Compliance & Data Protection
How Presto Service safeguards your data and complies with Canadian and Quebec privacy law
Last updated: September 7, 2026
Compliance Frameworks
Presto complies with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal law governing the collection, use, and disclosure of personal information in commercial activities. We apply the ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use, accuracy, safeguards, openness, individual access, and compliance.
As a Montreal-based business, Presto complies with Law 25 (modernizing personal information protection). We have appointed a Privacy Officer, conduct privacy impact assessments (PIAs) for high-risk projects, maintain a confidentiality incident register, and meet breach notification obligations to the Commission d'accès à l'information (CAI) and affected individuals.
Payment processing is fully delegated to Stripe, a PCI DSS Level 1 certified provider. Presto never stores full card numbers — only tokenized identifiers (PaymentMethod, SetupIntent) flow through Stripe's API. Our PCI compliance scope is limited to the Self-Assessment Questionnaire SAQ A, and we never access non-tokenized card data.
Our platform targets Web Content Accessibility Guidelines (WCAG) 2.1 Level AA conformance. We comply with the Accessibility for Ontarians with Disabilities Act (AODA) and applicable provincial standards. Features include keyboard navigation, sufficient contrast, ARIA labels, and screen reader support.
HIPAA applies only once Presto serves US clients or US covered entities. Our roadmap includes signing Business Associate Agreements (BAAs) with Stripe, implementing HIPAA-aligned technical safeguards, and a formal assessment before any cross-border deployment. Currently, Presto does not store clinical medical records — only booking metadata.
Our Compliance Process
Appoint a Privacy Officer
A Privacy Officer is designated and their contact details are published (Law 25 requirement).
Record of Processing
We maintain a record of personal information processing describing purposes, categories, recipients, and retention periods.
Privacy Impact Assessments
High-risk projects (new AI integrations, geolocation, cross-border transfers) undergo a privacy impact assessment before deployment.
Breach Notification
Any confidentiality incident posing a risk of serious harm is documented, assessed, and reported to the CAI and affected individuals per Law 25.
Access Requests
Requests to access, correct, or delete personal information are handled within 30 days of receipt via privacy@prestoservice.ca.
Annual Review
Our policies and security measures are reviewed at least annually and after any material change.
In accordance with Quebec's Law 25, Presto Service has appointed a Privacy Officer. For any question or to exercise your privacy rights, contact:
Request a Compliance Document
Professionals, partners, or regulatory bodies may request a copy of our compliance documentation (privacy policy, record of processing, privacy impact assessments).