Privacy policy

Last updated: 11 September 2026

1. Who is responsible

MOH Managed, operated by Mohamed Farah, Pointe-Claire, Québec, Canada, decides why and how the personal information described here is handled. In the language of European law, we are the controller.

Under Québec's Law 25, the person responsible for the protection of personal information is Mohamed Farah, reachable at contact@mohmanaged.ca.

2. What we collect

• What you send us. Your name, email address and message when you use a contact form, and anything you choose to include if you send us a self-check result or write to us directly.
• What delivering a service requires. If you engage us, technical and configuration information about your systems, and any personal information held in them, strictly to the extent needed to do the work.
• Server logs. Our host records standard request data, including IP addresses, for security and to keep the site running. We do not use it to build a profile of you.

3. What we do not do

• No cookies are set by this site.
• No analytics, no tag managers, no advertising or tracking pixels.
• No third-party requests. Fonts and every other asset are served from this domain, so loading a page tells nobody but our host that you were here.
• We never sell or rent personal information, and we do not share it for cross-context behavioural advertising.
• No automated decision-making and no profiling.

4. The security self-check

Your answers are held in your browser's memory and nowhere else. They are not sent to us, not written to a server, and not stored between visits. Copying, downloading or printing your result all happen on your device.

The one exception is entirely yours to make: if you use the Send it to MOH Managed option, the text is shown to you in an editable box first, so you can see and change exactly what will be sent before sending it.

5. Local storage on your device

Two small preferences are saved in your browser's local storage so the site does not have to ask twice: moh-theme, your light or dark choice, and moh-lang, set only if you dismiss the offer of the other language. Those two keys are the whole of it. They stay on your device, are never transmitted, and clearing your browser data removes them.

6. Why we handle it, and on what basis

• To answer you and to quote work — because you asked us to (consent), and to take steps at your request before entering a contract.
• To deliver, support and invoice services — performance of our contract with you.
• To keep the site and our systems secure — our legitimate interest in not being attacked.
• To meet legal, tax and professional obligations — legal obligation.

Where we rely on consent, you may withdraw it at any time. That does not affect anything already done, or information we must keep by law.

7. Where it is stored, including outside Québec and Canada

This site is hosted by Netlify, whose infrastructure and form submissions are located in the United States. So a message sent through a form on this site is stored outside Québec and outside Canada. We also use an email provider to receive mail sent to our address; a current list of our providers is available on request.

Before communicating personal information outside Québec, Law 25 requires us to assess whether it would receive adequate protection, taking account of its sensitivity, the purpose of its use, the protections in place and the legal framework of the destination. Where European transfer rules apply, transfers rest on the European Commission's Standard Contractual Clauses as incorporated into our providers' terms.

8. How long we keep it

• Enquiries that do not become work: 24 months, then deleted.
• Client records, contracts and invoices: 7 years, which is what Québec and Canadian tax and limitation rules expect.
• Access to your systems: handed back at the end of an engagement; we do not keep standing access between engagements.

9. Who else sees it

Only providers who need it to perform work on our behalf — today, our host and our email provider — under terms requiring them to protect it and use it for no other purpose. We also disclose information where the law compels us to. We do not otherwise share it with anyone.

10. How we protect it

We apply the controls we recommend to clients: multi-factor authentication on every account that can reach personal information, administrative identities kept separate from everyday ones, access limited to what a task needs, encryption in transit and at rest, and tested backups.

11. Security incidents

We keep a register of confidentiality incidents. Where an incident presents a risk of serious injury, we notify the Commission d'accès à l'information du Québec and the people affected promptly, and take reasonable steps to reduce the harm and prevent a recurrence. Where other breach-notification laws reach a given incident, we comply with those as well.

12. Your rights

We extend the following to everyone who contacts us, wherever you are, rather than only to people a particular statute happens to cover:

• Know and access — whether we hold information about you, and a copy of it.
• Correct — information that is inaccurate, incomplete or ambiguous.
• Delete — subject to what we must keep by law.
• Portability — computerised information you gave us, in a structured, commonly used technological format.
• Withdraw consent, at any time.
• Object or restrict — ask us to stop or limit a particular use.
• No retaliation — exercising any of these never costs you service or price.

Write to contact@mohmanaged.ca. We respond within 30 days.

Québec — Law 25

In addition to the above, you may ask us to cease disseminating information or to de-index it in the circumstances the law provides. If our response does not satisfy you, you may complain to the Commission d'accès à l'information du Québec.

Canada outside Québec — PIPEDA

You may complain to the Office of the Privacy Commissioner of Canada.

European Union and United Kingdom — GDPR

We are a Québec business serving businesses in the Montréal area. We do not target the European market, so the GDPR very likely does not apply to us by its own terms. We nonetheless honour the rights listed above, and if you are in the EU or UK you may lodge a complaint with your national supervisory authority.

California — CCPA and CPRA

We do not meet any of the thresholds that make the CCPA apply: we are far below its revenue floor, we handle nowhere near 100,000 consumers, and we earn nothing from selling or sharing personal information. We state this plainly rather than claim a compliance we are not subject to. The rights above are available to you regardless. We have never sold or shared personal information, and we do not.

13. Children

This site is aimed at businesses. We do not knowingly collect personal information from anyone under 14, the age at which Québec law treats a minor's own consent as capable of standing alone.

14. Changes

If this policy changes materially, the updated version appears here with a new date, and anything that would meaningfully change how we treat information already collected will be brought to your attention rather than quietly replaced.

15. Contact

Mohamed Farah, privacy officer · MOH Managed · Pointe-Claire, Québec · contact@mohmanaged.ca

This policy describes actual practice. It is written from published legal requirements and is not legal advice.