The English version of the texts below is provided only as a convenience, to make the original French version easier to read and understand. In the event of a dispute or of any discrepancy between the two versions, the French version prevails and governs the relationship between the parties.
Astral Internet explains here what personal information it processes, for what reasons, to whom it may be disclosed and how to exercise your rights. This policy covers our website, our client area and our exchanges with you. It applies to shared Linux and Windows web hosting, managed WordPress hosting, reseller hosting, email hosting, virtual private servers (VPS), domain names, SSL certificates, Business Anti-Spam, the WSA accelerator (Website Accelerator), advanced website monitoring, and support and webmaster services. It also covers SiteLock protection for the clients who still hold that service.
1. Who we are and our two roles
Astral Internet inc. is located at 1055, boulevard du Séminaire Nord, suite 242, Saint-Jean-sur-Richelieu (Québec) J3A 1R7, Canada.
We are subject to Québec’s Act respecting the protection of personal information in the private sector, as amended in particular by Law 25. The other applicable laws continue to be complied with, in particular Canada’s Personal Information Protection and Electronic Documents Act where it applies to our activities, in particular to certain interprovincial or international commercial exchanges, as well as Canada’s Anti-Spam Legislation for the communications it covers.
Our person in charge of the protection of personal information is Martin Blanchette. Their contact details and the complaint procedure are set out in sections 13 and 14.
For our own activities, we determine the information necessary to manage your account and your billing, to handle your requests, for security and for the other purposes expressly described here. We are responsible for processing it, including where we entrust part of it to a supplier.
For the data you host, we provide a technical service on your behalf. You determine the content of your websites, databases and mailboxes, the individuals concerned and the purposes of your activities. It is up to you, in particular, to inform those individuals and to hold the consents or other authorizations required. Astral Internet retains its own obligations of confidentiality, security and processing within its scope of responsibility, set out in section 6.
A request concerning information collected by a client website should normally be addressed to its operator. We cooperate with that operator within the limits of our role, without setting aside the obligations the law imposes on us directly.
2. The information collected and how it is used
2.1 Categories and means of collection
We receive information when you complete an order or a form, use the client area, open a ticket or communicate with us by email, telephone or in person. Certain technical information is generated during browsing, connections and use of the Service. Payment and anti-fraud verification providers also return to us the results necessary to process the order.
| Category | Information concerned | Use |
|---|---|---|
| Account identity and contact details | Name, business where applicable, postal address, email address, telephone and contact details of authorized representatives | Maintain your file in our billing system, manage your orders and reach you about the account |
| Billing and payments | Services ordered, invoices, amounts, dates, method and status of payments, transaction references and recurring payment authorizations | Bill, collect, renew, refund and keep the necessary supporting documents |
| Domains and SSL certificates | Domain requested, contact details of the holder or the organization, contacts and supporting documents required by the extension or the certificate | Register, validate, renew or transfer the product requested |
| Anti-fraud verification | IP address, postal address and email address of the person placing the order; result of the assessment received from MaxMind | Assess the fraud risk associated with the order |
| Support and exchanges | Messages, tickets, attachments and information necessary to diagnose a problem or verify an authorization | Answer your requests and document the work done |
| Browsing and technical operation | IP address, browser information, pages viewed, connection dates and necessary technical events | Operate and protect the website and the Service, diagnose problems and produce our internal statistics |
| Preferences and consents | Promotional choices, cookie choices and records of their modification | Honour your choices and keep proof of the consents required |
Hosted content — your users’ files, databases and email — is processed under the separate framework of section 6. It is not placed in your billing file to be used for other purposes.
2.2 Billing file and internal statistics
Your identity and contact information is managed in our billing system to administer your account and the services ordered. We do not distribute that file to outside businesses. The transmissions necessary for a domain, a certificate, a payment or anti-fraud verification are limited to the information described in section 3. Other particular situations are expressly governed by this policy.
The browsing data used for our statistics, including the IP address, serves our internal analyses and is not disclosed to an outside firm for that purpose. Sending an IP address to MaxMind to verify an order is a distinct anti-fraud use, described in sections 2.1 and 3.1.
2.3 Consent and withdrawal
We explain the purposes of the collection and distinguish the information necessary for the service from optional choices. Where consent is required, we request it clearly, for each purpose concerned and separately from other undertakings. The processing of sensitive information requires express consent where the law so requires.
You may withdraw a consent by contacting our person in charge. Promotional preferences can also be changed in the client area or through the unsubscribe link; cookie choices are managed in accordance with section 9.
A withdrawal applies to future processing that relies on that consent. It does not remove a legal retention obligation. If a piece of information is necessary to perform the service requested, we explain to you the precise consequences of withdrawing it or of its absence, including the impossibility of providing that service. Refusing promotional communications does not prevent you from obtaining our services.
A new use requiring a separate consent does not become authorized merely because you accepted the terms or continued browsing.
2.4 Anti-fraud assessment and automated decisions
MaxMind provides us with an assessment of the fraud risk. You may contact us to report an error in the information used or to request a review of a decision concerning your order.
If a decision concerning you is based exclusively on automated processing, we inform you of it no later than when we communicate that decision to you. On request, we explain the information used, the reasons and the principal factors and parameters that led to the decision, as well as your right to have that information corrected. You may submit your observations to a member of our staff in a position to review the decision.
3. Recipients, transmissions and places of processing
3.1 Suppliers connected to an order or to a function used
We neither sell nor rent your information for commercial prospecting purposes. The information disclosed for the operations below is limited to what is necessary for the operation concerned.
| Recipient | Situation and information transmitted |
|---|---|
| CentralNic and the registry for the extension | To register, transfer, renew or manage a domain: the holder’s contact details and the other information required by the applicable rules |
| The SSL Store and the authority issuing the paid SSL certificate | Orders and issuance requests go through The SSL Store, which forwards them to the authority concerned, in particular DigiCert or the one indicated at the time of the order: domain, contact details of the holder or the organization, certificate signing request and the elements necessary for validation and issuance |
| Let’s Encrypt, for the free certificates issued by the control panels | The domains to be certified and the technical data necessary for their validation and for the issuance of the certificate; contact details where they are configured for that function |
| Authorize.Net or PayPal | For the payment method chosen and, if authorized, recurring payments: the payment, billing and transaction data necessary to process them |
| MaxMind | For the anti-fraud verification of orders: the IP address, the postal address and the email address |
The written framework governing these communications. In addition to the terms of service accepted when each account is opened, these exchanges are governed by the documents these suppliers publish:
| Supplier | Document |
|---|---|
| Authorize.Net | Data Processing Agreement |
| MaxMind | Data Processing Addendum and End User License Agreement |
| PayPal | Data Protection Addendum applicable to payment processing products |
The applicable version is the one in force at the time of the processing concerned.
Registrars, registries, The SSL Store, certificate issuers and payment services may also have their own validation, security and retention obligations.
MaxMind indicates that, under the terms applicable to its service, certain information may also contribute to improving its anti-fraud and geolocation services. That use by the supplier must be distinguished from Astral’s internal statistics. Its privacy policy describes that processing. Our responsibility for the communications we make remains entire.
3.2 Operations necessary for the hosted service
The access and transmissions necessary for the Service requested are reserved to authorized persons and suppliers and limited to that purpose, in accordance with section 11.6 of the Terms and Conditions. Depending on the service, this includes routing and filtering email, resolving domain names and authorized technical work.
Sitejet and the other tools you activate yourself. The Sitejet website builder is opened from your control panel, by you. Astral Internet transmits no information to it: it is you who activate the service and who decide what information and content you place there. You are responsible for what you transmit there, including third parties’ personal information, in accordance with section 6, and that supplier’s terms and privacy policy apply to your use. The same holds for any other external service you choose from your panel. Such an activation gives that supplier no access to your billing file or to your other services.
Automated free certificates also require exchanges with the issuing authority. The domains appearing in a public certificate may appear in the public certificate transparency logs. These technical exchanges do not constitute a general sharing of the billing file.
3.3 Domain name registration data
The registrar and the registry receive the necessary data even where certain contact details are masked in the public directories. Publication and masking in RDAP or WHOIS depend on the rules of the extension, the holder’s category and the applicable laws.
For .CA, holders registered in an eligible individual category normally benefit from the free masking provided by CIRA. The rules differ for other categories, in particular organizations. A paid contact protection option is distinct from the masking imposed or offered by the registry’s rules; its availability and its price are stated before payment.
Public masking does not prevent the validations and communications legally required of the registrar or the registry. Section 9.7 of the Terms and Conditions completes these rules.
3.4 External requests and legal obligations
For an external request from an authority or a third party seeking your non-public information or your content, we first require a valid warrant or order from a court of competent jurisdiction. An informal request is not sufficient. The disclosure is limited to what that act requires and we inform you of it where the law permits.
This requirement does not prevent a disclosure directly imposed on Astral Internet by a mandatory legal provision, even without an order. It is consistent with section 11.6 of the Terms and Conditions.
The operations necessary for the service, requests to exercise rights by an individual or their authorized representative, and the transactions expressly governed by section 11 follow their respective rules. They do not constitute a general authorization to respond to external requests.
Any other optional disclosure requires your specific consent and must comply with the applicable contractual undertakings.
3.5 Québec and processing outside Québec
Our administrative offices and all of our hosting infrastructure are in Québec. Our equipment is housed in the Leaseweb MTL1 and eStruxture MTL-3 data centres.
That location does not mean that every operation of the service stays in Québec: the external suppliers described in section 3.1 may process or store the information transmitted to them outside Québec, depending on their facilities and subcontractors. Their processing may then be subject to the laws of the territories concerned. The data you make public or send to external recipients may also travel outside Québec.
Before disclosing personal information outside Québec or entrusting its processing on our behalf to a supplier outside Québec, we assess the privacy-related factors and satisfy ourselves that the information will receive adequate protection. The written framework takes that assessment into account, along with the information concerned, its use, the protections provided and the applicable legal regime. We obtain the consents required, unless an applicable legal exception applies.
You may contact our person in charge to obtain details on the recipients and places of processing applicable to your service.
4. Retention and destruction
4.1 Administrative file and exchanges with Astral
The periods below concern the information we process for our own activities. We destroy it securely once it is no longer necessary, subject to the applicable legal obligations.
| Category | Retention rule |
|---|---|
| Account file and administrative contact details | Kept as long as the account is active; an inactive account and the data in its file are deleted 96 months after it becomes inactive, subject to the particular periods below and to legally required retention |
| Invoices and accounting or tax documents | Kept with the administrative file according to the period of 96 months after the account becomes inactive; legally required retention beyond that point remains applicable to the documents concerned only |
| Sensitive documents sent to support or to verify an identity or an authorization | Deleted as soon as they are no longer necessary, and at the latest six months after they are received, subject to legally required retention |
| Astral’s administrative and support email | Messages older than one year are archived on offline media, not accessible from the internet; destruction seven years in total after the date of the email, subject to legally required retention |
| Support tickets, excluding attachments | Kept as long as the account is active; after it becomes inactive, they follow the deletion period of its file, that is 96 months |
| Attachments to support tickets, excluding sensitive documents | Deleted 24 months after they are received, even if the account remains active; they are deleted sooner if the file to which they belong is deleted |
| Technical logs and statistical data containing personal information | For the period necessary for the operation, security, diagnosis or internal analysis concerned, then destroyed |
| Proof of consent or of withdrawal | For the period necessary to apply the choice and demonstrate that it was honoured; only the necessary record is kept |
| Register of confidentiality incidents | At least five years after the incident became known, then destroyed once the applicable obligations have ended |
The 96-month period is our retention rule for inactive administrative files, in particular so that we can respond to Québec and Canadian tax requests. It runs from the moment the account becomes inactive. Closing a single service does not make the account inactive where other services remain active.
The particular destruction periods for attachments, sensitive documents and Astral’s email continue to apply during that period. The six-month limit for sensitive documents prevails over the 24-month limit for other attachments and also applies to their copies in our email and administrative archives. Residual backup copies follow section 4.4.
Astral’s email archiving rule does not cover the mailboxes hosted for our clients: those follow sections 4.2 and 6.
4.2 Hosted content and end of service
Sections 4.3 and 5.5 of the Terms and Conditions determine the deletion of hosted content: files, databases, email and mailing lists.
- Non-payment: the data of the unpaid service may be deleted as of fifteen days after its due date, under the special rule in section 4.3.
- Other ends of service: on shared, WordPress, reseller and email hosting, deletion may occur as of the effective end and occurs no later than thirty days after it; for a VPS, it occurs immediately at the effective end.
- A cancellation requested for the end of the term does not, in itself, trigger a deletion before that date. The data of the other active services remain subject to their own terms.
These periods do not guarantee access or any possibility of recovery after the end of the service. The client retrieves their content before that date. When a server is closed, they may request, by technical support ticket at the time of closure, written confirmation of the erasure; it is sent to them in that ticket once the data has been officially erased from our data centre. The deletion of hosted content is distinct from that of Astral’s administrative file and from the life cycle of domain names.
4.3 Documents sent to support
Send only what is necessary for your request. Prefer the relevant excerpts and mask superfluous information. Do not include a full card number, a card security code, a social insurance number or health data without an expressly established need.
If a verification or an intervention requires a sensitive document or access, ask our team for the appropriate means of transmitting it. Access is reserved to the persons whose duties require it. Attachments follow the 24-month period in section 4.1, reduced to a maximum of six months for sensitive documents. Temporary access must be withdrawn once it is no longer required.
4.4 Backups and retention exceptions
A deletion in the active system may temporarily leave a copy in a backup. These copies are protected, are not used for day-to-day purposes and are eliminated according to the applicable cycle. For a deleted VPS, the snapshots of its volume are replaced by the normal cycle within the following hours, and a backup configured to external storage is deleted in turn after the server. On a restoration, the deletions already required must be applied again.
At the end of a virtual server’s life, the machine and its disk are deleted from the hypervisor and from the storage system; the space freed is reallocated and overwritten in the course of normal operation, and space newly allocated to another service is zeroed. Until they are overwritten, residual data remains on self-encrypting drives: it is unreadable outside the storage array. A drive withdrawn from service is physically destroyed.
For hosted data, the mechanisms and cycles are set out in section 7.2 of the Terms and Conditions. They vary by product: SAN snapshots, account backups, email backups or the managed VPS configuration communicated at activation. There is no single two-week period applicable to all backups.
Where retention is legally required, we limit the information kept to what is required, restrict access to it and destroy it at the end of that period. Offline archiving remains a retention of personal information.
5. Security and payments
We apply security measures suited to the sensitivity, quantity, use and medium of the information: access control according to duties, confidentiality obligations for staff, protection of systems and communications, and retention and destruction procedures. Exchanges with our store and our client area use an HTTPS connection protected by TLS. Data at rest on our storage systems — the volumes of the hosted services and their snapshots — is protected by full-disk encryption (FDE), using self-encrypting drives (SED).
Electronic payments are processed through Authorize.Net or PayPal. As part of our payment arrangement with Authorize.Net, we have our PCI DSS compliance validation renewed annually with SecurityMetrics.
That validation covers the payment scope set out in the validation documents. It is not a general certification of all the websites, software, servers or content hosted with Astral Internet, nor a guarantee that no incident will occur.
You contribute to the security of your account by protecting your credentials and promptly reporting any suspicious access. The client’s responsibilities do not reduce Astral Internet’s own security obligations.
6. Framework governing the processing of hosted data
6.1 Purpose, scope and instructions
This section sets out our written undertakings for the processing of personal information on the client’s behalf, under the Agreement of which this policy forms part. The service ordered, the configurations chosen and the instructions given by authorized persons in the client area or in tickets define the mandate.
The processing covers the files, databases, messages and other content entrusted to the service. The individuals and categories of information concerned depend on the client’s activity. The mandate covers the operations necessary for the service subscribed to: storage, transmission, backup, restoration, security and, where provided for or requested, migration, administration and support.
The client holds the authorizations necessary to entrust this information to Astral. A processing need going beyond that framework must be agreed in writing before it is implemented. The level of support remains that of the service subscribed to.
6.2 Limitation of use and confidentiality
Astral Internet processes this information solely to perform that mandate, in accordance with the client’s lawful instructions, or to meet an applicable legal obligation. It does not use it to build its own advertising lists or to commercialize it.
The automatic processing necessary for operation is distinct from human consultation. An authorized person may access the content to the extent necessary for authorized work, for the security of the service or for a legal obligation. That access is limited to what the work requires and is subject to confidentiality.
On a managed or fully managed server, that access includes access by our support technicians to apply the updates and the work included in the management level. On cPanel servers, the logs of “root” access are kept for four (4) weeks; on Windows Plesk servers, access is recorded in the Windows event logs, under their default rotation. The client may restrict our technicians’ access to their server; we then need their authorization and their assistance in order to intervene, which lengthens the intervention time.
6.3 Protection and suppliers involved in the mandate
Astral Internet puts appropriate protective measures in place within its scope of intervention. The persons with access to the information are authorized according to their duties and are bound to preserve its confidentiality.
If a supplier processes information covered by this mandate on our behalf, its involvement is limited to the service required and is governed in writing: protection of the information, limitation of use, confidentiality, end of processing, notice of breach and applicable verifications. Transfers outside Québec follow section 3.5.
Using a supplier does not set aside our obligations to the client. The external services the client chooses directly are identified according to their role; they do not receive a general authorization to access the hosted content.
6.4 End of the mandate and cooperation
The client retrieves their data before the end of the service. Astral Internet keeps no copy of it for independent use after the end of the mandate. The destruction of the content and the elimination of residual copies are carried out in accordance with sections 4.2 and 4.4, subject to legally required retention.
We provide the client with the information available within our scope that they need in order to handle a request to exercise rights or an incident. Individuals do not lose their rights merely because their data is hosted with a service provider.
6.5 Confidentiality breaches and verifications
We notify without delay the person in charge of the protection of personal information designated by the client of any breach or attempted breach of the confidentiality obligations relating to the information entrusted to us of which we become aware. Absent a designated contact, we reach the account holder or their authorized representative. The information available is transmitted and then completed as the investigation progresses.
We allow the client’s person in charge to carry out the confidentiality-related verifications provided for by law. The practical arrangements protect other clients’ information and the security of the facilities, without preventing the exercise of that right. Notices and measures in the event of an incident also follow section 10.
7. Your rights and how to proceed
You may request access to the personal information we hold about you and its correction. You may also withdraw a consent or request the deletion of information, subject to the applicable legal conditions. Deletion is not automatic where retention remains legally necessary.
Portability. On request, the computerized personal information collected from you is communicated in a structured, commonly used technological format, unless serious practical difficulties arise. This right is not limited to the fields you entered: it may cover information generated by your activities. Information created or inferred through analysis, and information obtained from third parties, does not fall within that particular scope. You may request that it be transmitted to a person or body authorized by law to collect it.
This right concerns your personal information. Exporting all the content of a website, a server or a mailbox, which may include other people’s information, also depends on the tools and terms of the service. A lawful access request does not thereby become a webmaster service and is not conditional on payment of an overdue service invoice.
How to make a request. Write to the person in charge indicated in section 14, specifying the information sought and your request. You may act through an authorized representative. We verify your identity and, where applicable, that representative’s authority to act, using proportionate elements; a full copy of an identity document is not systematically required.
We assist in clarifying the request where needed and answer requests for access, correction and portability in writing within thirty days of their receipt. A refusal states its reasons, the applicable legal provisions and the available remedies. Any fees permitted by law for a copy or a transmission are announced to you in advance; support rates do not apply automatically.
Requests concerning the data of a client website are directed to the operator concerned, with our cooperation in accordance with section 6. The rights to cessation of dissemination, to de-indexation or to re-indexation may also be exercised where their legal conditions are met.
8. Service messages and promotional communications
Messages necessary for the service include invoices, renewals, maintenance and security notices, and the necessary administrative or contractual communications. They continue to be sent when you decline advertising.
Promotional messages require a separate consent, recorded in our system. You may withdraw it at any time through the unsubscribe link in the email or from your client area, at no charge. We act on it as soon as possible and at the latest within ten business days.
This choice concerns advertising communications. We do not use the “service message” category to get around a refusal to receive advertising.
9. Cookies and similar technologies
The cookie policy remains the reference for the inventory of the cookies and similar technologies used on our website, their purposes, their durations and the services concerned.
Necessary cookies serve in particular for operation, sessions and remembering choices. Optional cookies are subject to the choices presented in the consent manager. You may accept or refuse the optional categories there, then change your choices using the website’s consent management control.
Where a technology includes a function allowing you to be identified, located or profiled that is covered by law, we inform you of it beforehand and tell you how to activate that function, which is disabled by default in accordance with the applicable requirements.
You may also manage or delete cookies in your browser. Blocking a necessary cookie may prevent a function from working. Cookie choices are distinct from consent to promotional email. The statistical use of browsing information follows section 2.2.
10. Confidentiality incidents
If we have reason to believe that an incident affects personal information we hold, we take reasonable measures to limit the consequences and prevent a recurrence. Our person in charge takes part in assessing the risk, in particular according to the sensitivity of the information, the possible consequences and the likelihood of it being used for a harmful purpose.
Where there is a risk of serious injury, we promptly notify the Commission d’accès à l’information du Québec and the individuals concerned, in accordance with the applicable rules. The notice describes the situation as known, the information affected, the measures taken or proposed and the contact for obtaining help. It is completed where necessary.
We keep a register of all incidents, including those that do not present a risk of serious injury. The information in the register is kept for at least five years after the incident became known.
For hosted data, the notice to the client provided for in section 6.5 does not wait for the conclusion that a risk of serious injury exists. We coordinate what follows with the client, without setting aside the notification obligations incumbent on us directly.
11. Acquisitions, sales and transfers of activities
If an acquisition or sale of a business, of part of its activities or of a client portfolio requires the disclosure of personal information, we limit that disclosure to the information necessary and comply with the applicable legal conditions.
Before a disclosure under the legal exception relating to a commercial transaction, a written agreement requires the recipient to protect the information, to use it solely for the transaction and to disclose it only in the cases permitted. If the transaction fails or if their use is no longer necessary for its conclusion, the information must be returned or destroyed.
After the transaction closes, its use remains subject to the law. The party continuing the business informs the individuals concerned of the transfer within a reasonable time. The transaction does not constitute consent to new advertising purposes and does not permit hosted data to be processed outside the applicable mandate.
12. Changes to this policy
We indicate the date of each version and inform the individuals concerned of the changes that affect the processing of their information.
Where a change to this policy constitutes an amendment of the Agreement, it follows section 13.1 of the Terms and Conditions: an individual written notice sent at least thirty days before it takes effect, presenting exclusively the new or amended clauses, their previous version, the effective date and the rights of refusal. Merely updating this page does not take the place of that notice.
If the change increases the client’s obligations or reduces those of Astral, the client may refuse it and terminate at no charge by a notice sent no later than thirty days after it takes effect, with the pro rata refund provided for in section 13.1. The other protections of that section continue to apply.
Continued use of the service does not, in itself, constitute consent to a new collection, use or disclosure. Where the law requires a new consent, we obtain it before the processing concerned.
13. Governance and complaints
Our person in charge of the protection of personal information oversees the application of this policy and approves the practices governing personal information. Management provides the means necessary for their implementation.
These practices set out staff responsibilities, access authorizations, confidentiality, team awareness, the framework governing suppliers, retention and destruction, and the handling of requests and incidents. They are reviewed when activities, risks or applicable requirements change.
Any project to acquire, develop or overhaul an information system or electronic service delivery involving the collection, use, disclosure, retention or destruction of personal information is the subject of a privacy impact assessment, proportionate to the sensitivity of the information, the purpose of its use, its quantity, its distribution and its medium. Our person in charge is consulted from the start of the project.
For a question or a complaint, write to the person in charge with a description of the situation and the relevant details. They acknowledge receipt, examine the facts with the authorized persons and answer you in writing, indicating what action was taken.
You may exercise the applicable remedies before the Commission d’accès à l’information du Québec or, for matters within its jurisdiction, the Office of the Privacy Commissioner of Canada, without having to waive a remedy in order to use our internal procedure.
14. Contact us
Martin Blanchette — Person in charge of the protection of personal information
Astral Internet inc., 1055, boulevard du Séminaire Nord, suite 242, Saint-Jean-sur-Richelieu (Québec) J3A 1R7, Canada.
Email: support@astralinternet.com.
Telephone: 514-667-0932 or 1 877 667-0932.
For a request concerning your personal information or a complaint, please state that your message is addressed to the person in charge of the protection of personal information.
Last updated: 10 September 2026.