forms are connected directly to our customer relationship management system, provided by HubSpot, Inc., and quote requests are sent to it directly (see “HubSpot and Its Services”). A connected form says so in a sentence right below it, with a link to this section. What is then sent to HubSpot, whether or not you accepted the tracking code: the information you entered in the form, the language and page from which you sent it, the campaign parameters and the reference number of your request. Job applications will never be sent to HubSpot in any form: they stay on our server. If you accepted the tracking code, the pseudonymous identifier of its cookie will be sent too, so that your request is linked to the pages you visited; if you declined it, nothing will link your request to your browsing.

HubSpot Forms Embedded in the Pages

Depending on our settings, the contact (including the “Let’s talk about your project” form of the configurator), distributor application, product registration and newsletter subscription forms may be replaced, in the page, by forms of HubSpot, Inc., which provides our customer relationship management system. Such a form says so in a sentence right below it, with a link to this policy. Two HubSpot forms replace them: one receives contact, distributor and product registration requests, the other newsletter subscriptions, each in French and in English. The quote request and the job application remain Website forms. These forms will not be put in place before this policy takes effect.

As soon as the page opens. Where a HubSpot form is embedded, your browser contacts HubSpot as soon as the page opens, before you enter anything: it loads a script and the form itself from HubSpot’s servers (hsforms.net and hsforms.com). HubSpot then receives your IP address, the description of your browser, the address and title of the page, with the parameters of the link that brought you there, and the page you came from; it also counts the display of the form. If you accepted the HubSpot tracking code (see “Consent Banner and HubSpot Tracking Code”), it also receives the identifiers of its cookies, so that a request can be linked to the pages you visited; otherwise, nothing links the form to your browsing. The form itself places no cookie and no storage item on the Website’s domain, and HubSpot’s privacy policy (legal.hubspot.com/privacy-policy) also applies inside the form. We do this so that the form is ready without an extra step (our legitimate interest, GDPR Article 6(1)(f)).

When you send it. What you enter in the form (depending on the page: your first and last name, email, phone, organization, province or state, address, website, city, postal code, country and your message) is sent by your browser directly to HubSpot and recorded in our customer relationship management system, with the type of your request (contact, distributor or product registration), your language and the page from which you sent it. It is not recorded on our server: your request has no Website reference number, and our server attaches neither the fingerprint of your IP address nor the page version of an A/B test. To register a product, please write your order number in the message. The members of our team in charge of your request view it in HubSpot. HubSpot may also send a copy of it by email to the members of our team in charge of these forms: this internal notice is the one described in the processing table (“Internal email notice of requests received”), under the same conditions. The purposes and legal bases are those of the request concerned, described above; HubSpot processes this information on our behalf, under the conditions described in “HubSpot and Its Services”: it keeps it in Canada and may also process it outside Canada, including in the United States.

Newsletter. In HubSpot’s subscription form, you tick a box to agree to receive the newsletter by email. HubSpot records your email address, your language and this consent, with its date, in our account, from which the newsletter will be sent to you. Legal basis: your consent (GDPR Article 6(1)(a); Canada’s Anti-Spam Legislation), which you can withdraw at any time, including through the unsubscribe link in each mailing.

If a HubSpot form does not load, for example because a blocker prevents it, the Website’s own form appears in its place, and your request follows the path described in “Requests Sent Through Our Forms”.

Newsletter

If you subscribe to our newsletter, we keep your email address together with the exact text of the consent you accepted and its date. We will use it to send you by email what that text announces (for example, on the new arrivals page, our new machines and their launch dates), with your express consent (GDPR Article 6(1)(a); Canada’s Anti-Spam Legislation). Each mailing will include an unsubscribe link, and you can withdraw your consent at any time by writing to us. Once the subscription form is HubSpot’s (see “HubSpot Forms Embedded in the Pages”), your subscription will be recorded in our HubSpot account, from which the newsletter will be sent to you; if we entrust mailings to another provider, this policy will name it before it receives your address. The other forms do not subscribe you to any commercial communication.

Protection Against Abuse

To prevent automated mass submissions of forms and bug reports, our server counts the recent submissions of each IP address. It does not keep your IP address in clear for this: it computes a one-way fingerprint which, for the forms, is salted with a secret that never leaves the server. The form counters are erased after a few hours; the fingerprint stays attached to the request you send. Automatic error reports and traffic measurement also go through a counter, based on an unsalted fingerprint of your IP address (of the truncated address, for the measurement): it covers the last hour for error reports, and the current minute for the measurement. Legal basis: our legitimate interest in protecting the Website and its users (GDPR Article 6(1)(f)).

Campaign Parameters

If you reach the Website through a campaign link (for example in an email, a post or a QR code) that carries “utm” parameters, the Website keeps them in your browser tab (session storage, erased when the tab is closed), together with the address of the landing page. If you then send a request through a form, these parameters are attached to it: they tell us which campaign brought it. They contain only what was already written in the link you followed. Legal basis: our legitimate interest in knowing how effective our campaigns are (GDPR Article 6(1)(f)).

A/B Testing of Website Pages

We occasionally serve two versions of the same Website page, in order to find out which one is more useful to visitors. This measurement is made by our own server, from what our script sends it during your visit: no cookie or storage item is placed on or read from your device for this purpose, and no third party receives any part of it.

So that you see a consistent version from one page to the next, our server computes a one-way cryptographic fingerprint from your truncated IP address (the last portion is discarded) and your browser and system families, salted with a secret that is specific to each test and destroyed when that test ends. Your IP address itself is never stored. What is recorded is that fingerprint, the page, the version served, the language, whether the device is a desktop or a mobile, how far the page was scrolled, how long it was actively visible, the number of interactions, the furthest step reached in a page journey, for example in the “My project” list, and whether a goal, such as sending a form, was reached. If you send a Website form while a test is running, this goal is recorded with your fingerprint, even if you saw no page under test. Every night, a scheduled task deletes detailed events that are more than 90 days old (no later than 92 days after they are recorded). A test’s fingerprint index, which is used to link a goal reached to the version seen, is kept during the test and deleted when it ends; after that, only aggregate counts, without fingerprints, are kept.

Legal basis: our legitimate interest in improving the Website (GDPR Article 6(1)(f)). No cookie or storage item is placed on or read from your device for this measurement; our script only notes, during your visit, scrolling, visible time and interactions. It is not used to identify you, locate you or build a profile of you. Should we ever move to a method that does store something on your device, we would ask for your consent first.

Measurement of the Website’s Traffic and Speed

To know which pages are useful and which ones lead to a request or to a contact, how fast the Website loads for its visitors and what does not work, in order to fix it, our own server measures visits. As with A/B tests, no cookie or storage item is placed on your device for this purpose. Our script only reads, during your visit, the technical information listed below, which your browser makes available to it, and our server only checks whether our administration tools’ cookie is present, never its value (see below). No third party receives these measurements, except the summary of a fault that we may pass to our tracking tool (HubSpot), described below. We view them in a dashboard (Umami) installed on that same server, in Canada, which receives neither your IP address nor the full description of your browser.

During your visit, your browser sends our server the page viewed, the name of the website you came from (its name only), the utm_source, utm_medium and utm_campaign campaign parameters, the language, the width of your browser window, the device type, the browser and system family, how long the page was visible, scrolling, the loading speed measured by your browser (Core Web Vitals), server calls or files that fail, repeated clicks on the same element, pages not found with the page that led there, the sending of a form (which one and from which page, never its content), contacts started from the Website (a call, a WhatsApp message or an email opened from a link on the Website, the opening of a calendar and the confirmation that a meeting is booked, with the profile of our team member concerned, but never the content of these exchanges or your contact details: the HubSpot calendar only tells the page that a meeting is booked), a machine added to your project (its code) and a file downloaded (its name). This information carries a random identifier drawn when each page opens, which is not kept on your device. To recognize the pages of a single visit, our server computes a one-way fingerprint from your truncated IP address and your browser and system families, salted with a secret drawn every day and destroyed the next day: two days of visits cannot be linked, and your IP address is never recorded. Visits by our staff are set apart from the figures, recognized only by the presence, in their browser, of our administration tools’ cookie.

If your browser sends the Global Privacy Control or Do Not Track signal, only faults reach us, without a fingerprint. Our staff may pass the summary of a fault to our tracking tool, HubSpot (United States), as a ticket: the pages affected, the number of occurrences and of visitor-days, the websites visitors came from (their name only), the browser families and the technical trace of the error, without any information about any individual visitor. Every night, whether the measurement is running or stopped and even without any visit, a scheduled task deletes detailed events that are more than 35 days old (no later than 37 days after they are recorded), aggregate counts older than 400 days and the secret of each past day; stopping the measurement also does this deletion immediately. Only aggregate counts, without fingerprints, are kept beyond 35 days. Legal basis: our legitimate interest in measuring and fixing the Website (GDPR Article 6(1)(f)); this measurement is not used to identify you, locate you or build a profile of you.

Bug Reports and Error Reports

The Website has a tool to report a problem to us (it opens in particular with the Ctrl+B shortcut); it is available to every visitor, on every page of the Website. So that a report is useful, the Website keeps, during your visit, a session log in your browser tab (atl-journal): the pages opened, the clicks with the label of the button or link, the name of the fields changed but never what you type in them, the keyboard shortcuts used, the network calls of the Website and the errors. This log only keeps the last 20 minutes, is erased when the tab is closed and leaves your browser only if you send a report.

If you send a report, we receive your description, the name you give (optional and not verified), this log, then its continuation for two minutes after sending, a screenshot of the page (field values are masked before the screenshot is taken), technical details (screen and window size, language, time zone, previous page), your full IP address, the description of your browser, the version of the Website and the page version served by an A/B test. Your browser also keeps the name you gave and a random identifier, which lets us group your reports without naming you.

Independently of any report, when a programming error occurs in your browser, the Website automatically sends us the error message, its technical trace, the address of the page and the version of the Website, with no log, no screenshot and without attaching your IP address.

We use this information only to find and fix problems on the Website. Legal basis: our legitimate interest in keeping it working properly (GDPR Article 6(1)(f)).

Server Logs

Like any web server, our servers keep technical logs of the requests they receive: IP address, date and time, address requested (including the terms of a search made on the Website), previous page and browser description. They are used for diagnosis and security. Legal basis: our legitimate interest in operating the Website securely (GDPR Article 6(1)(f)).

Case Studies and Testimonials

Our case studies present installations completed for our customers. Some name representatives of these customers, with their job title, company, city, a quotation and sometimes a link to a public social media profile. Anyone named can ask us to correct or remove this information by writing to privacy@atlantisstrength.com.

Sensitive Information

We do not ask you for any sensitive information, for example about your health. A message, a résumé or a bug report may however contain some if you choose to include it: only include what is useful to your request.

HubSpot and Its Services

HubSpot, Inc. (Cambridge, Massachusetts, United States) provides our customer relationship management system and processes on our behalf the information we entrust to it. Our HubSpot account is hosted in HubSpot’s Canadian data center, in Montreal (with Amazon Web Services): this information is kept there, and its backup copies stay in Canada. HubSpot does not, however, guarantee that it stays there at all times: its support, security and development staff, its affiliates and its sub-processors may access or process it outside Canada, including in the United States, and some usage data of its service is transferred to the United States. On the Website, its tracking code loads only if you accept it in the consent banner, and it then also collects the content of our forms. The other services described in this section run only once we switch them on (see “Other HubSpot Services”).

Agreement and transfer. Our use of HubSpot is governed by its customer terms of service, which include its Data Processing Agreement: HubSpot acts as our processor under it and undertakes to process this information only on our instructions and to protect it. Access and processing in the United States rely on HubSpot, Inc.’s certification under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework; the agreement also provides for the Standard Contractual Clauses of the European Commission and, for the United Kingdom, the addendum issued by the Information Commissioner. The privacy impact assessment that Quebec law requires before any disclosure of information outside Quebec is under way (see “Where Your Information Is Kept and Disclosure Outside Quebec”).

Consent Banner and HubSpot Tracking Code

With your consent only, the Website uses the HubSpot tracking code, and a banner asks for your choice. Until you click “Accept” in the banner, the tracking code is not loaded: it sends nothing to HubSpot and places no cookie on your device. The HubSpot forms embedded in some pages and the booking calendar displayed directly in a page, once they are in place, are an exception: they load from HubSpot’s servers as soon as the page opens, whether you accepted, declined or have not yet chosen, and even if your browser sends the Global Privacy Control signal (see “HubSpot Forms Embedded in the Pages” and “Calendar displayed directly in the page”). The tracking code is therefore off by default. If you decline, ignore the banner, or if your browser sends the Global Privacy Control signal (treated as a refusal, without even showing the banner), the Website works exactly the same.

If you accept, your browser loads the HubSpot script, which then contacts other HubSpot servers. The tracking code records the pages of the Website you visit, when you visit them and the page you came from, together with your IP address and the type of browser and device you use, under a pseudonymous identifier stored in a cookie. We use this information to measure the audience of the Website and to follow up on requests. It is not used for advertising: the HubSpot chat window and the advertising pixels HubSpot can install are disabled.

Forms collected by the tracking code. If you accepted, the tracking code also collects what you enter in the Website forms when you send them. HubSpot records it in our account, linked to the history of your visits, so that the person who answers you knows which products you looked at. The tracking code never collects job applications, forms with an attached file or a password, bug reports or our internal tools. Your request is also recorded on our server, as described in “Requests Sent Through Our Forms”.

The main cookies placed by HubSpot, according to its documentation, are:

• __hstc: the main tracking cookie (identifier, first and last visit, number of visits), kept 6 months;
• hubspotutk: the pseudonymous identifier used to recognize you when you submit a form, kept 6 months;
• __hssc: counts the pages viewed during the current visit, kept 30 minutes;
• __hssrc: detects the start of a new visit, deleted when you close your browser.

The Website also keeps the choice you made in your browser (atl.consentement.v1, 6 months), so that it does not ask you on every page. This item is strictly necessary to respect your choice, including a refusal, and it never leaves your browser.

Legal basis: your consent (GDPR Article 6(1)(a); section 8.1 of Quebec’s Act respecting the protection of personal information in the private sector). Your choice is kept for six months, after which we ask you again; we also ask again if what you accepted changes, for example if the tracking code starts collecting something else. You can withdraw your consent at any time, as easily as you gave it, with the “Cookies” link at the bottom of every page. Withdrawing deletes the HubSpot cookies from your browser; it does not affect what was collected before, but you can ask us to delete from our HubSpot account what concerns you (see “Your Rights”).

Other HubSpot Services

The following services run only once we switch them on; the HubSpot forms embedded in the pages will not be put in place before this policy takes effect, as stated at the top of this page:

• forms connected directly to HubSpot and the direct sending of quote requests to our customer relationship management system (see “Requests Sent Through Our Forms”);
• booking a meeting with our team, described below;
• campaign pages published on a HubSpot domain: HubSpot will receive your visits to them and what you enter in their form, and its own cookie banner will apply there;
• HubSpot forms embedded in the contact, configurator, distributor, product registration and newsletter pages (see “HubSpot Forms Embedded in the Pages”).

They will rely on the same agreement and on the same transfer mechanisms as the tracking code. Before putting any of them into service, we will have completed the privacy impact assessment described above, and we will put none of them into service if it does not show that the information will receive adequate protection.

Booking a Meeting with Our Team

Once this service is in place, some of our contact pages will let you book a meeting directly in the calendar of the person who covers your territory, or in a general calendar of our team. Depending on our settings, a calendar will be shown in one of two ways. Either the calendar will not be loaded from HubSpot, and nothing will be sent to it for the calendar, until you click to book: the calendar will then open in a window served directly by HubSpot; or it will be displayed directly in the page, as described in the next paragraph. In both cases, HubSpot’s own privacy policy (legal.hubspot.com/privacy-policy) will also apply inside the calendar.

Calendar displayed directly in the page. Where a calendar is shown without a click, your browser will contact HubSpot as soon as the page opens: it will load a HubSpot script (hsappstatic.net), then the calendar itself (meetings.hubspot.com, or its regional address). HubSpot will then receive your IP address, your type of browser, the address of the page with the parameters of the link that brought you there, and an identifier. If you accepted the HubSpot tracking code (see “Consent Banner and HubSpot Tracking Code”), this identifier will be the one in its cookie, so that a booking can be linked to the pages you visited; otherwise, it will be a temporary identifier created for that page only. We do this so that the calendar is ready without an extra step (our legitimate interest, GDPR Article 6(1)(f)). HubSpot may process this information outside Quebec and Canada, including in the United States.

If you book, the information you enter (your first and last name, your email address and any details you choose to add) will be collected by HubSpot and recorded in our customer relationship management system, so that the meeting is added to our representative’s calendar, you both receive a confirmation and we can follow up on your request. Booking a meeting will not subscribe you to any commercial communication. Legal basis: the steps needed to arrange the meeting you ask for (GDPR Article 6(1)(b)).

Third-Party Services Embedded in the Website

Some pages display content provided by other servers. To display it, your browser contacts them directly and sends them, as it would to any web server, your IP address, the description of your browser and the address of our Website.

• OpenStreetMap map: on our contact pages, the map showing our facilities loads automatically when you scroll down to it. Its images come from the servers of the OpenStreetMap Foundation (United Kingdom), distributed by a content delivery network that may serve them from other countries. The Foundation processes this information under its own privacy policy. Legal basis: our legitimate interest in showing you where to find us (GDPR Article 6(1)(f)); our address is also written as text on the page.
• YouTube videos: on some product pages, a video only loads if you click on its image; nothing is sent to YouTube before that click. After the click, the video is served by YouTube (Google LLC, United States) in privacy-enhanced mode (youtube-nocookie.com), and Google may place cookies or other items on your device and collect information under its privacy policy. Legal basis: your consent, given by that click (GDPR Article 6(1)(a)).
• Product images: the original photos of our products are kept on another of our servers, s2.atlantisstrength.app, hosted by Hostinger (see “Where Your Information Is Kept and Disclosure Outside Quebec”). Ordinarily, our website fetches these photos itself and serves them to you: your browser does not contact that server. It does so only if our website cannot prepare a photo: your browser is then redirected to that server. That server then receives the same technical information as any web server and may record it in its logs.
• Images from our atlantisstrength.com website: on three pages of the “Industries” section (commercial gyms, private training studios, universities and schools), the large photo of an installation loads automatically from our atlantisstrength.com website when you scroll down to it. That website is served through Cloudflare, Inc. (United States), a delivery network placed in front of its host, which also receives these requests. Legal basis: our legitimate interest in illustrating our projects (GDPR Article 6(1)(f)).
• HubSpot forms: once they are in place, the contact (including the one on the configurator), distributor, product registration and newsletter forms of some pages will load from HubSpot as soon as the page opens (see “HubSpot Forms Embedded in the Pages”).

Cookies and Storage on Your Device

The Website itself places no cookie on its visitors’ devices; only internal pages reserved for our staff and our guests use a session cookie. It does however keep a few items in your browser’s storage: local storage, which lasts until you erase it, or session storage, erased when the tab is closed. These items do not leave your browser, except in the cases described in this policy:

• your preferences: the display language, recorded when some pages open and when you choose one, and the light or dark display, when you choose it;
• your “My project” list and your last six searches on the Website;
• the draft of the quote request form, including your contact details, so that you can resume it; it is erased after a successful submission, but stays in your browser if you abandon the form;
• the update notices of our legal texts that you have closed;
• the choice you make in the consent banner;
• the campaign parameters, in the tab (see “Campaign Parameters”);
• the session log of the bug report tool, in the tab, and, after a first report, the name you gave and a random identifier (see “Bug Reports and Error Reports”).

The campaign parameters and the session log are not strictly necessary to display the pages: they are used to attribute requests to our campaigns and to diagnose problems. They only leave your browser if you send a form or a report, and they are erased when the tab is closed. You can erase all these items at any time in your browser settings (site data). The third-party services described above may place their own cookies, in particular YouTube after a click and HubSpot after your consent.

Who Receives Your Information

Your information is accessed by the members of our staff who need it in their duties: the sales team and customer service for requests, the people in charge of hiring for job applications, and the people in charge of the Website for bug reports and technical measurements. It is also entrusted to the providers that host the Website and to HubSpot, if you accept its tracking code or, once these services are in place, if you submit a form connected to it or a quote request, if you open a page where one of its forms is embedded or its booking calendar is displayed directly, even without using it, if you book a meeting with our team or if you visit one of our campaign pages hosted by HubSpot. Some pages also use external services that your browser contacts directly (see “Third-Party Services Embedded in the Website”). The table below gives, for each recipient, its role, what it receives, where it is located and the safeguards that frame the disclosure.

We may also disclose personal information:

• to public or judicial authorities, when the law requires us to, for example in response to an order;
• when necessary to prevent or stop fraud, abuse of the Website or a threat to the safety of any person, to the extent permitted by law;
• to another company, as part of a merger, a reorganization or the sale of all or part of our business; we will then require it to honour the commitments of this policy, or we will inform you that a new policy applies.

We do not sell or rent your personal information, and we do not disclose it to anyone for advertising or marketing purposes.

Where Your Information Is Kept and Disclosure Outside Quebec

The Website and the information it receives are hosted by OVH Hosting, Inc. (OVHcloud), on servers located in Canada. Our product image server is hosted by Hostinger. According to the public information associated with its address, this server is located in the United States. Our customer relationship management system, provided by HubSpot, Inc., is hosted in HubSpot’s data center in Montreal, Canada.

Information may therefore be disclosed outside Quebec and Canada:

• to the image server hosted by Hostinger, as described above;
• to HubSpot, Inc. (United States), which keeps the information in our account in its Montreal data center, but whose staff, affiliates and sub-processors may access or process it outside Canada, including in the United States: if you accept its tracking code, the pages you visit and the content of the forms you send, under the conditions described in “HubSpot and Its Services”; once they are in place, its forms embedded in the pages will receive the form’s technical data as soon as the page opens, then what you enter in them; its other services, once we switch them on, receive what this policy describes;
• to Cloudflare (United States) and the host of our atlantisstrength.com website, when the large image of one of three “Industries” pages loads;
• to the OpenStreetMap Foundation (United Kingdom) and its delivery network, when the map on a contact page loads;
• to Google (United States), if you start a YouTube video.

Information stored or processed outside Canada is subject to the laws of the country where it is located: the courts, law enforcement agencies and national security authorities of that country may access it under those laws. A company established in the United States, such as HubSpot, Inc., may also be required by the laws of that country to disclose to U.S. authorities information in its possession, custody or control, even if it is kept in Canada.

People in Quebec. Before disclosing personal information outside Quebec, we must assess whether it will receive adequate protection there (privacy impact assessment) and enter into a written agreement that takes this assessment into account. For HubSpot, the written agreement exists (see “HubSpot and Its Services”) and the assessment, which takes into account both the hosting in Montreal and the possible access and processing in the United States, is under way; if it does not show that the information receives adequate protection there, we will stop using its tracking code. For the image server hosted by Hostinger, we undertake to carry out this assessment and to sign this agreement, or to replace it with a server located in Canada. The OpenStreetMap map on the contact pages and the images from our atlantisstrength.com website, which load automatically, and YouTube videos, which load after your click, are requested by your browser directly from these providers: no assessment or written agreement exists with OpenStreetMap or Google, and none is documented for Cloudflare; our address is also shown as text on the contact pages. We undertake to apply this rule to any new disclosure.

People in the EEA or the United Kingdom. Your information is processed in Canada, which is covered by an adequacy decision of the European Commission for organizations subject to the Personal Information Protection and Electronic Documents Act (Decision 2002/2/EC), also recognized by the United Kingdom. There is no adequacy decision covering the United States as a whole: the European Commission’s decision, and its UK extension, only cover companies certified under the EU-U.S. Data Privacy Framework. The information we entrust to HubSpot is kept in Canada; for access and processing that take place in the United States, HubSpot, Inc. is certified under this framework and its UK Extension, and its Data Processing Agreement also provides for the Standard Contractual Clauses of the European Commission and, for the United Kingdom, the addendum issued by the Information Commissioner. We undertake to entrust information to another provider in the United States only after entering into a written agreement with it that includes these clauses and this addendum; we make the same commitment for Hostinger, as stated above. Cloudflare, Google (YouTube) and the OpenStreetMap Foundation receive directly from your browser the requests described in “Third-Party Services Embedded in the Website”. You can obtain a copy of the safeguards in place by writing to us.

You can refuse to have information about you transferred outside the EEA, the United Kingdom or Quebec by writing to our Privacy Officer; for the HubSpot tracking code, simply decline it in the consent banner. This refusal may prevent you from using some features of the Website.

How Long We Keep Your Information

We keep your information for as long as needed for the purposes for which it was collected, then for as long as the law requires or as needed to assert or defend our rights. Here, for each category, is the starting point and the criterion we apply. Except where a specific period is stated, no automatic deletion exists yet: deletion is done manually, in particular at your request, and we will state the periods we adopt in a future version of this policy.

• Contact, quote request and distributor requests: during the exchange and any business relationship that follows from it; no specific period is set yet.
• Product registrations: during the warranty of your equipment, then as long as needed to settle related claims; no specific period is set yet.
• Job applications, including résumés and cover letters: during the hiring process; no period is set yet for afterwards, and you can ask for their deletion at any time.
• Newsletter subscription: until you withdraw your consent; we then keep proof of your consent and of its withdrawal for as long as needed to show that we complied with the law.
• Bug reports: until the problem is dealt with; no maximum period is set yet. Automatic error reports: only the 400 most recent distinct errors are kept.
• A/B tests: detailed events are deleted every night by a scheduled task once they are more than 90 days old (no later than 92 days after they are recorded); a test’s fingerprint index is kept during the test and deleted when it ends; only aggregate counts, without fingerprints, are kept after that.
• Traffic and speed measurement: detailed events are deleted every night once they are more than 35 days old (no later than 37 days after they are recorded), whether the measurement is running or stopped, and the day’s secret is destroyed the next day; only aggregate counts, without fingerprints, are kept after that, for 400 days.
• Abuse protection counters: a few hours for forms, bug reports and automatic error reports; the current minute for traffic measurement.
• Server logs: according to the configuration of our hosting providers; no period is set yet.
• Campaign parameters and session log: until the tab is closed, and 20 minutes at most for each log entry; once attached to a request or a report, they follow its retention.
• Consent banner choice: 6 months in your browser; HubSpot cookies: see their duration above.
• Information collected by the HubSpot tracking code, if you accepted it: in our HubSpot account, during any business relationship that follows; no maximum period is set yet, and you can ask for its deletion at any time.
• Requests sent through a HubSpot form embedded in a page, once these forms are in place: in our HubSpot account, during the exchange and any business relationship that follows; no maximum period is set yet, and you can ask for their deletion at any time.
• Information published in a case study: as long as the case study is online, or until the person named asks for its removal.

Where the law permits, we may keep data that has been made anonymous, which no longer allows anyone to be identified, such as the aggregate counts of A/B tests and of traffic measurement.

Security

We protect your information with measures suited to its sensitivity, including:

• all communications with the Website are encrypted (HTTPS);
• requests, applications and bug reports are kept outside the public part of the server, in files whose access is restricted to the Website service; no public address gives access to them, and only our administration tools, after authentication, allow them to be viewed;
• résumés and cover letters are limited to PDF, DOC and DOCX files of up to 5 MB, and are kept like the applications they accompany;
• apart from bug reports and server logs, our application does not record your IP address in clear, only a one-way fingerprint;
• access to our administration tools is reserved to authorized people, through individual password-protected accounts, and sensitive operations are logged;
• the value of form fields is never written in the session log, and it is masked on the screenshots of bug reports.

No measure is perfect. If a confidentiality incident occurs, we will take reasonable measures to reduce the risks and, where the law requires it, we will notify the Commission d’accès à l’information du Québec, the other competent authorities and the people concerned.

Your Rights

Depending on the laws that apply to you, including Quebec’s Act respecting the protection of personal information in the private sector, Canada’s Personal Information Protection and Electronic Documents Act, the GDPR and the UK GDPR, you can:

• access your personal information and know how we use it and to whom we disclose it;
• have it corrected if it is inaccurate, incomplete or equivocal;
• ask for its deletion;
• ask for the restriction of its processing, for example while we check its accuracy;
• receive the computerized information you gave us in a structured, commonly used technological format, or have it sent to the person or body of your choice (portability);
• ask us to stop disseminating information about you or to de-index any hyperlink attached to your name that gives access to it, where this dissemination contravenes the law or a court order, or causes you serious injury, under the conditions set by law;
• withdraw your consent at any time, without affecting what was done before.

Your Right to Object

You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest: answering a simple question, protection against abuse, campaign parameters, A/B tests, traffic and speed measurement, bug and error reports, server logs (including those of our image server), the map on our contact pages, the images from our atlantisstrength.com website, case studies and testimonials, the calendar displayed directly in the page and the loading of HubSpot forms embedded in the pages, once they are in place. We will then stop that processing, unless we have compelling legitimate grounds to continue it or need it to establish, exercise or defend legal claims. You can also object at any time, without having to give a reason, to the use of your information for direct marketing.

Automated Decisions

We make no decision based exclusively on automated processing of your information, and no automatic screening is applied to job applications. Should this change, we would inform you first, as the law requires.

How to Exercise Your Rights

Write to privacy@atlantisstrength.com or to the postal address given above. We may ask you to confirm your identity, so that we disclose your information only to you. We will answer you in writing within 30 days of receiving your request; where the applicable law allows this period to be extended for a complex request, we will tell you before the 30 days are over, with the reason. Exercising your rights is free of charge; reasonable fees could only be charged in the cases provided for by law, and you would be told in advance. If we refuse a request, we will give you the reasons in writing, with the provision of the law on which the refusal is based, and tell you what remedies you have and the time limit for exercising them; if you ask, we will help you understand the refusal (section 34 of Quebec’s Act respecting the protection of personal information in the private sector). Exercising your rights has no effect on the prices or conditions we offer you.

Complaints

If you believe we have not respected your rights or this policy, we invite you to write to us first, by email at privacy@atlantisstrength.com or by mail. We will acknowledge receipt of your complaint within 30 days, look into it and inform you of the outcome.

You can also contact a supervisory authority:

• in Quebec: the Commission d’accès à l’information du Québec; if we refuse a request for access or correction, or do not answer it within 30 days, an application to examine the disagreement must be filed with it within 30 days of the refusal or of the expiry of the time limit for answering (sections 42 and 43 of the Act respecting the protection of personal information in the private sector);
• elsewhere in Canada: the Office of the Privacy Commissioner of Canada;
• in the United Kingdom: the Information Commissioner’s Office;
• in the EEA: the data protection authority of the country where you live, where you work or where the alleged infringement took place, whose list is published by the European Data Protection Board.

Minors

The Website is intended for professionals and adults; it is not directed at minors. We do not knowingly collect information about a person under 14 years of age without the consent of the person having parental authority or the tutor. If we learn that we have received such information without this consent, we will delete it.

United States Residents and Browser Signals

We do not sell your personal information and do not share it for cross-context behavioural advertising, as those terms are defined by the laws of California and other U.S. states, and we do not use sensitive information to infer characteristics about you. If a law of your state gives you rights, for example to know what information we hold, or to have it corrected or deleted, you can exercise them as described in “Your Rights”, yourself or through an authorized agent. We will not treat you differently because you exercise them.

The “Do Not Track” signal, for which there is no common standard, limits our own traffic measurement to faults, without a fingerprint; it changes nothing else: no advertising tool loads on the Website, the HubSpot tracking code in any case loads only with your consent, and only the HubSpot forms embedded in the pages, which will count their displays, and the booking calendar displayed directly in a page will contact HubSpot as soon as the page opens, once they are in place (see “HubSpot Forms Embedded in the Pages” and “Calendar displayed directly in the page”). The Global Privacy Control signal limits our traffic measurement in the same way, and is treated as a refusal of the HubSpot tracking code, without even showing the banner. Third-party services you choose to use (a YouTube video after a click, the HubSpot tracking code after your consent) may collect information about your online activities over time and across other websites, under their own policies.

Governance

Our Privacy Officer, Diego Fernandez, ensures compliance with the law and with this policy; he receives requests and complaints. We keep an inventory of the Website technologies that involve personal information, checked against this policy, and we review this policy at least once every 12 months. Our internal rules for the governance of personal information (roles and responsibilities of our staff, retention and destruction of information, handling of complaints) are being drafted; once approved by our Privacy Officer, they will be published on the Website and this policy will link to them. Until then, requests and complaints are handled as described in “How to Exercise Your Rights” and “Complaints”.

Changes to This Policy

The date of last update, the version number and the effective date of this policy are shown at the top of this page. Every version is kept: previous versions, with the summary of their changes, are at the bottom of this page (version history).

We distinguish three kinds of changes:

• Corrections: corrections of form, clarifications with no change of substance, updates of our contact details. They take effect when published.
• Changes with immediate effect, because they cannot wait or do not disadvantage you: those required by law or by an authority; urgent security measures; those that reduce what we collect or add protections; a more complete or more accurate description of processing already in place, with no new purpose and no new recipient; a new optional processing activity that only starts with your express consent, given after the publication of the version that describes it.
• Substantial changes: for example a new purpose, a new category of information or of recipients, a disclosure to a new country, a longer retention period or a reduction of your rights. They only take effect after at least 30 days’ notice: the new version is published at least 30 days before it takes effect, and we normally add a 14-day margin so that this notice remains complete even if its publication online is delayed.

A version takes the nature of its most demanding change. When a new version adds processing that is not yet in place, the notice at the top of this page states the date before which that processing will not start, at least 30 days after the publication of that version.

Every new version is announced by a banner on the pages of the Website for at least 30 days and, where applicable, until it takes effect. For a substantial change, and for any other significant change, we also make reasonable efforts to notify you by email when we have your contact information, for example if you are a customer, a distributor or a newsletter subscriber, or if you sent us a request. During the notice period, you can object, withdraw your consent or ask for the deletion of your information.

When a change affects processing based on your consent, or aims to use information already collected for a new purpose, we will ask for your consent again: a notice is not enough. A new version never applies retroactively: information collected under a previous version continues to be processed under that version’s commitments when they are more favourable to you.

In Brief

• This policy explains what personal information the newera.atlantisstrength.app website collects, why, who receives it, where it is kept and how to exercise your rights.
• The Website has no user accounts and sells nothing online. What we collect is mostly what you send us through our forms: contact or quote requests, distributor or job applications, product registration, newsletter.
• Your requests are recorded on our server, hosted by OVH in Canada, except those you will send through a HubSpot form embedded in a page, once these forms are in place: they will go directly to HubSpot, which will keep them in its Montreal data center, in Canada, and may also process them in the United States. Our product image server is hosted by Hostinger in the United States.
• No advertising tool is loaded on the Website. The HubSpot tracking code, which measures the Website’s audience, loads only if you accept it in the consent banner; the HubSpot forms embedded in the pages, once they are in place, will however count their own displays as soon as the page opens, whatever your choice. Our own measurements (page traffic and speed, A/B tests, error reports) stay on our server, without cookies; only the summary of a fault, without any information about any individual visitor, may be passed to HubSpot.
• If you accept it, the tracking code of HubSpot (United States), which provides our customer relationship management system, records the pages you visit and the content of the forms you send us, but never a job application. If you decline, or if your browser sends the Global Privacy Control signal, this code does not load and sends nothing to it; only the HubSpot forms embedded in the pages and the booking calendar displayed directly in a page, once they are in place, will still contact it, as soon as the page opens.
• The other HubSpot services (forms connected directly to HubSpot, meeting booking, campaign pages, forms embedded in the pages) and the internal email notice of your requests run only once we switch them on; this policy describes what each of them collects. The HubSpot forms embedded in the pages will not be put in place before this policy takes effect.
• Some external content appears on certain pages: the OpenStreetMap map on our contact pages and the large images of three “Industries” pages, served by our atlantisstrength.com website through Cloudflare, load automatically; YouTube videos load only if you click.
• We do not sell or rent your personal information.
• You can access your information, have it corrected or deleted, object to some processing and withdraw your consent by writing to privacy@atlantisstrength.com.
• Any substantial change to this policy is announced at least 30 days before it takes effect.

Who We Are

The Website is operated by Atlantis Strength Inc. (Atlantis Force Inc. in French), a corporation incorporated under the Canada Business Corporations Act (corporation number 207503-2), whose registered office is at 4745 avenue des Industries, Laval, Quebec H7C 1A1, Canada (“Atlantis”, “we”, “us”). We are responsible for the personal information collected by the Website; under the General Data Protection Regulation of the European Union (GDPR) and the UK GDPR, we are its “controller”.

This policy applies to the newera.atlantisstrength.app website (the “Website”) and to the information it collects. It concerns people who visit it, write to us or ask us for a quote, register a product, apply for a job or to become a distributor, as well as people named in our case studies. It is an information notice separate from the Terms and Conditions of the Website, and it is not part of them.

Person in Charge of the Protection of Personal Information

For any question about this policy, to exercise your rights or to make a complaint, write to our Privacy Officer, the person in charge of the protection of personal information:

Diego Fernandez, Privacy Officer
Atlantis Strength Inc.
4745 avenue des Industries, Laval, Quebec H7C 1A1, Canada
privacy@atlantisstrength.com

What We Collect, Why, and on What Basis

We only collect the information needed for the purposes described below, and we do not use it for other purposes without your consent, unless the law permits or requires it.

In Quebec and elsewhere in Canada, when you give us information after being informed as described in this policy, you consent to its use and disclosure for the stated purposes; you can withdraw this consent at any time (see “Your Rights”). For people in the European Union, the European Economic Area (EEA) or the United Kingdom, the legal basis of each processing activity under Article 6 of the GDPR is given in the following table and in the sections that detail it.

The table summarizes each processing activity: the people concerned, the information, the purpose, the legal basis and the retention period.

Requests Sent Through Our Forms

The Website has six forms: contact, quote request (a single screen, the same on three pages), distributor application, product registration for the warranty, newsletter subscription and job application. What you enter in our forms (depending on the form: your name, email, phone, organization, city or address, website, order number, your message and, for a job application, your résumé and cover letter; for a quote request, the machines in your “My project” list) is recorded on our own server. The server adds the date and time, a reference number, the language and page from which you sent it, the description of your browser, a fingerprint of your IP address (see “Protection Against Abuse”), the campaign parameters of the link that brought you, if any (see “Campaign Parameters”), and the version of the page you saw if an A/B test was running. Where one of these forms is replaced by a HubSpot form, the above does not apply: see “HubSpot Forms Embedded in the Pages”.

We use this information to answer your request and follow up on it: call you back, prepare a quote, review an application, register the warranty of your equipment. The members of our team in charge of your request have access to it. When the internal notice described in the processing table is switched on, a copy of your request is also sent to them by email. The fields marked as required are needed to process your request: without them, we cannot answer it. The quote request form also requires you to tick an agreement box; we keep a record of that agreement and its date.

Legal basis (GDPR): steps taken at your request before entering into a contract, or the performance of a contract such as the warranty of your equipment (Article 6(1)(b)); for a simple question, our legitimate interest in answering you (Article 6(1)(f)); for the quote request, the checkbox records your agreement to these pre-contractual steps, which remain the legal basis; for the newsletter, your consent (see “Newsletter”).

What HubSpot receives from our forms. If you accepted the HubSpot tracking code (see “Consent Banner and HubSpot Tracking Code”), this code also collects the content of the Website forms you send and passes it to HubSpot, which links it to the pages you visited. It never collects job applications, forms with an attached file or a password, bug reports or our internal tools. If you declined the tracking code, have not made a choice yet, or if your browser sends the Global Privacy Control signal, HubSpot receives nothing from the Website forms: your requests stay on our server (the HubSpot forms embedded in the pages follow other rules: see “HubSpot Forms Embedded in the Pages”).

Forms connected directly to HubSpot (once this service is switched on). Once this service is switched on, some forms are connected directly to our customer relationship management system, provided by HubSpot, Inc., and quote requests are sent to it directly (see “HubSpot and Its Services”). A connected form says so in a sentence right below it, with a link to this section. What is then sent to HubSpot, whether or not you accepted the tracking code: the information you entered in the form, the language and page from which you sent it, the campaign parameters and the reference number of your request. Job applications will never be sent to HubSpot in any form: they stay on our server. If you accepted the tracking code, the pseudonymous identifier of its cookie will be sent too, so that your request is linked to the pages you visited; if you declined it, nothing will link your request to your browsing.

HubSpot Forms Embedded in the Pages

Depending on our settings, the contact (including the “Let’s talk about your project” form of the configurator), distributor application, product registration and newsletter subscription forms may be replaced, in the page, by forms of HubSpot, Inc., which provides our customer relationship management system. Such a form says so in a sentence right below it, with a link to this policy. Two HubSpot forms replace them: one receives contact, distributor and product registration requests, the other newsletter subscriptions, each in French and in English. The quote request and the job application remain Website forms. These forms will not be put in place before this policy takes effect.

As soon as the page opens. Where a HubSpot form is embedded, your browser contacts HubSpot as soon as the page opens, before you enter anything: it loads a script and the form itself from HubSpot’s servers (hsforms.net and hsforms.com). HubSpot then receives your IP address, the description of your browser, the address and title of the page, with the parameters of the link that brought you there, and the page you came from; it also counts the display of the form. If you accepted the HubSpot tracking code (see “Consent Banner and HubSpot Tracking Code”), it also receives the identifiers of its cookies, so that a request can be linked to the pages you visited; otherwise, nothing links the form to your browsing. The form itself places no cookie and no storage item on the Website’s domain, and HubSpot’s privacy policy (legal.hubspot.com/privacy-policy) also applies inside the form. We do this so that the form is ready without an extra step (our legitimate interest, GDPR Article 6(1)(f)).

When you send it. What you enter in the form (depending on the page: your first and last name, email, phone, organization, province or state, address, website, city, postal code, country and your message) is sent by your browser directly to HubSpot and recorded in our customer relationship management system, with the type of your request (contact, distributor or product registration), your language and the page from which you sent it. It is not recorded on our server: your request has no Website reference number, and our server attaches neither the fingerprint of your IP address nor the page version of an A/B test. To register a product, please write your order number in the message. The members of our team in charge of your request view it in HubSpot. HubSpot may also send a copy of it by email to the members of our team in charge of these forms: this internal notice is the one described in the processing table (“Internal email notice of requests received”), under the same conditions. The purposes and legal bases are those of the request concerned, described above; HubSpot processes this information on our behalf, under the conditions described in “HubSpot and Its Services”: it keeps it in Canada and may also process it outside Canada, including in the United States.

Newsletter. In HubSpot’s subscription form, you tick a box to agree to receive the newsletter by email. HubSpot records your email address, your language and this consent, with its date, in our account, from which the newsletter will be sent to you. Legal basis: your consent (GDPR Article 6(1)(a); Canada’s Anti-Spam Legislation), which you can withdraw at any time, including through the unsubscribe link in each mailing.

If a HubSpot form does not load, for example because a blocker prevents it, the Website’s own form appears in its place, and your request follows the path described in “Requests Sent Through Our Forms”.

Newsletter

If you subscribe to our newsletter, we keep your email address together with the exact text of the consent you accepted and its date. We will use it to send you by email what that text announces (for example, on the new arrivals page, our new machines and their launch dates), with your express consent (GDPR Article 6(1)(a); Canada’s Anti-Spam Legislation). Each mailing will include an unsubscribe link, and you can withdraw your consent at any time by writing to us. Once the subscription form is HubSpot’s (see “HubSpot Forms Embedded in the Pages”), your subscription will be recorded in our HubSpot account, from which the newsletter will be sent to you; if we entrust mailings to another provider, this policy will name it before it receives your address. The other forms do not subscribe you to any commercial communication.

Protection Against Abuse

To prevent automated mass submissions of forms and bug reports, our server counts the recent submissions of each IP address. It does not keep your IP address in clear for this: it computes a one-way fingerprint which, for the forms, is salted with a secret that never leaves the server. The form counters are erased after a few hours; the fingerprint stays attached to the request you send. Automatic error reports and traffic measurement also go through a counter, based on an unsalted fingerprint of your IP address (of the truncated address, for the measurement): it covers the last hour for error reports, and the current minute for the measurement. Legal basis: our legitimate interest in protecting the Website and its users (GDPR Article 6(1)(f)).

Campaign Parameters

If you reach the Website through a campaign link (for example in an email, a post or a QR code) that carries “utm” parameters, the Website keeps them in your browser tab (session storage, erased when the tab is closed), together with the address of the landing page. If you then send a request through a form, these parameters are attached to it: they tell us which campaign brought it. They contain only what was already written in the link you followed. Legal basis: our legitimate interest in knowing how effective our campaigns are (GDPR Article 6(1)(f)).

A/B Testing of Website Pages

We occasionally serve two versions of the same Website page, in order to find out which one is more useful to visitors. This measurement is made by our own server, from what our script sends it during your visit: no cookie or storage item is placed on or read from your device for this purpose, and no third party receives any part of it.

So that you see a consistent version from one page to the next, our server computes a one-way cryptographic fingerprint from your truncated IP address (the last portion is discarded) and your browser and system families, salted with a secret that is specific to each test and destroyed when that test ends. Your IP address itself is never stored. What is recorded is that fingerprint, the page, the version served, the language, whether the device is a desktop or a mobile, how far the page was scrolled, how long it was actively visible, the number of interactions, the furthest step reached in a page journey, for example in the “My project” list, and whether a goal, such as sending a form, was reached. If you send a Website form while a test is running, this goal is recorded with your fingerprint, even if you saw no page under test. Every night, a scheduled task deletes detailed events that are more than 90 days old (no later than 92 days after they are recorded). A test’s fingerprint index, which is used to link a goal reached to the version seen, is kept during the test and deleted when it ends; after that, only aggregate counts, without fingerprints, are kept.

Legal basis: our legitimate interest in improving the Website (GDPR Article 6(1)(f)). No cookie or storage item is placed on or read from your device for this measurement; our script only notes, during your visit, scrolling, visible time and interactions. It is not used to identify you, locate you or build a profile of you. Should we ever move to a method that does store something on your device, we would ask for your consent first.

Measurement of the Website’s Traffic and Speed

To know which pages are useful, how fast the Website loads for its visitors and what does not work, in order to fix it, our own server measures visits. As with A/B tests, no cookie or storage item is placed on your device for this purpose. Our script only reads, during your visit, the technical information listed below, which your browser makes available to it, and our server only checks whether our administration tools’ cookie is present, never its value (see below). No third party receives these measurements, except the summary of a fault that we may pass to our tracking tool (HubSpot), described below.

During your visit, your browser sends our server the page viewed, the name of the website you came from (its name only), the utm_source, utm_medium and utm_campaign campaign parameters, the language, the width of your browser window, the device type, the browser and system family, how long the page was visible, scrolling, the loading speed measured by your browser (Core Web Vitals), server calls or files that fail, repeated clicks on the same element, pages not found with the page that led there, and the sending of a form (which one and from which page, never its content). This information carries a random identifier drawn when each page opens, which is not kept on your device. To recognize the pages of a single visit, our server computes a one-way fingerprint from your truncated IP address and your browser and system families, salted with a secret drawn every day and destroyed the next day: two days of visits cannot be linked, and your IP address is never recorded. Visits by our staff are set apart from the figures, recognized only by the presence, in their browser, of our administration tools’ cookie.

If your browser sends the Global Privacy Control or Do Not Track signal, only faults reach us, without a fingerprint. Our staff may pass the summary of a fault to our tracking tool, HubSpot (United States), as a ticket: the pages affected, the number of occurrences and of visitor-days, the websites visitors came from (their name only), the browser families and the technical trace of the error, without any information about any individual visitor. Every night, whether the measurement is running or stopped and even without any visit, a scheduled task deletes detailed events that are more than 35 days old (no later than 37 days after they are recorded), aggregate counts older than 400 days and the secret of each past day; stopping the measurement also does this deletion immediately. Only aggregate counts, without fingerprints, are kept beyond 35 days. Legal basis: our legitimate interest in measuring and fixing the Website (GDPR Article 6(1)(f)); this measurement is not used to identify you, locate you or build a profile of you.

Bug Reports and Error Reports

The Website has a tool to report a problem to us (it opens in particular with the Ctrl+B shortcut); it is available to every visitor, on every page of the Website. So that a report is useful, the Website keeps, during your visit, a session log in your browser tab (atl-journal): the pages opened, the clicks with the label of the button or link, the name of the fields changed but never what you type in them, the keyboard shortcuts used, the network calls of the Website and the errors. This log only keeps the last 20 minutes, is erased when the tab is closed and leaves your browser only if you send a report.

If you send a report, we receive your description, the name you give (optional and not verified), this log, then its continuation for two minutes after sending, a screenshot of the page (field values are masked before the screenshot is taken), technical details (screen and window size, language, time zone, previous page), your full IP address, the description of your browser, the version of the Website and the page version served by an A/B test. Your browser also keeps the name you gave and a random identifier, which lets us group your reports without naming you.

Independently of any report, when a programming error occurs in your browser, the Website automatically sends us the error message, its technical trace, the address of the page and the version of the Website, with no log, no screenshot and without attaching your IP address.

We use this information only to find and fix problems on the Website. Legal basis: our legitimate interest in keeping it working properly (GDPR Article 6(1)(f)).

Server Logs

Like any web server, our servers keep technical logs of the requests they receive: IP address, date and time, address requested (including the terms of a search made on the Website), previous page and browser description. They are used for diagnosis and security. Legal basis: our legitimate interest in operating the Website securely (GDPR Article 6(1)(f)).

Case Studies and Testimonials

Our case studies present installations completed for our customers. Some name representatives of these customers, with their job title, company, city, a quotation and sometimes a link to a public social media profile. Anyone named can ask us to correct or remove this information by writing to privacy@atlantisstrength.com.

Sensitive Information

We do not ask you for any sensitive information, for example about your health. A message, a résumé or a bug report may however contain some if you choose to include it: only include what is useful to your request.

HubSpot and Its Services

HubSpot, Inc. (Cambridge, Massachusetts, United States) provides our customer relationship management system and processes on our behalf the information we entrust to it. Our HubSpot account is hosted in HubSpot’s Canadian data center, in Montreal (with Amazon Web Services): this information is kept there, and its backup copies stay in Canada. HubSpot does not, however, guarantee that it stays there at all times: its support, security and development staff, its affiliates and its sub-processors may access or process it outside Canada, including in the United States, and some usage data of its service is transferred to the United States. On the Website, its tracking code loads only if you accept it in the consent banner, and it then also collects the content of our forms. The other services described in this section run only once we switch them on (see “Other HubSpot Services”).

Agreement and transfer. Our use of HubSpot is governed by its customer terms of service, which include its Data Processing Agreement: HubSpot acts as our processor under it and undertakes to process this information only on our instructions and to protect it. Access and processing in the United States rely on HubSpot, Inc.’s certification under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework; the agreement also provides for the Standard Contractual Clauses of the European Commission and, for the United Kingdom, the addendum issued by the Information Commissioner. The privacy impact assessment that Quebec law requires before any disclosure of information outside Quebec is under way (see “Where Your Information Is Kept and Disclosure Outside Quebec”).

Consent Banner and HubSpot Tracking Code

With your consent only, the Website uses the HubSpot tracking code, and a banner asks for your choice. Until you click “Accept” in the banner, the tracking code is not loaded: it sends nothing to HubSpot and places no cookie on your device. The HubSpot forms embedded in some pages and the booking calendar displayed directly in a page, once they are in place, are an exception: they load from HubSpot’s servers as soon as the page opens, whether you accepted, declined or have not yet chosen, and even if your browser sends the Global Privacy Control signal (see “HubSpot Forms Embedded in the Pages” and “Calendar displayed directly in the page”). The tracking code is therefore off by default. If you decline, ignore the banner, or if your browser sends the Global Privacy Control signal (treated as a refusal, without even showing the banner), the Website works exactly the same.

If you accept, your browser loads the HubSpot script, which then contacts other HubSpot servers. The tracking code records the pages of the Website you visit, when you visit them and the page you came from, together with your IP address and the type of browser and device you use, under a pseudonymous identifier stored in a cookie. We use this information to measure the audience of the Website and to follow up on requests. It is not used for advertising: the HubSpot chat window and the advertising pixels HubSpot can install are disabled.

Forms collected by the tracking code. If you accepted, the tracking code also collects what you enter in the Website forms when you send them. HubSpot records it in our account, linked to the history of your visits, so that the person who answers you knows which products you looked at. The tracking code never collects job applications, forms with an attached file or a password, bug reports or our internal tools. Your request is also recorded on our server, as described in “Requests Sent Through Our Forms”.

The main cookies placed by HubSpot, according to its documentation, are:

• __hstc: the main tracking cookie (identifier, first and last visit, number of visits), kept 6 months;
• hubspotutk: the pseudonymous identifier used to recognize you when you submit a form, kept 6 months;
• __hssc: counts the pages viewed during the current visit, kept 30 minutes;
• __hssrc: detects the start of a new visit, deleted when you close your browser.

The Website also keeps the choice you made in your browser (atl.consentement.v1, 6 months), so that it does not ask you on every page. This item is strictly necessary to respect your choice, including a refusal, and it never leaves your browser.

Legal basis: your consent (GDPR Article 6(1)(a); section 8.1 of Quebec’s Act respecting the protection of personal information in the private sector). Your choice is kept for six months, after which we ask you again; we also ask again if what you accepted changes, for example if the tracking code starts collecting something else. You can withdraw your consent at any time, as easily as you gave it, with the “Cookies” link at the bottom of every page. Withdrawing deletes the HubSpot cookies from your browser; it does not affect what was collected before, but you can ask us to delete from our HubSpot account what concerns you (see “Your Rights”).

Other HubSpot Services

The following services run only once we switch them on; the HubSpot forms embedded in the pages will not be put in place before this policy takes effect, as stated at the top of this page:

• forms connected directly to HubSpot and the direct sending of quote requests to our customer relationship management system (see “Requests Sent Through Our Forms”);
• booking a meeting with our team, described below;
• campaign pages published on a HubSpot domain: HubSpot will receive your visits to them and what you enter in their form, and its own cookie banner will apply there;
• HubSpot forms embedded in the contact, configurator, distributor, product registration and newsletter pages (see “HubSpot Forms Embedded in the Pages”).

They will rely on the same agreement and on the same transfer mechanisms as the tracking code. Before putting any of them into service, we will have completed the privacy impact assessment described above, and we will put none of them into service if it does not show that the information will receive adequate protection.

Booking a Meeting with Our Team

Once this service is in place, some of our contact pages will let you book a meeting directly in the calendar of the person who covers your territory, or in a general calendar of our team. Depending on our settings, a calendar will be shown in one of two ways. Either the calendar will not be loaded from HubSpot, and nothing will be sent to it for the calendar, until you click to book: the calendar will then open in a window served directly by HubSpot; or it will be displayed directly in the page, as described in the next paragraph. In both cases, HubSpot’s own privacy policy (legal.hubspot.com/privacy-policy) will also apply inside the calendar.

Calendar displayed directly in the page. Where a calendar is shown without a click, your browser will contact HubSpot as soon as the page opens: it will load a HubSpot script (hsappstatic.net), then the calendar itself (meetings.hubspot.com, or its regional address). HubSpot will then receive your IP address, your type of browser, the address of the page with the parameters of the link that brought you there, and an identifier. If you accepted the HubSpot tracking code (see “Consent Banner and HubSpot Tracking Code”), this identifier will be the one in its cookie, so that a booking can be linked to the pages you visited; otherwise, it will be a temporary identifier created for that page only. We do this so that the calendar is ready without an extra step (our legitimate interest, GDPR Article 6(1)(f)). HubSpot may process this information outside Quebec and Canada, including in the United States.

If you book, the information you enter (your first and last name, your email address and any details you choose to add) will be collected by HubSpot and recorded in our customer relationship management system, so that the meeting is added to our representative’s calendar, you both receive a confirmation and we can follow up on your request. Booking a meeting will not subscribe you to any commercial communication. Legal basis: the steps needed to arrange the meeting you ask for (GDPR Article 6(1)(b)).

Third-Party Services Embedded in the Website

Some pages display content provided by other servers. To display it, your browser contacts them directly and sends them, as it would to any web server, your IP address, the description of your browser and the address of our Website.

• OpenStreetMap map: on our contact pages, the map showing our facilities loads automatically when you scroll down to it. Its images come from the servers of the OpenStreetMap Foundation (United Kingdom), distributed by a content delivery network that may serve them from other countries. The Foundation processes this information under its own privacy policy. Legal basis: our legitimate interest in showing you where to find us (GDPR Article 6(1)(f)); our address is also written as text on the page.
• YouTube videos: on some product pages, a video only loads if you click on its image; nothing is sent to YouTube before that click. After the click, the video is served by YouTube (Google LLC, United States) in privacy-enhanced mode (youtube-nocookie.com), and Google may place cookies or other items on your device and collect information under its privacy policy. Legal basis: your consent, given by that click (GDPR Article 6(1)(a)).
• Product images: the original photos of our products are kept on another of our servers, s2.atlantisstrength.app, hosted by Hostinger (see “Where Your Information Is Kept and Disclosure Outside Quebec”). Ordinarily, our website fetches these photos itself and serves them to you: your browser does not contact that server. It does so only if our website cannot prepare a photo: your browser is then redirected to that server. That server then receives the same technical information as any web server and may record it in its logs.
• Images from our atlantisstrength.com website: on three pages of the “Industries” section (commercial gyms, private training studios, universities and schools), the large photo of an installation loads automatically from our atlantisstrength.com website when you scroll down to it. That website is served through Cloudflare, Inc. (United States), a delivery network placed in front of its host, which also receives these requests. Legal basis: our legitimate interest in illustrating our projects (GDPR Article 6(1)(f)).
• HubSpot forms: once they are in place, the contact (including the one on the configurator), distributor, product registration and newsletter forms of some pages will load from HubSpot as soon as the page opens (see “HubSpot Forms Embedded in the Pages”).

Cookies and Storage on Your Device

The Website itself places no cookie on its visitors’ devices; only internal pages reserved for our staff and our guests use a session cookie. It does however keep a few items in your browser’s storage: local storage, which lasts until you erase it, or session storage, erased when the tab is closed. These items do not leave your browser, except in the cases described in this policy:

• your preferences: the display language, recorded when some pages open and when you choose one, and the light or dark display, when you choose it;
• your “My project” list and your last six searches on the Website;
• the draft of the quote request form, including your contact details, so that you can resume it; it is erased after a successful submission, but stays in your browser if you abandon the form;
• the update notices of our legal texts that you have closed;
• the choice you make in the consent banner;
• the campaign parameters, in the tab (see “Campaign Parameters”);
• the session log of the bug report tool, in the tab, and, after a first report, the name you gave and a random identifier (see “Bug Reports and Error Reports”).

The campaign parameters and the session log are not strictly necessary to display the pages: they are used to attribute requests to our campaigns and to diagnose problems. They only leave your browser if you send a form or a report, and they are erased when the tab is closed. You can erase all these items at any time in your browser settings (site data). The third-party services described above may place their own cookies, in particular YouTube after a click and HubSpot after your consent.

Who Receives Your Information

Your information is accessed by the members of our staff who need it in their duties: the sales team and customer service for requests, the people in charge of hiring for job applications, and the people in charge of the Website for bug reports and technical measurements. It is also entrusted to the providers that host the Website and to HubSpot, if you accept its tracking code or, once these services are in place, if you submit a form connected to it or a quote request, if you open a page where one of its forms is embedded or its booking calendar is displayed directly, even without using it, if you book a meeting with our team or if you visit one of our campaign pages hosted by HubSpot. Some pages also use external services that your browser contacts directly (see “Third-Party Services Embedded in the Website”). The table below gives, for each recipient, its role, what it receives, where it is located and the safeguards that frame the disclosure.

We may also disclose personal information:

• to public or judicial authorities, when the law requires us to, for example in response to an order;
• when necessary to prevent or stop fraud, abuse of the Website or a threat to the safety of any person, to the extent permitted by law;
• to another company, as part of a merger, a reorganization or the sale of all or part of our business; we will then require it to honour the commitments of this policy, or we will inform you that a new policy applies.

We do not sell or rent your personal information, and we do not disclose it to anyone for advertising or marketing purposes.

Where Your Information Is Kept and Disclosure Outside Quebec

The Website and the information it receives are hosted by OVH Hosting, Inc. (OVHcloud), on servers located in Canada. Our product image server is hosted by Hostinger. According to the public information associated with its address, this server is located in the United States. Our customer relationship management system, provided by HubSpot, Inc., is hosted in HubSpot’s data center in Montreal, Canada.

Information may therefore be disclosed outside Quebec and Canada:

• to the image server hosted by Hostinger, as described above;
• to HubSpot, Inc. (United States), which keeps the information in our account in its Montreal data center, but whose staff, affiliates and sub-processors may access or process it outside Canada, including in the United States: if you accept its tracking code, the pages you visit and the content of the forms you send, under the conditions described in “HubSpot and Its Services”; once they are in place, its forms embedded in the pages will receive the form’s technical data as soon as the page opens, then what you enter in them; its other services, once we switch them on, receive what this policy describes;
• to Cloudflare (United States) and the host of our atlantisstrength.com website, when the large image of one of three “Industries” pages loads;
• to the OpenStreetMap Foundation (United Kingdom) and its delivery network, when the map on a contact page loads;
• to Google (United States), if you start a YouTube video.

Information stored or processed outside Canada is subject to the laws of the country where it is located: the courts, law enforcement agencies and national security authorities of that country may access it under those laws. A company established in the United States, such as HubSpot, Inc., may also be required by the laws of that country to disclose to U.S. authorities information in its possession, custody or control, even if it is kept in Canada.

People in Quebec. Before disclosing personal information outside Quebec, we must assess whether it will receive adequate protection there (privacy impact assessment) and enter into a written agreement that takes this assessment into account. For HubSpot, the written agreement exists (see “HubSpot and Its Services”) and the assessment, which takes into account both the hosting in Montreal and the possible access and processing in the United States, is under way; if it does not show that the information receives adequate protection there, we will stop using its tracking code. For the image server hosted by Hostinger, we undertake to carry out this assessment and to sign this agreement, or to replace it with a server located in Canada. The OpenStreetMap map on the contact pages and the images from our atlantisstrength.com website, which load automatically, and YouTube videos, which load after your click, are requested by your browser directly from these providers: no assessment or written agreement exists with OpenStreetMap or Google, and none is documented for Cloudflare; our address is also shown as text on the contact pages. We undertake to apply this rule to any new disclosure.

People in the EEA or the United Kingdom. Your information is processed in Canada, which is covered by an adequacy decision of the European Commission for organizations subject to the Personal Information Protection and Electronic Documents Act (Decision 2002/2/EC), also recognized by the United Kingdom. There is no adequacy decision covering the United States as a whole: the European Commission’s decision, and its UK extension, only cover companies certified under the EU-U.S. Data Privacy Framework. The information we entrust to HubSpot is kept in Canada; for access and processing that take place in the United States, HubSpot, Inc. is certified under this framework and its UK Extension, and its Data Processing Agreement also provides for the Standard Contractual Clauses of the European Commission and, for the United Kingdom, the addendum issued by the Information Commissioner. We undertake to entrust information to another provider in the United States only after entering into a written agreement with it that includes these clauses and this addendum; we make the same commitment for Hostinger, as stated above. Cloudflare, Google (YouTube) and the OpenStreetMap Foundation receive directly from your browser the requests described in “Third-Party Services Embedded in the Website”. You can obtain a copy of the safeguards in place by writing to us.

You can refuse to have information about you transferred outside the EEA, the United Kingdom or Quebec by writing to our Privacy Officer; for the HubSpot tracking code, simply decline it in the consent banner. This refusal may prevent you from using some features of the Website.

How Long We Keep Your Information

We keep your information for as long as needed for the purposes for which it was collected, then for as long as the law requires or as needed to assert or defend our rights. Here, for each category, is the starting point and the criterion we apply. Except where a specific period is stated, no automatic deletion exists yet: deletion is done manually, in particular at your request, and we will state the periods we adopt in a future version of this policy.

• Contact, quote request and distributor requests: during the exchange and any business relationship that follows from it; no specific period is set yet.
• Product registrations: during the warranty of your equipment, then as long as needed to settle related claims; no specific period is set yet.
• Job applications, including résumés and cover letters: during the hiring process; no period is set yet for afterwards, and you can ask for their deletion at any time.
• Newsletter subscription: until you withdraw your consent; we then keep proof of your consent and of its withdrawal for as long as needed to show that we complied with the law.
• Bug reports: until the problem is dealt with; no maximum period is set yet. Automatic error reports: only the 400 most recent distinct errors are kept.
• A/B tests: detailed events are deleted every night by a scheduled task once they are more than 90 days old (no later than 92 days after they are recorded); a test’s fingerprint index is kept during the test and deleted when it ends; only aggregate counts, without fingerprints, are kept after that.
• Traffic and speed measurement: detailed events are deleted every night once they are more than 35 days old (no later than 37 days after they are recorded), whether the measurement is running or stopped, and the day’s secret is destroyed the next day; only aggregate counts, without fingerprints, are kept after that, for 400 days.
• Abuse protection counters: a few hours for forms, bug reports and automatic error reports; the current minute for traffic measurement.
• Server logs: according to the configuration of our hosting providers; no period is set yet.
• Campaign parameters and session log: until the tab is closed, and 20 minutes at most for each log entry; once attached to a request or a report, they follow its retention.
• Consent banner choice: 6 months in your browser; HubSpot cookies: see their duration above.
• Information collected by the HubSpot tracking code, if you accepted it: in our HubSpot account, during any business relationship that follows; no maximum period is set yet, and you can ask for its deletion at any time.
• Requests sent through a HubSpot form embedded in a page, once these forms are in place: in our HubSpot account, during the exchange and any business relationship that follows; no maximum period is set yet, and you can ask for their deletion at any time.
• Information published in a case study: as long as the case study is online, or until the person named asks for its removal.

Where the law permits, we may keep data that has been made anonymous, which no longer allows anyone to be identified, such as the aggregate counts of A/B tests and of traffic measurement.

Security

We protect your information with measures suited to its sensitivity, including:

• all communications with the Website are encrypted (HTTPS);
• requests, applications and bug reports are kept outside the public part of the server, in files whose access is restricted to the Website service; no public address gives access to them, and only our administration tools, after authentication, allow them to be viewed;
• résumés and cover letters are limited to PDF, DOC and DOCX files of up to 5 MB, and are kept like the applications they accompany;
• apart from bug reports and server logs, our application does not record your IP address in clear, only a one-way fingerprint;
• access to our administration tools is reserved to authorized people, through individual password-protected accounts, and sensitive operations are logged;
• the value of form fields is never written in the session log, and it is masked on the screenshots of bug reports.

No measure is perfect. If a confidentiality incident occurs, we will take reasonable measures to reduce the risks and, where the law requires it, we will notify the Commission d’accès à l’information du Québec, the other competent authorities and the people concerned.

Your Rights

Depending on the laws that apply to you, including Quebec’s Act respecting the protection of personal information in the private sector, Canada’s Personal Information Protection and Electronic Documents Act, the GDPR and the UK GDPR, you can:

• access your personal information and know how we use it and to whom we disclose it;
• have it corrected if it is inaccurate, incomplete or equivocal;
• ask for its deletion;
• ask for the restriction of its processing, for example while we check its accuracy;
• receive the computerized information you gave us in a structured, commonly used technological format, or have it sent to the person or body of your choice (portability);
• ask us to stop disseminating information about you or to de-index any hyperlink attached to your name that gives access to it, where this dissemination contravenes the law or a court order, or causes you serious injury, under the conditions set by law;
• withdraw your consent at any time, without affecting what was done before.

Your Right to Object

You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest: answering a simple question, protection against abuse, campaign parameters, A/B tests, traffic and speed measurement, bug and error reports, server logs (including those of our image server), the map on our contact pages, the images from our atlantisstrength.com website, case studies and testimonials, the calendar displayed directly in the page and the loading of HubSpot forms embedded in the pages, once they are in place. We will then stop that processing, unless we have compelling legitimate grounds to continue it or need it to establish, exercise or defend legal claims. You can also object at any time, without having to give a reason, to the use of your information for direct marketing.

Automated Decisions

We make no decision based exclusively on automated processing of your information, and no automatic screening is applied to job applications. Should this change, we would inform you first, as the law requires.

How to Exercise Your Rights

Write to privacy@atlantisstrength.com or to the postal address given above. We may ask you to confirm your identity, so that we disclose your information only to you. We will answer you in writing within 30 days of receiving your request; where the applicable law allows this period to be extended for a complex request, we will tell you before the 30 days are over, with the reason. Exercising your rights is free of charge; reasonable fees could only be charged in the cases provided for by law, and you would be told in advance. If we refuse a request, we will give you the reasons in writing, with the provision of the law on which the refusal is based, and tell you what remedies you have and the time limit for exercising them; if you ask, we will help you understand the refusal (section 34 of Quebec’s Act respecting the protection of personal information in the private sector). Exercising your rights has no effect on the prices or conditions we offer you.

Complaints

If you believe we have not respected your rights or this policy, we invite you to write to us first, by email at privacy@atlantisstrength.com or by mail. We will acknowledge receipt of your complaint within 30 days, look into it and inform you of the outcome.

You can also contact a supervisory authority:

• in Quebec: the Commission d’accès à l’information du Québec; if we refuse a request for access or correction, or do not answer it within 30 days, an application to examine the disagreement must be filed with it within 30 days of the refusal or of the expiry of the time limit for answering (sections 42 and 43 of the Act respecting the protection of personal information in the private sector);
• elsewhere in Canada: the Office of the Privacy Commissioner of Canada;
• in the United Kingdom: the Information Commissioner’s Office;
• in the EEA: the data protection authority of the country where you live, where you work or where the alleged infringement took place, whose list is published by the European Data Protection Board.

Minors

The Website is intended for professionals and adults; it is not directed at minors. We do not knowingly collect information about a person under 14 years of age without the consent of the person having parental authority or the tutor. If we learn that we have received such information without this consent, we will delete it.

United States Residents and Browser Signals

We do not sell your personal information and do not share it for cross-context behavioural advertising, as those terms are defined by the laws of California and other U.S. states, and we do not use sensitive information to infer characteristics about you. If a law of your state gives you rights, for example to know what information we hold, or to have it corrected or deleted, you can exercise them as described in “Your Rights”, yourself or through an authorized agent. We will not treat you differently because you exercise them.

The “Do Not Track” signal, for which there is no common standard, limits our own traffic measurement to faults, without a fingerprint; it changes nothing else: no advertising tool loads on the Website, the HubSpot tracking code in any case loads only with your consent, and only the HubSpot forms embedded in the pages, which will count their displays, and the booking calendar displayed directly in a page will contact HubSpot as soon as the page opens, once they are in place (see “HubSpot Forms Embedded in the Pages” and “Calendar displayed directly in the page”). The Global Privacy Control signal limits our traffic measurement in the same way, and is treated as a refusal of the HubSpot tracking code, without even showing the banner. Third-party services you choose to use (a YouTube video after a click, the HubSpot tracking code after your consent) may collect information about your online activities over time and across other websites, under their own policies.

Governance

Our Privacy Officer, Diego Fernandez, ensures compliance with the law and with this policy; he receives requests and complaints. We keep an inventory of the Website technologies that involve personal information, checked against this policy, and we review this policy at least once every 12 months. Our internal rules for the governance of personal information (roles and responsibilities of our staff, retention and destruction of information, handling of complaints) are being drafted; once approved by our Privacy Officer, they will be published on the Website and this policy will link to them. Until then, requests and complaints are handled as described in “How to Exercise Your Rights” and “Complaints”.

Changes to This Policy

The date of last update, the version number and the effective date of this policy are shown at the top of this page. Every version is kept: previous versions, with the summary of their changes, are at the bottom of this page (version history).

We distinguish three kinds of changes:

• Corrections: corrections of form, clarifications with no change of substance, updates of our contact details. They take effect when published.
• Changes with immediate effect, because they cannot wait or do not disadvantage you: those required by law or by an authority; urgent security measures; those that reduce what we collect or add protections; a more complete or more accurate description of processing already in place, with no new purpose and no new recipient; a new optional processing activity that only starts with your express consent, given after the publication of the version that describes it.
• Substantial changes: for example a new purpose, a new category of information or of recipients, a disclosure to a new country, a longer retention period or a reduction of your rights. They only take effect after at least 30 days’ notice: the new version is published at least 30 days before it takes effect, and we normally add a 14-day margin so that this notice remains complete even if its publication online is delayed.

A version takes the nature of its most demanding change. When a new version adds processing that is not yet in place, the notice at the top of this page states the date before which that processing will not start, at least 30 days after the publication of that version.

Every new version is announced by a banner on the pages of the Website for at least 30 days and, where applicable, until it takes effect. For a substantial change, and for any other significant change, we also make reasonable efforts to notify you by email when we have your contact information, for example if you are a customer, a distributor or a newsletter subscriber, or if you sent us a request. During the notice period, you can object, withdraw your consent or ask for the deletion of your information.

When a change affects processing based on your consent, or aims to use information already collected for a new purpose, we will ask for your consent again: a notice is not enough. A new version never applies retroactively: information collected under a previous version continues to be processed under that version’s commitments when they are more favourable to you.

In Brief

• This policy explains what personal information the newera.atlantisstrength.app website collects, why, who receives it, where it is kept and how to exercise your rights.
• The Website has no user accounts and sells nothing online. What we collect is mostly what you send us through our forms: contact, quote or project requests, applications, product registration, newsletter.
• Your requests are recorded on our server, hosted by OVH in Canada. A working copy reserved for our team, and our product image server, are hosted by Hostinger in the United States.
• No advertising tool is loaded on the Website. The only third-party audience measurement tool, the HubSpot tracking code, loads only if you accept it in the consent banner; our own measurements (A/B tests, error reports) stay on our server.
• If you accept it, the tracking code of HubSpot (United States), which provides our customer relationship management system, records the pages you visit and the content of the forms you send us, but never a job application. If you decline, or if your browser sends the Global Privacy Control signal, nothing is sent to it.
• The other HubSpot services (forms connected directly to HubSpot, meeting booking, campaign pages) and the internal email notice of your requests are not yet in place: none of them will begin before the date stated in the notice at the top of this page.
• Some external content appears on certain pages: the OpenStreetMap map on our contact pages and the large images of three “Industries” pages, served by our official website atlantisstrength.com through Cloudflare, load automatically; YouTube videos load only if you click.
• We do not sell or rent your personal information.
• You can access your information, have it corrected or deleted, object to some processing and withdraw your consent by writing to privacy@atlantisstrength.com.
• Any substantial change to this policy is announced at least 30 days before it takes effect.

Who We Are

The Website is operated by Atlantis Strength Inc. (Atlantis Force Inc. in French), a corporation incorporated under the Canada Business Corporations Act (corporation number 207503-2), with its head office at 4745 avenue des Industries, Laval, Quebec H7C 1A1, Canada (“Atlantis”, “we”, “us”). We are responsible for the personal information collected by the Website; under the General Data Protection Regulation of the European Union (GDPR) and the UK GDPR, we are its “controller”.

This policy applies to the newera.atlantisstrength.app website (the “Website”) and to the information it collects. It concerns people who visit it, write to us or ask us for a quote, register a product, apply for a job or to become a distributor, as well as people named in our case studies. It is an information notice separate from the Terms and Conditions of the Website, and it is not part of them.

Person in Charge of the Protection of Personal Information

For any question about this policy, to exercise your rights or to make a complaint, write to our Privacy Officer, the person in charge of the protection of personal information:

Diego Fernandez, Privacy Officer
Atlantis Strength Inc.
4745 avenue des Industries, Laval, Quebec H7C 1A1, Canada
privacy@atlantisstrength.com

What We Collect, Why, and on What Basis

We only collect the information needed for the purposes described below, and we do not use it for other purposes without your consent, unless the law permits or requires it.

In Quebec and elsewhere in Canada, when you give us information after being informed as described in this policy, you consent to its use and disclosure for the stated purposes; you can withdraw this consent at any time (see “Your Rights”). For people in the European Union, the European Economic Area (EEA) or the United Kingdom, the legal basis of each processing activity under Article 6 of the GDPR is given in the following table and in the sections that detail it.

The table summarizes each processing activity: the people concerned, the information, the purpose, the legal basis and the retention period.

Requests Sent Through Our Forms

The Website has seven forms: contact, quote request (in several steps), “Get a Quote” request, distributor application, product registration for the warranty, newsletter subscription and job application. What you enter (depending on the form: your name, email, phone, organization, job title, city or address, order number, your message and, for a job application, your résumé and cover letter) is recorded on our own server. The server adds the date and time, a reference number, the language and page from which you sent it, the description of your browser, a fingerprint of your IP address (see “Protection Against Abuse”), the campaign parameters of the link that brought you, if any (see “Campaign Parameters”), and the version of the page you saw if an A/B test was running.

We use this information to answer your request and follow up on it: call you back, prepare a quote, review an application, register the warranty of your equipment. The members of our team in charge of your request have access to it. At the date of this version, no copy is sent to them by email: this internal notice, described in the processing table, will not begin before the date stated in the notice at the top of this page. The fields marked as required are needed to process your request: without them, we cannot answer it. The quote request form also requires you to tick an agreement box; we keep a record of that agreement and its date.

Legal basis (GDPR): steps taken at your request before entering into a contract, or the performance of a contract such as the warranty of your equipment (Article 6(1)(b)); for a simple question, our legitimate interest in answering you (Article 6(1)(f)); for the quote request, the checkbox records your agreement to these pre-contractual steps, which remain the legal basis; for the newsletter, your consent (see “Newsletter”).

What HubSpot receives from our forms. If you accepted the HubSpot tracking code (see “Consent Banner and HubSpot Tracking Code”), this code also collects the content of the Website forms you send and passes it to HubSpot, which links it to the pages you visited. It never collects job applications, forms with an attached file or a password, bug reports or our internal tools. If you declined the tracking code, have not made a choice yet, or if your browser sends the Global Privacy Control signal, HubSpot receives nothing from our forms: your requests stay on our server.

Forms connected directly to HubSpot (not yet in place). We also plan to connect some forms directly to our customer relationship management system, provided by HubSpot, Inc., and to send quote requests to it directly (see “HubSpot: What Is in Place and What Is Not Yet”). At the date of this version, no form is connected to it in this way, and this sending will not begin before the date stated in the notice at the top of this page. A connected form will say so in a sentence right below it, with a link to this section. What will then be sent to HubSpot, whether or not you accepted the tracking code: the information you entered in the form, the language and page from which you sent it, the campaign parameters and the reference number of your request. For a job application, your résumé and cover letter will never be sent: they stay on our server. If you accepted the tracking code, the pseudonymous identifier of its cookie will be sent too, so that your request is linked to the pages you visited; if you declined it, nothing will link your request to your browsing.

Newsletter

If you subscribe to our newsletter, we keep your email address together with the exact text of the consent you accepted and its date. We will use it to send you our news (new products, offers), with your express consent (GDPR Article 6(1)(a); Canada’s Anti-Spam Legislation). Each mailing will include an unsubscribe link, and you can withdraw your consent at any time by writing to us. At the date of this version, no mailing is sent from the Website; if we entrust mailings to a provider, this policy will name it before it receives your address. The other forms do not subscribe you to any commercial communication.

Protection Against Abuse

To prevent automated mass submissions of forms and bug reports, our server counts the recent submissions of each IP address. It does not keep your IP address in clear for this: it computes a one-way fingerprint which, for the forms, is salted with a secret that never leaves the server. The form counters are erased after a few hours; the fingerprint stays attached to the request you send. Legal basis: our legitimate interest in protecting the Website and its users (GDPR Article 6(1)(f)).

Campaign Parameters

If you reach the Website through a campaign link (for example in an email, a post or a QR code) that carries “utm” parameters, the Website keeps them in your browser tab (session storage, erased when the tab is closed), together with the address of the landing page. If you then send a request through a form, these parameters are attached to it: they tell us which campaign brought it. They contain only what was already written in the link you followed. Legal basis: our legitimate interest in knowing how effective our campaigns are (GDPR Article 6(1)(f)).

A/B Testing of Website Pages

Since September 2026, we occasionally serve two versions of the same Website page, in order to find out which one is more useful to visitors. This measurement takes place entirely on our own server: nothing is written to or read from your device for this purpose. No cookie, no local storage, and no third party receives any part of it.

So that you see a consistent version from one page to the next, our server computes a one-way cryptographic fingerprint from your truncated IP address (the last portion is discarded) and your browser family, salted with a secret that is specific to each test and destroyed when that test ends. Your IP address itself is never stored. What is recorded is that fingerprint, the page, the version served, the language, whether the device is a desktop or a mobile, how far the page was scrolled, how long it was actively visible, the number of interactions, the furthest step reached in a multi-step form, and whether a goal, such as sending a form, was reached. Detailed events are deleted 90 days after they are recorded, by a scheduled task. A test’s fingerprint index, which is used to link a goal reached to the version seen, is kept during the test and deleted when it ends; after that, only aggregate counts, without fingerprints, are kept.

Legal basis: our legitimate interest in improving the Website (GDPR Article 6(1)(f)). Because nothing is written to or read from your device, no cookie consent is required for this measurement; it is not used to identify you, locate you or build a profile of you. Should we ever move to a method that does store something on your device, we would ask for your consent first.

Bug Reports and Error Reports

The Website has a tool to report a problem to us (it opens in particular with the Ctrl+B shortcut); it is used mainly by our team and by people testing the Website. So that a report is useful, the Website keeps, during your visit, a session log in your browser tab (atl-journal): the pages opened, the clicks with the label of the button or link, the name of the fields changed but never what you type in them, the keyboard shortcuts used, the network calls of the Website and the errors. This log only keeps the last 20 minutes, is erased when the tab is closed and leaves your browser only if you send a report.

If you send a report, we receive your description, the name you give (optional and not verified), this log, then its continuation for two minutes after sending, a screenshot of the page (field values are masked before the screenshot is taken), technical details (screen and window size, language, time zone, previous page), your full IP address, the description of your browser, the version of the Website and the page version served by an A/B test. Your browser also keeps the name you gave and a random identifier, which lets us group your reports without naming you.

Independently of any report, when a programming error occurs in your browser, the Website automatically sends us the error message, its technical trace, the address of the page and the version of the Website, with no log, no screenshot and without attaching your IP address.

We use this information only to find and fix problems on the Website. Legal basis: our legitimate interest in keeping it working properly (GDPR Article 6(1)(f)).

Server Logs

Like any web server, our servers keep technical logs of the requests they receive: IP address, date and time, address requested (including the terms of a search made on the Website), previous page and browser description. They are used for diagnosis and security. Legal basis: our legitimate interest in operating the Website securely (GDPR Article 6(1)(f)).

Case Studies and Testimonials

Our case studies present installations completed for our customers. Some name representatives of these customers, with their job title, company, city, a quotation and sometimes a link to a public social media profile. Anyone named can ask us to correct or remove this information by writing to privacy@atlantisstrength.com.

Sensitive Information

We do not ask you for any sensitive information, for example about your health. A message, a résumé or a bug report may however contain some if you choose to include it: only include what is useful to your request.

HubSpot: What Is in Place and What Is Not Yet

HubSpot, Inc. (Cambridge, Massachusetts, United States) provides our customer relationship management system and processes on our behalf, on servers located in the United States, the information we entrust to it. At the date of this version, only one of its services runs on the Website: its tracking code, which loads only if you accept it in the consent banner, and which then also collects the content of our forms. The other services described in this section are not yet in place (see “HubSpot Services Not Yet in Place”).

Agreement and transfer. Our use of HubSpot is governed by its customer terms of service, which include its Data Processing Agreement: HubSpot acts as our processor under it and undertakes to process this information only on our instructions and to protect it. The transfer to the United States relies on HubSpot, Inc.’s certification under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework; the agreement also provides for the Standard Contractual Clauses of the European Commission and, for the United Kingdom, the addendum issued by the Information Commissioner. The privacy impact assessment that Quebec law requires before any disclosure of information outside Quebec is under way (see “Where Your Information Is Kept and Disclosure Outside Quebec”).

Consent Banner and HubSpot Tracking Code

With your consent only, the Website uses the HubSpot tracking code, and a banner asks for your choice. Until you click “Accept” in the banner, the tracking code is not loaded, nothing is sent to HubSpot, and no HubSpot cookie is placed on your device. This feature is therefore off by default. If you decline, ignore the banner, or if your browser sends the Global Privacy Control signal (treated as a refusal, without even showing the banner), the Website works exactly the same.

If you accept, your browser loads the HubSpot script, which then contacts other HubSpot servers. The tracking code records the pages of the Website you visit, when you visit them and the page you came from, together with your IP address and the type of browser and device you use, under a pseudonymous identifier stored in a cookie. We use this information to measure the audience of the Website and to follow up on requests. It is not used for advertising: the HubSpot chat window and the advertising pixels HubSpot can install are disabled.

Forms collected by the tracking code. If you accepted, the tracking code also collects what you enter in the Website forms when you send them. HubSpot records it in our account, linked to the history of your visits, so that the person who answers you knows which products you looked at. The tracking code never collects job applications, forms with an attached file or a password, bug reports or our internal tools. Your request is also recorded on our server, as described in “Requests Sent Through Our Forms”.

The main cookies placed by HubSpot, according to its documentation, are:

• __hstc: the main tracking cookie (identifier, first and last visit, number of visits), kept 6 months;
• hubspotutk: the pseudonymous identifier used to recognize you when you submit a form, kept 6 months;
• __hssc: counts the pages viewed during the current visit, kept 30 minutes;
• __hssrc: detects the start of a new visit, deleted when you close your browser.

The Website also keeps the choice you made in your browser (atl.consentement.v1, 6 months), so that it does not ask you on every page. This item is strictly necessary to respect your choice, including a refusal, and it never leaves your browser.

Legal basis: your consent (GDPR Article 6(1)(a); section 8.1 of Quebec’s Act respecting the protection of personal information in the private sector). Your choice is kept for six months, after which we ask you again; we also ask again if what you accepted changes, for example if the tracking code starts collecting something else. You can withdraw your consent at any time, as easily as you gave it, with the “Cookies” link at the bottom of every page. Withdrawing deletes the HubSpot cookies from your browser; it does not affect what was collected before, but you can ask us to delete from our HubSpot account what concerns you (see “Your Rights”).

HubSpot Services Not Yet in Place

The following services are not yet in place, and none of them will begin before the date stated in the notice at the top of this page:

• forms connected directly to HubSpot and the direct sending of quote requests to our customer relationship management system (see “Requests Sent Through Our Forms”);
• booking a meeting with our team, described below;
• campaign pages published on a HubSpot domain: HubSpot will receive your visits to them and what you enter in their form, and its own cookie banner will apply there.

They will rely on the same agreement and on the same transfer mechanisms as the tracking code. Before putting any of them into service, we will have completed the privacy impact assessment described above, and we will put none of them into service if it does not show that the information will receive adequate protection.

Booking a Meeting with Our Team

Once this service is in place, some of our contact pages will let you book a meeting directly in the calendar of the person who covers your territory, or in a general calendar of our team. Depending on our settings, a calendar will be shown in one of two ways. Either nothing will be loaded from HubSpot, and nothing will be sent to it, until you click to book: the calendar will then open in a window served directly by HubSpot; or it will be displayed directly in the page, as described in the next paragraph. In both cases, HubSpot’s own privacy policy (legal.hubspot.com/privacy-policy) will also apply inside the calendar.

Calendar displayed directly in the page. Where a calendar is shown without a click, your browser will contact HubSpot as soon as the page opens: it will load a HubSpot script (hsappstatic.net), then the calendar itself (meetings.hubspot.com, or its regional address). HubSpot will then receive your IP address, your type of browser, the address of the page with the parameters of the link that brought you there, and an identifier. If you accepted the HubSpot tracking code (see “Consent Banner and HubSpot Tracking Code”), this identifier will be the one in its cookie, so that a booking can be linked to the pages you visited; otherwise, it will be a temporary identifier created for that page only. We would do this so that the calendar is ready without an extra step (our legitimate interest, GDPR Article 6(1)(f)). HubSpot may process this information outside Quebec and Canada, including in the United States.

If you book, the information you enter (your first and last name, your email address and any details you choose to add) will be collected by HubSpot and recorded in our customer relationship management system, so that the meeting is added to our representative’s calendar, you both receive a confirmation and we can follow up on your request. Booking a meeting will not subscribe you to any commercial communication. Legal basis: the steps needed to arrange the meeting you ask for (GDPR Article 6(1)(b)).

Third-Party Services Embedded in the Website

Some pages display content provided by other servers. To display it, your browser contacts them directly and sends them, as it would to any web server, your IP address, the description of your browser and the address of our Website.

• OpenStreetMap map: on our contact pages, the map showing our facilities loads automatically when you scroll down to it. Its images come from the servers of the OpenStreetMap Foundation (United Kingdom), distributed by a content delivery network that may serve them from other countries. The Foundation processes this information under its own privacy policy. Legal basis: our legitimate interest in showing you where to find us (GDPR Article 6(1)(f)); our address is also written as text on the page.
• YouTube videos: on some product pages, a video only loads if you click on its image; nothing is sent to YouTube before that click. After the click, the video is served by YouTube (Google LLC, United States) in privacy-enhanced mode (youtube-nocookie.com), and Google may place cookies or other items on your device and collect information under its privacy policy.
• Product images: the photos of our products are served by another of our servers, s2.atlantisstrength.app, hosted by Hostinger (see “Where Your Information Is Kept and Disclosure Outside Quebec”). It receives the same technical information as any web server and may record it in its logs.
• Images from our official website: on three pages of the “Industries” section (commercial gyms, private training studios, universities and schools), the large photo of an installation loads automatically from our official website, atlantisstrength.com, when you scroll down to it. That website is served through Cloudflare, Inc. (United States), a delivery network placed in front of its host, which also receives these requests. Legal basis: our legitimate interest in illustrating our projects (GDPR Article 6(1)(f)).

Cookies and Storage on Your Device

The Website itself places no cookie on its visitors’ devices; only internal pages reserved for our staff and our guests use a session cookie. It does however keep a few items in your browser’s storage: local storage, which lasts until you erase it, or session storage, erased when the tab is closed. These items do not leave your browser, except in the cases described in this policy:

• your preferences: the language and the light or dark display, when you choose them;
• your “My project” list and your last six searches on the Website;
• the draft of the quote request form, including your contact details, so that you can resume it; it is erased after a successful submission, but stays in your browser if you abandon the form;
• the update notices of our legal texts that you have closed;
• the choice you make in the consent banner;
• the campaign parameters, in the tab (see “Campaign Parameters”);
• the session log of the bug report tool, in the tab, and, after a first report, the name you gave and a random identifier (see “Bug Reports and Error Reports”).

The campaign parameters and the session log are not strictly necessary to display the pages: they are used to attribute requests to our campaigns and to diagnose problems. They only leave your browser if you send a form or a report, and they are erased when the tab is closed. You can erase all these items at any time in your browser settings (site data). The third-party services described above may place their own cookies, in particular YouTube after a click and HubSpot after your consent.

Who Receives Your Information

Your information is accessed by the members of our staff who need it in their duties: the sales team and customer service for requests, the people in charge of hiring for job applications, and the people in charge of the Website for bug reports and technical measurements. It is also entrusted to the providers that host the Website and to HubSpot, if you accept its tracking code. Some pages also use external services that your browser contacts directly (see “Third-Party Services Embedded in the Website”). The table below gives, for each recipient, its role, what it receives, where it is located and the safeguards that frame the disclosure.

We may also disclose personal information:

• to public or judicial authorities, when the law requires us to, for example in response to an order;
• when necessary to prevent or stop fraud, abuse of the Website or a threat to the safety of any person, to the extent permitted by law;
• to another company, as part of a merger, a reorganization or the sale of all or part of our business; we will then require it to honour the commitments of this policy, or we will inform you that a new policy applies.

We do not sell or rent your personal information, and we do not disclose it to anyone for advertising or marketing purposes.

Where Your Information Is Kept and Disclosure Outside Quebec

The Website and the information it receives are hosted by OVH Hosting, Inc. (OVHcloud), on servers located in Canada. Our team also uses a working copy of the Website, with restricted access, hosted by Hostinger; it contains a copy of the information received by the Website up to September 11, 2026. The same provider hosts our product image server. According to the public information associated with its address, this server is located in the United States.

Information may therefore be disclosed outside Quebec and Canada:

• to the working copy and the image server hosted by Hostinger, as described above;
• to HubSpot (United States), if you accept its tracking code: the pages you visit and the content of the forms you send, under the conditions described in “HubSpot: What Is in Place and What Is Not Yet”; its other services are not yet in place;
• to Cloudflare (United States) and the host of our official website, when the large image of one of three “Industries” pages loads;
• to the OpenStreetMap Foundation (United Kingdom) and its delivery network, when the map on a contact page loads;
• to Google (United States), if you start a YouTube video.

People in Quebec. Before disclosing personal information outside Quebec, we must assess whether it will receive adequate protection there (privacy impact assessment) and enter into a written agreement that takes this assessment into account. For HubSpot, the written agreement exists (see “HubSpot: What Is in Place and What Is Not Yet”) and the assessment is under way; if it does not show that the information receives adequate protection there, we will stop using its tracking code. For the working copy and the image server hosted by Hostinger, this assessment and this agreement are still to be confirmed; you can ask us to remove your information from the working copy. The OpenStreetMap map on the contact pages and the images from our official website, which load automatically, and YouTube videos, which load after your click, are requested by your browser directly from these providers: no assessment or written agreement exists with OpenStreetMap or Google, and none is documented for Cloudflare; our address is also shown as text on the contact pages. We undertake to apply this rule to any new disclosure.

People in the EEA or the United Kingdom. Your information is processed in Canada, which is covered by an adequacy decision of the European Commission for organizations subject to the Personal Information Protection and Electronic Documents Act (Decision 2002/2/EC), also recognized by the United Kingdom. There is no adequacy decision covering the United States as a whole: the European Commission’s decision, and its UK extension, only cover companies certified under the EU-U.S. Data Privacy Framework. HubSpot, Inc. is certified under this framework and its UK Extension, and its Data Processing Agreement also provides for the Standard Contractual Clauses of the European Commission and, for the United Kingdom, the addendum issued by the Information Commissioner. We undertake to entrust information to another provider in the United States only after entering into a written agreement with it that includes these clauses and this addendum; safeguards of this kind for Hostinger are still to be confirmed, as stated above. Cloudflare, Google (YouTube) and the OpenStreetMap Foundation receive directly from your browser the requests described in “Third-Party Services Embedded in the Website”. You can obtain a copy of the safeguards in place by writing to us.

You can refuse to have information about you transferred outside the EEA, the United Kingdom or Quebec by writing to our Privacy Officer; for the HubSpot tracking code, simply decline it in the consent banner. This refusal may prevent you from using some features of the Website.

How Long We Keep Your Information

We keep your information for as long as needed for the purposes for which it was collected, then for as long as the law requires or as needed to assert or defend our rights. Here, for each category, is the starting point and the criterion we apply. Except where a specific period is stated, no automatic deletion exists yet: deletion is done manually, in particular at your request, and we will state the periods we adopt in a future version of this policy.

• Contact, quote and distributor requests: during the exchange and any business relationship that follows from it; no specific period is set yet.
• Product registrations: during the warranty of your equipment, then as long as needed to settle related claims; no specific period is set yet.
• Job applications, including résumés and cover letters: during the hiring process; no period is set yet for afterwards, and you can ask for their deletion at any time.
• Newsletter subscription: until you withdraw your consent; we then keep proof of your consent and of its withdrawal for as long as needed to show that we complied with the law.
• Bug reports: until the problem is dealt with; no maximum period is set yet. Automatic error reports: only the 400 most recent distinct errors are kept.
• A/B tests: detailed events are deleted 90 days after they are recorded, by a scheduled task; a test’s fingerprint index is kept during the test and deleted when it ends; only aggregate counts, without fingerprints, are kept after that.
• Abuse protection counters of the forms: a few hours.
• Server logs: according to the configuration of our hosting providers; no period is set yet.
• Campaign parameters and session log: until the tab is closed, and 20 minutes at most for each log entry; once attached to a request or a report, they follow its retention.
• Consent banner choice: 6 months in your browser; HubSpot cookies: see their duration above.
• Information collected by the HubSpot tracking code, if you accepted it: in our HubSpot account, during any business relationship that follows; no maximum period is set yet, and you can ask for its deletion at any time.
• Information published in a case study: as long as the case study is online, or until the person named asks for its removal.

Where the law permits, we may keep data that has been made anonymous, which no longer allows anyone to be identified, such as the aggregate counts of A/B tests.

Security

We protect your information with measures suited to its sensitivity, including:

• all communications with the Website are encrypted (HTTPS);
• requests, applications and bug reports are kept outside the public part of the server, in files whose access is restricted to the Website service; no public address gives access to them, and only our administration tools, after authentication, allow them to be viewed;
• résumés and cover letters are limited to PDF, DOC and DOCX files of up to 5 MB, and are kept like the applications they accompany;
• apart from bug reports and server logs, our application does not record your IP address in clear, only a one-way fingerprint;
• access to our administration tools is reserved to authorized people, through individual password-protected accounts, and sensitive operations are logged;
• the value of form fields is never written in the session log, and it is masked on the screenshots of bug reports.

No measure is perfect. If a confidentiality incident occurs, we will take reasonable measures to reduce the risks and, where the law requires it, we will notify the Commission d’accès à l’information du Québec, the other competent authorities and the people concerned.

Your Rights

Depending on the laws that apply to you, including Quebec’s Act respecting the protection of personal information in the private sector, Canada’s Personal Information Protection and Electronic Documents Act, the GDPR and the UK GDPR, you can:

• access your personal information and know how we use it and to whom we disclose it;
• have it corrected if it is inaccurate, incomplete or equivocal;
• ask for its deletion;
• ask for the restriction of its processing, for example while we check its accuracy;
• receive the computerized information you gave us in a structured, commonly used technological format, or have it sent to the person or body of your choice (portability);
• ask us to stop disseminating information about you or to de-index any hyperlink attached to your name that gives access to it, where this dissemination contravenes the law or a court order, or causes you serious injury, under the conditions set by law;
• withdraw your consent at any time, without affecting what was done before.

Your Right to Object

You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest: answering a simple question, protection against abuse, campaign parameters, A/B tests, bug and error reports, server logs (including those of our image server), the map on our contact pages, the images from our official website, the development copy at Hostinger, case studies and testimonials, the calendar displayed directly in the page once it is in place. We will then stop that processing, unless we have compelling legitimate grounds to continue it or need it to establish, exercise or defend legal claims. You can also object at any time, without having to give a reason, to the use of your information for direct marketing.

Automated Decisions

We make no decision based exclusively on automated processing of your information, and no automatic screening is applied to job applications. Should this change, we would inform you first, as the law requires.

How to Exercise Your Rights

Write to privacy@atlantisstrength.com or to the postal address given above. We may ask you to confirm your identity, so that we disclose your information only to you. We will answer you in writing within 30 days of receiving your request; where the applicable law allows this period to be extended for a complex request, we will tell you before the 30 days are over, with the reason. Exercising your rights is free of charge; reasonable fees could only be charged in the cases provided for by law, and you would be told in advance. If we refuse a request, we will give you the reasons in writing and tell you what remedies you have. Exercising your rights has no effect on the prices or conditions we offer you.

Complaints

If you believe we have not respected your rights or this policy, we invite you to write to us first, by email at privacy@atlantisstrength.com or by mail. We will acknowledge receipt of your complaint within 30 days, look into it and inform you of the outcome.

You can also, at any time, contact a supervisory authority:

• in Quebec: the Commission d’accès à l’information du Québec;
• elsewhere in Canada: the Office of the Privacy Commissioner of Canada;
• in the United Kingdom: the Information Commissioner’s Office;
• in the EEA: the data protection authority of the country where you live, where you work or where the alleged infringement took place, whose list is published by the European Data Protection Board.

Minors

The Website is intended for professionals and adults; it is not directed at minors. We do not knowingly collect information about a person under 14 years of age without the consent of the person having parental authority or the tutor. If we learn that we have received such information without this consent, we will delete it.

United States Residents and Browser Signals

We do not sell your personal information and do not share it for cross-context behavioural advertising, as those terms are defined by the laws of California and other U.S. states, and we do not use sensitive information to infer characteristics about you. If a law of your state gives you rights, for example to know what information we hold, or to have it corrected or deleted, you can exercise them as described in “Your Rights”, yourself or through an authorized agent. We will not treat you differently because you exercise them.

The Website does not change how it works in response to the “Do Not Track” signal, for which there is no common standard; in any case, no third-party advertising or audience measurement tool loads on it without your consent. The Global Privacy Control signal, however, is treated as a refusal of the HubSpot tracking code, without even showing the banner. Third-party services you choose to use (a YouTube video after a click, the HubSpot tracking code after your consent) may collect information about your online activities over time and across other websites, under their own policies.

Governance

Our Privacy Officer, Diego Fernandez, ensures compliance with the law and with this policy; he receives requests and complaints. We keep an inventory of the Website technologies that involve personal information, checked against this policy, and we review this policy at least once every 12 months. Our internal rules for the governance of personal information (roles and responsibilities of our staff, retention and destruction of information, handling of complaints) are being drafted; once approved by our Privacy Officer, they will be published on the Website and this policy will link to them. Until then, requests and complaints are handled as described in “How to Exercise Your Rights” and “Complaints”.

Changes to This Policy

The date of last update, the version number and the effective date of this policy are shown at the top of this page. Every version is kept: previous versions, with the summary of their changes, are at the bottom of this page (version history).

We distinguish three kinds of changes:

• Corrections: corrections of form, clarifications with no change of substance, updates of our contact details. They take effect when published.
• Changes with immediate effect, because they cannot wait or do not disadvantage you: those required by law or by an authority; urgent security measures; those that reduce what we collect or add protections; a more complete or more accurate description of processing already in place, with no new purpose and no new recipient; a new optional processing activity that only starts with your express consent, given after the publication of the version that describes it.
• Substantial changes: for example a new purpose, a new category of information or of recipients, a disclosure to a new country, a longer retention period or a reduction of your rights. They only take effect after at least 30 days’ notice: the new version is published at least 30 days before it takes effect, and we normally add a 14-day margin so that this notice remains complete even if its publication online is delayed.

A version takes the nature of its most demanding change. When a version describes processing that is not yet in place, the notice at the top of this page says so, and that processing does not start before the date shown there, at least 30 days after publication.

Every new version is announced by a banner on the pages of the Website for at least 30 days and, where applicable, until it takes effect. For a substantial change, and for any other significant change, we also make reasonable efforts to notify you by email when we have your contact information, for example if you are a customer, a distributor or a newsletter subscriber, or if you sent us a request. During the notice period, you can object, withdraw your consent or ask for the deletion of your information.

When a change affects processing based on your consent, or aims to use information already collected for a new purpose, we will ask for your consent again: a notice is not enough. A new version never applies retroactively: information collected under a previous version continues to be processed under that version’s commitments when they are more favourable to you.

Welcome!

Welcome to the Atlantis Strength website at https://atlantisstrength.com/ (the “Website”), which includes all subpages and subdomains, present and future. The Website enables us to monitor and maintain communication with individuals who express interest in our services, which includes the sale, distribution and installation of strength and gym equipment (the “Services”). This Privacy Policy (the “Policy”) covers personal data collected from you or about you when (1) you are browsing the Website; (2) you are an individual seeking quotes and/or product registration for warranty claims or answers to general inquiries (a “Customer”); or (3) you are an individual seeking to become distributors of our products (a “Distributor”). We are pleased that you have chosen to visit our Website and are interested in our Services.

Atlantis Strength takes your privacy and the security of your personal data very seriously. We have provided and will continue to provide a secure environment and this Policy describes the limited ways your information is used and accessed. We ask that you read it carefully.

Key Elements of this Policy

Here are the key elements of this Policy so that you can know the important parts right away to make an informed decision about your consent for our collection, use and disclosure of your personal data. By submitting personal data to us via any means, you consent to such collection, use and disclosure. You can find the details in the rest of the Policy.

DEFINITIONS

Before we get started with the details, here are a few terms we think you should know as you read this Policy.

“Data Protection Laws”refers to the laws that are designed to protect your personal data and privacy in the place where you live. Atlantis Strength is committed to adhering to all applicable Data Protection Laws. The Data Protection Laws include:

• The “GDPR“, the European Data Protection Law which stands for “General Data Protection Regulation”, with the official nameRegulation (EU) 2016/679 of the European Parliament and of the Council;
• The “UK GDPR” which applies to our activities in the United Kingdom; please note that when this Policy refers only to the “GDPR”, this includes the UK GDPR, as applicable;
• “PIPEDA” (Personal Information Protection and Electronic Documents Act), which is the Canadian Data Protection Law that applies to our activities in Canada;
• Quebec’s Act Respecting the Protection of Personal Information in the Private Sector(the “Quebec Privacy Act”) as amended by Law 25, that applies to our activities in Quebec;
• The California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act which applies to our activities in the United States in certain circumstances; and
• Other state privacy laws in the United States, specifically those which are currently in force in Colorado, Connecticut, and Virginia.

“Personal data”, this is information we collect from you or about you and which is defined in the GDPR as “any information relating to an identified or identifiable natural person.” It can be as simple as your name or your email, or something more complicated like an online identifier (usually a string of letters and / or numbers) that gets attached to you. Under PIPEDA, the Quebec Privacy Act and the CCPA, the equivalent concept is “personal information”, which is roughly the same. For example, the Quebec Privacy Act defines “personal information” as “any information which relates to a natural person and allows that person to be identified either directly or indirectly.” Any mention of “personal data” in this Policy will also mean personal information.

About Us and Contacting Us

Atlantis Strength Inc. (“Atlantis Strength”), who owns and operates the Website and Services, is a Canadian corporation located in the province of Quebec, Canada, with an office at the address listed below.Where this Policy refers to “Atlantis Strength”, it may refer to Atlantis Strength and / or its affiliates, and their respective officers, directors, employees, agents, partners, principals, representatives, successors and assigns (collectively “Representatives”), depending on the context. Any reference to “we”, “our”, or “us” in this Policy shall also refer to Atlantis Strength. In this Policy, a Website visitor, Customer, Distributor or any other individual for whom we hold personal data may be referred to as “you” or “your”.

Under the GDPR, Atlantis Strength is a “data controller”. That means we collect personal data directly from you and determine the purpose and means of “processing” that data. “Processing” is a broad term that means the collection, use, storage, transfer or any other action related to your personal data; it is used in this Policy in that way. Under PIPEDA, Atlantis Strength is an “organization” and under the Quebec Privacy Act, Atlantis Strength is an “enterprise”. PIPEDA uses the phrase “collection, use and disclosure” and the Quebec Privacy Act uses “collects, holds, uses or communicates to third parties” as the approximate equivalent to the “processing” of the GDPR. When we use “processing” in this Policy, you can substitute either of the Canadian or Quebec law phrases.

If you want to ask us anything about what’s in this Policy, or anything else privacy- or data- related, or exercise any of your available privacy rights, you can contact:

Diego Fernandez Atlantis Strength Privacy and Data Protection Officer privacy@atlantisstrength.com

or:

Diego Fernandez Atlantis Strength Privacy and Data Protection Officer 4745 Avenue des Industries Laval, Quebec Canada, H7C 1A1

Your Rights

You have the following rights regarding your personal data held by Atlantis Strength, and other privacy rights. Please note that not necessarily all of these rights may be available to you; this depends on the Data Protection Laws where you are located that apply to you. These rights may be exercised without affecting any prices or costs charged by Atlantis Strength, if any, in connection with our Services. However, please note that exercising certain of these rights may affect your ability to use some or all of the Website or Services.

• The right to withdraw your consent for Atlantis Strength to process your personal data at any time;
• The right to have your personal data erased from Atlantis Strength’s records, and to have your name de-indexed if we link to any information about you (which we currently do not);
• The right to access your personal data and any relevant information around its processing and use;
• The right to have a copy of your personal data given to you in an easy-to-read format so that you can transfer it to any data controller or data processor or other third party;
• The right to have your personal data corrected or updated if you believe it is inaccurate or out of date;
• The right to opt out of email communications we send you, at any time;
• The right to know whether Atlantis Strength shares your personal data (and if so, who gets it). Please refer to that information elsewhere in this Policy, though you can contact our Privacy and Data ProtectionOfficer if you need additional information or clarification;
• The right to demand that Atlantis Strength not sell your personal data. Please note that Atlantis Strength does not sell your personal data;
• The right to restrict the processing of your personal data if it is inaccurate or if our processing or use of it is against the law; and
• The right to refuse any marketing or advertising targeted at you by Atlantis Strength.

If you wish to exercise any of these rights, please contact our Privacy and Data Protection Officer at the contact information above or refer to certain relevant sections further in this Policy.

Limited Personal Data Collected from You and What We Use It For

Atlantis Strength limits the amount of personal data we collect to what is necessary and appropriate for the identified purposes. We will not use or disclose your personal data for purposes other than those for which it was collected, except with your consent or as permitted or required by applicable law.

In the table below, please find all the personal data we may collect from you directly, what we use it for and the legal basis under the GDPR for us having and processing this personal data. Under PIPEDA, the Quebec Privacy Act and the CCPA, the legal basis is your informed consent and by submitting this personal data you acknowledge having granted this consent to Atlantis Strength.

Personal Data Collected About You from Third Parties and What We Use It For

Atlantis Strength does not routinely collect personal data about you from third parties, except to the extent that analytics identifiers are generated from third parties and, as such, may be considered personal data collected from third parties. You can find details about our analytics practices further below in this Policy.

Sensitive Personal information

We do not collect any of what the Data Protection Laws consider sensitive personal information from you when you use the Website or Services, unless you voluntarily submit it to us, which we encourage you not to do.

Who We Transfer Your Personal Data To

We only share some of your personal data with third parties who are identified in the table further below in this section, along with what they do with it.

We will share personal data with law enforcement or other public authorities if: (1) we are required by applicable law in response to lawful requests, including to meet national security or law enforcement requirements; (2) if we believe it is necessary in order to investigate, prevent, or take action regarding illegal activities, fraud, or situations involving potential threats to the safety of any person, or any violation of the Website’s Terms & Conditions; (3) if we believe it is necessary to investigate, prevent, or take action regarding situations that involve abuse of the Website infrastructure or the internet in general (such as voluminous spamming or denial of service attacks); or (4) we are required to under any applicable law.

We may also share personal data: (1) to a parent company, subsidiary, joint venture or other company under common control with Atlantis Strength (in which case we will require such entity to honour this Policy); or (2) if Atlantis Strength merges with another entity, is subject to a corporate reorganization, sells or transfers all or part of its business, assets or shares (in which case we will require such entity to assume our obligations under this Policy or inform you that you are covered by a new privacy policy).

Some of these third-party recipients may be based outside your home jurisdiction. If you are in the European Economic Area or the U.K., please see the “Transfer of Your Personal Data Outside of the European Economic Area” further down in this Policy for more information, including on how we safeguard your personal data when this occurs. If you are in Quebec, please see the “Transfer of Your Personal Data Outside of Quebec” section further down in this Policy for information on how we safeguard your personal data when this occurs.

We will never share your personal data with other third parties except under these circumstances. We do not sell or rent your personal data to any third party for direct marketing purposes or any other purpose.

• Companies providing technical infrastructure for the Website, specifically Acolyte Communication and Bloom;
• Companies that provide us with CRM services, specifically Dynamics Business Central; and
• Companies that help us to manage our mailing list and to communicate with interested Website visitors, specifically Microsoft 365
• Companies that help us to manage our mailing list and to communicate with Customers, specifically Microsoft 365
• Companies that help us to manage our mailing list and to communicate with Distributors, specifically Microsoft 365
• Companies that provide the online calendar through which you can book a meeting with our team, and the customer relationship management system in which that booking is recorded, specifically HubSpot, Inc. (see “Booking a Meeting with Our Team” below)
• The company that provides the tracking code of the Website, HubSpot, Inc., and only if you accept it in the consent banner (see “Consent Banner and HubSpot Tracking Code” below)
• The company that provides our customer relationship management system, HubSpot, Inc., for the requests sent through the forms of the Website that are connected to it (see “Requests Sent Through Our Forms” below)

Email Communications and Compliance with Anti-Spam Laws

Atlantis Strength manages our own mailing list to send out our newsletter and to email Website visitors, Customers and Distributors regarding new product releases and special offers using Microsoft 365’s Outlook (the “Email Service Provider”). Personal data is transferred to the Email Service Provider in order for the emails to be sent out properly. The Email Service Provider does not use your personal data for any other purpose and will not transfer or sell your personal data to any other third party. For more information, please refer to Microsoft 365’s Privacy Policy.

You may unsubscribe to stop receiving email communications from us at any time, by following the link at the bottom of Atlantis Strength emails. Other types of emails, such as those related to product quotations, orders, or inquiries about becoming a Distributor, will not include an opt-out provision, as they are essential for the use of our Services.

Atlantis Strength’s email practices are designed to be strictly compliant with anti-spam laws, including, but not limited to, the law unofficially called “CASL” or Canada’s Anti-Spam Law (S.C. 2010, c. 23) and the American CAN-SPAM Act of 2003. If you believe you have received any email from Atlantis Strength in violation of these laws, please contact our Privacy and Data Protection Officer using the contact information further up in this Policy.

Atlantis Strength Advertising and Opting Out

Atlantis Strength is continuously evaluating and modifying our use of various advertising networks, which may change from time to time. In this section you will find all the advertising networks that Atlantis Strength currently uses and instructions for opting out of them. You may also opt out or decline such advertising by refusing or deleting the appropriate cookie, as described further in this Policy. We will always update this Policy if we use additional advertising networks.

Generally, these ad networks work bydelivering you advertisements that will be of particular interest to you when you use their websites, apps, or services, based on your browsing and activity history interacting with the Website. Certain advertising networks use your email address that you submit to us to match your profile in order to better target the advertising to your preferences, called email retargeting.

The table below identifies the advertising networks we currently use, as well as links and instructions on opting out. By visiting the Website, using the Services or submitting your email address to us in any way, you consent to our advertising to you in this manner, understanding that you can opt out any time, or refuse or delete the cookie which will prevent such advertising (as described below).

Limited Gathering of Information for Statistical, Analytical and Security Purposes

Atlantis Strength automatically collects certain information using the “Third-Party Analytics Program” Google Analytics to help us understand more about our Website visitors and how they use the Website, but none of this information identifies you personally, except via an alphanumeric string. For example, each time you visit the Website, we automatically collect (as applicable) your IP address, browser and computer or device type, access times, the web page from which you came, the web page(s) or content you access, and other related information. We use information collected in this manner only to better understand your needs and the needs of Website visitors in the aggregate. Atlantis Strength also makes use of information gathered for statistical purposes to keep track of the number of visits to the Website and the specific pages visited on the Website, with a view to introducing improvements to the Website, Services and our activities.

We also use other Third-Party Analytics Programs, such as Bloom’s Digital Campaign Measurement and Tracking Tools, to monitor and analyse performance of the Website generally. This analysis encompasses, but is not limited to, the following aspects:

• Identifying the most and least frequented web pages;
• Tracking visitor navigation patterns on the site, including page view frequency; and
• Assessing product popularity by monitoring your browsing behavior.

Your IP address and other relevant information we collect using the Third-Party Analytics Program may be used in order to trace any fraudulent or criminal activity.

A/B Testing of Website Pages

Since September 2026, Atlantis Strength occasionally serves two versions of the same Website page, in order to find out which one is more useful to visitors. This measurement takes place entirely on our own server: nothing is written to or read from your device for this purpose. No cookie, no local storage, and no third party receives any part of it.

So that you see a consistent version from one page to the next, our server computes a one-way cryptographic fingerprint from your truncated IP address (the last portion is discarded) and your browser family, salted with a secret that is specific to each test and destroyed when that test ends. Your IP address itself is never stored. What is recorded is that fingerprint, the page, the version served, the language, whether the device is a desktop or a mobile, how far the page was scrolled, how long it was actively visible, and whether a form was completed. These records are deleted after 90 days; only aggregate counts are kept.

The legal basis for this processing is our legitimate interest in improving the Website (GDPR Article 6(1)(f)). Because nothing is stored on or read from your device, the prior consent required by Article 5(3) of the ePrivacy Directive and section 8.1 of Quebec’s Law 25 is not engaged. Should we ever move to a method that does store something on your device, a consent banner would be introduced in the same release.

This section was added on September 3, 2026. The date at the top of this page is deliberately unchanged: the Policy as a whole was not reviewed on that date, only this section was added.

Booking a Meeting with Our Team

Some of our contact pages let you book a meeting directly in the calendar of the person at Atlantis Strength who covers your territory, or in a general calendar of our team. The booking calendar is provided by HubSpot, Inc. (Cambridge, Massachusetts, United States), which processes it on our behalf. Depending on our settings, a calendar is shown in one of two ways. Either nothing is loaded from HubSpot, and nothing is sent to it, until you click to book: the calendar then opens in a window served directly by HubSpot; or it is displayed directly in the page, as described in the next paragraph. In both cases, HubSpot’s own privacy policy (legal.hubspot.com/privacy-policy) also applies inside the calendar.

Calendar displayed directly in the page. Where a calendar is shown without a click, your browser contacts HubSpot as soon as the page opens: it loads a HubSpot script (hsappstatic.net), then the calendar itself (meetings.hubspot.com, or its regional address). HubSpot then receives your IP address, your type of browser, the address of the page with the parameters of the link that brought you there, and an identifier. If you accepted the HubSpot tracking code (see “Consent Banner and HubSpot Tracking Code” below), this identifier is the one in its cookie, so that a booking can be linked to the pages you visited; otherwise, it is a temporary identifier created for that page only. We do this so that the calendar is ready without an extra step (our legitimate interest, GDPR Article 6(1)(f)). As for bookings, HubSpot may process this information outside Quebec and Canada, including in the United States.

If you book a meeting, the information you enter (your first and last name, your email address, and any details you choose to add) is collected by HubSpot and recorded in our customer relationship management system, so that the meeting is added to our representative’s calendar, you both receive a confirmation, and we can follow up on your request. HubSpot may store and process this information outside Quebec and Canada, including in the United States: see the two sections below on the transfer of your personal data outside of Quebec and outside of the European Economic Area.

The legal basis for this processing is that it is needed to arrange the meeting you ask for (GDPR Article 6(1)(b)). Booking a meeting does not subscribe you to our marketing communications: you will receive them only if you expressly agree to them, and you can withdraw that agreement at any time (see “Email Communications and Compliance with Anti-Spam Laws”). The information related to your meeting is kept as described under “Data Retention”.

This section was added on September 18, 2026, and completed on September 24, 2026 with the calendar displayed directly in the page. The date at the top of this page is deliberately unchanged: the Policy as a whole was not reviewed on those dates, only this section was added, then completed.

Requests Sent Through Our Forms

When you send us a request through one of the forms of the Website (contact, quote request, distributor application, product registration, newsletter subscription or job application), it is first recorded on our own server. Then, for each form we have connected to it, it is sent to our customer relationship management system, provided by HubSpot, Inc. (Cambridge, Massachusetts, United States), which processes it on our behalf. A connected form says so in a sentence right below it, with a link to this section.

What is sent to HubSpot: the information you entered in the form, the language and the page from which you sent it, the campaign parameters of the link you followed to reach the Website (if any), and the reference number of your request. For a job application, your résumé and cover letter are never sent: they stay on our server. If you accepted the HubSpot tracking code (see “Consent Banner and HubSpot Tracking Code” below), the pseudonymous identifier of its cookie is sent too, so that your request is linked to the pages you visited; if you declined it, nothing links your request to your browsing. Sending a request through one of these forms does not subscribe you to our marketing communications; only the newsletter form does, with the consent you give in it, which you can withdraw at any time.

We use this information to answer your request and follow up on it (GDPR Article 6(1)(b)) and, for the newsletter, to send it to you with your consent (GDPR Article 6(1)(a)). HubSpot may store and process it outside Quebec and Canada, including in the United States: see the two sections below on the transfer of your personal data outside of Quebec and outside of the European Economic Area. It is kept as described under “Data Retention”.

This section was added on September 23, 2026. The date at the top of this page is deliberately unchanged: the Policy as a whole was not reviewed on that date, only this section was added.

Consent Banner and HubSpot Tracking Code

With your consent only, the Website uses the tracking code of HubSpot, Inc. (Cambridge, Massachusetts, United States), the provider of our customer relationship management system. Until you click “Accept” in the banner, the tracking code is not loaded: it sends nothing to HubSpot and places no HubSpot cookie on your device. The booking calendar, described above, is separate. If you decline, ignore the banner, or if your browser sends the Global Privacy Control signal, the Website works exactly the same.

If you accept, the tracking code records the pages of the Website you visit, when you visit them and the page you came from, together with your IP address and the type of browser and device you use, under a pseudonymous identifier stored in a cookie. If you later send us a request through one of our forms, this browsing history may be linked to the information you give us, so that the person who answers you knows which products you looked at. We use it to measure the audience of the Website and to follow up on requests. It is not used for advertising: the HubSpot chat window and the advertising pixels HubSpot can install are disabled on the Website.

The cookies placed by HubSpot, according to its documentation at the date of this section, are:

• __hstc: the main tracking cookie (identifier, first and last visit, number of visits), kept 6 months;
• hubspotutk: the pseudonymous identifier used to recognize you when you submit a form, kept 6 months;
• __hssc: counts the pages viewed during the current visit, kept 30 minutes;
• __hssrc: detects the start of a new visit, deleted when you close your browser.

The Website also keeps the choice you made in your browser (atl.consentement.v1, 6 months), so that it does not ask you on every page. This item is strictly necessary to respect your choice, including a refusal, and it never leaves your browser.

The legal basis for this processing is your consent (GDPR Article 6(1)(a); section 8.1 of Quebec’s Law 25). Your choice is kept for six months, after which we ask you again; we also ask again if what you accepted changes. You can withdraw your consent at any time, as easily as you gave it, with the “Cookies” link at the bottom of every page. Withdrawing deletes the HubSpot cookies from your browser; it does not affect what was collected before. HubSpot may process this information outside Quebec and Canada, including in the United States: see the two sections below on the transfer of your personal data outside of Quebec and outside of the European Economic Area.

This section was added on September 23, 2026, and its first paragraph made more precise on September 24, 2026. The date at the top of this page is deliberately unchanged: the Policy as a whole was not reviewed on those dates, only this section was added, then made more precise.

Tracking Technology (“Cookies”) and Related Technologies

Atlantis Strength uses tracking technology (“cookies” and related technology such as tags, pixels and web beacons) on the Website. Cookies are small text files placed on your computer or device when you visit a website, in order to track the use of the website and to improve the user experience by storing certain data on your computer. By visiting or using the Website, you agree to their use, but only if you explicitly consent to such use, according to the cookie banner presented to you when you visit the Website.

Specifically, we use cookies and related technologies for the following functions:

• to facilitate online advertising, as described above in this Policy;
• to provide general internal and user analytics and to conduct research to improve the content of the Website and to monitor the performance of the Website using the Third-Party Analytics Programs as described above in this Policy;
• to translate the Website; and
• to assist in identifying possible fraudulent activities.

Your browser can be set to refuse cookies or delete them after they have been accepted and stored. You can refer to your browser’s help section for instructions,but here are instructions for the most commonly used browsers and operating systems:

• Google Chrome
• Mozilla Firefox
• Microsoft Edge
• Opera
• Apple Safari
• iOS
• Android

Please note that deleting or refusing cookies may reduce your user experience on the Website. Furthermore, deleting cookies may prevent certain functions from working at all.

How We Protect Your Personal Data

We have implemented strict technical and organisational procedures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed by us. These procedures prevent your personal data from being lost or used or accessed in any unauthorised way.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable supervisory authority of a suspected data security breach where the Data Protection Laws require us to do so and within the time frame required by the applicable Data Protection Law(s).

Atlantis Strength uses only industry best practices (physical, electronic and procedural) in keeping any data collected (including personal data) secure. In addition, we use third-party vendors and hosting partners to provide the necessary hardware, software, networking, storage, and related technology required to operate the Website, and these third parties have been selected for their high standards of security, both electronic and physical. For example, Atlantis Strength uses OVHcloud for hosting of the Website and related data and for the collection and storage of data, including personal data.

Finally, all information, including personal data, is transferred with encryption using Secure Sockets Layer (“SSL”) or Transport Layer Security (“TLS”), robust security standards for internet data transfer and transactions. You can use your browser to check Atlantis Strength’s valid SSL security certificates on the Website.

Internal Procedures and Policies

In addition to the measures to protect your personal data described in the previous section, we have drafted and implemented certain internal procedures and policies regarding personal data, including the following:

• A framework for the keeping and destruction of the personal data that we collect, including where we may keep anonymized data;
• Defining and describing the roles and responsibilities of the members of Atlantis Strength personnel throughout the life cycle of the personal data; and
• A process for dealing with individual complaints and requests for personal data and exercising of the individual’s rights under Data Protection Laws.

Transfer of Your Personal Data Outside of the European Economic Area (“EEA”) and the U.K.

For our European users, we endeavour to keep your personal data inside the EEA or the U.K. (as applicable). However, certain of our data processors (and Atlantis Strength) are in other countries where your personal data may be transferred. However, these countries are limited to countries with particular circumstances that protect your data, specifically:

• Canada. We transfer personal data to our operations in Canada, but Canada has been determined to have an “adequate level of protection” for your personal data under European Data Protections Laws.
• The United States. Your personal data is only transferred to companies in the United States that: (1) have signed agreements with us or have informed us that they are GDPR-compliant; and (2) have concluded the Standard Contractual Clauses for the transfer of personal data outside the EEA and the U.K.

That’s it! You have the right, however, to refuse to have your data transferred outside the EEA or the U.K. Please contact our Privacy and Data Protection Officer to make that request. Please note that making this request may prevent you from being able to use certain portions of the Website or Services.

Transfer of Your Personal Data Outside of Quebec

For our Quebec Website visitors, Customers and Distributors, we endeavour to keep your personal data in Quebec. However, certain of our third-party service providers are in other provinces or countries where your personal data may be transferred. When this happens, we do the following to safeguard your personal data:

• We will perform what the Quebec Privacy Act calls an “Assessment of the privacy-related factors” (what is generally called a “Privacy Impact Assessment,” or “PIA”) prior to the personal data leaving Quebec. If the PIA does not meet our standards and the standards required by the Quebec Privacy Act, we will not transfer your personal data to such a service provider; and
• If the PIA allows us to transfer the personal data to such a service provider outside Quebec, we will sign what is generally called a “Data Processing Agreement,” or DPA, with the service provider, which protects the person data transferred to them and limits their use of it to what we have contracted with them to do. This DPA will adhere to the requirements of the Quebec Privacy Act.

Supervisory Authorities and Complaints

If you are in the EEA or the U.K., under the GDPR, you have the right to make a complaint to the appropriate supervisory authority. If you are not satisfied with the response received or the actions taken by our Privacy and Data Protection Officer, or if you would like to make a complaint directly about Atlantis Strength’s data practices, we invite you to contact the supervisory authority in your country.

If you are in the U.K., you should contact the Information Commissioner’s Office who is the supervisory authority. You can reach them in a variety of ways, including by phone (0303 123 1113 in the UK) and mail (Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF). If you are in France, you should contact theCommission Nationale de l’Informatique et des Libertéswhich is the supervisory authority there. Their contact information can be found here.

The full listing of all Data Protection Authorities (the supervisory authorities) across the EEA can be found here.

If you are in Canada and you are not satisfied with the response received or the actions taken by our Privacy and Data Protection Officer, you can make a complaint to the Office of the Privacy Commissioner of Canada. Instructions on how to do so can be found on their website. If you are in Québec, you can make a complaint to theCommission d’accès à l’information, with the instructions for contacting them on their website.

Data Retention

Your personal data will only be kept for as long as is necessary for the purpose needed for that processing. For example, we will retain your Customer Contact Information for a reasonable period of time following expiry of your product warranty.

We may have to keep your data for a longer period of time to satisfy our requirements under any applicable law, including anti-spam laws, or to protect our legal interests.

In some cases, where permitted by the Data Protection Laws, we may keep personal data that has been anonymized, for our legitimate business purposes.

Automated Decision-Making

Atlantis Strength does not use any automated decision-making processes with regard to your personal data in providing the Website or Services.

Children’s Privacy Statement

The Services are only intended for persons who are 18 years old for a resident of a Canadian province or the age of majority in any other country.

The Data Protection Laws have various age limits as to the minimum age required for us to hold personal data about an individual. We do not knowingly collect any personal data from a child under those minimum ages. If we become aware that we have inadvertently received personal data from a person under the minimum ages through the Website, we will delete such information from our records.

Changes to This Privacy Policy

The date at the top of this page indicates when this Policy was last updated. Every now and then, we will have to update this Policy and we will update it no less than once every 12 months. You can always find the most updated version at this URL, and we will always post a prominent notice on the Website if we make significant changes and use reasonable efforts to contact you if we have your contact information, for example, if you are a Customer or a Distributor.

Thanks for reading! Please keep your personal data safe; we promise to do the same.

Atlantis Strength Inc., 2024.