Privacy Policy

Last updated: June 4, 2026

1. Who we are — privacy officer

ObjectifCyber is a free cybersecurity training platform, available in French and English at objectifcyber.ca. The site is a static website hosted on Cloudflare Pages.

Privacy Officer (under Quebec's Law 25):
Privacy Officer, ObjectifCyber
Email: privacy@objectifcyber.ca
This officer responds to any access, correction or deletion request within 30 days.

2. Data we collect

ObjectifCyber does not collect any personal information without your consent. Specifically:

• No user account is required or created
• No sign-up form exists on the site (except the optional contact forms)
• No name, email or identifier is requested to access the training modules
• An audience-measurement tool (Google Analytics) is used only if you explicitly accept it — see section 4

3. Local storage (localStorage)

Your progress through the 15 modules, your quiz results and your preferences (language, font size) are saved in your browser's local storage (localStorage). This data:

• Stays only on your device
• Is never transmitted to our servers or to any third party
• Can be deleted at any time via your browser settings (Settings → Privacy → Clear browsing data)
• Is lost if you switch browsers or use private/incognito mode

localStorage keys used by ObjectifCyber: objectifcyber_progress, objectifcyber_lang, objectifcyber_fontsize, objectifcyber_quiz_*, objectifcyber_final.

4. Cookies and audience measurement

ObjectifCyber uses no advertising cookies and sets no analytics cookie without your explicit consent.

Audience measurement — Google Analytics (with your consent only)

To understand which pages are most useful and improve the training, we use Google Analytics 4 — only after you agree, via the consent banner:

• Before your choice, or if you refuse: no Google script is loaded, no cookie is set, no data is transmitted
• If you accept: Google Analytics sets cookies (_ga, _ga_*) and collects aggregated navigation statistics (page views, referrer, device type), with IP anonymization
• This data is processed by Google LLC and may be hosted outside Quebec and Canada (United States)
• Your choice is remembered on your device for 6 months and is never shared with a third party
• Withdrawing consent: at any time via the "Manage my cookies" link at the bottom of every page — refusing is exactly as easy as accepting

Google's privacy policy: policies.google.com/privacy

Technical cookies may be set automatically by Cloudflare (our host) for performance and network security purposes (DDoS protection, load balancing). These cookies are strictly technical and do not allow personal identification.

These cookies are not always present — they appear only when Cloudflare detects unusual traffic. For more information: Cloudflare privacy policy.

5. Contact forms

The site offers an optional contact form (page /en/contact/) and a newsletter sign-up. When you use them:

• The data you enter (name, email, message) is relayed by Web3Forms (web3forms.com), our form provider, which forwards it to us by email
• Web3Forms does not store message content in a database
• This information is used only to respond to your request and is never sold or shared
• Web3Forms privacy policy: web3forms.com/privacy

You can also reach us directly: contact@objectifcyber.ca. Using the forms is entirely optional.

6. Third-party services

Operating ObjectifCyber involves the following third-party services:

• Cloudflare Pages (hosting) — may collect connection metadata (IP, user-agent) for network security purposes. See Cloudflare's policy.
• Google Analytics 4 (audience measurement, consent-only) — aggregated traffic statistics, anonymized IPs. See section 4. Google's policy.
• Web fonts — Plus Jakarta Sans and Fira Code are hosted directly on our servers (/assets/fonts/, .woff2 files). No calls are made to Google Fonts or any other external CDN.

7. Compliance with Quebec's Law 25 and Canada's PIPEDA

ObjectifCyber was designed to comply with Quebec's Act to modernize legislative provisions as regards the protection of personal information (Law 25) and Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA).

Principles we follow:

• Minimization: we collect only what is strictly necessary (no data without an active contact form submission)
• Consent: use of the contact forms and analytics is voluntary and clearly presented
• Transparency: this policy fully describes our practices
• Security: the site is served exclusively over HTTPS with recommended security headers

See our Law 25 compliance guide for details on the law itself.

8. Your rights

Under Law 25 and PIPEDA, you have the following rights:

• Access: ask what data we hold about you
• Correction: have inaccurate information corrected
• Deletion: request deletion of your data
• Portability: receive your data in a structured format

Since ObjectifCyber stores no personal data on its own servers, these rights apply mainly to data submitted through our contact forms. To exercise these rights: contact@objectifcyber.ca

If your request goes unanswered, you may contact Quebec's Commission d'accès à l'information: cai.gouv.qc.ca

9. Changes to this policy

We may update this policy to reflect changes in our practices or in response to legal requirements. The last-updated date appears at the top of this page. We will clearly flag any significant change.