Privacy Policy
Privacy and Personal Information Protection Policy
Creation Date: April 2024
Version 1: April 2024
Objective
The objective of this policy is to promote responsible practices in the handling and management of personal data, in compliance with the Personal Information Protection Act.
More specifically, the Confidential Data Protection Policy aims to outline the measures the Châteauguay Community Centre is committed to implementing to safeguard the confidentiality of the personal information it collects. It also seeks to inform stakeholders about the process established to handle complaints related to personal information protection and confidentiality incidents.
Scope
This policy applies to confidential data and personal information collected, used, stored, or disclosed by the Châteauguay Community Centre. It specifically addresses data related to donors, information linked to the organization’s activities, as well as information concerning clients, members of the Board of Directors, staff, interns, individual members, and peer support workers.
The policy governs relationships among all individuals, including clients, board members, donors, staff, interns, peer support workers, community service or compensatory workers, partners, and anyone present on the premises of the Châteauguay Community Centre.
It also applies to relationships with third-party partner organizations that handle confidential information on behalf of the Châteauguay Community Centre.
Application Procedures
The organization’s management and the Board of Directors are responsible for implementing and enforcing the privacy policy.
Board members, the management team, employees, interns, and peer support workers must complete a commitment form to comply with this policy upon its effective date.
Failure to adhere to this policy may result in disciplinary actions, up to and including dismissal or exclusion.
Roles and Responsibilities of Team Members
Each team member of the Châteauguay Community Centre formally commits to maintaining the confidentiality of personal information they collect or that is collected by others, in accordance with this policy.
The person responsible for personal information protection at the Châteauguay Community Centre is Nadia Tremblay, Executive Director.
- Ensuring appropriate measures are in place to protect personal information throughout its lifecycle, from collection to destruction;
- Responding to requests for access, rectification, and communication with third parties;
- Receiving, documenting, and ensuring the resolution of complaints and confidentiality incidents;
- Maintaining the confidentiality incident register.
Commitment
The Châteauguay Community Centre is committed to:
- Protecting personal information and confidential data obtained and under its control;
- Informing the individual at the time personal information is collected;
- Collecting only the data necessary and relevant;
- Obtaining consent when required for the collection, use, or disclosure of personal information;
- Retaining personal information for specific purposes;
- Protecting personal information through appropriate measures;
- Providing individuals, upon request, with information about the personal data held about them;
- Ensuring the prompt and confidential handling of complaints.
1. Protecting Personal Information and Confidential Data Obtained and Under Its Control
The Châteauguay Community Centre is responsible for the personal information it holds and controls. It will implement appropriate measures to ensure a comparable level of protection when such information is processed by a third party. The Centre has established policies and procedures to safeguard personal information. The Executive Director has been appointed as the person responsible for personal information protection to oversee privacy-related matters. Employees have been trained on the privacy policy and their specific roles in protecting personal information.
2. Informing the Individual at the Time of Personal Information Collection
When the Châteauguay Community Centre collects personal information, the individual is informed verbally, in writing, or by email about the reasons for the collection, how the information will be used, and with whom it may be shared.
Unless required or permitted by law, the Centre will not disclose personal information for purposes other than those for which it was collected without the individual’s consent. Personal information is shared only with individuals who need it to perform their duties.
3. Collecting Only Necessary and Relevant Data
The Châteauguay Community Centre will limit the collection of personal information to what is reasonably required to carry out its activities and provide its services. Personal information collected is strictly necessary for the purpose of the relevant file and is treated confidentially.
Information About Clients Served
The Centre collects, uses, stores, and discloses personal information about its clients for the following purposes:
- Understanding their assistance needs;
- Providing appropriate material support based on their situation;
- Delivering community and compensatory work programs.
Information About Employees and Job Applicants
The Centre collects personal information about employees to process payroll, comply with current legislation, offer employee benefits, use performance management tools, manage and improve employee programs, policies, and relationships, prepare for emergency situations, manage, establish, or terminate the employment relationship.
It also collects personal information about job applicants to select candidates and ensure that qualified individuals are hired for appropriate positions.
Where necessary, the personal information collected by the Centre may be shared with board members or other organizations involved in contractual activities on the Centre’s behalf. The information will only be used for the purposes for which it was collected.
Information About Interns and Peer Support Workers
The Centre collects personal information about interns and peer support workers as needed to manage internships or collaborations with peer support workers.
Information About Donors
The Centre places great importance on the trust of donors who choose to support it. Therefore, it strives to minimize the collection and use of donors’ personal information and to protect its confidentiality. No information will be disclosed without the donor’s consent.
4. Obtaining Consent for the Collection, Use, or Disclosure of Personal Information When Required
In general, consent for the collection, use, and storage of personal information is implied at the time of collection. Requests for material assistance, participation in community or compensatory work programs, or making a donation are considered implicit consent for the collection and use of the necessary information to create a file.
Information may only be collected for these purposes. If it is required for another purpose, new consent will be obtained. The Châteauguay Community Centre will consider the sensitivity of the personal information when determining the format and method for obtaining consent.
The Centre will seek consent before disclosing an individual’s personal information to a third party, except where permitted or required by law. When an employee accepts a job offer or employee benefits, this acceptance generally constitutes consent for the Centre to collect, use, and disclose personal information for the identified purposes.
At any time, individuals may withdraw their consent. If the consent was provided in writing, a written request is required to withdraw it. Otherwise, a verbal request will suffice.
5. Respecting the Retention Period for Personal Information
The Châteauguay Community Centre will retain personal information (PI) according to the following categories:
Client Files: 5 years after the last contact
Employee Files: 7 years after the end of employment
Community, Compensatory Work, and Peer Support Files: 5 years
Donor PI: 7 years or as required by the legal statute of limitations
Members of the Châteauguay Community Centre: 5 years
Board of Directors Members’ PI: 5 years
After these retention periods, personal information will be destroyed in a manner that ensures it cannot be recovered or reconstituted.
6. Protecting Personal Information Using Appropriate Measures
Personal information may be stored in various formats, including paper or digital files, and access to this information is secured. In all cases, only authorized individuals within the Châteauguay Community Centre, whose roles require access to this information, are permitted to view it. Access is granted solely when the information is necessary for performing their duties.
The Centre will protect personal information using appropriate security measures to guard against risks such as loss, theft, unauthorized access, disclosure, copying, use, modification, or destruction, regardless of the format in which it is stored. The sensitivity of the information will determine the level of protection required. Personal information will be carefully destroyed to prevent unauthorized access. In the event of a security breach, the Centre will take all necessary steps to minimize potential harm.
All employees with access to personal information must respect its confidential and private nature.
7. Providing Individuals with Access to Their Personal Information Upon Request
Any request from clients to access their personal information held by the Châteauguay Community Centre must be submitted through a written and signed request addressed to the person responsible for personal information, Ms. Nadia Tremblay, using the designated form. Once completed, the request can be sent via email or postal mail following the Request for Access to Personal Information procedure. The request may also include a correction or deletion of information. The identity of the requester must be reasonably verified. If satisfactory verification is not possible, the Centre may refuse to disclose the requested personal information.
The Châteauguay Community Centre will respond promptly, no later than 30 days from the date of receipt of the request.
Requests for personal information made by third parties must be submitted in writing. In most cases, the Centre will obtain the individual’s written consent before disclosing personal information to a third party. However, personal information may be disclosed without consent when required by law. In such cases, only the personal information necessary under the relevant law and circumstances will be disclosed.
For employees, requests to access their personnel file must be made in writing to the management team.
Individuals may also request the Centre to modify their personal information if it is outdated, inaccurate, or incomplete.
The Centre will promptly update any personal information found to be inaccurate or incomplete. Any unresolved disagreements regarding the accuracy of personal information will be noted in the individual’s file.
8. Ensuring the Prompt and Confidential Handling of Complaints
Anyone wishing to submit a complaint related to this policy or, more generally, to the protection of personal information must do so in writing, including their name, contact details, and the reason(s) for the complaint. The complaint should be addressed to the person responsible for personal information protection at the Châteauguay Community Centre.
The Centre is committed to handling complaints confidentially and will respond promptly, no later than 30 days from the date of receipt, provided that all necessary information has been obtained to properly address the complaint.
The person responsible for personal information protection must also investigate any confidentiality incident. If an incident presents a serious risk of harm, they must promptly notify the affected individuals and the Commission d’accès à l’information, if required. Additionally, the responsible person must identify reasonable measures to mitigate the risks of harm to the individuals affected and prevent similar incidents from occurring in the future.
Use of Cookies
The Châteauguay Community Centre’s website uses cookies and other technologies to enhance the browsing experience. By using the website, you agree to our use of cookies and other tracking technologies as specified in the privacy policy available on our website.