1. Responsibilities and operation

The company's president and CEO delegates the role of Privacy Officer to the vice president of human resources, as required by law.

A committee was established in January 2023 to support the Privacy Officer and monitor our commitments to protecting personal information.

This committee meets at least twice a year, or more frequently as needed. It is composed of the Vice President, or an employee designated by him, for each of the following key areas:

• Human Resources
• Information Technology
• Finance
• Legal Affairs

 

2. Collection of personal information

We are committed to collecting only the personal information necessary to carry out our activities.

We inform our employees and collaborators of the purposes for which this information is collected and, when required, we obtain their consent to use or disclose it.

3. Disclosure of personal information

We disclose personal information to third parties only in the following cases:

when we obtain the consent of the individual concerned, or

when permitted or required by law.

 

4. Security of personal information

We take all reasonable measures to protect personal information from:

• loss
• misuse
• unauthorized access
• disclosure
• alteration
• destruction

 

5. Retention and destruction of personal information

Personal information is stored in secure systems and files with controlled access.
Access is restricted to a limited number of employees who absolutely need this information to perform their work.

Personal information that is no longer required is destroyed according to a process reviewed annually by the committee.

 

6. Incident Management

The RPRP is responsible for taking all necessary measures when a security incident involving personal information occurs.

It must also keep a record of incidents, which includes:

the date and circumstances of the incident;

the date on which the company became aware of the incident;

the identity of the person who conducted the investigation;

the personal information involved;

the level of sensitivity of the information concerned;

the number of people affected or an estimate thereof;

the measures taken to mitigate the harm;

the date on which the notice was sent to the Commission d'accès à l'information and to the individuals concerned;

where applicable, the reasons why the company is not required to disclose the incident.

 

7. Accountability

Once a year, the RPRP submits a report on the committee's activities related to the protection of personal information to the company's Board of Directors.

 

8. Access to personal information and complaints

All employees and partners have the right to request access to their personal information that we hold and to request that it be corrected if they believe it is inaccurate.

They may also file a complaint if they believe that their personal information is not being handled or stored properly.

The RPRP is responsible for handling all requests and complaints diligently.

Please address your request or complaint to the Privacy Officer.

 

9. Contact

If you have any questions about this policy or how we manage personal information, please contact our Privacy Officer:

 

Jean-François Reid
Vice President, Human Resources
📧 jeanfrancoisreid@roxborobauval.ca
📞 (514) 631-1888