1. Why this page exists
Québec law requires a business to assess the privacy implications before it communicates personal information outside Québec, to take into account the sensitivity of the information, the purpose of using it, the protections it would receive including any contractual terms, and the legal framework of the place it is going. It also requires that the information not be communicated if the assessment shows it would not receive adequate protection.
Saying "we may transfer your data abroad" in a policy is not an assessment. This page is the assessment, published so you can read the same record we rely on.
2. Where information is processed today
Cashify's website is a set of static files with no third-party scripts, no analytics, no advertising tags, no embedded fonts or images loaded from another company, and no content delivery network in front of the pages. Nothing about your visit is shared with another business simply because you opened the page.
When you send an estimate request, the details and photos you upload are received by the Cashify application server and written to storage that only that application can read.
| What | Who processes it | Where | Outside Québec? |
|---|---|---|---|
| Website pages, styles, fonts, photographs | Cashify only; served as static files | Confirmed and published before seller requests open | No personal information is involved |
| Estimate request: name, email, phone, shipping address, device description, notes, device photos | Cashify application server | Confirmed and published before seller requests open | Confirmed and published before seller requests open |
| Consent record: which document version and language you accepted, and when | Cashify application server | Confirmed and published before seller requests open | Confirmed and published before seller requests open |
| Transactional email: shipping label, inspection findings, offer | Not yet in service. No email provider is connected, and no seller information has been sent to one. | Not applicable | Not applicable |
| Payment by Interac e-Transfer | Not yet in service. No payment provider is connected. | Not applicable | Not applicable |
| Shipping label and carrier tracking | Not yet in service. No carrier account is connected. | Not applicable | Not applicable |
The rows marked "not yet in service" are honest about the current state of the build rather than describing a supply chain that does not exist. Each one is a launch gate: the provider, its processing location, and its contractual protections must be recorded here before that part of the service is switched on.
3. The assessment applied before any transfer
Before Cashify sends personal information to a provider outside Québec, the privacy officer completes and records the following, and the record is kept for as long as the transfer continues.
- Sensitivity. What is being sent. A shipping address and device photographs are more sensitive than a device model, and government identification, if it is ever collected, is more sensitive again.
- Purpose and necessity. Why the transfer is needed, and whether the same purpose can be achieved with less information or without leaving Québec.
- Protections in place. The written agreement with the provider, what it may and may not do with the information, whether it may use sub-processors, security measures, breach notification duties, and deletion on termination.
- Legal framework where it lands. Whether that jurisdiction affords protection equivalent to Québec's principles, including lawful-access exposure.
- Conclusion. Whether the transfer may proceed, on what conditions, and when the assessment is reviewed again.
Current conclusion. No seller personal information is communicated to a third-party provider today, in Québec or outside it, because no third-party provider is connected to the service. There is therefore no transfer to assess. This conclusion stops being true the moment an email, carrier, payment, analytics, or hosting provider is added, and this page must be completed and re-dated before that happens.
4. What would change this page
Any of the following requires a new assessment, a new version of this page, and an update to the Privacy Policy: connecting an email, carrier, payment or identity provider; moving hosting to a new region; adding analytics or error reporting; introducing a sub-processor; or beginning to collect government identification. Sellers with an open request are told when the change affects information we already hold.
Questions about this assessment
Use the privacy contact route supplied with your request confirmation or shipping instructions. You can also read your privacy rights, including how to escalate to the Commission d'accès à l'information du Québec.