Privacy Policy
Procedure for the Retention, Destruction, and Anonymization of Personal Information
1. Overview
It is essential to implement a procedure for the retention, destruction, and anonymization of personal information in order to ensure the protection of individuals’ privacy, comply with personal data protection laws, prevent privacy incidents and security breaches involving personal information, maintain customer trust, and protect the organization’s reputation.
2. Purpose
The purpose of this procedure is to ensure the protection of individuals’ privacy and to comply with legal obligations regarding the protection of personal information.
3. Scope
This procedure applies to the entire lifecycle of personal information, from its collection to its destruction. It concerns all employees and stakeholders involved in the collection, processing, retention, destruction, and anonymization of personal information in accordance with legal requirements and best privacy practices.
4. Definitions
• Personal Information: Any information that allows the identification, directly or indirectly, of a natural person.
• Retention: Secure storage of personal information for the required duration.
• Destruction: Permanent deletion, elimination, or erasure of personal information.
• Anonymization: A process of modifying personal information so that the identification of individuals, directly or indirectly, is no longer possible at any time and in an irreversible manner.
4. Procedure
4.1 Retention Period
4.1.1 Personal information has been categorized as follows:
• Information about company employees
• Information about organization members
• Information about clients
4.1.2 The retention period for each category is as follows:
• Employees: 7 years after the end of employment
• Members: Variable depending on the type of personal information
• Clients: Variable depending on the type of personal information
For more details, refer to the full inventory of personal information held.
Note: Specific retention periods may apply.
4.2 Secure Storage Methods
4.2.1 Personal information is stored in the following locations: OneDrive, Wix
4.2.2 The sensitivity level of each storage location has been assessed.
4.2.3 These storage locations, whether paper or digital, are adequately secured.
4.2.4 Access to these storage locations is restricted to authorized personnel only.
4.3 Destruction of Personal Information
4.3.1 For paper-based personal information, it must be completely shredded.
4.3.2 For digital personal information, it must be completely deleted from devices (computers, phones, tablets, external hard drives), servers, and cloud tools.
4.3.3 A destruction schedule based on the established retention periods for each category must be created. It is imperative to document the scheduled destruction dates.
4.3.4 It must be ensured that the destruction is carried out in such a way that personal information cannot be recovered or reconstructed.
4.4 Anonymization of Personal Information
4.4.1 Personal information should only be anonymized if the organization intends to retain and use it for serious and legitimate purposes.
4.4.2 The selected anonymization method is as follows: data will be deleted after the retention period.
4.4.3 It must be ensured that the remaining information can no longer directly or indirectly identify the individuals in an irreversible manner. Regular assessments of the re-identification risk of anonymized data should be performed through testing and analysis to ensure its effectiveness.
Note: As of the date of this template, anonymization of personal information for serious and legitimate purposes is not yet possible. A government regulation must be adopted to establish the criteria and procedures.
4.5 Staff Training and Awareness
4.5.1 Regular training must be provided to employees on the procedure for the retention, destruction, and anonymization of personal information, as well as on the risks associated with privacy breaches.
4.5.2 This also includes raising staff awareness on good data security practices and the importance of following established procedures.
Last updated: April 2025
Procedure for Access Requests to Personal Information and Complaint Handling
1. Overview
Since individuals may request access to personal information held about them by an organization or file complaints, it is important to have predefined guidelines in place to respond to such requests.
2. Purpose
The purpose of this procedure is to ensure that all access requests are handled confidentially, promptly, and accurately, while respecting the rights of the individuals concerned.
3. Scope
This procedure applies to internal stakeholders responsible for handling access requests and complaints, as well as individuals seeking access to their own personal information.
4. Access Request Procedure
4.1 Submitting the Request
4.1.1 Individuals wishing to access their personal information must submit a written request to the organization’s Privacy Officer. The request may be sent by email or postal mail.
4.1.2 The request must clearly indicate that it is an access request for personal information and must provide sufficient information to identify the individual and the data sought.
4.1.3 This may include the individual's name, address, and any other relevant information that allows for reliable identification.
4.2 Receipt of the Request
4.2.1 Upon receipt of the request, an acknowledgment of receipt is sent to confirm that the request has been taken into account.
4.2.2 The request must be processed within thirty (30) days of receipt.
4.3 Identity Verification
4.3.1 Before processing the request, the individual’s identity must be reasonably verified. This may involve requesting additional information or verifying the individual’s identity in person.
4.3.2 If the identity cannot be satisfactorily verified, the organization may refuse to disclose the requested personal information.
4.4 Response to Incomplete or Excessive Requests
4.4.1 If a personal information access request is incomplete or excessive, the Privacy Officer will contact the individual to request additional information or clarification.
4.4.2 The organization reserves the right to refuse any request that is clearly abusive, excessive, or unfounded.
4.5 Processing the Request
4.5.1 Once identity is verified, the Privacy Officer responsible for access requests proceeds to gather the requested personal information.
4.5.2 The officer reviews the relevant records to collect the requested information, ensuring compliance with any legal restrictions.
4.6 Review of the Information
4.6.1 Before disclosing the personal information, the officer carefully examines it to ensure it does not contain confidential third-party information or data that could infringe on others’ rights.
4.6.2 If third-party information is present, the officer evaluates whether it can be separated or must be excluded from the disclosure.
4.7 Disclosure of the Information
4.7.1 Once all verifications are completed, the personal information is disclosed to the individual within a reasonable timeframe, in accordance with applicable legal requirements.
4.7.2 The information may be provided electronically, by secure postal mail, or in person, depending on the individual’s preferences and appropriate security measures.
4.8 Monitoring and Documentation
4.8.1 All steps in the access request process must be accurately and thoroughly documented.
4.8.2 The request details, actions taken, decisions made, and corresponding dates must be recorded in an access request tracking log, including:
• Date of receipt of the request
• Date of acknowledgment of receipt
• Date of identity verification
• Identity verification method
• Decision – access request approved or denied
• Date of disclosure (if applicable)
4.9 Confidentiality Protection
4.9.1 All staff involved in processing personal information access requests must maintain confidentiality and data protection standards.
4.10 Complaint and Appeal Management
4.10.1 If an individual is dissatisfied with the response to their access request, they must be informed of the available complaint and appeal procedures before the Commission d’accès à l’information.
4.10.2 Complaints must be handled in accordance with the organization’s internal complaint management policies and procedures (see next section).
5. Complaint Handling Procedure
5.1 Receiving Complaints
5.1.1 Complaints may be submitted in writing, by phone, by email, or via any other official communication channel. They must be logged in a centralized registry accessible only to designated staff.
5.1.2 The employee receiving the complaint must immediately inform the person responsible for handling complaints.
5.2 Preliminary Assessment
5.2.1 The designated officer reviews each complaint to assess its relevance and severity.
5.2.2 Frivolous, defamatory, or clearly unfounded complaints may be rejected. However, justification must be provided to the complainant.
5.3 Investigation and Analysis
5.3.1 The officer responsible for the complaint conducts an investigation by gathering evidence, interviewing involved parties, and collecting all relevant documentation.
5.3.2 The officer must be impartial and have the authority to resolve the complaint.
5.3.3 The officer must maintain confidentiality of all complaint-related information and ensure fair treatment of all parties involved.
5.4 Complaint Resolution
5.4.1 The complaint officer proposes appropriate solutions to resolve the complaint promptly.
5.4.2 Solutions may include corrective measures, financial compensation, or any other necessary action to satisfactorily resolve the issue.
5.5 Communication with the Complainant
5.5.1 The complaint officer communicates regularly with the complainant to keep them informed of the investigation’s progress and outcome.
5.5.2 All communication must be professional, empathetic, and respectful.
5.6 Closing the Complaint
5.6.1 Once the complaint is resolved, the officer must provide a written response to the complainant, summarizing the actions taken and the proposed solutions.
5.6.2 All documents and information related to the complaint must be stored in a confidential file.
Last updated: April 2025
Procedure for Requesting De-Indexing and Deletion of Personal Information
1. Overview
This procedure is intended to address our clients’ privacy and personal information protection concerns.
2. Objective
The purpose of this procedure is to provide a structured mechanism for handling client requests for de-indexing and deletion of personal information.
3. Scope
This procedure applies to our internal team responsible for managing requests for de-indexing and deletion of personal information. It covers all information published on our online platforms, including our website, mobile applications, databases, or any other digital media used by our clients.
4. Definitions
• Deletion of Personal Information: The action of completely erasing data, making it unavailable and unrecoverable.
• De-indexing of Personal Information: The removal of information from search engine results, making it less visible, though still directly accessible.
Deletion permanently eliminates the data, while de-indexing limits its online visibility.
5. Procedure
5.1 Receiving Requests
5.1.1 Requests for de-indexing and deletion of personal information must be received by the designated responsible team.
5.1.2 Clients may submit their requests through specific channels such as an online form, a dedicated email address, or a phone number.
5.2 Identity Verification
5.2.1 Before processing the request, the individual’s identity must be reasonably verified.
5.2.2 This may be done by requesting additional information or by verifying the individual’s identity in person.
5.2.3 If identity cannot be satisfactorily verified, the organization may refuse to process the request.
5.3 Request Evaluation
5.3.1 The responsible team must carefully review the requests, and the personal information involved to determine their eligibility for de-indexing or deletion.
5.3.2 Requests must be handled confidentially and within the prescribed timeframes.
5.4 Reasons for Refusal
5.4.1 There are valid reasons for which we may refuse to delete or de-index personal information, such as:
• To continue providing goods and services to the client;
• For employment law requirements;
• For legal reasons in the case of litigation.
5.5 De-indexing or Deletion of Personal Information
5.5.1 The responsible team must take the necessary steps to de-index or delete personal information in accordance with eligible requests.
5.6 Communication and Follow-Up
5.6.1 The responsible team is in charge of communicating with applicants throughout the process, providing acknowledgment receipts and regular updates on the status of their request.
5.6.2 Any delays or issues encountered during processing must be communicated to the applicants with clear explanations.
5.7 Monitoring and Documentation
5.7.1 All requests for de-indexing and deletion of personal information, as well as the actions taken in response, must be logged in a dedicated tracking system.
5.7.2 Records must include request details, actions taken, dates, and outcomes.
Last Updated: April 2025
Security Incident and Personal Information Breach Management Procedure
1. Overview
An incident response plan is essential for managing cyber incidents effectively. During a crisis, it's easy to overlook important steps. A response plan reduces the risk of missing critical actions and lowers stress.
2. Objective
The purpose of this procedure is to ensure the organization is ready to respond to a cyber incident and resume operations quickly.
3. Scope
This procedure covers all networks and systems, as well as stakeholders (clients, partners, employees, subcontractors, suppliers) who access these systems.
4. Recognizing a Cyber Incident
A cybersecurity incident may not be recognized or detected immediately. However, certain signs may indicate a breach or unauthorized activity. It's essential to stay alert for any indicators that a security incident has occurred or is ongoing.
Examples of such indicators:
• Unusual or excessive system or login activity, especially from inactive user accounts.
• Unusual or excessive remote access within your organization (staff or third-party providers).
• New, visible, or accessible wireless networks (Wi-Fi) appearing.
• Suspicious activity related to malware, suspicious files, or unauthorized/executable programs.
• Lost, stolen, or misplaced devices containing payment card data, personal information, or other sensitive data.
5. Contact Information
Responsible Party: Diane Fournier
Email: dianefournierart@gmail.com
Phone: 514-953-2557
Website: dianefournier.com
6. Personal Information Breach – Specific Response
If a security incident involving a personal information breach is confirmed, the following steps must be taken:
• Complete the privacy incident log to document the incident.
• Assess the breach to determine if personal information was lost due to unauthorized access, use, or disclosure, and whether there is a risk of serious harm to affected individuals.
• If so, report the breach to the Commission d’accès à l’information in Québec.
• Notify all individuals whose personal information was involved in the incident.
7. Ransomware – Specific Response
If a ransomware attack is confirmed, the following steps must be taken:
• Immediately disconnect affected devices from the network.
• DO NOT DELETE anything from devices (computers, servers, etc.).
• Examine the ransomware and determine how the device was infected to help remove it.
• Notify local authorities and cooperate with their investigation.
• After removing the ransomware, run a full system analysis using the latest antivirus and anti-malware tools to ensure it has been fully eliminated.
• If the ransomware cannot be removed (often the case with stealthy malware), the device must be reset using original installation media or images.
• Before restoring from backups, ensure they are not infected.
• If critical data must be restored and cannot be recovered from clean backups, look for decryption tools on nomoreransom.org.
• The policy is not to pay the ransom, unless deemed necessary based on the stakes involved. It is also highly recommended to involve a breach coach (cyberattack project manager).
• Protect systems from reinfection by applying patches and updates to prevent future attacks.
8. Account Hacking – Specific Response
If an account breach is confirmed, the following steps must be taken:
• Notify clients and suppliers that they may receive fraudulent emails appearing to come from us, and advise them not to reply or click on any links.
• Check whether you still have access to the compromised account.
• If not, contact the platform’s support team to attempt to recover access.
• Change the account password.
• If the same password is used elsewhere, change those as well.
• Enable two-factor authentication on the platform.
• Remove illegitimate connections and devices from the login history.
9. Loss or Theft of a Device – Specific Response
If device loss or theft is confirmed, the following steps must be taken:
• Report the theft or loss of any property (computer, laptop, mobile device) to local law enforcement immediately, including outside of normal business hours or on weekends.
• If the device contained sensitive data and is not encrypted, assess the sensitivity, type, and volume of data, including any potentially affected payment card numbers.
• If possible, lock/disable lost or stolen mobile devices (e.g., smartphones, tablets, laptops) and perform remote data wiping.
Last Updated: April 2025
Legislation
We are committed to complying with the legislative requirements outlined in:
Québec
Amendments to Law 25
This privacy policy may be updated occasionally to maintain compliance with the law and reflect any changes in our data collection process. We recommend that users check our policy from time to time to ensure they are aware of any updates. If necessary, we may inform users of changes via email.
Update: April 2025