Policies and Practices Governing the Management of Personal Information

Roxane Saulnier (hereinafter referred to as the “BROKER”) is governed by the Act Respecting the Protection of Personal Information in the Private Sector (CQLR, c. P-39.1) (the Act).

Personal Information

Personal information is information about an individual that allows them to be identified directly or indirectly. A document, image, video, or sound recording can contain personal information. In the course of its professional activities, the BROKER may collect personal information such as name, home address, date of birth, information from an identification document, social insurance number, income information, marital status, etc.

Consent

The BROKER collects, uses, and discloses personal information with the consent of the concerned individual. To be valid, this consent must be explicit, free, informed, and given for specific purposes. A person who consents to provide their personal information is presumed to consent to its use and disclosure for the purposes for which it was collected.

Any individual may withdraw their consent to the collection, use, and disclosure of their personal information by the BROKER at any time. In such a case, if the collection is necessary for the conclusion or execution of the contract by the BROKER, the BROKER may be unable to fulfill a service request.

Responsibility

The BROKER is responsible for the protection of personal information they hold in the course of real estate brokerage activities. To this end, the BROKER has adopted a privacy policy as well as policies and practices governing the management of personal information. These policies aim to regulate the collection, use, disclosure, retention, and destruction of personal information.

Collection of Personal Information

The BROKER only collects personal information necessary for conducting activities in the field of real estate brokerage. For example, this may include information collected for the purpose of completing a real estate transaction, maintaining records, monitoring professional practice by the ‘Organisme d’Autoréglementation du Courtage Immobilier du Québec’ (OACIQ), or any other purpose determined by the BROKER and communicated to the person from whom consent is sought.

The BROKER encourages its staff members to explain in simple and clear terms to the concerned individual the reasons for collecting their personal information and to ensure their understanding.

For the collection of personal information, the BROKER encourages its staff members to use standardized forms developed by the OACIQ.

The BROKER may also collect personal information verbally during correspondences with individuals involved in a transaction or through various documents submitted in the course of completing a real estate transaction (identification documents, financial documents, powers of attorney, etc.).

Use and Disclosure of Personal Information

Personal information is used and disclosed for the purposes for which it was collected and with the consent of the concerned individual. In certain cases provided by law, personal information may be used for other purposes, such as detecting and preventing fraud or providing a service to the concerned individual.

The BROKER may be required to disclose personal information to third parties, such as suppliers, co-contractors, subcontractors, agents, insurers (such as the ‘Fonds d’assurance responsabilité professionnelle du courtage immobilier du Québec’ [FARCIQ]), professionals, other regulators, or outside Quebec.

The BROKER may, without the consent of the concerned individual, disclose personal information to a third party if this disclosure is necessary for the execution of a mandate or a service or business contract. In this case, the BROKER establishes a written mandate or contract specifying the measures that the agent must take to ensure the protection of the personal information entrusted to them, to ensure that it is only used in the execution of the mandate or contract, and that it is destroyed after its completion. The co-contractor must also agree to cooperate with the BROKER in case of a breach of personal information confidentiality.

Before disclosing personal information outside Quebec, the BROKER considers its sensitivity, the purpose of its use, and the protective measures it will receive outside Quebec. The BROKER will only disclose personal information outside Quebec if its analysis demonstrates that it will receive adequate protection in the destination location.

Retention and Destruction of Personal Information

When the purposes for which personal information was collected or used have been fulfilled, the BROKER must destroy it, subject to a retention period provided by law. In this regard, the BROKER’s professional obligations require them to retain their records for at least six (6) years following their final closure.

Security Measures

During the collection, use, retention, and destruction of personal information, the BROKER applies necessary security measures to protect the confidentiality of personal information. Specifically, here are the applicable measures: The BROKER maintains an up-to-date register of confidentiality incidents in accordance with applicable legislation. In the event of a confidentiality incident that presents a risk of serious harm to you, the BROKER will take the necessary measures to inform you, in compliance with applicable legislation. The assessment of the risk of serious harm is conducted by considering criteria such as the sensitivity of the personal information involved in the confidentiality incident, the anticipated consequences of its use, and the likelihood that it will be used for harmful purposes.

Confidentiality Incident

A confidentiality incident is the unauthorized access, use, or disclosure of personal information as defined by the Law, or the loss of personal information, or any other breach of personal information protection.

The BROKER has implemented a protocol for managing confidentiality incidents, identifying the individuals who assist the Personal Information Protection Officer and outlining the concrete actions to be taken in the event of an incident. This protocol specifically outlines the responsibilities expected at each stage of incident management, including the measures to be taken to ensure data security.

Roles and Responsibilities

1. The BROKER

The BROKER:

– Ensures the confidentiality of information through good information management practices. More specifically, the BROKER provides directives, training, and instructions to staff members regarding the collection, use, storage, modification, consultation, disclosure, and permitted destruction of personal information.

– Deploys adequate protection measures to reduce the risk of confidentiality incidents, such as IT security, updating personal information policies, training staff, etc.

– Utilizes standardized methods for filing documents containing personal information.

– Utilizes standardized methods for retaining documents containing personal information, particularly regarding the digitization procedure.

– Manages physical and IT access to personal information based on its sensitivity.

– Conducts secure destruction of personal information. More specifically, the BROKER provides directives or instructions to staff members regarding secure destruction methods, destruction timelines, etc.

2. Personal Information Protection Officer

In accordance with the Law, the BROKER has appointed the Personal Information Protection Officer.

This officer ensures that these policies are followed and that they comply with applicable regulations. The name and contact details of this person are listed in the “Right of Access, Withdrawal, and Rectification” section.

The Personal Information Protection Officer manages confidentiality incidents and, in this context, takes actions as required by the Law.

The Personal Information Protection Officer handles requests for access and rectification of personal information. They also address complaints regarding the BROKER’s handling of personal information.

The Personal Information Protection Officer is consulted for a privacy impact assessment for any project involving the acquisition, development, and redesign of an information system or electronic service delivery that involves the collection, use, disclosure, retention, or destruction of personal information. They may suggest measures to ensure the protection of personal information in such projects.

3. Staff Members

A staff member of the BROKER may access personal information only to the extent necessary to perform their duties or mandate.

The staff member of the BROKER:

– Ensures the integrity and confidentiality of personal information held by the BROKER.

– Complies with all BROKER policies and directives on the access, collection, use, disclosure, destruction of personal information, and information security and follows the instructions provided.

– Adheres to the security measures implemented at their workstation and on any equipment containing personal information.

– Uses only the equipment and software authorized by the BROKER.

– Ensures, when the time comes, the secure destruction of personal information in accordance with the instructions received. Immediately reports to their supervisor any act they become aware of that may constitute an actual or suspected violation of personal information security rules.

Right of Access, Withdrawal, and Rectification

An individual (or their authorized representative) may request access to their personal information held by the BROKER. An individual may withdraw their consent to the collection, use, and disclosure of their personal information at any time. This withdrawal is then recorded in writing.

An individual may request the correction of personal information in their file that they believe is inaccurate, incomplete, or ambiguous.

The BROKER may refuse a request for access or rectification in cases provided by law.

Complaints

An individual who feels aggrieved may file a complaint regarding the handling of their personal information by the BROKER. This complaint will be handled diligently within a maximum of 15 days by the Personal Information Protection Officer, and a written response will be sent to you.

Personal Information Access and Protection Officer

Roxane Saulnier, Real estate Broker Certified AEO (PIAPRO).

12 River Street, Suite D, Stanbridge East, QC, J0J 2H0

Or by email at roxane@roxanesaulnier.ca.

Any complaint must include the following: the complainant’s name, contact information, and a brief statement of the reasons for the complaint.

An anonymous complaint will be considered as not received.

Please note that Roxane Saulnier is required to verify your identity before responding to any request, question, comment, or complaint addressed to her Personal Information Protection Officer.

To make a request for access or correction of your personal information or to submit a complaint regarding the handling of personal information, please contact Roxane Saulnier, Real estate Broker Certified AEO (PIAPRO).

12 River Street, Suite D, Stanbridge East, QC, J0J 2H0

Or by email at roxane@roxanesaulnier.ca