Privacy Policy
Last updated October 19, 2026 (v1.2)
1. Introduction
This Privacy Policy explains to users of the shared mobility service operated in Montréal by 9526-1731 Québec inc. (hereinafter “LEO,” “we” or “our company”) how their personal information is collected, used, retained, protected and shared.
LEO is committed to handling your personal information in accordance with applicable Québec laws, in particular the Act respecting the protection of personal information in the private sector, as amended by Law 25.
We encourage users to read this Policy carefully. It forms an integral part of our Terms and Conditions of Use. By using our services, you accept the practices described in this Policy.
We reserve the right to amend this Policy at any time, including to reflect changes in legislation or our practices. Any material change will be communicated to users through appropriate means (in-app notification, email, website update, etc.).
2. What is personal information?
Personal information is any information concerning an individual that, alone or combined with other data, directly or indirectly identifies that person.
This may include, without limitation:
- first and last name;
- email and mailing addresses;
- telephone number;
- a photograph or video recording;
- geolocation data;
- event data relating to the condition of the vehicle and driving when associated with a rental or an identifiable person (for example, date, time, location, speed, measurements of speed, acceleration, braking or movements);
- identity information, a driver’s licence or bank card information;
- the IP address or identifier of the device used to access the service;
- your reservation history, odometer readings and other data relating to use of the service.
- Public transit card (if applicable)
LEO is committed to collecting only the information strictly necessary to provide its services and ensure their proper operation.
3. Person responsible for processing personal information
The person responsible for processing personal information is the person or entity that determines the purposes and means of processing the data.
In operating its shared mobility service, LEO, namely 9526-1731 Québec inc., acts as the person responsible for processing personal information.
LEO contact information:
Legal name: 9526-1731 Québec inc.
Trade name: LEO
Mailing address: Suite 401, 279 Sherbrooke Street West, Montreal, Quebec, H2X 1Y2
Email: bonjour@leoautopartage.com
4. Personal information collected and purposes of use
In connection with the use of our shared mobility service, LEO collects various types of personal information necessary for registration, service management, operational safety and communications with users.
We collect this information for the following purposes:
- to verify your identity and eligibility for the service;
- to manage reservations and access to vehicles;
- to secure the use of our fleet and prevent fraud or unauthorized use;
- to prepare and send invoices;
- to collect payment of invoices;
- to manage customer relations, including technical support and informational communications;
- to handle incidents, claims or accidents, traffic violations or tickets;
- to comply with our legal obligations, particularly regarding taxation or road safety;
- to analyze use of the service for continuous improvement, fleet optimization and assessment of environmental impact;
- to send you communications, promotions or surveys relating to our service, in accordance with your preferences.
LEO is committed to collecting only the information strictly necessary to provide its services. Some information may be generated automatically when you use our vehicles or digital platforms (e.g., vehicle location, trip dates and times, vehicle condition, IP address, usage preferences, etc.).
The information collected will never be used for purposes incompatible with those stated above without your express consent.
4.1 Vehicle data relating to damage and driving safety
Some vehicles may be equipped with devices that measure their use and condition. Depending on the equipment, data relevant to an event may include its date and time, location, vehicle speed and measurements of acceleration, braking or movement that may indicate an impact, collision or risky situation.
The vehicle device may take the measurements needed to detect an event. As described in the Terms and Conditions of Use, driving and vehicle condition data are not systematically transmitted to or retained by Leo Autopartage. If the device detects indications of an impact or a situation that may pose a risk to the vehicle, its occupants or others, data relevant to that event may be transmitted to Leo Autopartage and retained for review.
These data are used to identify a potential incident, check the condition of the vehicle, arrange an intervention, examine a damage claim, assess a safety situation and verify compliance with the Terms and Conditions of Use. They may be considered together with available reports, photographs, statements from the persons concerned and findings.
5. Access to personal information
Access to personal information collected by LEO is strictly limited to persons or entities that need it in the course of their duties or mandates, solely for the legitimate purposes stated in the preceding section.
Accordingly, your personal information may be disclosed, in whole or in part, to the following categories of recipients:
- authorized members of the LEO team, including personnel responsible for administration, customer service, operations management or security;
- our service providers and subcontractors acting on our behalf, including for data hosting, technology platform management, payment processing, customer support or fleet maintenance;
- our contractual partners, insofar as their involvement is necessary to provide the service or perform the contract with the user;
- our insurers, brokers or claims adjusters, when the circumstances require;
- judicial, administrative or regulatory authorities, where required by law or in connection with an investigation or official proceeding.
All third parties to whom we disclose personal information are required to maintain its confidentiality and security and to use it only for the specific purposes for which it is disclosed. LEO ensures that these third parties comply with legal and contractual standards for the protection of personal information.
No personal information is sold, rented or otherwise transferred to third parties for commercial purposes without your express consent.
6. Transfers of personal information outside Québec
In providing its services, LEO may transfer certain personal information outside Québec, including:
- to its technology provider based in France, which may access data for platform maintenance, technical support or improvement;
- to a hosting server located in the United States, where user data are physically stored.
LEO ensures that foreign providers comply with standards comparable to those of Québec regarding confidentiality, security and limits on access to personal information.
Users are informed that these transfers are necessary for the technical operation and continuity of the service.
7. Retention of personal information
LEO retains personal information only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law.
The criteria used to determine this period include:
- applicable legal and regulatory obligations (for example, tax or contractual recordkeeping obligations);
- operational needs relating to service management, incident follow-up, the handling of claims and tickets, or insurance obligations;
- applicable limitation periods in the event of a dispute.
By way of indication:
- Information collected at registration (e.g., first and last name, address, email, driver’s licence, payment information, etc.) is retained throughout the contractual relationship. The contractual relationship begins when the user registers. It ends either when the user requests account closure or when the user account has been inactive for three years. At the end of the contractual relationship, the account and all user data may be retained for 12 months for operational purposes relating to the management of incidents and tickets and the handling of claims and disputes.
- Trip data (e.g., date, time, distance travelled and usage history) are retained throughout the contractual relationship. Geolocation data for the vehicle used are retained for a maximum of 12 months after the end of the trip for the management of tickets and potential fraud.
Event data relating to an impact or driving that are actually transmitted to Leo Autopartage are retained for the period necessary to review the incident, manage a claim or safety measure and, where applicable, defend the rights of the persons concerned. Personal information used to make a decision concerning a person is retained for at least one year after that decision, in accordance with the law. Once these purposes have been fulfilled and no retention obligation applies, the data are deleted or anonymized.
Once retention periods have expired, the information is either erased or irreversibly anonymized if it may be kept for statistical purposes, service improvement or internal research.
8. Your personal information rights
Under applicable Québec legislation, you have a number of rights regarding your personal information. LEO is committed to facilitating the exercise of these rights within reasonable timeframes and in a transparent manner.
a) Right of access
You have the right to request access to the personal information we hold about you, as well as information on how it is used, who has access to it and its expected retention period.
b) Right to correction
If you find that any information about you is inaccurate, incomplete or ambiguous, you may ask us to correct or update it.
c) Right to withdraw consent
Where the processing of your information is based on your consent, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
d) Right to cessation of dissemination or de-indexing
In certain circumstances, you may request that we cease disseminating or de-index personal information concerning you, particularly if the dissemination causes you serious injury or contravenes the law.
e) Right to data portability
As of September 22, 2024, you may request that computerized personal information concerning you be provided in a structured, commonly used technological format or transferred to a third party, where technically feasible.
f) Right to file a complaint
If you believe your rights have not been respected, you may file a complaint with our person in charge of the protection of personal information (see section 3) or with the Commission d’accès à l’information du Québec (www.cai.gouv.qc.ca).
How to exercise your rights
Any request relating to these rights must be submitted in writing and accompanied by a document that allows us to verify your identity. We will respond within a maximum of 30 days after receiving your complete request. If we refuse, you will be informed of the reasons and of the remedies available to you.
Where we hold event data associated with your account, you may also request access to that information and, where applicable, its correction under the conditions provided by law. To challenge the attribution of damage or a measure relating to driving, you may send your explanation and any relevant evidence to the address set out in section 3.
9. Security measures
LEO implements rigorous physical, administrative and technological security measures to protect the confidentiality, integrity and availability of the personal information it holds.
These measures include:
- encryption of sensitive data during transmission and storage;
- secure authentication mechanisms for access to platforms and data;
- firewalls, intrusion detection systems and monitoring protocols;
- restricting access to authorized persons according to their role or function;
- confidentiality agreements with employees and service providers.
All employees and subcontractors with access to data are made aware of their confidentiality obligations and receive appropriate training.
Notification in the event of a privacy incident
In the event of an incident involving personal information that could cause serious injury, LEO undertakes to:
- keep a record of the incident;
- notify the Commission d’accès à l’information du Québec;
- inform the persons concerned without delay, providing the information needed to understand the nature of the risk and the steps to take to protect themselves.
10. Changes to the Privacy Policy
LEO reserves the right to amend this Privacy Policy at any time, including to reflect changes in its practices, technologies or applicable legal and regulatory requirements.
In the event of a material change, users will be informed by a notice posted in the mobile app, on the website or through another appropriate means (e.g., email).
The date of the last update appears at the beginning of this Policy. We encourage users to consult it regularly to stay informed about how their personal information is handled.
11. Cookies
LEO uses cookies and similar technologies (e.g., pixels and web beacons) on its websites and mobile apps to ensure they function properly, improve the user experience and better understand browsing behaviour.
What is a cookie?
A cookie is a small text file stored on a user’s device (computer, mobile phone, tablet, etc.) when the user visits a website or uses an app. It allows the browser to be recognized on later visits and certain information to be remembered.
Types of cookies used by LEO:
- Strictly necessary cookies: essential to the technical operation of our websites and apps (e.g., session management, security and account access).
- Performance and analytics cookies: allow us to measure traffic, understand how users interact with our services and optimize our interfaces. We use tools such as Google Analytics.
- Personalization cookies: used to adapt content or features to your preferences or location.
- Marketing cookies (where applicable): used to display personalized advertising or track the performance of promotional campaigns.
Consent and cookie management
On your first visit to our platforms, an information banner tells you about our use of cookies and allows you to accept, refuse or customize your preferences. You may also manage your choices at any time through your browser or mobile app settings.
Please note that refusing certain cookies may affect the quality or availability of some service features.
Disabling cookies in your browser
You can configure your browser to refuse cookies or delete those already installed. The procedure varies by browser. For more information:
