Policy on the Protection of Personal and Confidential Information
1. Introduction
Groupe Conseil Genicom Inc. is committed to respecting your privacy and protecting your personal information.
In the course of using its services, Groupe Conseil Genicom Inc. may collect personal information, and you may in turn disclose such information to us.
The purpose of this policy is to explain, to the users of the services offered by Groupe Conseil Genicom Inc., the following elements:
- How their personal data is collected and processed;
- What rights they have with respect to their data;
- Who is responsible for processing personal data;
- To whom this data is transmitted;
- The use of cookies on Groupe Conseil Genicom Inc.'s websites.
2. Applicable Laws
In the course of using its services, Groupe Conseil Genicom Inc. may collect personal information, and you may in turn disclose such information to us. The collection, use, disclosure and retention of your personal information are subject to the Act Respecting the Protection of Personal Information in the Private Sector (CQLR, c. P-39.1).
3. Personal Information
Any information that relates to a natural person and allows that person to be identified is considered personal. Your personal information may include, but is not limited to, your first and last name, date of birth, home address, phone numbers, gender, email address, information about your family situation, information you provide when creating a profile to subscribe to one of our services, your lifestyle, or your health.
However, information relating to the performance by the person concerned of a role within a business, such as their name, title and function, as well as the address, email address and phone number of their workplace, will not be considered personal information.
4. Our Commitment
We have established and enforced internal policies and procedures designed to adequately protect the personal information in our possession, regardless of its medium or form. We review them on a regular basis.
We raise our staff's awareness of the importance of protecting personal information by providing training on the subject and by periodically issuing directives outlining their role and obligations in this regard.
5. Objectives of Information Collection
As part of our duties, we collect your personal and confidential information solely to enable us to provide you with the requested services in an adequate and personalized manner. In all cases, the disclosure of your personal information will be subject to confidentiality obligations and compliance with applicable laws.
6. Consent
Subject to the exceptions and requirements of applicable laws, we will not communicate or disclose your personal information to any other third party without your consent.
By using our services, you consent to the collection, use and disclosure of your personal information in accordance with this policy. The form of consent may vary depending on the context or the service requested.
Your consent will be requested, among others:
- By a person representing our senior management, for contractual purposes;
- By a person representing our human resources department;
- By a person representing one of the services you wish to use.
You may withdraw your consent at any time, subject to certain legal or contractual restrictions.
In certain specific circumstances, we may collect, use or disclose personal information without informing you or without your having given your consent. Such circumstances arise, among others, when, for legal, medical or security reasons, it is impossible or unlikely to obtain your consent, or when the information is necessary to conduct an investigation into a possible breach of contract, to prevent or detect fraud, or to enforce the law.
Before disclosing personal information concerning another person to us, you must obtain that person's consent regarding the disclosure and processing of such personal information under the terms of this policy.
6.1 Personal Information Concerning a Minor
Personal information concerning a minor under the age of 14 will not be collected from that minor without the consent of the person holding parental authority or the person acting as tutor.
7. Limits on Collection, Use and Disclosure
7.1 Collection
We limit the collection, use and disclosure of your personal information solely to the purposes we have indicated to you. Personal information is accessible to any individual within Groupe Conseil Genicom Inc. only if that information is necessary for the performance of their duties.
7.2 Use
We may use the personal information collected for, among others, the following purposes:
- To provide the requested service;
- To confirm your identity and respond to your requests for information;
- To provide any other complementary service associated with the requested service;
- To comply with legal and regulatory requirements.
7.3 Disclosure
We may disclose your personal information to any of our staff members, professional advisors, suppliers, subcontractors, or affiliates, to the extent reasonably necessary to provide the requested services and for the purposes set out in this policy.
As a general rule, we do not disclose your personal information. On occasion, we may communicate your personal information to certain suppliers or agents in order to provide the services you have requested from us. In all cases, we comply with the restrictions and requirements set out by law when we disclose your personal information, and this is, in certain circumstances, subject to a written agreement and a security assessment demonstrating that your personal information benefits from protection that is adequate and similar to that in place within Groupe Conseil Genicom Inc.
Your personal information will not be disclosed to third parties other than in accordance with this Privacy Policy, except as required or authorized by law, or as ordered by a court of competent jurisdiction.
We do not sell your personal information to third parties.
7.4 Impact Assessment
A privacy impact assessment (PIA) regarding the use of personal information by our services and/or systems is carried out before any personal information is collected by Groupe Conseil Genicom Inc. Where transfers are made outside of Quebec, the impact of such a transfer will also be assessed.
7.5 International Data Transfers
The information we collect may be stored, processed and transferred in any country in which Groupe Conseil Genicom Inc. and its subcontractors offer their services, in order to allow us to use the information in accordance with this policy.
The information we collect may be transferred or processed in a country outside of Quebec.
You expressly agree to the transfer of personal information described in this section.
8. Non-Personal Information
We automatically collect certain non-personal information using third-party analytics programs, such as Google Analytics, to help us understand how our visitors use our Web services, but none of this information can be used to identify you. The following information may be collected, stored and used:
- Information about your computer, including your IP address, geographic location, browser type and version, and operating system;
- Information about your visits and use of our websites, including referring source, visit duration, page views and website navigation paths;
- Information generated when using our site, including when, how often and under what circumstances you use it.
9. Cookies
The Web services of Groupe Conseil Genicom Inc. and its affiliates use cookies. Cookies are small data files stored on your computer's or mobile device's memory when you visit a website or application. They are used to enhance your user experience by recording certain data. You may accept or decline the use of these cookies: in the latter case, your user experience on our websites may be reduced.
9.1 Cookies We Use on Our Websites
We may use cookies for the following purposes:
- Technical or functional cookies: Certain cookies ensure the proper functioning of certain parts of a website and account for your preferences as a user. By placing functional cookies, this facilitates your visit to our websites. For example, you may not need to re-enter the same information repeatedly when visiting our websites, since this information is saved in a cookie.
- Statistical cookies: Statistical cookies are sometimes used to optimize the experience of internet users on our websites. With these statistical cookies, we can obtain information about the use of our websites.
9.2 Cookies Used by Our Service Providers
In certain situations, one of our services may be provided by one of our external providers, who may use cookies that will be stored on your computer or mobile device.
9.3 Managing Cookies
You can set your browser or device to refuse cookies or delete them after they are saved. Please consult the "Help" section of your browser or device for the necessary instructions. Please note that deleting or refusing these cookies may impair your user experience.
10. Retention of Information
When your personal information is no longer needed, it is destroyed in accordance with the law and our records retention policy. In certain circumstances, we may anonymize the personal information we retain.
Your personal and confidential information is retained, directly or through subcontractors, only for the period necessary for the purposes of the requested services and applicable legal and regulatory requirements. We require our subcontractors to adhere to confidentiality commitments and to apply policies equivalent to this one. In all cases, access to your personal and confidential information is restricted to individuals for whom access is necessary in the performance of their duties.
11. Accountability
We are responsible for the personal information in our possession or under our custody, including information we entrust to third parties for the purpose of providing you with the requested service. We require these third parties to retain this information in accordance with strict confidentiality and security standards.
We adhere to the principles set out by the law. We have implemented policies and directives that ensure the protection of your privacy. The person responsible for the protection of personal information oversees this personal information protection policy as well as the company's various frameworks.
Our staff is informed and adequately trained on policies and practices regarding the protection of personal information.
12. Security Measures
We have implemented several security measures regarding the personal information and confidential data we hold, in order to protect them against loss and theft and to prevent unauthorized access, transmission, use or modification of this personal information, notably through the following subsections:
12.1 Privacy Impact Assessment
Groupe Conseil Genicom Inc. conducts a privacy impact assessment for any project involving the acquisition, development or redesign of an information system or electronic service delivery involving the collection, use, disclosure, retention or destruction of personal information. This assessment documents the serious and legitimate interest in the use of personal information.
12.2 Secure IT Environments
Our infrastructure and equipment are hosted in a secure environment, in a data center located in Quebec, Canada. In cases where it is not possible to host a solution or service in Quebec, we ensure that security measures equivalent to or greater than those required by this Policy are put in place.
Access to Groupe Conseil Genicom Inc.'s Web services is done through a secure transmission channel using an SSL certificate (HTTPS).
12.3 Access Management
Only staff members whose duties require it have access to personal or confidential information. Data access is logged and monitored.
12.4 Training and Awareness
Our staff and partners are trained and made aware of the importance of protecting your personal information.
12.5 Confidentiality Commitment
Our staff members are required to sign a confidentiality commitment.
Security audits are conducted by firms specializing in information security.
12.6 Destruction
Groupe Conseil Genicom Inc. ensures physical and technological security for the personal information it retains, in order to prevent accidental destruction, loss and disclosure, as well as improper destruction.
We retain your personal information for as long as necessary for the purposes for which it was collected. We must destroy or anonymize this information in accordance with the law and our retention schedule. When we destroy or anonymize your personal information, we take the necessary measures to ensure its confidentiality and to ensure that no unauthorized person can access it during the destruction or anonymization process.
12.7 Managing Incidents Involving Personal Information
If Groupe Conseil Genicom Inc. has reason to believe that a confidentiality incident involving personal information has occurred and that it presents a risk of serious harm, Groupe Conseil Genicom Inc. will diligently inform the Commission d'accès à l'information as well as any person whose personal information is concerned by the incident. It may also notify any person or organization that could reduce this risk, disclosing only the personal information necessary for this purpose, without the consent of the person concerned. In all cases, a record will document the incident for reference purposes.
13. Users' Rights
13.1 Request for Access, Withdrawal or Correction
Subject to any regulatory or contractual restrictions, you may consult, have corrected, or have destroyed the personal information we hold about you.
We will provide you with such information within a maximum of 30 days from the date of receipt of the written request, in a structured and commonly used technological format. Fees may, however, be charged to process your request.
In certain specific circumstances, we may refuse to provide you with the requested information. Exceptions to your right of access include cases where the information cannot be disclosed for legal or security reasons. These limitations are described in the Act Respecting the Protection of Personal Information in the Private Sector (CQLR, c. P-39.1).
You may verify the accuracy and completeness of your personal information and, where applicable, request that it be corrected. Any request for correction will be processed in accordance with the law.
Members, as well as candidates, nonetheless have an obligation to keep their information up to date in accordance with the Professional Code.
13.2 Right to Be Forgotten or Right to De-indexing
The right to request that search engines remove links to web pages containing inaccurate, incomplete or outdated personal information, particularly if the dissemination of this information infringes on your rights.
Submit a request to the search engine operator specifying the URLs to be de-indexed and the reasons for the request.
At Groupe Conseil Genicom Inc., there is no public indexing or online visibility of personal data. A de-indexing policy will be put in place should this situation change.
13.3 Data Portability
Users have the right to request the portability of their personal data, held by Groupe Conseil Genicom Inc., to another site.
13.4 Limitation of and Objection to Data Processing
Users have the right to request the limitation of, or to object to, the processing of their data by Groupe Conseil Genicom Inc., and Groupe Conseil Genicom Inc. may not refuse this request except where legitimate and compelling grounds exist that may override the interests, rights and freedoms of the user.
13.5 Decisions Based Solely on Automated Processing
Users have the right not to be subject to a decision based solely on automated processing if the decision produces legal effects concerning them or significantly affects them in a similar manner.
14. Requests, Complaints and Questions
We are committed to responding to your questions and concerns regarding the protection of your personal information. If the response does not satisfy you, you may contact the Privacy Officer at the address mentioned above.
14.1 Contact Information
Any request or complaint regarding the protection of personal information must be directed to the Privacy Officer at the address below:
Privacy Officer
GROUPE CONSEIL GENICOM INC.
1550 Ampère Street, suite 300,
Boucherville, Quebec J4B 7L4
Email: vieprivee@gcgenicom.com
If the Privacy Officer of Groupe Conseil Genicom Inc. decides not to respond to a user's request, and the user wishes to challenge this decision, or believes that one of their rights has been violated, they are entitled to contact the Commission d'accès à l'information du Québec.
15. Review and Approval
This Policy takes effect upon its adoption by the Committee on Access to Information and Protection of Personal Information, and may be revised at any time by the Privacy Officer.
Amendments may be proposed by various stakeholders of Groupe Conseil Genicom Inc., and must be submitted in writing to the Officer responsible for access to information and the protection of personal information.
Groupe Conseil Genicom Inc. reserves the right to modify this policy at any time. Any modification will be published on Groupe Conseil Genicom Inc.'s various Web platforms. Your continued use of the services following the posting of changes to the policy constitutes acceptance of these changes.
This Policy should be reviewed at least every two years to ensure its relevance in light of Groupe Conseil Genicom Inc.'s mission, its users' activities, and any substantial changes to legislation or regulatory requirements.
16. Effective Date
This Policy takes effect on September 28, 2024. It cancels and replaces all previous frameworks on this subject.