Privacy Policy

Rum&Code

Last updated: 28 September 2026

At Rum&Code, the trust of our clients and partners is central to what we do. Rum&Code (rumandcode.io (opens in a new tab)) is a custom software design and development firm based in Shawinigan, Québec, Canada, specialising in web and mobile applications.

This policy applies to the personal information of any individual we deal with — clients, visitors to this website, and supplier and partner contacts. It does not apply to the personal information of our employees and job applicants, which is covered by a separate policy.

We handle your personal information with care, transparency and respect. Because we are established in Québec, we are subject to the Act respecting the protection of personal information in the private sector (“Law 25”). Because this website is directed at visitors in the United Kingdom, we also comply with the UK General Data Protection Regulation (“UK GDPR”) and the Privacy and Electronic Communications Regulations (“PECR”) in respect of those visitors. Where the two frameworks differ, we apply the one that gives you the greater protection.

When we deal with you in a professional context, your business contact details (name, job title, work email address and work telephone number) are generally not treated as personal information under Law 25. Under the UK GDPR, information that identifies you as an individual is personal data regardless of the context in which we obtained it, and this policy applies to it.

In the course of our engagements we may collect and process personal information about you, or about our clients’ own customers, suppliers or partners, solely for the purposes necessary to deliver our services. Where Rum&Code acts as a service provider on behalf of a client — a “processor” under the UK GDPR — we process that information only on the documented instructions agreed in the engagement, and make no other use of it.

What information do we collect?

Information you give us

When you contact us through the contact form, or in the course of our services, we may collect:

• Your first and last name, or the name of your organisation
• Your postal address
• Your email address
• Your telephone number
• Any other information you choose to share with us

Information collected automatically

When you browse this website, certain technical data is collected automatically, including:

• Your device’s IP address (which may constitute personal data depending on the context)
• The browser type and operating system you are using
• The pages you visit, how long you stay, and the date and time of your visit

This data is used only to improve the website, to analyse how it is used, and to keep it running properly.

Why do we collect your information?

We collect only the information necessary for the following purposes:

Cookies

This website uses cookies — small files stored on your device. We group them into three categories, which match exactly the categories shown on our cookie banner:

• Strictly necessary cookies. Required for the website to work and to remember the choice you make on the cookie banner. They store no personally identifiable information, cannot be switched off, and are exempt from consent under PECR.
• Analytics cookies. These tell us how the site is used — how many visitors arrive, where they come from, which pages they read and where they leave — so that we can improve it. They are set only with your prior consent, and are never used to show you advertising.
• Marketing cookies. Set by Google advertising services. They build a profile of your interests so that the advertising you see, on this site and elsewhere, is relevant to you, and they measure how that advertising performs. They are set only with your prior consent.

On your first visit, a banner lets you accept all cookies, reject all non-essential cookies, or choose category by category. Rejecting a category never restricts what you can do on this site.

Your choice is stored in a cookie named cc_cookie, on your device only, for six months. After that we will ask you again. You can change or withdraw your consent at any time — it is as easy to withdraw as it was to give — using the Cookie settings link in the footer of every page. When you withdraw consent for a category, the cookies set under it are deleted from your device. You can also configure your browser to refuse cookies.

The cookie banner lists every cookie we use in each category, together with the domain that sets it and how long it lasts.

Do we share your information?

Rum&Code does not sell or rent your personal information.

In some cases we use third-party service providers who may process certain data under their own privacy policies. These include:

• Web analytics tools (for example, Google Analytics)
• Cloud hosting platforms (for example, AWS, Azure, OVH)
• Customer relationship management (CRM) and email tools (for example, HubSpot)

We satisfy ourselves that these providers offer adequate data protection safeguards.

International transfers

Rum&Code is established in Canada, so personal information collected through this website is stored in Québec and elsewhere in Canada. Some of the providers listed above may process or store information outside Canada, including in the United States.

Where personal data is transferred out of the United Kingdom, we rely on an approved transfer mechanism and put appropriate safeguards in place to ensure your data receives a level of protection essentially equivalent to that guaranteed by the UK GDPR. Before any transfer of personal information outside Québec, Rum&Code also carries out a privacy impact assessment to confirm that the information will receive protection equivalent to that required by Québec law (s. 17, Law 25).

Other disclosures

Your information may also be disclosed where the law requires it — for example, in response to a court order or a request from a government body.

How long do we keep your information?

We keep your personal information for as long as necessary for the purposes for which it was collected. Data relating to our engagements and contractual obligations is kept for the retention periods required by law, according to its nature.

How do we protect your information?

The security of your data is a priority. Rum&Code applies physical and technological measures to protect your information against unauthorised access, loss and disclosure.

Your personal information is stored in Québec and Canada, except for the transfers described under International transfers above. Only those members of our team who need it in order to do their jobs can access it.

We should point out that no transmission of data over the internet can be guaranteed to be entirely secure.

Your rights

You can exercise the following rights over the personal information we hold about you, at any time:

• Access — obtain a copy of the personal information we hold about you.
• Rectification — ask us to correct it if it is inaccurate or incomplete.
• Erasure — ask us to delete it, subject to our legal obligations.
• Withdrawal of consent — withdraw your consent to its collection or use, at any time, without affecting the lawfulness of what we did before you withdrew it.
• Portability — receive, in a structured and commonly used technological format, the personal information you provided to us by automated means under a contract or with your consent, or ask us to transmit it directly to another organisation.
• Restriction and objection (UK GDPR) — ask us to restrict how we use your information, or object to our using it on the basis of legitimate interests.
• De-indexing (Law 25) — ask us to stop disseminating your information, or to remove any hyperlink attached to your name, where doing so causes you harm or breaches the law.

Send your request in writing to our Privacy Officer, whose details are below. We will respond within one month of receiving it. That period may be extended by a further month where the complexity or volume of your request justifies it; we will tell you in writing before the original period expires.

If we refuse your request, in whole or in part, we will tell you in writing, explain why, and set out the remedies available to you.

How to complain

If you are not satisfied with how we have handled your request, you can complain to the relevant supervisory authority.

If you are in the United Kingdom, you can complain to the Information Commissioner’s Office (ICO): ico.org.uk (opens in a new tab)

If you are in Québec, you can complain to the Commission d’accès à l’information du Québec: cai.gouv.qc.ca (opens in a new tab)

Privacy Officer

For any question, request or concern about your personal information or about this policy, please contact:

Privacy incidents

In the event of a privacy incident — unauthorised access to, loss of, or disclosure of personal information — Rum&Code takes immediate steps to limit its consequences and records the incident in a register, as required by Law 25.

Where an incident presents a risk of serious harm to the individuals concerned, we notify them and the Commission d’accès à l’information as soon as possible. Where the UK GDPR applies, we notify the Information Commissioner’s Office within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to your rights and freedoms.

Changes to this policy

We may update this policy at any time. The version in force is always available on this website. We encourage you to review it from time to time.

Request or complaint form

To exercise your rights or submit a complaint, please use our online form:

Privacy Policy — request or complaint form (opens in a new tab)