Privacy Policy

Effective November 2, 2026. In case of discrepancy, the French version prevails.

1. Who is responsible for your information

2AF Inc. (“2AF”, “we”) is responsible for the personal information collected on this site (2af.ca), by Eliora and through its services: recruitment, information technology and cybersecurity, artificial intelligence agents.

The person in charge of the protection of personal information is the General Management of 2AF Inc. You can reach them at info@2af.ca or by mail at 2828, boulevard Laurier, bureau 700, Québec (Québec) G1V 0B9.

2. What this policy covers

This policy applies to the 2af.ca website (in French and English), to Eliora on WhatsApp, Messenger and Instagram, to the newsletter (for job seekers and employers), the contact form and meeting booking. It applies to all activities of 2AF Inc.; the recruitment site recru2af.com has its own policy, which details what concerns candidates, applications and Alex. It does not apply to third-party sites we link to.

3. The information we collect

Situation	Information	Purposes
You browse the site	IP address, device and browser type, pages viewed, cookies (section 5)	Run and secure the site; measure audience with your consent
You fill in the contact form	First name, last name, email, phone, subject and message	Answer your request and, if you are a business, offer our services
You book a meeting	Name, email, chosen time and notes you add (Calendly)	Organize and hold the meeting
You subscribe to the newsletter	Email, language	Send you the newsletter you asked for
You write to Eliora on WhatsApp, Messenger or Instagram	WhatsApp number and profile name, or an identifier specific to our page on Messenger and Instagram; messages; if you provide them: name, company, email, description of your need	Answer your questions and forward your request to the team (section 6)
You are a client or supplier	Business contact details of contact persons, information needed for the engagement	Perform the contract, invoice, meet our legal obligations

We collect this information from you. We only collect what is necessary for the stated purposes. Do not send us sensitive information we do not need (social insurance number, health, banking details, etc.).

4. Your consent

We use your information with your consent, given clearly and for specific purposes: by filling in a form, subscribing, agreeing to talk with Eliora or choosing your cookies. We ask for new consent before using your information for another purpose, except where the law allows otherwise (for example, a court order).

You may withdraw your consent at any time: unsubscribe link, “STOP” in the conversation with Eliora, or a request to info@2af.ca. If you give us another person's information (for example a colleague's), you confirm you have their permission.

5. Cookies, audience measurement and advertising

Cookies strictly necessary for the site to work (security, language, remembering your choices) are always active. All others are off by default: nothing is set or sent to these services until you give your consent. On your first visit, a banner managed by our consent tool, Axeptio, lets you refuse all, accept all, or choose service by service.

• Audience measurement (Google Analytics): site traffic statistics. Google Analytics is loaded only after you consent; if you refuse, no data is sent to Google.
• Map (Google Maps): the map on the Contact page is shown only with your consent or if you click “Show the map”, because Google then sets its own cookies.
• Advertising (Meta pixel, from Meta Platforms): only if you accept it in the banner. The pixel tells us, for example, that someone who came from one of our Facebook or Instagram ads viewed a page or contacted us. Meta processes this data under its own privacy policy and may process it outside Quebec.

Your choice and its date are kept as proof of consent. You can change or withdraw it at any time with the “Manage cookies” link at the bottom of every page.

6. Eliora, our virtual assistant on WhatsApp, Messenger and Instagram

Eliora is 2AF Inc.'s virtual assistant on our official WhatsApp account and in the private messages of our Facebook (Messenger) and Instagram pages. She answers questions about our services using artificial intelligence, can suggest a meeting and forwards requests to our team.

• Before any processing: at the first message, Eliora informs you and asks for your agreement with a button. No message is analyzed before you agree.
• Information processed: your WhatsApp number and profile name (or, on Messenger and Instagram, the identifier Meta assigns to your conversation with our page, without your number), your messages and, if you choose to provide them, your name, company name, email and description of your need. Social insurance and card numbers written in a message are masked.
• AI service: messages are analyzed by an artificial intelligence provider located in the United States, acting on our behalf, which may not use your information for its own purposes. Messages pass through WhatsApp, Messenger or Instagram (Meta), which applies its own privacy policy.
• Retention: the conversation and related information are stored encrypted, then deleted automatically 90 days after your last message. If you decline at the first message, nothing is kept.
• Decisions: Eliora makes no decision about you and may make mistakes. You can ask to speak with a person at any time.
• Deletion: write STOP in the conversation to immediately delete your conversation and contact details.

7. Who we share your information with

Your information is only accessible to 2AF team members who need it for their work. We never sell it. We only share it with our providers, bound by contract and who may only use it to serve us, and with authorities where the law requires or allows it.

Provider	Role	Location
GoDaddy	Website hosting, email	United States
Google (Analytics, Tag Manager)	Audience measurement, with your consent	United States
Axeptio (Agilitation SAS)	Managing and recording your cookie consent	France (European Union)
Calendly	Meeting booking	United States
Intuit Mailchimp	Newsletter delivery	United States
Anthropic	Artificial intelligence service used by Eliora	United States
Meta (WhatsApp, Messenger, Instagram)	Messaging with Eliora	United States and other countries
2AF — Abidjan office	Team with access to requests and files	Côte d'Ivoire

8. Information processed outside Québec

As shown in the table above, some information may be stored or processed outside Québec, including in the United States and Côte d'Ivoire. Before sharing it, we assess privacy factors (sensitivity, purposes, protection measures, legal framework of the location) and provide adequate protection by contract. This information may be accessible to the authorities of those countries under their laws.

9. How long we keep it

Information	Period
Conversation with Eliora	90 days after your last message (deleted immediately if you write STOP)
Contact form messages	2 years
Newsletter	Until you unsubscribe
Client and supplier files	Term of the contract, then 6 years for our accounting and tax obligations
Security logs	1 year

At the end of these periods, information is securely destroyed or anonymized, unless the law requires us to keep it longer.

10. How we protect it

We apply security measures suited to the sensitivity of the information: encrypted connection (HTTPS), multi-factor authentication for our systems, encryption of conversations with Eliora, access limited to authorized people, regular backups and updates, team awareness. Our security management follows the ISO/IEC 27001 standard.

In case of a confidentiality incident (unauthorized access, use or loss), we take steps to reduce its consequences, record it in our register and, if it presents a risk of serious injury, notify the Commission d'accès à l'information and the people concerned.

11. Your rights

You may, free of charge:

• access your information and get a copy, including in a structured, commonly used technological format (portability);
• have it corrected if it is inaccurate, incomplete or ambiguous;
• withdraw your consent and ask for its deletion when it is no longer needed;
• ask that its dissemination stop or that a link be de-indexed where the law allows.

Write to the person in charge at info@2af.ca. We may ask you to confirm your identity. We reply within 30 days. If you are not satisfied, you may file a complaint with the Commission d'accès à l'information du Québec.

12. Our governance

The person in charge of the protection of personal information oversees this policy across all activities of 2AF Inc. Our rules include:

• training and awareness for team members who have access to information;
• a privacy impact assessment before any new project or system that processes personal information, and before any communication outside Québec;
• a register of confidentiality incidents;
• a complaint-handling process: each complaint received at info@2af.ca is recorded, reviewed by the person in charge and answered in writing within 30 days.

13. Updates to this policy

We may update this policy to reflect changes to our services or the law. The effective date appears at the top of the page. If a material change affects how your information is used, we inform you on this site and, where needed, ask for your consent again.

14. Contact us

Person in charge of the protection of personal information — 2AF Inc.
info@2af.ca
2828, boulevard Laurier, bureau 700, Québec (Québec) G1V 0B9