Protection of personal information policy

Context

This policy aims to ensure the protection of personal information and to outline how Cuisines Poirier collects, uses, communicates, retains, destroys, or otherwise manages such information. It also aims to inform any interested person about how Cuisines Poirier handles their personal information.

Application and Definitions

This policy applies to Cuisines Poirier, including its directors, employees, consultants, volunteers, and any person providing services on behalf of Cuisines Poirier. It also applies to the Cuisines Poirier website and all websites controlled and maintained by Cuisines Poirier.

It covers all types of personal information managed by Cuisines Poirier, whether from its potential or current clients, consultants, employees, members, or any other persons (such as visitors to its websites).

For the purposes of this policy, personal information is any information about an individual that directly or indirectly identifies them. For example, it could be the name, address, email address, phone number, gender, banking information, health information, ethnic origin, language, etc.

Sensitive personal information is information with a high degree of reasonable expectation of privacy, such as health information, banking information, biometric data, sexual orientation, ethnic origin, political opinions, religious or philosophical beliefs, etc.

In general, professional or business contact information is not considered personal information, for example, the name, title, address, email address, or phone number at work of a person. Specifically, according to the Quebec Act Respecting the Protection of Personal Information in the Private Sector, from September 22, 2023, sections 3 (collection, use, communication), 4 (retention and destruction), and 6 (data security) do not apply to information about a person related to their function in a business, such as their name, title, function, and work address, email address, and phone number. These paragraphs also do not apply to personal information that is public by law from the effective date of this policy.

Collection, Use, and Communication

As part of its activities, Cuisines Poirier may collect various types of information for different purposes. The types of information that Cuisines Poirier may collect, their use (or intended purpose), and the means by which the information is collected are listed in Appendix A of this policy. Cuisines Poirier will also inform the concerned individuals at the time of collecting personal information of any other information collected, the purposes for which they are collected, and the means of collection, in addition to other information required by law.

Cuisines Poirier follows the general principles below regarding the collection, use, and communication of personal information:

Consent: Generally, Cuisines Poirier collects personal information directly from the concerned individual and with their consent, unless an exception is provided by law. Consent can be implicitly obtained in certain situations, for example, when the person decides to provide their personal information after being informed by this policy about the use and communication for the purposes indicated here (see Appendix A for more details). Thus, this policy and the information it contains can be consulted by the concerned individual at the time of collecting personal information.

Normally, Cuisines Poirier must also obtain the consent of the concerned individual before collecting their personal information from third parties, before communicating it to third parties, or for any secondary use thereof. However, Cuisines Poirier may act without consent in certain cases provided by law and under the conditions provided by it. The main situations where Cuisines Poirier may act without consent are indicated in the relevant sections of this policy.

Collection: In all cases, Cuisines Poirier collects information only if there is a valid reason to do so. Additionally, the collection will be limited to the necessary information needed to fulfill the intended purpose.

Please note that Cuisines Poirier’s services and programs are not intended for minors, and generally, Cuisines Poirier does not intentionally obtain personal information about minors (in these cases, information cannot be collected from them without the consent of a parent or guardian).

Collection from Third Parties: Cuisines Poirier may collect personal information from third parties. Unless an exception is provided by law, Cuisines Poirier will seek the consent of the concerned individual before collecting personal information about them from a third party. In cases where such information is not collected directly from the person but from another organization, the concerned individual can request the source of the collected information from Cuisines Poirier.

In certain situations, Cuisines Poirier may also collect personal information from third parties without the consent of the concerned individual if it has a serious and legitimate interest in doing so and a) if the collection is in the interest of the person and it is not possible to obtain it from them in a timely manner, or b) if this collection is necessary to ensure the information’s accuracy.

This collection through third parties may be necessary for certain services or programs or for otherwise doing business with Cuisines Poirier. Where required, Cuisines Poirier will obtain the person’s consent at the appropriate time.

Retention and Use: Cuisines Poirier ensures that the information it holds is up to date and accurate when used to make a decision regarding the concerned person.

Cuisines Poirier may only use a person’s personal information for the reasons indicated herein or for any other reasons provided at the time of collection. As soon as Cuisines Poirier wishes to use this information for another reason or purpose, new consent must be obtained from the concerned individual, which must be explicitly obtained if it is sensitive personal information. However, in some cases provided by law, Cuisines Poirier may use the information for secondary purposes without the person’s consent, for example:

• When this use is obviously in the person’s benefit;
• When necessary to prevent or detect fraud;
• When necessary to assess or improve protection and security measures.

Limited Access: Cuisines Poirier must implement measures to limit access to personal information only to employees and individuals within its organization who need to know it and for whom this information is necessary in the performance of their duties. Cuisines Poirier will seek the person’s consent before granting access to any other person.

Communication: Generally, and unless an exception is indicated in this policy or otherwise provided by law, Cuisines Poirier will obtain the concerned individual’s consent before communicating their personal information to a third party. Additionally, when consent is necessary and when it is sensitive personal information, Cuisines Poirier must obtain the person’s explicit consent before communicating the information.

However, the communication of personal information to third parties is sometimes necessary. Thus, personal information may be communicated to third parties without the person’s consent in certain cases, including but not limited to the following:

• Cuisines Poirier may communicate personal information without the concerned individual’s consent to a public body (such as the government) which, through one of its representatives, collects it in the exercise of its duties or the implementation of a program under its management.
• Personal information may be transmitted to its service providers to whom it is necessary to communicate the information, without the person’s consent. For example, these service providers may be event organizers, subcontractors designated by Cuisines Poirier to perform mandates in the programs administered by Cuisines Poirier, and cloud service providers. In these cases, Cuisines Poirier must have written contracts with these providers specifying the measures they must take to ensure the confidentiality of the communicated personal information, that the use of this information is only made within the framework of the contract’s execution, and that they cannot retain this information after its expiration. Additionally, these contracts must stipulate that the providers must notify the personal information protection officer of Cuisines Poirier (indicated in this policy) of any violation or attempted violation of the confidentiality obligations regarding the communicated personal information and must allow this officer to conduct any verification related to this confidentiality.
• If necessary for the conclusion of a commercial transaction, Cuisines Poirier could also communicate personal information without the concerned individual’s consent to the other party of the transaction, subject to the conditions provided by law.
• Communication outside Quebec: It is possible that the personal information held by Cuisines Poirier is communicated outside Quebec, for example when Cuisines Poirier uses cloud service providers whose servers are located outside Quebec or when Cuisines Poirier does business with subcontractors outside the province.

Additional Information on the Technologies Used:

Use of Cookies: Cookies are data files transmitted to a website visitor’s computer by their web browser when they visit the site and can have several uses.

The websites controlled by Cuisines Poirier use cookies notably:

• To remember the visitor’s settings and preferences, such as language choice, and to allow the tracking of the current session.
• For statistical purposes to know visitor behavior, the content viewed, and to improve the website.

The websites controlled by Cuisines Poirier use the following types of cookies:

• Session cookies: These are temporary cookies kept in memory only for the duration of the website visit.
• Persistent cookies: They are kept on the computer until they expire and will be retrieved during the next website visit.

Some cookies can be disabled by default, and visitors can choose whether to enable these functions when visiting Cuisines Poirier’s websites.

It is also possible to enable and disable the use of cookies by changing the preferences in the settings of the browser used.

Use of Google Analytics: Some Cuisines Poirier sites use Google Analytics to enable continuous improvement. Google Analytics allows, among other things, to analyze how a visitor interacts with a Cuisines Poirier website. Google Analytics uses cookies to generate statistical reports on website visits without identifying the visitors personally.

It is possible to block the use of Google Analytics by installing the Google Analytics opt-out browser add-on.

Retention and Destruction

Retention: Cuisines Poirier retains personal information for as long as necessary to achieve the purposes for which it was collected. This information will also be retained for any duration required by law.

The retained personal information will be protected throughout the retention period.

Destruction: At the end of the retention period, Cuisines Poirier will securely destroy personal information in a manner that prevents anyone from reconstructing it or from accessing it in the future. Different destruction methods may be used depending on the type of information and the medium in which it is contained, for example by shredding paper documents, securely deleting electronic data, etc.

Data Security

Cuisines Poirier takes reasonable measures to ensure the protection and security of the personal information it holds, considering the sensitivity of the information, the purposes for which it is used, the quantity and distribution of the information, and the medium in which it is stored.

Additional Rights and Information

Access and Correction: In accordance with applicable laws, any person concerned may request access to their personal information held by Cuisines Poirier. The person may also request the correction of their personal information if it is inaccurate or incomplete.

Requests for access or correction must be addressed to the person responsible for protecting personal information at Cuisines Poirier, using the contact information provided in this policy. Cuisines Poirier will respond to the request within 30 days, as required by law.

Withdrawal of Consent: Any person concerned may withdraw their consent for the use or communication of their personal information by Cuisines Poirier, at any time. However, in such cases, Cuisines Poirier may no longer be able to provide certain services or programs.

Complaints: Any person who believes that their personal information has been improperly handled by Cuisines Poirier or that their rights regarding personal information have been violated can file a complaint with the person responsible for protecting personal information at Cuisines Poirier. The contact information for this person is provided in this policy.

Amendments to this Policy

This policy may be amended from time to time to reflect changes in laws, regulations, or practices regarding the protection of personal information. The amended policy will be available on the Cuisines Poirier website and any other appropriate means of communication.

Contact Information

For any questions or concerns regarding this policy or the protection of personal information at Cuisines Poirier, you can contact the person responsible for protecting personal information at the following contact information:

Guillaume Fournier

1733 rue Atmec, Gatineau QC, J8R 0E7

guillaume@cuisinespoirier.com

Appendix A – Types of Information Collected and Their Use