Personal information governance policy

1. What this document is

Law 25 requires every business to establish policies governing how it handles personal information, and to publish that information in clear and simple terms. This is that document. It is separate from our privacy policy: that one says what we collect and why, this one says how we organise ourselves to protect it. They are meant to be read together.

2. Who answers for what

Responsibility is not spread across everyone: it is named.

• The designated officer: Samuel Leclerc approves this policy, decides questions relating to the protection of personal information, answers requests for access, correction and withdrawal of consent, and keeps the register of confidentiality incidents.
• Staff: Everyone who enters the admin panel sees and does only what their role allows. That access is granted because the work requires it, and withdrawn as soon as it no longer does.
• Our providers: They act only on our instructions and for the mandate we give them. They are named in the privacy policy, with what each one does and the country where it does it.

3. The life of a piece of information

Personal information has a beginning, a bounded use and an end. The same five stages apply to all of it.

• Collection: we ask only for what serves a stated purpose, told to you at the moment we ask. No field is there just in case.
• Use: information serves only the purpose it was collected for. We do not sell it, do not rent it, and carry out no profiling and no targeted advertising.
• Disclosure: we disclose it only to a provider that needs it for its mandate, or where the law requires it. Never for commercial purposes.
• Retention: each category has a period, set out below. It runs from the moment the purpose is fulfilled, not from the moment someone remembers.
• Destruction: once the period has passed, the information is deleted. Where the period is fixed, deletion is automatic.

4. How long we keep things

These are the periods we apply. Those marked “automatic” are carried out by a scheduled task in our database: they do not depend on anyone remembering.

Customer account and proof of consent

As long as the account exists. Deleted at your request, except what the law requires us to keep.

Order requests and their supporting records

Six years after the end of the financial year concerned, because of our tax and accounting obligations.

Messages sent through the contact form

Twenty-four months. Automatic.

Reviews published on a product

As long as the account exists. Removed at your request.

Notification subscription

As long as the device stays subscribed. Deleted as soon as it unsubscribes or the service declares it expired.

Register of the emails the Site sends

Twelve months. Automatic.

Log of actions taken in the admin panel

Twenty-four months. Automatic.

Anti-abuse counters

At most three hours. They hold no IP address, only a non-reversible fingerprint of one. Automatic.

5. How we destroy

For us, destroying means permanently deleting the records from our database, keeping no copy elsewhere. Where the period is fixed, deletion is handed to a scheduled task that runs on its own and judges nothing: it removes what has passed the period, and nothing else.

Our hosting providers keep backup copies for a limited time so that service can be restored after an outage. Those copies replace themselves, they are not consulted, and deleted information disappears from them as they renew.

6. Who can see what, internally

Entering the admin panel requires TWO things: an account whose role allows it, and a password specific to the panel. Either one alone is not enough.

• Customer: sees their own account, orders and addresses. Nothing else, and nothing belonging to anyone else.
• Staff: handles orders and answers messages. Touches neither prices, nor promotions, nor roles, nor discounts, and does not read the log.
• Administrator: manages the catalogue, prices, promotions, accounts, roles and discounts.
• Owner: the same powers, plus final responsibility for the business with respect to personal information.

Every action taken in the panel is written to the log, with its author, its date and the value before and after. That log exists so that accounts can be rendered, including about us.

7. Our providers, and processing outside Quebec

Part of the processing happens outside Quebec: the pages of the Site run in the United States. Each provider is named in the privacy policy, with its role and the country where it processes the information.

Before entrusting personal information to a provider established outside Quebec, the law requires us to carry out a privacy impact assessment and to enter into a written agreement. That assessment is under way. It will be recorded in writing, and you may obtain a summary of it by writing to the officer.

8. If an incident happens

A confidentiality incident is unauthorised access to, use of, or disclosure of personal information, or its loss. As soon as we become aware of one, we take reasonable measures to reduce its effects and prevent it from happening again, then we assess whether it presents a risk of serious injury.

If it does, we promptly notify the Commission d’accès à l’information and the people concerned. Every incident, serious or not, is entered in a register that we provide to the Commission on request.

9. Your requests and your complaints

You may ask to see the information we hold about you, to have it corrected, to withdraw your consent, or to have your account deleted. You may also complain about how we handle your information.

Write to the officer through the Contact page: your request reaches them directly. We answer within thirty days, as the law provides. A complaint is reviewed by the officer, who tells you what they conclude and what they do about it.

If our answer does not satisfy you, you may take the matter to Quebec's Commission d’accès à l’information.

10. Review of this policy

It is reviewed at least once a year, and whenever a change in our practices, our tools or our providers calls for it. It is approved by the person holding the highest authority in the business, and the version published here is the one that applies.