Bill 25 Disclosure
Last updated July 26th 2026 · Transparency statement
This page explains, in plain language, how NESTOR LOGIC approaches Québec's Law 25 (Bill 25) — in how we run our own business, and in how the platform helps our clients strengthen their position. It is a transparency statement, not legal advice.
What Law 25 changed
Law 25 modernized Québec's private-sector privacy law. It strengthened the standard for consent, requires every organization to designate a person responsible for protecting personal information, added obligations around confidentiality incidents, gave individuals rights including access, correction and portability, and requires an assessment before personal information is handled outside Québec.
What the platform does — and what it doesn't
NESTOR LOGIC supports privacy and compliance work in three concrete ways: it keeps the business owner's approval in the loop before anything is published, it maintains an immutable record of what was changed, when, and who approved it, and it surfaces likely issues for the owner's review.
What we do not claim
Using NESTOR LOGIC helps you reduce exposure and build a documented, good-faith record. It does not guarantee compliance, does not promise you will avoid fines or complaints, and does not make a business "audit-proof." Compliance depends on your own practices and on advice from your own counsel.
Where data is held
Client data on the platform is hosted on our Montréal-based infrastructure. That is a deliberate choice, and it is worth being precise about why.
Law 25 is not a localization law
Law 25 does not require personal information to stay in Québec. It permits information to be handled elsewhere once a proper assessment of privacy-related factors has been carried out. Hosting in Québec is intended to remove that assessment burden — not to satisfy a localization requirement that does not exist.
Person responsible for privacy
Our Privacy Officer is responsible for the protection of personal information at NESTOR LOGIC and can be reached at privacy@nestorlogic.ai.
Confidentiality incidents
We maintain a process to identify, record and respond to confidentiality incidents. Where an incident presents a risk of serious injury, we notify the Commission d'accès à l'information and the people affected, and we keep a register of incidents.
Automated processing and the scanner
Our compliance scanner produces assessments about websites — it does not make automated decisions about individuals. Its scope and limits are set out in the Scanner Terms & Limitations.
Consent and individual rights
We seek consent that is clear and informed, and we support the rights Law 25 gives individuals. Our Canadian Privacy Policy sets out the detail and how to make a request.
Contact and oversight
Reach us at hello@nestorlogic.ai. You may also contact the Commission d'accès à l'information du Québec, which oversees Law 25.