Privacy Policies
Summary
- Context
- Application and definitions
- Collection, Use and Disclosure
- Retention and Destruction of Personal Information
- Responsibilities of Soluflex Inc.
- Data Security
- Rights of access, rectification and withdrawal of consent
- Complaint Process
- Approval
Appendix A
Appendix B
Version history
This document will be reviewed regularly and updated according to legislative, technological and organisational developments.
Version: June 5, 2024
- Context
Soluflex Inc. and its franchises are for-profit provincial corporations that process personal information in the course of their business. The purpose of this policy is to ensure the protection of personal information and to govern the manner in which Soluflex Inc. and its franchises collect, use, disclose, retain and destroy it, or otherwise manage it. In addition, it is intended to inform any interested person about how Soluflex Inc. and its franchises handle their personal information. It also covers the processing of personal information collected by Soluflex Inc. and its franchises by technological means.
- Application and Definitions
This policy applies to Soluflex Inc. and its franchises, including, but not limited to, its officers, employees, consultants, volunteers, and anyone who otherwise provides services on behalf of Soluflex Inc. and its franchises. It also applies with respect to the Soluflex Inc. website and its franchises, as well as all websites controlled and maintained by Soluflex Inc. and its franchises.
It applies to all types of personal information managed by Soluflex Inc. and its franchises, whether it is the information of its customers, potential or current, its consultants, its employees, its members or any other person (such as visitors to its websites or otherwise). For the purposes of this Privacy Policy, personal information is information about a natural person that directly or indirectly identifies that person. For example, this could include an individual’s name, address, email address, phone number, gender or banking information, health information, ethnicity, language, etc.
Sensitive personal information is information for which there is a high degree of reasonable expectation of privacy, e.g., health information, banking information, biometric information, sexual orientation, ethnic origin, political opinions, religious or philosophical beliefs, etc. Generally, an individual’s business or business contact information does not constitute personal information, such as an individual’s name, title, address, email address or business telephone number.
More specifically, and for the sake of clarity, within the meaning of Quebec’s Act respecting the protection of personal information in the private sector, and as of September 22, 2023, Divisions 3 (collection, use, disclosure), 4 (retention and destruction) and 6 (data security) do not apply to information of an individual relating to the performance of a function in an enterprise, such as their name, title, job title, and workplace address, email address, and telephone number. These same subsections also do not apply to personal information that is public under the law, as of the coming into force of this policy.
- Collection, Use and Communication
In the course of their business, Soluflex Inc. and its franchises may collect different types of information for different purposes. The types of information that Soluflex Inc. and its franchises may collect, its use (or purpose) and the means by which the information is collected are set out in Appendix A of this policy. Soluflex Inc. and its franchises will also inform the individuals concerned, at the time of collection of personal information, of any other information collected, the purposes for which it is collected and the means of collection, in addition to other information to be provided as required by law.
Soluflex Inc. and its franchises apply the following general principles with respect to the collection, use and disclosure of personal information:
Consent:
– Generally, Soluflex Inc. and its franchises collect personal information directly from the individual concerned and with his or her consent, unless an exception is provided for by law. Implied consent may be obtained in certain situations, for example, where the individual decides to provide his or her personal information after being informed by this policy about the use and disclosure for the purposes identified in this policy (see Appendix A for more details). This policy and the information it contains may be consulted by the person concerned at the time personal information is collected.
– Normally, Soluflex Inc. and its franchises must also obtain the consent of the individual concerned before collecting their personal information from third parties, before disclosing it to third parties, or for any secondary use thereof. However, Soluflex Inc. and its franchises may act without consent in certain cases provided for by law and under the conditions provided for by law. The main situations in which Soluflex Inc. and its franchises may act without consent are indicated in the relevant sections of this policy.
Collection:
– In all cases, Soluflex Inc. and its franchisees only collect information if it has a valid reason to do so. In addition, the collection will be limited to only the necessary information that is necessary to fulfill the intended purpose.
– Please note that Soluflex Inc.’s services and programs and franchises are not directed to minors, and more generally, Soluflex Inc. and its franchises do not knowingly obtain personal information from minors (in these cases, the information cannot be collected from them without the consent of a parent or guardian).
– Collection from third parties. Soluflex Inc. and its franchises may collect personal information from third parties. Unless otherwise provided for by law, Soluflex Inc. and its franchises will seek the consent of the individual concerned before collecting personal information about him or her from a third party. In the event that such information is not collected directly from the individual, but from another organization, the individual concerned may request the source of the information collected from Soluflex Inc. and its franchises. In certain situations, Soluflex Inc. and its franchises may also collect personal information from third parties, without the consent of the individual concerned, if he or she has a serious and legitimate interest in doing so and (a) if the collection is in the interest of the individual and it is not possible to do so from the individual in a timely manner, or (b) if such collection is necessary to ensure that the information is accurate.
– Also, Soluflex Inc. and its franchises may collect personal information, indirectly, in particular through the use of a third party. This collection through third parties may be necessary to use certain services or programs, or to otherwise do business with Soluflex Inc. and its franchises. When required, Soluflex Inc. and its franchisees will obtain the consent of the individual at the appropriate time.
Holding and Use:
– Soluflex Inc. and its franchisees ensure that the information they hold is current and accurate at the time it is used to make a decision about the person in question.
– Soluflex Inc. and its franchisees may only use an individual’s personal information for the purposes set out herein or for any other purposes provided at the time of collection. As soon as Soluflex Inc. and its franchises wish to use this information for another reason or purpose, a new consent must be obtained from the person concerned, which must be expressly obtained in the case of sensitive personal information. However, in certain cases provided by law, Soluflex Inc. and its franchises may use the information for secondary purposes without the individual’s consent, e.g.:
– when such use is clearly for the benefit of that person;
– when necessary to prevent or detect fraud;
– when necessary to evaluate or improve safeguards and security measures.
– Limited access. Soluflex Inc. and its franchises must put in place measures to limit access to personal information only
employees and persons within the organization who have the authority to know it and for whom the information is necessary in the performance of their duties. Soluflex Inc. and its franchisees will seek the consent of the individual before granting access to any other person.
Communication:
– Generally, and unless otherwise provided for in this Policy or as otherwise provided by law, Soluflex Inc. and its franchises will obtain the consent of the individual concerned before disclosing his or her personal information to a third party. In addition, where consent is required and where sensitive personal information is involved, Soluflex Inc. and its franchisees will be required to obtain the individual’s express consent before disclosing the information.
– However, the disclosure of personal information to third parties is sometimes necessary. As such, personal information may be disclosed to third parties without the consent of the individual concerned in certain circumstances, including, but not limited to, the following:
– Soluflex Inc. and its franchises may disclose personal information, without the consent of the person concerned, to a public body (such as the government) which, through one of its representatives, collects it in the exercise of its powers, duties or functions or the implementation of a program under its management.
– Personal information may be shared with its service providers to whom it is necessary to disclose the information without the individual’s consent. For example, these service providers may be event organizers, subcontractors of Soluflex Inc. and its franchises designated to perform mandates in programs administered by Soluflex Inc. and its franchises, and cloud service providers. In these cases, Soluflex Inc. and its franchises must have written contracts with these suppliers that indicate the measures they must take to ensure the confidentiality of the personal information provided, that the use of this information is only made in the context of the performance of the contract and that they cannot retain this information after its expiry. In addition, these contracts must provide that suppliers must notify the person responsible for the protection of personal information of Soluflex Inc. and its franchises of any breach or attempted breach of confidentiality obligations concerning the personal information communicated and must allow this person to carry out any verification relating to such confidentiality.
– If it is necessary for the purposes of concluding a commercial transaction, Soluflex Inc. and its franchises may also communicate personal information, without the consent of the person concerned, to the other party to the transaction and subject to the conditions provided for by law.
Communication outside Quebec:
It is possible that personal information held by Soluflex Inc. and its franchises may be disclosed outside of Quebec, for example, when Soluflex Inc. and its franchises use cloud service providers whose server(s) are located outside Quebec or when Soluflex Inc. and its franchises do business with subcontractors located outside the province.
Additional information on the technologies used:
Use of cookies:
Cookies are data files that are transmitted to a website visitor’s computer by their web browser when they visit that site and can have a number of uses. Websites controlled by Soluflex Inc. and its franchises use cookies, including:
– To remember visitors’ settings and preferences, e.g. for the choice of language and to enable the tracking of the current session.
– For statistical purposes to know the behavior of visitors, the content viewed and to allow the improvement of the website.
Websites controlled by Soluflex Inc. and its franchises use the following types of cookies:
– Session cookies: These are session cookies that are stored for the duration of the visit to the website only.
– Persistent cookies: These are kept on the computer until they expire and they will be retrieved the next time you visit the site.
Some cookies may be disabled by default and visitors will be able to choose whether or not to activate these features when visiting the websites of Soluflex Inc. and its franchises. It is also possible to enable and disable the use of cookies by changing the preferences in the settings of the browser used.
Use of Google Analytics:
The Soluflex Inc. and its franchises use Google Analytics to enable continuous improvement. Google Analytics makes it possible to analyze how a visitor interacts with a Soluflex Inc. website and its franchises. Google Analytics uses cookies to generate statistical reports on the behavior of visitors to these websites and the content viewed.
Personal information collected by the technologies listed in our Cookie Policy will never be shared by Soluflex Inc. and its franchises with third parties.
- Retention and Destruction of Personal Information
Unless a minimum retention period is required by applicable law or regulation, Soluflex Inc. and its franchisees will retain personal information only for as long as necessary to fulfill the purposes for which it was collected. Personal information used by Soluflex Inc. and its franchises to make a decision about an individual must be retained for a period of at least one year following the decision in question or even seven years after the end of the tax year in which the decision was made if the decision has tax implications, for example, the circumstances of termination of employment.
At the end of the retention period or when the personal information is no longer required, Soluflex Inc. and its franchises will ensure:
- destroy them; or
- anonymize it (i.e., it no longer irreversibly identifies the individual and it is no longer possible to establish a link between the individual and personal information) to use it for serious and legitimate purposes.
The destruction of information by Soluflex Inc. and its franchises must be done in a secure manner to ensure the protection of such information. This section may be supplemented by any policy or procedure adopted by Soluflex Inc. and its franchises regarding the retention and destruction of personal information, if any. Please contact the Privacy Officer of Soluflex Inc. and its franchisees (as set out in this policy) for more information.
- Responsibilities of Soluflex Inc.
In general, Soluflex Inc. and its franchises are responsible for the protection of the personal information under their control. The Privacy Officer of Soluflex Inc. and its franchises is the Director of Operations of the organization or franchise in question. In general, he or she must ensure compliance with applicable legislation concerning the protection of personal information. The head must approve the policies and practices governing the governance of personal information.
In particular, this person is responsible for implementing this policy and ensuring that it is known, understood and applied. In the event of the absence or inability of this person to act, the presidents of Soluflex Inc. and its franchisees will assume the duties of the person in charge of the protection of personal information. Employees of Soluflex Inc. and its franchisees who have access to personal information or are otherwise involved in the management of personal information must ensure their protection and comply with this policy. The roles and responsibilities of Soluflex Inc.’s employees and franchises throughout the personal information lifecycle may be specified by any other Soluflex Inc. policies and franchises in this regard, as applicable.
- Data Security
Soluflex Inc. and its franchises are committed to implementing reasonable security measures to ensure the protection of the personal information under its control. The security measures in place include the purpose, quantity, distribution, medium and sensitivity of the information. This means that information that qualifies as sensitive (see the definition in section 2) will need to be subject to greater security safeguards and will need to be better protected.
In particular, and in accordance with what has been mentioned above regarding limited access to personal information, Soluflex Inc. and its franchises must put in place the necessary measures to impose constraints on the rights of use of its information systems so that only those employees who need access to them are authorized to access them.
- Rights of Access, Rectification and Withdrawal of Consent
To exercise their rights of access, rectification or withdrawal of consent, the person concerned must submit a written request to this effect to the person in charge of the protection of personal information of Soluflex Inc. and its franchises, at the email address indicated in the following section.
Subject to certain legal restrictions, individuals may request access to their personal information held by Soluflex Inc. and its franchises and request its correction in the event that it is inaccurate,
incomplete or equivocal. They may also require that the dissemination of personal information concerning them cease or that any hyperlink attached to their name that allows access to this information by technological means be de-indexed, when the dissemination of this information contravenes the law or a court order. They may do the same, or require that the hyperlink to access this information be reindexed, when certain conditions set out in the law are met.
The Privacy Officer of Soluflex Inc. and its franchisees must respond in writing to such requests within 30 days of the date of receipt of the request. Any refusal must be justified and accompanied by the legal provision justifying the refusal. In these cases, the response must indicate the remedies under the law and the time limit for exercising them. The person in charge must help the applicant understand the refusal if necessary.
Subject to applicable legal and contractual restrictions, data subjects may withdraw their consent to the disclosure or use of the information collected. They may also ask Soluflex Inc. and its franchises what personal information is collected from them, the categories of individuals at Soluflex Inc. and its franchises who have access to it and how long it is kept.
- Complaint Handling Process
Reception:
Any person who wishes to make a complaint regarding the application of this policy or, more generally, the protection of his or her personal information by Soluflex Inc. and its franchises, must do so in writing by contacting the person in charge of the protection of personal information of Soluflex Inc. and its franchises, at the email address indicated in the following section.
The individual will be required to provide his or her name, contact information, including a telephone number, as well as the subject matter and reasons for the complaint, providing sufficient detail for it to be evaluated by Soluflex Inc. and its franchises. If the complaint is not specific enough, the Privacy Officer may request any additional information that he or she deems necessary to assess the complaint.
Treatment:
Soluflex Inc. and its franchises undertake to treat any complaint received confidentially. Within 30 days of receipt of the complaint or receipt of any additional information deemed necessary and required by Soluflex Inc.’s Privacy Officer and its franchisees to be able to process it, the latter must evaluate the complaint and provide a written response to the complainant by email. This assessment will determine whether the handling of personal information by Soluflex Inc. and its franchises complies with this policy, any other policies and practices in place within the organization, and applicable legislation or regulations.
In the event that the complaint cannot be dealt with within this period, the complainant must be informed of the reasons justifying the extension of the time limit, of the state of progress in the processing of the complaint and of the reasonable period of time needed to be able to provide a final response.
Soluflex Inc. and its franchisees must prepare a separate file for each complaint addressed to it. Each file contains the complaint, the analysis and documentation supporting its assessment, and the response sent to the person who made the complaint.
It is also possible to file a complaint with the Commission d’accès à l’information du Québec or any other privacy oversight body responsible for the application of the law concerned by the subject of the complaint. However, Soluflex Inc. and its franchises invite any interested person to first contact their Privacy Officer and to wait for the completion of the processing process by Soluflex Inc. and its franchises.
- Approval
This policy is approved by the privacy officers of Soluflex Inc. and its franchisees, whose business contact information is as follows:
Privacy Officers:
– SOLUFLEX FRANCHISOR
Étienne Claessens, President
– SOLUFLEX STE-JULIE
Valérie Martin, Executive Director
– SOLUFLEX MONTÉRÉGIE-EST
Sabrina Mailloux, President
– SOLUFLEX ESTRIE
Mathieu St-Amant, President
– SOLUFLEX LAURENTIDES
Véronique Biron, President
– SOLUFLEX LAVAL
Patrizia Dignazio, President
– SOLUFLEX HAUTE YAMASKA
Anny Chagnon, President
– SOLUFLEX MONTREAL EAST
Catherine Lancelot, President
– SOLUFLEX MONTREAL CENTRE
Maude Rodrigue, President
If you have any requests, questions or comments regarding this policy, please contact the person in charge by email.
Appendix A
The following is a non-exhaustive list of the types of information that Soluflex Inc. and its franchises may collect, how it may be used, or the purpose for which it is collected, and the means by which the information is collected. Thus, this includes, but is not limited to, the following. Please note that most of the personal information managed by Soluflex Inc. and its franchises is personal information of employees, job applicants and consultants. For the other categories of individuals listed below, the information provided is, in most cases, information of a professional or business nature (see section 2 on business contact information). It should be noted that in most cases, Soluflex Inc. and its franchises also collect the professional title/function of individuals, the name of the organization and/or the address of the organization (see section 2 on business contact information).
Customers:
– Type of personal information: banking information (where required).
– End of collection / uses: pre-authorized payment by bank account.
– How the information is collected (means): through pre-authorization forms completed by the client, by email (directly or through an attached document or other type of form).
Job Applicants and Employees:
– Type of personal information: name, telephone number, email address, banking information, social insurance number, date of birth, address.
– End of collection / uses: management of communications with the candidate or employee, ensuring the operation of the payroll system.
– How the information is collected (means): by email, by phone, in person.
Consultants:
– Type of personal information: name, telephone number, e-mail address, address.
– End of collection/uses: management of communications with the consultant, invoicing.
– How the information is collected (means): by email (directly or through an attachment: Word, PDF, etc.).
Appendix B – Cookie protection by CookieYes
- Introduction
Soluflex Inc. uses the CookieYes service to manage and protect cookies on its websites. CookieYes is a cookie consent management solution that helps businesses comply with data protection regulations, such as GDPR and CCPA.
- Types of Cookies Used
The cookies used on the Soluflex Inc. website can be classified into different categories:
Essential cookies:
These cookies are essential for the website to function properly and cannot be disabled in our systems. They are typically set up in response to actions performed by you that correspond to a request for services, such as setting your privacy preferences, logging in, or filling out forms.
Performance Cookies:
These cookies allow us to count visits and traffic sources in order to measure and improve the performance of our site. They help us to know which pages are the most and least popular and to see how visitors move around the site.
Functional cookies:
These cookies allow the site to provide enhanced functionality and personalization. They can be defined by our partners or by ourselves. If you do not allow these cookies, some or all of these services may not function properly.
Targeting Cookies:
These cookies may be set on our site by our advertising partners. They may be used by these companies to build a profile of your interests and show you relevant advertisements on other sites. They do not directly store personal information, but are based on the unique identification of your browser and your internet device.
- Cookie Management
Soluflex Inc. uses CookieYes to manage users’ cookie preferences. At the time of the first visit to our site, a cookie consent banner will appear, allowing users to choose the types of cookies they wish to allow.
Users can change or withdraw their consent to cookies at any time via the Cookie Preference Center, accessible on our website.
- CookieYes Privacy & Security Policy
CookieYes adheres to strict security and privacy practices to protect the data collected through cookies. Information about CookieYes’ security practices can be found in their Privacy Policy.
- Contact
If you have any questions or request additional information regarding CookieYes’ management of cookies on the Soluflex Inc. website, please contact our Privacy Officer at the email address indicated in section 9 of this policy.
