Policies and practices for
personal information governance

Régitex is committed to protecting all personal information collected and used in the management of its activities.

Objectives of information collection

Everyone who works with Régitex, for it or on its behalf, is required to respect the confidentiality of personal information and every person’s right to privacy, in accordance with the Act respecting the protection of personal information in the private sector, when they collect, use, disclose, retain or dispose of personal information in the course of their duties.

Policy statement

Personal information under Régitex’s custody or control is created, collected, retained, used, disclosed and disposed of only in a manner that complies with the Act respecting the protection of personal information in the private sector. We respect the right to privacy of the persons whose personal information is in our possession, in accordance with these requirements.

Personal information

Personal information is defined as any information or combination of information that relates to a natural person and allows that person to be identified. However, an individual’s name, as well as their business contact information, namely their professional title, address, telephone number and email address, is not personal information.

Personal information must be protected regardless of the nature of its medium and whatever its form: written, graphic, audio, visual, computerized or other.

Consent

The organization obtains a person’s written consent in the following situations:

• before personal information is collected, unless asking for consent would result in the collection of inaccurate information, would run counter to the purpose of the collection, or would compromise the use of the information collected;
• before personal information is used or disclosed for purposes other than those for which the information was collected or prepared;
• before any removal of personal information, unless such removal is expressly authorized by law;
• if it intends to disclose a complaint received by the business or any privileged or confidential information obtained in the course of an investigation or proceeding.

Obtaining a person’s consent to the collection of personal information does not replace or establish the authority to collect that information under the Act; rather, the organization ensures that the personal information to be collected is directly related to and clearly necessary for its activities.

Collection of personal information

Personal information may be collected or created only under the following conditions: it is directly related to an activity of the organization, and its collection is necessary to enable the organization to fulfil the purposes provided for by law or to achieve its objectives. Before collecting or creating new personal information, the organization determines the information concerned and the purposes of its collection, and collects only what is necessary to achieve those purposes.

We limit the collection, use and disclosure of your personal information solely to the purposes we have indicated to you. Your personal information may be accessed only by certain authorized persons, and only within the scope of the tasks assigned to them.

Disclosure of personal information

Personal information held by the organization will not be disclosed unless the consent of the person concerned has been obtained, or unless disclosure is authorized or required under the Act. Any person subject to this policy discloses only the minimum information required to fulfil the valid purposes indicated, and consults the privacy officer before any disclosure that would fall outside the scope of their duties.

Retention of information

We retain your personal information for as long as necessary for the purposes for which it was collected, then destroy it in accordance with the law and our records retention policy, while ensuring its confidentiality throughout the destruction process.

Accuracy

The organization takes reasonable steps to ensure that personal information is as accurate, complete and up to date as the purposes for which it is intended require, and has documented procedures allowing individuals to request the correction of their personal information when they believe there has been an error or omission.

Accountability

We are responsible for the personal information in our possession or under our custody, including information we entrust to third parties for processing, from whom we require strict standards of confidentiality and security. Our person in charge of the protection of personal information, Éric Boulianne, oversees this policy and the related processes. Our staff are informed and adequately trained on our policies and practices regarding the protection of personal information.

Security measures

The organization protects personal information under its custody or control against unauthorized access, collection, use, disclosure or removal, through a combination of technical, administrative and physical safeguards proportionate to the sensitivity, quantity, distribution, format and storage method of the information to be protected.

These measures include organizational measures, such as restricting access to what is necessary and backing up and archiving data through an external system, as well as technological measures such as the use of passwords, encryption and firewalls.

Access to personal information

The organization requires that access to personal information be role-based and limited to the minimum amount necessary for the authorized purposes, and monitors this access to promptly detect any inappropriate or unauthorized access. Service providers are required to comply with the organization’s obligations regarding the handling and protection of personal information, and to comply with this policy.

Requests for access to information and changes

Subject to the exceptions provided for by the Act, any person may access their personal information held by the organization, review it or receive a copy by submitting a written request to the privacy officer. We will provide this information within a reasonable time of receiving the request; reasonable fees may be charged.

In certain particular circumstances, we may refuse to provide the requested information, in particular when it concerns other persons, cannot be disclosed for legal, security or copyright reasons, was obtained in the course of a fraud investigation, can be obtained only at prohibitive cost, or is the subject of litigation or is privileged.

Person in charge of the protection of personal information

Éric Boulianne
eric.boulianne@regitex.com
418 397-5775, ext. 237

Any request for access or modification, as well as any complaint concerning the protection of personal information, may be sent to the person named above, marked for the attention of “Privacy Protection”. We will investigate any complaint and, if it is found to be justified, take appropriate measures, including amending our policies and practices as needed.

Training and awareness

The company promotes best practices and respect for rights regarding transparency and the protection of personal information: it informs its staff through a consent form, posts the name and contact details of the person in charge, and uses various awareness-raising means (information sessions, reminders at team meetings, training, action plan, logbook).

Policy update

This policy must be reviewed every three years. It is also updated whenever there is a substantial change to legislation or regulatory requirements.