Privacy Policy

Who we are and who to contact

2727 Coworking is operated by 9258-0448 Québec inc., 2727 rue Saint-Patrick, #109, Montréal (Québec) H3K 0A8, Canada.

The person in charge of the protection of personal information is our Privacy Officer (Responsable de la protection des renseignements personnels). You can reach them at [email protected] or by mail at the address above, marked “Attention: Privacy Officer”.

What we collect and why

1. Information you give us in our forms

Depending on the form, we collect:

• Contact form and tour requests: name, email, phone number, what you are looking for, your message, and for tours your team size, move-in timeline and the visit time you pick.
• Business address requests: name, email, phone, company, country, the institution the address is for, intended use and timeline.
• Waitlist: name, email, phone, offices of interest, number of people, budget range and desired start date.
• Lease requests and online lease offers: company name, contact name, email, phone, and the details needed to prepare and sign your agreement.
• Checkout discount offer: your email address, so we can send you the discount code.

We use this information to answer you, schedule visits, prepare quotes and agreements, and follow up on your request. Form submissions are emailed to our team, posted in our internal team chat (Slack), and some are stored in our own customer database (waitlist, lease requests, business address and discount-offer requests). A copy of inquiry emails is also kept by the marketing service provider that helps us follow up on and measure our inquiries.

2. Bookings, payments and membership

Online payments on booking.2727coworking.com are processed by Stripe. We never see or store your full card number. We receive your name, email, phone, billing address, what you bought, the amount and a transaction identifier. If you become a member or tenant, we also keep your agreement, company details, invoices and payment history, the banking details you provide for pre-authorized payments, and your building access credentials. For mailbox clients, we keep the names authorized to receive mail and any scans of mail you ask us to make. We use this to provide the service, bill you, give you access to the building and meet our legal and accounting obligations.

3. Phone calls

Calls to our phone line go through an automated menu operated with Twilio. We receive your phone number, the time of the call and the menu option you choose. Before we transfer you, a message tells you that the call may be recorded. Answered calls may be recorded, and voicemails are recorded and automatically transcribed into text using OpenAI’s speech-to-text service. Recordings and transcripts are sent to our team by email and Slack so we can call you back and handle your request. We use the recordings to respond to you, to keep a record of what was asked and agreed, and to improve how we answer calls.

4. Your visit to our websites

Our own visitor tracker stores a random identifier in a first-party cookie (_sv, valid one year) and records the pages you view, the page that referred you and the campaign tags in the link you clicked (for example UTM parameters or an ad click identifier such as gclid). When you submit a form, we attach this visit history to your inquiry so our team can see how you found us and which ads work. We also use the third-party tools listed in the next section.

5. Information from our ads on Google, Facebook and Instagram

If you send us information through one of our ads (for example a Facebook or Instagram lead form, or a message to our page), we receive what you submit and use it like a form on our website. We use a Meta developer app called “2727 Coworking Ads” only to manage 2727 Coworking’s own advertising and to read performance reports, which are aggregated. It does not offer Facebook Login and does not read your profile, friends or posts. See our data deletion instructions to have this information deleted.

Cookies, tags and measurement tools

Our websites use the following tools, which can set cookies or similar identifiers in your browser:

• Google Tag Manager and Google Analytics (Google): to measure visits, pages viewed and inquiries.
• Google Ads (Google): to measure which ads lead to inquiries, bookings, purchases and phone calls, and to show our ads again to people who visited our site. Google’s call tracking may display a different phone number on our site so calls from ads can be counted.
• Meta Pixel (Meta Platforms): to measure our Facebook and Instagram ads and reach people who visited our site. The pixel may use advanced matching, which sends Meta a hashed (encoded) version of contact details typed on the page.
• Microsoft Clarity (Microsoft): heatmaps and session replays that show how pages are used (clicks, scrolling, mouse movements), to improve the site. Microsoft may also use this data for its own advertising services.
• OpenAI ads measurement pixel (OpenAI): to measure ads we run on ChatGPT.
• We may also use the LinkedIn Insight Tag (LinkedIn) to measure LinkedIn ads, and RB2B, a service that tries to identify the company or professional profile of business visitors so we can follow up with relevant offers.
• Cloudflare: website delivery, security and bot protection (including the Turnstile check on some forms) and privacy-friendly traffic statistics.
• Google Maps and YouTube: embedded maps and videos, which Google can use to set its own cookies when they load.
• Stripe: checkout takes you to a payment page hosted by Stripe, which uses its own cookies for payment and fraud prevention.

Measuring ads with hashed contact details

To learn which ads bring real customers, we send advertising platforms limited information about conversions: when you book or pay on booking.2727coworking.com, a hashed version of your email, phone number and name is sent to Google Ads (enhanced conversions); when an inquiry later turns into a visit or a signed agreement, we send Google Ads the ad click identifier and the date; and for phone calls to our sales line we send a hashed version of the caller’s number. We may send similar hashed information to Meta. Hashing (SHA-256) turns your details into a code that cannot be read back; the platform only uses it to match the conversion to an ad interaction. We do not use this to send you messages, and the platforms do not receive your message content.

Your choices

The analytics and ad measurement tools listed above are active when you visit. You can block them with your browser’s privacy settings or a content blocker, and manage ads through Google’s ad settings and Meta’s ad preferences. You can also email us at any time to withdraw your consent to any use described here.

Who we share information with

We do not sell personal information. We share it only with service providers that help us run our business, and only what they need:

• Hosting and infrastructure: OVHcloud (servers), Cloudflare (delivery, security, file storage).
• Email and calendar: Google Workspace, Amazon Web Services (sending our emails).
• Team communication: Slack.
• Phone line and transcription: Twilio, OpenAI.
• Payments, accounting and building access: Stripe, Xero, Kisi.
• Analytics and advertising: Google, Meta, Microsoft, OpenAI, and LinkedIn or RB2B where used.
• Our marketing service provider, which helps us follow up on inquiries and run our ads.

We may also disclose information when the law requires it, or to protect our rights, our members or our building.

Information stored outside Quebec

Most of the providers above store information outside Quebec, mainly in the United States (our website and customer database run on servers located in the United States). This means your information is communicated outside Quebec and may be accessible to authorities there under local law. We use established providers and rely on their contractual commitments to protect personal information.

How long we keep information

• Inquiries and leads that do not become customers: up to 3 years after our last exchange.
• Customer agreements, invoices and payment records: for the length of the relationship, then as long as tax and accounting laws require (generally 6 years after the end of the fiscal year concerned).
• Call recordings and voicemails: our copies are deleted automatically 12 months after the call. Transcripts sent to our team by email may be kept with the related inquiry.
• Website visit history linked to an inquiry: kept with that inquiry. The tracker cookie expires after 1 year.
• Data held by analytics and advertising platforms: according to each platform’s own retention settings.

When information is no longer needed, we delete it or make it anonymous.

Security

We limit access to personal information to the people who need it for their work, protect our systems with access controls, and use encrypted connections. No system is perfectly secure; if an incident creates a risk of serious harm, we will notify the people affected and the Commission d’accès à l’information as the law requires.

Your rights

Under Quebec law, you can ask us to:

• access the personal information we hold about you and receive a copy;
• correct information that is inaccurate, incomplete or out of date;
• withdraw your consent to a use of your information;
• delete your information, or stop disseminating it, when the law allows;
• receive information you gave us in a structured, commonly used technological format;
• know how we collected it and who has access to it.

Send your request to [email protected]. We will confirm your identity before acting (for example by replying to the email address or phone number you used with us), and we will respond within 30 days. These requests are free. For deletion, see our data deletion instructions. We do not make decisions about you based solely on automated processing.

Complaints

If you have a concern, please contact our Privacy Officer first at [email protected]; we will look into it and answer you in writing. If you are not satisfied, you can file a complaint with the Commission d’accès à l’information du Québec, or, if you live outside Quebec, with the Office of the Privacy Commissioner of Canada.

Children

Our website and services are meant for adults and businesses. We do not knowingly collect personal information from anyone under 14.

Changes to this policy

We will update this policy when our practices change and show the date of the latest version at the top of this page.