Last updated: March 2026
Quartier Royalmount Limited Partnership (“Carbonleo”, “we”, “us” or “our”) are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our websites, interact with us online or in person, use our complimentary Wi-Fi, or participate in our programs and events. It also informs you of your rights regarding your personal information.
1. What is personal information?
Personal information means any information that can directly or indirectly identify a person. This includes, without limitation, your name, contact details, financial and billing information, geolocation data, and information about your interactions with our websites or properties.
2. What information do we collect and why?
We may collect personal information directly from you, automatically through technologies such as cookies or Wi-Fi, or indirectly from third parties such as tenants, business partners, or service providers who interact with you on our behalf, always in compliance with applicable privacy laws.
We collect only the personal information that is necessary to fulfill the purposes identified at the time of collection.
Category
What we collect
Why we collect it
Contact and identification information
Name, address, phone number, email address
To communicate with you, provide services, respond to inquiries, deliver newsletters, and send you updates about our activities (with your consent).
Payment and transaction information
Payment method, credit card number, billing address, purchase details
To process payments, verify transactions, issue refunds, prevent fraud, and manage billing.
Membership and marketing information
Preferences, consent status, communication choices
To personalize your experience, manage subscriptions, and send promotional offers (with your consent).
Wi-Fi and geolocation data
IP address, device ID, location data collected via our Wi-Fi network or mobile apps
To provide Wi-Fi access, analyze traffic flow within our properties, and improve visitor experience.
Online browsing data
Pages visited, search queries, links clicked, cookies, and pixels
To analyze website use, enhance functionality, and adapt content and advertising to your preferences.
Gift card information
Gift card number, registration information, associated personal details
To issue, register, and process gift cards and to fulfill related customer service requests.
Career-related information
CV, cover letter, job title, employment history, references
To evaluate job applications and manage recruitment.
Security and surveillance data
Images, video recordings, observable movements, and metadata, such as date and time, relating to individuals present in monitored areas of our properties. No biometric recognition systems are used.
To ensure the safety and security of our visitors, tenants, and employees; protect our assets; prevent and investigate incidents, theft, or misconduct; and support internal or legal investigations when necessary.
Parking and vehicle information
License plate number, parking timestamps (entry/exit), permit or reservation ID, information collected through automated license plate readers (ANPR/LPR)
To manage access to parking facilities, verify parking permissions, facilitate entry and exit, enforce parking rules, prevent fraud, ensure the safety and security of our premises, and improve operational efficiency.
Analytics and third-party technologies
Information collected through tools such as Google Analytics, Apple Analytics, Mixpanel, Meta Pixel or other similar technologies. This may include: device identifiers, browser type, session data, interactions with our websites or apps, approximate geolocation, and preferences inferred from your browsing behaviour.
To understand how users interact with our websites, improve functionality and performance, measure the effectiveness of our marketing campaigns, and personalize content based on user preferences (with your consent where required by law).
Rewards program and proof-of-purchase submissions
Information voluntarily submitted by you to validate eligibility for a promotion or reward, such as images or scans of purchase receipts. These may include: store name, date of purchase, items purchased, amounts, and any information visible on the receipt.
To verify your participation, validate purchases, issue rewards, prevent fraud, and manage promotional campaigns. We obtain your express consent before collecting and processing this information.
3. How do we obtain your consent?
When you provide us with personal information, you consent to its collection, use, and disclosure for the purposes described in this Privacy Policy. In certain situations where the law requires a more specific form of consent, we will clearly explain the purpose and request your express consent.
You may withdraw your consent at any time by contacting us. However, doing so may limit your ability to access some of our services.
If we intend to use your personal information for a new purpose not previously identified, we will inform you and request your consent again, unless the law allows us to proceed without it.
We may use certain technologies to improve your browsing experience or personalize content. When these technologies require your prior consent, we will request it in a clear and transparent manner.
4. Do we use automated technologies?
We use cookies and similar technologies to improve your browsing experience and enhance our digital services. When required by law, we will request your consent before using technologies that involve personalization, profiling, or targeted advertising. You may manage your cookie preferences through your browser settings, but some features may not function properly if cookies are disabled.
We do not use personal information to make decisions based exclusively on automated processing, including profiling, that produce legal effects concerning individuals or that significantly affect them. If such systems are introduced in the future, we will provide clear notice and obtain your consent where required by law.
When consent is required for specific activities, we will inform you of the purpose and provide you with the option to withdraw your consent at any time.
5. To whom do we communicate your personal information?
We share your personal information only as necessary to fulfill legitimate business or legal purposes. These third parties are required to protect your personal information and use it only for the purposes for which it was shared.
Category
Purpose / Role
Service providers
Hosting, data storage, IT maintenance, marketing, communications, and payment processing.
Marketing and advertising partners
To conduct analytics, personalize content, and deliver relevant promotional messages.
E-commerce and retail operations
To manage online orders, track product inventory, and ensure efficient operation of our digital platforms.
Payment services
To authorize, process, and secure payment transactions.
Gift card and loyalty program providers
To issue, register, and manage gift card-related services and customer benefits.
Business partners and event collaborators
To manage co-branded promotions, contests, or events.
Legal and regulatory authorities
To comply with legal obligations, respond to lawful requests, or protect our legal rights.
Affiliated entities
To operate shared systems, coordinate marketing, and ensure consistent experiences across our brands.
Transaction-related parties
In the event of a merger, acquisition, financing, or sale of business assets.
Rewards program processors
To validate receipt submissions, verify eligibility, prevent fraud, and administer promotions or loyalty initiatives (where applicable, with your consent).
When personal information is transferred outside Quebec, we ensure equivalent protection through contractual clauses and technical safeguards, in compliance with applicable privacy laws.
6. How do we protect your personal information?
We use a combination of administrative, technical, and physical safeguards to prevent unauthorized access, loss, theft, or misuse of your personal information, in accordance with the sensitivity of the personal information involved. These measures include secure servers, encryption, access controls, and regular staff training.
In the event of a privacy incident that poses a risk of serious harm, we will notify the Commission d’accès à l’information du Québec and affected individuals, as required by law. We also maintain an internal confidentiality incident register documenting all incidents involving personal information, whether or not they pose a risk of serious harm. This register is reviewed periodically and may be shared with the Commission d’accès à l’information upon request.
Our safeguards include, among other things:
encrypted connections (SSL/TLS) and secure servers;
strict access controls and authentication measures (including multi-factor authentication, where feasible);
restricted access to data based on business needs;
employee confidentiality agreements and mandatory privacy training;
secure data destruction procedures at the end of the retention period.
We regularly test and update our systems to maintain high security standards and prevent unauthorized access.
Protecting your information is a shared responsibility. We encourage users to take appropriate steps to secure their devices and passwords, avoid sharing login information, and promptly report any suspected misuse of their accounts or personal information.
7. Where do we store your personal information?
Your personal information is primarily stored in Quebec. However, it may be accessible from outside Quebec by certain service providers. Before disclosing personal information outside Quebec, we conduct an assessment to ensure that it will receive adequate protection in accordance with applicable legal requirements.
8. How long do we retain your personal information?
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected and to comply with applicable legal requirements.
Once these purposes have been achieved, personal information is securely destroyed or anonymized in accordance with our internal governance practices.
We periodically review the personal information we hold to ensure it is accurate, up to date, and retained only for the appropriate period.
Information collected in connection with promotional or rewards programs (such as receipts or proof of purchase) is retained only for the time required to administer the program, validate eligibility, and prevent fraud, after which it is securely destroyed or anonymized.
Additional information regarding our privacy practices may be obtained by contacting our Privacy Officer.
9. What are your rights regarding your personal information?
You have several rights regarding your personal information. The table below summarizes these rights and how you can exercise them.
Right
What it means
How to exercise it
Access
You can request a copy of the personal information we hold about you.
Contact our Privacy Officer using the contact details below.
Correction
You can ask us to correct or complete inaccurate, incomplete, or outdated information.
Provide documentation supporting your correction request.
Withdrawal of consent
You can withdraw your consent for the use or disclosure of your personal information, where applicable.
Submit a written request to our Privacy Officer. Some uses may still be required by law.
Deletion /
De-indexation / Anonymization
You can request that your personal information be deleted or anonymized when no longer necessary.
Contact our Privacy Officer with a justification.
Portability
You can request that your personal information be provided in a structured, commonly used format where permitted by law.
Submit a request specifying the data you wish to receive.
Information about automated decision-making
You can request details about any automated processes that may affect you.
Contact our Privacy Officer for clarification.
You also have the right to be informed when your personal information is used to make a decision based exclusively on automated processing, and to submit observations concerning that decision before it is finalized. We will respond to all written requests regarding your personal information within 30 days of receipt, as required by Quebec privacy law. If additional time is needed, we will inform you of the reason and the expected timeline for our response.
10. External links
Our websites may contain links to external sites. We are not responsible for how your personal information is collected, used, or protected by third-party websites over which we have no control.
11. Children’s privacy
Our services are not directed to children under 14 years of age, and we do not knowingly collect personal information from individuals under that age. If we become aware that personal information has been collected from a child under 14 without the consent of a parent or guardian, we will delete that information promptly and take steps to prevent any further collection. If you believe that a child under 14 has provided us with personal information, please contact us immediately.
12. Updates to this Privacy Policy
We may revise this Policy to reflect changes in our practices or legal requirements. The latest version will always be available on our website, with the revision date clearly indicated. Continued use of our services constitutes acceptance of the updated Policy. Any significant changes to how we handle personal information will be preceded by a clear notice on our website and, when appropriate, direct notification to affected individuals.
13. How to contact us
In accordance with Quebec’s Act respecting the protection of personal information in the private sector, the Vice President, Legal Affairs at Carbonleo Real Estate Inc. acts as the person in charge of the protection of personal information (Privacy Officer).
Privacy Officer
Jessica-Lauren Vieira
Vice President, Legal Affairs
Carbonleo Real Estate Inc.
8500 Décarie Boulevard, 8th Floor
Mount Royal, Quebec, H4P 2N2
Canada
Email: servicejuridique@carbonleo.com
14. Governing law
This Privacy Policy is governed by the laws of the Province of Quebec and the applicable laws of Canada. Any dispute shall be submitted to the courts of the judicial district of Montreal, Province of Quebec.
15. Governance of Personal Information
We have implemented policies and practices to ensure the protection of personal information and compliance with Quebec’s Law 25. These measures outline:
the responsibilities of the Privacy Officer;
the procedures for receiving and responding to requests for access or correction; and
our practices relating to the retention and destruction of personal information.
A summary of these governance practices is available upon request.
Note: A French version of this Policy is also available.