About

Trust center

Data Next Step is committed to protecting the privacy of all individuals whose personal information we collect and process in the course of our operations.

Compliance

ISO 27001 · SOC 2

These controls are reviewed and tested as part of our ISMS and Law 25 privacy governance program.

Read our Privacy Policy

How we protect your data

DNS applies administrative, technical, and physical safeguards to protect personal information, including:

Encryption in transit and at rest

Role-based access controls and least-privilege principles

Multi-factor authentication

Regular vulnerability and risk assessments

Secure data-handling and disposal procedures

Privacy by design — privacy requirements are integrated into the development and procurement of systems and processes from the outset, in accordance with Law 25

Data stored in Canada

Data Next Step primarily stores data in Canada. Before any transfer of personal information outside Quebec, DNS conducts a Privacy Impact Assessment (PIA).

A person accountable for your data

We have designated a person responsible for the protection of personal information (PRP), who also serves as Data Protection Officer (DPO).

Incident response

In the event of a privacy or security incident, DNS follows its Incident Response Plan and, where required by Law 25, notifies the Commission d’accès à l’information du Québec (CAI) and affected individuals.

Retention and destruction

Personal information is retained only as long as necessary or as required by law. Once no longer needed, data is securely deleted or anonymized.

Your rights

Under Law 25 and applicable privacy laws, you have the following rights:

Right of access — to know whether we hold personal data about you and obtain a copy.
Right to rectification — to correct inaccurate or incomplete information.
Right to withdraw consent — to stop processing where consent is the legal basis.
Right to data portability — to receive your data in a structured format, when applicable.
Right to deletion (erasure) — to request deletion of your data where retention is no longer justified.
Right to be informed of automated decision-making, if applicable.
Right to file a complaint — you may file a complaint with the Commission d’acces a l’information du Quebec (CAI) at www.cai.gouv.qc.ca if you believe your privacy rights have not been respected.

We will respond to all requests within 30 days of receiving the information required to process them, in accordance with applicable law.

Questions about your data?

If you have questions or wish to exercise your privacy rights, please contact:

Data Protection Officer · security@datanextstep.com