Skip to content
Swimo

Personal information

Privacy policy

Swimo is a solution by PLANITOU.CA INC. (“Planitou”). This Policy explains how we collect, use, disclose and protect your personal information when you use Swimo (Planitou).

Last updated: March 31, 2025.

1. Introduction

BEFORE USING OUR WEBSITE AND APPLICATIONS, PLEASE READ THIS PRIVACY POLICY CAREFULLY (the “Policy”).

This Policy governs the protection of Personal Information (as defined below) by PLANITOU.CA INC., doing business as Planitou (“Planitou”, “we”), publisher of the Swimo platform.

We pay particular attention to the protection of your Personal Information collected via our website and applications (collectively, the “Applications”) and via the Swimo (Planitou) solutions (collectively, with the Applications, the “Platform”).

This Policy applies in full only to Personal Information of users of the Applications (“you”). Its purpose is to explain how we collect, use and disclose your Personal Information.

If you are an Authorized User of a Subscriber, a section of this Policy applies to you only where it expressly states so. Each Subscriber is responsible for its compliance with the legal obligations that apply to any person collecting Personal Information about others and, in that regard, is responsible for obtaining valid consent to its collection, disclosure and use. In addition, it must establish its own privacy policy, determine the protection measures applicable to Personal Information and give the persons concerned the means to exercise their rights.

This Policy does not apply to Personal Information about our employees or our Subcontractors (as defined in Article 6).

Finally, this Policy is intended to comply with European and Europe laws on the protection of Personal Information and, where applicable, with the General Data Protection Regulation (“GDPR”).

For the purposes of this Policy, the following definitions apply:

1.1. “Account Administrator”

Member of an Organization to whom the Organization grants the right to administer the account. This right includes the following prerogatives:

  • modifying User Account information;
  • adding Authorized Users and their User Profiles;
  • modifying payment information;
  • carrying out any operation related to the Organization’s business relationship with Swimo (Planitou).

1.2. “Subscriber”

An Organization named on the subscription form that has received a subscription confirmation email for the Swimo (Planitou) solutions.

1.3. “Organization”

A person that operates a business, limited partnership, limited liability company, partnership, union, employer association, sole proprietorship, corporation or company (with or without share capital), legal person, cooperative, trust, unincorporated association, joint venture, non-profit or not-for-profit organization, governmental authority or any other entity, regardless of its legal form, incorporation status or the jurisdictions in which it operates, carrying on an organized activity of any nature, and which uses the Swimo (Planitou) solutions. Any Authorized User who manages the schedules of other Authorized Users is also treated as an Organization.

1.4. “Swimo (Planitou) solutions”

Means:

  • the Swimo (Planitou) solutions, software offered as a remote service (software as a service) for participant and employee attendance and absence management, participant and employee file management, participant and employee note-taking and communication between Authorized Users;
  • the Swimo (Planitou) solutions offered, in whole or in part, as mobile applications for smartphones or tablets;
  • any other solution providing new features that may be added as a module to the solutions listed in (1) and (2);
  • support to Authorized Users and related maintenance provided by Swimo (Planitou).

1.5. “Authorized User”

Member of a Subscriber, Organization or Affiliate whom an Account Administrator authorizes to use the Swimo (Planitou) solutions after the Subscriber has paid the applicable fees. An Authorized User may be a member of several Subscribers, Organizations or Affiliates.

1.6. “Personal Information”

Any information relating to a natural person that allows the person to be identified, directly or indirectly. For the purposes of this Policy, Personal Information corresponds to “personal data” within the meaning of the GDPR.

1.7. “User Profile”

The Personal Information about an Authorized User transcribed in an intelligible, structured form that is accessible and modifiable via the Platform.

2. Personal information we collect

We collect only the Personal Information about you that is necessary to establish, manage and maintain our relationship with you. In most cases, collection is limited to the following:

  • First and last name;
  • Date of birth;
  • Email address, postal address, phone numbers;
  • Banking information, where applicable;
  • Connection cookies (see Section 10 for details).

2.1. Collection methods and responsibility

We may collect Personal Information via the Applications, upon signing a contract or, more broadly, during email, phone or in-person exchanges with one of our employees or representatives.

The Platform is designed for use by adults only as understood in the province of Europe. Swimo (Planitou) does not knowingly collect personal information from persons under the age of eighteen (18), unless the data has been transmitted by the holders of parental authority or by a minor over fourteen (14).

Personal Information entered by Authorized Users and their User Profiles is under the responsibility of their Organizations.

3. Your consent

Your consent to the collection, use and disclosure of your Personal Information must be clear, free and informed. It must be given for specific purposes.

Our policies and contracts are written in plain language to help you understand the nature, purposes and consequences of the collection, use and disclosure of your Personal Information.

Depending on the nature and sensitivity of your Personal Information, your consent may be explicit (verbal, written or electronic) or implicit (when you voluntarily provide Personal Information).

We will generally ask for your consent, except where it is otherwise required or permitted by law. If you are an Authorized User, our Terms and Conditions require your Organization to obtain your consent, and we assume it acts within the limits set by law. If you witness or are the victim of a breach in this regard, you may notify us using the contact information provided at the end of the Policy.

By using the Applications, you consent to your Personal Information being used in accordance with this Policy.

4. Security and governance

Cybersecurity is a priority. We have adopted policies and practices that govern our management of Personal Information. They provide the following:

  • The rules applicable to use, disclosure, retention and destruction of this information;
  • The roles and responsibilities of our employees throughout the lifecycle of this information;
  • A complaint-handling process related to the protection of this information.

4.1. Policies and practices

These policies and practices are the following:

  • Personal Information Management Policy: sets out, among other things, the categorization of this information by sensitivity, and the obligation we impose on ourselves to keep a register for all categories of use, disclosure, retention, destruction or any other category of operation we perform;
  • Information Security Policy: sets out all our processes aimed at protecting the confidentiality, integrity and availability of the information and systems we hold;
  • Internal Personal Information Protection Policies: includes employee confidentiality agreements, criminal-record checks every two (2) years, use of password-protected data networks, etc.;
  • Subcontractor Management Policy: sets out how we select our Subcontractors (as defined in Article 6), and the security requirements they must put in place before receiving Personal Information.

4.2. Physical and technological measures

In addition to these administrative measures, we have put in place physical and technological measures that are reasonable given the sensitivity of the Personal Information, its use, quantity, distribution and medium.

We use all reasonable means to reduce the risk of breaches of confidentiality of Personal Information. For example:

  • We apply the principles of maximum protection by default: by default, the Platform’s settings have the highest level of confidentiality without any intervention from you. Cookies are not automatically disabled, but you can do so by following the instructions in Section 10.
  • When the use or disclosure of Personal Information is necessary to modify the Platform or deploy new features, we carry out a privacy impact assessment whose results guide the measures put in place.

5. Use of Personal Information

We use the Personal Information of users of the Applications and of Authorized Users of our Subscribers only for the following purposes:

  • Provide the Platform and ensure its security and optimal operation. The Platform enables participant and employee attendance and absence management, participant and employee file management, participant and employee note-taking, and communication between Authorized Users;
  • Identify a user of the Applications or an Authorized User and verify the authenticity of that identification;
  • Provide technical support;
  • Provide training;
  • Where applicable, allow a user or an Authorized User to carry out operations on the Platform;
  • Where applicable, send newsletters and other promotional communications about our products, services, updates, news, tips and special offers.

5.1. Employees and sanctions

Every employee at Swimo (Planitou) who handles Personal Information is bound by confidentiality obligations and has received adequate training. They may only access the Personal Information necessary to perform their duties. In case of breach, our governance policies and practices (see Article 4) provide for sanctions.

We use Personal Information only for the purposes set out in this Policy, except where the law authorizes us, in very limited cases, to do so without your consent. Our Subscribers have the right to access the Personal Information they collect about their Authorized Users. To learn more, please consult our Terms and Conditions and our Acceptable Use Policy, which require them to put security measures in place.

The provisions of this article apply to the Personal Information we hold about both users of the Applications and Authorized Users of our Subscribers.

6. Disclosure of your Personal Information

6.1. To whom?

We may disclose Personal Information to third parties in specific circumstances authorized by law. The following sections summarize those circumstances and the measures we take to protect that information.

To service providers, agents, subcontractors (“Subcontractors”)

Description and purpose: We may enter into contracts with Subcontractors to deliver a service to our Subscribers, such as a Platform feature. Those Subcontractors may also provide a service to you directly on our behalf.

We believe in transparency and maintain an up-to-date list of the third-party service providers to whom Personal Information we hold may be disclosed.

Measures: The contract requires Subcontractors to:

  • use only the Personal Information necessary to deliver the service;
  • refrain from disclosing or communicating the Personal Information without our consent;
  • put rigorous security measures in place;
  • allow us to audit those measures;
  • notify us immediately of any confidentiality incident;
  • destroy the Personal Information at the end of a contract.

To another party during a Commercial Transaction

Description and purpose: We may enter into a contract with a third party in view of a Commercial Transaction. Such a transaction is defined as the sale, lease or transfer of all or part of our business or its assets, a change to our legal structure by merger or otherwise, obtaining a loan or any other form of financing, or a security granted to guarantee one of our obligations (“Commercial Transaction”).

Measures: The contract requires the other party to:

  • use the Personal Information only for the purposes of closing the Commercial Transaction;
  • put rigorous security measures in place;
  • refrain from disclosing or communicating the Personal Information without our consent;
  • notify us immediately of any confidentiality incident;
  • destroy the Personal Information if the Transaction does not close or the information is no longer required.

To legitimate authorities

Description and purpose: To comply with a court order or decision, including a valid search warrant, or an order of a regulatory authority, we may be required to provide Personal Information.

Measures: The laws governing those authorities require them to put measures in place to respect and preserve the confidentiality of your Personal Information.

We notify Subscribers of any request from legitimate authorities for access to Personal Information about their Authorized Users. We refuse access whenever the request is not legally binding.

To our lawyers or attorneys

Description and purpose: In order to defend or assert our rights, we may in certain cases disclose your Personal Information.

Measures: Both the law and the engagement letters we sign require our lawyers to protect the confidentiality of all our communications with them.

6.2. Where?

In the course of delivering our services, we may disclose Personal Information outside Europe, notably in the following regions:

  • Canada;
  • Europe;
  • United States.

6.3. Hosting and transfers

Personal Information is stored securely with Digital Ocean on servers located in Europe or in the European Union. All Personal Information is encrypted on storage media.

Before disclosing Personal Information outside Europe, we carry out a privacy impact assessment that takes into account its sensitivity, the purpose of its use, the protection measures it will benefit from and the legal regime applicable in the State to which the Personal Information will be disclosed.

We proceed with such disclosure only if the assessment shows that the Personal Information will benefit from adequate protection. In addition, the disclosure must be the subject of a written contract that reflects all the conclusions of the assessment.

The provisions of this article apply to Personal Information we hold about both users of the Applications and Authorized Users of our Subscribers.

7. Retention

We retain Personal Information about you only for as long as necessary to fulfill the purpose for which it was collected, to comply with legal retention requirements and to protect our legitimate business interests. We reserve the right to establish from time to time policies for the destruction of Personal Information.

If you request the destruction of your Personal Information, we will make reasonable efforts to honor that request as quickly as possible.

Deletion of your User Account is completed within 90 days of the request; for technical reasons, some traces of your use may remain in our systems, notably in connection logs and backup copies, for up to 12 months.

In addition, we ensure that temporary files created as a result of the collection, use or disclosure of Personal Information are properly deleted as soon as they are no longer needed.

Please note that Authorized Users of our Subscribers may have the right to retain certain information despite your deletion request. Please contact the Personal Information Officer of your Organization for more details.

8. Anti-spam law

Swimo (Planitou) complies with the requirements of Canada’s Anti-Spam Legislation (CASL).

To unsubscribe from our electronic communications, simply contact us at confidentialite@planitou.ca.

9. Your rights

ANY REQUEST FROM AUTHORIZED USERS MUST BE ADDRESSED TO THE PERSONAL INFORMATION OFFICER OF THEIR ORGANIZATION. EXCEPT TO INFORM YOU OF THE SOURCE OF THAT PERSONAL INFORMATION, WE DO NOT ANSWER SUCH REQUESTS, AS WE LIMIT ITS USE TO WHAT IS NECESSARY TO PERFORM THE CONTRACT WITH OUR SUBSCRIBERS AND WE DELETE IT PER THEIR INSTRUCTIONS. YOU MAY DIRECTLY UPDATE YOUR USER PROFILE WHERE YOUR ORGANIZATION ALLOWS IT.

Users of the Applications who are not Authorized Users of an Organization have the following rights:

  • The right to be informed of the types of operations performed on your Personal Information, including its use or disclosure (Processing under the GDPR). This Policy is intended to do so.
  • The right to access your Personal Information by connecting to the Platform and to obtain more details about how we carry out those operations. You may also exercise this right by emailing the address provided at the end of this Policy with the subject line “Access to my personal data”.
  • In certain cases, the right to object to, restrict or withdraw your consent to those operations upon reasonable prior notice by email to the address provided at the end of this Policy, with the subject line “Objection, restriction or withdrawal (as applicable) of consent”. Please note that if you choose to withdraw your consent, you may no longer be able to use the Applications.
  • The right to have your Personal Information corrected if it is inaccurate or unclear and to have it completed when it is incomplete, by emailing the address provided at the end of this Policy with the subject line “Modification of my personal information”.
  • The right to have your Personal Information deleted, subject to our legal obligations.
  • The right to obtain your Personal Information in a commonly used digital form.
  • The right to be informed of a confidentiality incident affecting your Personal Information that may cause you serious harm. We maintain a register that lists all confidentiality incidents and assesses the harm they may cause. If an incident affects the Authorized Users of a Subscriber, the Subscriber remains responsible for notifying you; we will notify them as soon as possible.

9.1. Deadlines and refusals

We will respond to any request within 30 days of receipt, except where the law allows an extension. If we refuse to provide or correct the information, we will communicate the reasons for the refusal, the applicable legal provisions, and information about your remedies, subject to the restrictions provided by law.

If we refuse to correct your Personal Information, we will allow you to add written comments to your file regarding the Personal Information subject to the refusal. We will also retain the Personal Information subject to an access request for as long as necessary to allow you to exhaust the remedies provided by law.

10. Cookies

10.1. Definition

A cookie is a small text sent by a server to your browser, which the browser sends back on subsequent connections to servers sharing the same domain name. You can configure your browser to warn you when you receive cookies or to refuse them. You do not need to accept cookies to visit our Applications; however, if you refuse them, some features may not work.

10.2. Types of cookies used

  • Technical cookies: technical cookies are used throughout navigation to facilitate use of the Applications. For example, a technical cookie may be used to remember your user name to ease login, or to remember your preferences.
  • Analytics cookies: these cookies are anonymous and are used to collect usage statistics for the Applications.
  • Advertising cookies: these cookies may be added by the Applications or by other sites carrying advertising. They collect information anonymously and build your visitor profile.

11. Personal Information Officer

The Personal Information Officer at Swimo (Planitou) is Jonathan Thivierge. This role corresponds to the Data Protection Officer (DPO) within the meaning of the GDPR.

For any question or request related to the Policy, please email confidentialite@planitou.ca.

12. Changes

Swimo (Planitou) reserves the right to change the content of this Policy at any time. Any change will appear on our Platform and be brought to your attention when you connect. We recommend printing a copy for your records and reviewing this section periodically.