Privacy Policy
StaffMTL — Last updated: May 19, 2026
LANGUAGE NOTE — In accordance with the Charter of the French Language, the French version of this Privacy Policy is the official version. This English version is provided as a courtesy translation. In the event of any inconsistency, the French version prevails.
This Privacy Policy explains how Groupe MBH inc. (the “Company,” “we,” or “StaffMTL”) collects, uses, discloses, and retains personal information of users of the Site staffmtl.ca and the Services offered thereon. It complies with Quebec’s Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) (“Law 25”) and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
1. Privacy Officer
In accordance with Law 25, the Company has designated a Privacy Officer (“Responsable de la protection des renseignements personnels”) responsible for ensuring compliance with this policy and the protection of personal information:
Bartek Kostrz
Title: Privacy Officer
Address: 14 rue de la Falaise
Email: info@staffmtl.ca
Phone: 514-999-6908
Any question, complaint, or request concerning your personal information must be addressed to this person.
2. Personal Information We Collect
We collect personal information strictly necessary for the purposes set out in Section 3. The categories of information collected include:
2.1 Information provided directly
- Identification: first name, last name, position within the establishment;
- Contact details: email address, phone number, establishment address;
- Establishment information: trade name, type of establishment, Quebec business number (NEQ) where applicable;
- Content: text of publications, uploaded images (which may contain personal information);
- Application: if you apply to a job offer through the platform, your name, email address, résumé (CV), and any message you attach. A CV may contain sensitive personal information;
- Profile and messaging: if you create a job-seeker account, the CV you save in your profile (reused to apply) and the messages you exchange with a recruiter through the platform’s internal messaging;
- Communications: emails, messages, and support requests you send us.
2.2 Payment information
Payments are processed by Stripe Inc. We do not store complete credit card numbers. We retain only: (a) the amount paid, (b) the transaction date, (c) the Stripe transaction ID, (d) the last four digits of the card, and (e) the billing information required for tax purposes.
2.3 Information collected automatically
- IP address, browser type, operating system, device identifiers;
- Dates and times of access, pages viewed, session durations;
- Cookies and similar technologies, in accordance with Section 9.
3. Purposes of Collection
We collect and use your personal information for the following purposes:
- Creating and managing your account;
- Providing the Services, in particular publishing your Content;
- Processing job applications and, by means of automated analysis (artificial intelligence), producing a fit score between the CV and the offer’s requirements, to help the recruiter triage applications (the CV is transmitted to our processor Anthropic for this purpose, see sections 5 and 6);
- Processing your payments and issuing invoices compliant with tax requirements;
- Communicating with you (confirmations, service notices, support);
- Ensuring the security of the Site and preventing fraud;
- Complying with our legal, accounting, and tax obligations;
- Improving our Services and producing aggregated, anonymized statistics;
- Sending you, with your consent, commercial electronic communications in compliance with Canada’s Anti-Spam Legislation (CASL).
4. Consent
The Company collects your personal information with your consent, express or implied depending on the nature of the information and reasonable expectations of sensitivity. By creating an account or using the Services, you consent to the collection and use described in this policy.
You may withdraw your consent at any time by contacting the Privacy Officer. Withdrawal of consent may make certain Services unavailable. Withdrawal does not apply to information the Company is required to retain by law (see Section 8).
5. Disclosure to Third Parties
Your personal information may be disclosed to the following third parties, strictly for the purpose of providing the Services:
| Third party | Purpose | Country |
| Stripe Inc. | Payment processing | United States / Canada |
| Meta Platforms Inc. (Facebook) | Publication of Content in the Facebook group (Content, which may contain personal information you voluntarily include therein, will be publicly visible) | United States |
| Anthropic PBC | Automated translation of listing content (on request, optional) and, when you apply to an offer, fit analysis of your CV against the offer’s requirements — your CV is transmitted to Anthropic for this analysis | United States |
| Resend (Resend, Inc.) | Sending transactional emails | United States |
| Vercel Inc. | Site hosting and server function execution | United States |
| Supabase (Supabase, Inc.) | Database and file storage (accounts, listings, documents) | United States |
| Professional advisors | Accounting, tax, legal | Canada |
| Public authorities | When required by law (e.g., Revenu Québec, CRA, court order) | Canada |
The Company does not sell or rent your personal information to third parties for marketing purposes.
6. Disclosure Outside Quebec
Certain of your personal information is disclosed outside Quebec, notably to the United States (Stripe, Meta, Resend, Vercel, Supabase, Anthropic). In accordance with section 17 of Law 25, the Company:
- has carried out a Privacy Impact Assessment (“PIA”) for each transfer outside Quebec;
- ensures the information benefits from adequate protection in the recipient country through contractual, technical, and organizational measures;
- hereby informs you that your information may be disclosed outside Quebec.
You may contact the Privacy Officer to obtain further information about the PIAs carried out.
7. Automated Decisions
To date, the Company does not use your personal information to make decisions based exclusively on automated processing that would produce legal effects concerning you or significantly affect you, within the meaning of section 12.1 of Law 25. If such use were to be implemented, you would be informed and would have the right to obtain explanations and submit observations.
The artificial-intelligence fit score produced for job applications (section 3) is a triage aid for the recruiter: it does not automatically select or reject any application. The decision regarding an application remains entirely human and rests with the recruiter.
8. Retention of Personal Information
We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, subject to legal obligations:
| Category of information | Retention period |
| Profile information (name, email, phone) | Duration of the account + 12 months after inactivity or deletion request |
| Published Content (text, images) | Duration of the account + 12 months (anonymized after account deletion) |
| Payment information and tax records (invoices, receipts, GST/QST records) | Six (6) years from the end of the last fiscal year, in accordance with the Income Tax Act, the Excise Tax Act, and the Tax Administration Act (Quebec) |
| Security logs and technical files | 12 months maximum |
| Customer service communications | 24 months |
At the end of the applicable retention period, personal information is irreversibly destroyed or anonymized. When account deletion is requested, profile personal information is immediately deleted or anonymized; tax and accounting records are retained in a limited form, accessible only for tax compliance purposes, until the legal retention period expires.
9. Cookies and Similar Technologies
The Site uses cookies and similar technologies for the following purposes:
- Essential cookies: required for the operation of the Site (authentication, cart, security);
- Analytics cookies: to understand Site usage (aggregated data);
- Functional cookies: to remember your preferences (language, session choices).
You can configure your browser to refuse cookies. Disabling essential cookies may prevent the use of certain features.
10. Security
The Company implements reasonable physical, technical, and organizational security measures to protect your personal information against loss, unauthorized access, disclosure, alteration, or destruction. These measures include:
- Encryption of communications (HTTPS/TLS);
- Encryption of sensitive data at rest;
- Access controls based on the principle of least privilege;
- Passwords stored in hashed form;
- Access logging and periodic audits;
- Regular backups.
Despite these measures, no Internet transmission or storage system can be guaranteed 100% secure.
11. Confidentiality Incident
In the event of a confidentiality incident presenting a risk of serious injury, the Company will: (i) take reasonable measures to limit its consequences; (ii) promptly notify the Commission d’accès à l’information du Québec (CAI); (iii) notify affected individuals in accordance with Law 25; and (iv) maintain an incident register.
12. Your Rights
Subject to the exceptions provided by law, you have the following rights:
12.1 Right of access
You may request to consult the personal information we hold about you.
12.2 Right of rectification
You may request correction of inaccurate, incomplete, or ambiguous information.
12.3 Right to portability
Since September 22, 2024, you may request to receive, in a structured and commonly used technological format, the computerized information you have provided to us.
12.4 Right to withdraw consent
You may withdraw your consent to the collection, use, or disclosure of your information, subject to legal restrictions.
12.5 Right to deletion (de-indexing and cessation of dissemination)
You may request the cessation of dissemination of personal information concerning you, or the de-indexing of any hyperlink giving access thereto, when the conditions of section 28.1 of Law 25 are met.
12.6 How to exercise these rights
To exercise these rights, send a written request to the Privacy Officer (contact information in Section 1). We will respond within thirty (30) days, in accordance with the law. Reasonable proof of identity may be required.
12.7 Recourse to the CAI
If you are not satisfied with our response, you may file a complaint with the Commission d’accès à l’information du Québec: www.cai.gouv.qc.ca.
13. Minors
The Services are intended for commercial establishments and are not aimed at persons under 14 years of age. The Company does not knowingly collect personal information from children. If you believe a child has provided us with information, please contact the Privacy Officer.
14. Changes to This Policy
The Company may modify this Privacy Policy from time to time. The current version is always accessible on the Site. In case of material changes, you will be notified by a reasonable means (in particular by email or a notice posted on the Site).
15. Language
This Privacy Policy is drafted in French and English. The French version is the official version. In the event of any inconsistency, the French version prevails, in accordance with the Charter of the French Language.
16. Contact
For any question, request, or complaint regarding this policy:
Groupe MBH inc.
Attn: Privacy Officer
14 rue de la Falaise
Blainville, Quebec, J7B 1X6
Email: info@staffmtl.ca