How we collect, retain, protect, and — when the time comes — delete the personal information you share with us.
It is important to implement a procedure for the retention, destruction, and anonymization of personal information to ensure the protection of individuals' privacy, comply with personal information protection laws, prevent confidentiality incidents involving personal information and security breaches, maintain customer trust, and protect the organization's reputation.
The purpose of this procedure is to ensure the protection of individuals' privacy and to comply with legal obligations regarding the protection of personal information.
The scope of this procedure should cover the entire life cycle of personal information, from its collection to its destruction. It applies to all employees and stakeholders involved in the collection, processing, retention, destruction, and anonymization of personal information in accordance with legal requirements and best practices in privacy protection.
Personal Information: Any information that can identify, directly or indirectly, a physical person.
Retention: Secure storage of personal information for the required period.
Destruction: Complete deletion, elimination, or erasure of personal information.
Anonymization: The process of modifying personal information so that it no longer allows the identification, directly or indirectly, of the individuals concerned, in an irreversible manner.
5.1.1 Personal information is categorized as follows:
5.1.2 The retention period for each category is as follows:
Company employees: 7 years after the end of employment.
Members: Variable depending on the type of personal information.
Clients: Variable depending on the type of personal information. For more details, refer to the complete inventory of retained personal information. Specific retention periods may apply.
5.2.1 Personal information is stored in locations such as One Drive, Leadfox. 5.2.2 The sensitivity level of each storage location has been assessed. 5.2.3 These storage locations, whether paper or digital, are adequately secured. 5.2.4 Access to these storage locations is restricted to authorized persons only.
5.3.1 For personal information on paper, it must be completely shredded. 5.3.2 For digital personal information, it must be completely deleted from devices (computers, phones, tablets, external hard drives), servers, and cloud tools. 5.3.3 A destruction schedule based on the established retention period for each category of personal information must be created. It is imperative to document the scheduled destruction dates. 5.3.4 Ensure that the destruction is carried out so that personal information cannot be recovered or reconstructed.
5.4.1 Anonymization of personal information should only be done if the organization wishes to retain and use it for serious and legitimate purposes. 5.4.2 The chosen method of anonymization is as follows: will be deleted after the retention period. 5.4.3 Ensure that the remaining information no longer allows, in an irreversible manner, the direct or indirect identification of the individuals concerned and regularly assess the risk of re-identification of anonymized data by performing tests and analyses to ensure their effectiveness. Note that as of the drafting date of this template, the anonymization of personal information for serious and legitimate purposes is not possible. A government regulation must be adopted to determine the criteria and modalities.
5.5.1 Ensure regular training for employees on the procedure for the retention, destruction, and anonymization of personal information, as well as on the risks associated with privacy breaches. 5.5.2 This includes raising awareness among staff about good data security practices and the importance of complying with established procedures.
Since an individual may request access to personal information that an organization holds about them, or may also file complaints, it is important to have predefined guidelines to respond to such requests.
The purpose of this procedure is to ensure that all access requests are handled confidentially, promptly, and accurately, while respecting the rights of the individuals concerned.
The scope of this procedure involves the internal actors responsible for handling access requests and complaints, as well as individuals wishing to access their own personal information.
4.1.1 The individual wishing to access their personal information must submit a written request to the organization's personal information protection officer. The request can be sent by email or postal mail. 4.1.2 The request must clearly indicate that it is an access request for personal information, and provide sufficient information to identify the individual and the information sought. 4.1.3 This information may include the name, address, and any other pertinent information to reliably identify the individual making the request.
4.2.1 Once the request is received, an acknowledgment of receipt is sent to the individual to confirm that their request has been taken into account. 4.2.2 The request must be processed within thirty (30) days of its receipt.
4.3.1 Before processing the request, the individual's identity must be reasonably verified. This can be done by requesting additional information or by verifying the individual's identity in person. 4.3.2 If the identity cannot be satisfactorily verified, the organization may refuse to disclose the requested personal information.
4.4.1 If an access request for personal information is incomplete or excessive, the personal information protection officer communicates with the individual to request additional information or clarifications. 4.4.2 The organization reserves the right to refuse a request if it is manifestly abusive, excessive, or unjustified.
4.5.1 Once the identity is verified, the personal information protection officer processes the access requests for personal information by collecting the requested information. 4.5.2 The officer consults the relevant files to collect the requested personal information, ensuring compliance with any legal restrictions.
4.6.1 Before disclosing personal information to the individual, the officer carefully reviews the information to ensure it does not contain confidential third-party information or information that could infringe on other rights. 4.6.2 If third-party information is present, the officer assesses whether it can be separated or must be excluded from the disclosure.
4.7.1 Once the verifications are complete, the personal information is communicated to the individual within a reasonable timeframe, in accordance with legal requirements. 4.7.2 Personal information may be communicated to the individual electronically, by secure postal mail, or in person, depending on the individual's preferences and appropriate security measures.
4.8.1 All steps of the process for handling access requests for personal information must be accurately and completely recorded. 4.8.2 The details of the request, the actions taken, the decisions made, and the corresponding dates must be recorded in an access request tracking log.
Date of receipt of the request;
Date of acknowledgment of receipt;
Date of identity verification;
Method of identity verification;
Decision – access request accepted or refused;
Date of communication of the information (if applicable).
4.9.1 All personnel involved in handling access requests for personal information must respect confidentiality and data protection.
4.10.1 If an individual is dissatisfied with the response to their access request for personal information, they must be informed of the complaint procedures and the remedies available before the Commission d'accès à l'information.
4.10.2 Complaints must be handled in accordance with internal policies and procedures for complaint management (next section).
This procedure aims to address clients' concerns and privacy protection needs.
The purpose of this procedure is to provide a structured mechanism for handling deindexing and deletion requests for personal information from our clients.
This procedure applies to our internal team responsible for managing deindexing and deletion requests for personal information. It covers all information published on our online platforms, including our website, mobile applications, databases, or any other digital medium used by our clients.
Deletion of Personal Information: The action of completely erasing data, making it unavailable and unrecoverable.
Deindexing of Personal Information: Removing information from search engines, making it less visible but still directly accessible. Deletion permanently eliminates data, while deindexing limits its online visibility.
5.1.1 Deindexing and deletion requests for personal information must be received by the designated responsible team. 5.1.2 Clients can submit their requests through specific channels such as an online form, dedicated email address, or phone number.
5.2.1 Before processing the request, the individual's identity must be reasonably verified. 5.2.2 This can be done by requesting additional information or by verifying the individual's identity in person. 5.2.3 If the identity cannot be satisfactorily verified, the organization may refuse to proceed with the request.
5.3.1 The responsible team must carefully review the requests and the personal information concerned to determine their eligibility for deindexing or deletion. 5.3.2 Requests must be handled confidentially and within the specified timeframes.
5.4.1 There are also valid reasons for refusing to delete or deindex personal information:
5.5.1 The responsible team must take the necessary steps to deindex or delete personal information according to eligible requests.
5.6.1 The responsible team is tasked with communicating with requesters throughout the process, providing acknowledgment of receipt and regular updates on the status of their request. 5.6.2 Any delays or issues encountered during the processing of requests must be communicated to the requesters with clear explanations.
5.7.1 All deindexing and deletion requests for personal information, as well as the actions taken to respond to them, must be recorded in a dedicated tracking system. 5.7.2 Records must include details of the requests, actions taken, dates, and results of the actions performed.
An intervention plan is essential for effectively managing cybersecurity incidents. In times of crisis, knowing how to act and prioritize actions can be challenging. An intervention plan helps reduce the stress of forgetting important aspects.
The purpose of this procedure is to ensure the organization is ready to intervene in the event of a cybersecurity incident, enabling a quick resumption of activities.
The scope of this procedure includes all networks and systems, as well as stakeholders (clients, partners, employees, subcontractors, suppliers) who access these systems.
A cybersecurity incident may not be immediately recognized or detected. However, certain indicators can signal a security breach, a compromised system, or unauthorized activity. It is crucial to stay alert for any signs indicating that a security incident has occurred or is in progress. Some of these indicators include:
Role Owner: Francois Tetu
Phone: 514 234 8388
Email: info@3i.global
If it is confirmed that a security incident involving a personal information breach has occurred, the following steps must be taken:
If it is confirmed that a ransomware security incident has occurred, the following steps must be taken:
If it is confirmed that an account hacking has occurred, the following steps must be taken:
If it is confirmed that a device loss has occurred, the following steps must be taken:
Reach out to our privacy officer directly.