Personal Information Protection and Privacy Policy

1. Background

Urnes dépôt inc. is a company incorporated in Quebec that processes personal information as part of its business activities.

This policy is intended to ensure the protection of personal information and to govern the manner in which Urnes dépôt inc. collects, uses, communicates, retains, and destroys or otherwise manages it. Furthermore, it aims to inform any interested person about how Urnes dépôt inc. processes their personal information. It also applies to the processing of personal information collected by Urnes dépôt inc. through technological means.

2. Application and Definitions

This policy applies to Urnes dépôt inc., which includes its officers, employees, consultants, volunteers, as well as any person who otherwise provides services on behalf of Urnes dépôt inc. It also applies to the Urnes dépôt inc. website, as well as all websites controlled and maintained by Urnes dépôt inc.

It covers all types of personal information managed by Urnes dépôt inc., whether it pertains to its clients (potential or current), consultants, employees, members, or any other persons (such as visitors to its websites or others).

For the purposes hereof, personal information is information that concerns a natural person and allows them to be identified, directly or indirectly. For example, this could include a person’s name, address, email address, telephone number, gender, or banking information, as well as information about their health, ethnic origin, language, etc.

A sensitive personal information is information for which there is a high degree of reasonable expectation of privacy, e.g., health information, banking information, biometric information, sexual orientation, ethnic origin, political opinions, religious or philosophical beliefs, etc.

Generally speaking, a person’s professional or business contact information does not constitute personal information, such as a person’s name, title, address, email address, or work telephone number. More specifically and for the sake of precision, within the meaning of Quebec’s Act respecting the protection of personal information in the private sector, and as of September 22, 2023, sections 3 (collection, use, communication), 4 (retention and destruction), and 6 (data security) do not apply to information about a person relating to the performance of a function in a business, such as their name, title, function, as well as the address, email address, and telephone number of their place of work.

These same paragraphs also do not apply to personal information that is public in nature by law, effective from the date this policy comes into force.

3. Collection, Use, and Communication

As part of its activities, Urnes dépôt inc. may collect different types of information for various purposes. The types of information that Urnes dépôt inc. might collect, their use (or the intended objective), and the means by which the information is collected are indicated in Appendix A of this policy.

Urnes dépôt inc. will also inform the individuals concerned, at the time of collection of personal information, of any other information collected, the purposes for which it is collected, and the means of collection, in addition to other information to be provided as required by law.

Urnes dépôt inc. applies the following general principles regarding the collection, use, and communication of personal information:

Consent:

• Generally, Urnes dépôt inc. collects personal information directly from the individual concerned and with their consent, unless an exception is provided by law. Consent may be obtained implicitly in certain situations, for example, when the person decides to provide their personal information after being informed by this policy about the use and communication for the purposes indicated therein (see Appendix A for more details). Thus, this policy and the information it contains may be consulted by the individual concerned at the time of collection of personal information.
• Normally, Urnes dépôt inc. must also obtain the consent of the individual concerned before collecting their personal information from third parties, before communicating it to third parties, or for any secondary use thereof. However, Urnes dépôt inc. may act without consent in certain cases provided by law and under the conditions set out therein. The main situations where Urnes dépôt inc. may act without consent are indicated in the relevant sections of this policy.

Collection:

• In all cases, Urnes dépôt inc. only collects information if it has a valid reason to do so. Furthermore, collection will be limited only to the necessary information required to fulfill the intended objective.
• Please note that the services and programs of Urnes dépôt inc. are not intended for minors, and more generally, Urnes dépôt inc. does not intentionally obtain personal information concerning minors (in such cases, information cannot be collected from them without the consent of a parent or guardian).
• Collection from third parties. Urnes dépôt inc. may collect personal information from third parties. Unless an exception is provided by law, Urnes dépôt inc. will request the consent of the individual concerned before collecting personal information about them from a third party. In the event that such information is not collected directly from the person, but from another organization, the individual concerned may request the source of the information collected from Urnes dépôt inc.

In certain situations, Urnes dépôt inc. may also collect personal information from third parties without the consent of the individual concerned, if it has a serious and legitimate interest in doing so and a) if the collection is in the interest of the person and it is not possible to do so from them in a timely manner, or b) if such collection is necessary to ensure that the information is accurate.

Additionally, Urnes dépôt inc. may collect personal information indirectly, notably by using:

• Clover. Clover has its own terms and privacy policy, which can be consulted for more information.
• Global Payments. Global Payments has its own terms and privacy policy, which can be consulted for more information.
• Stripe. Stripe has its own terms and privacy policy, which can be consulted for more information.

This collection through third parties may be necessary to use certain services or programs, or to otherwise do business with Urnes dépôt inc. When required, Urnes dépôt inc. will obtain the person’s consent at the appropriate time.

Retention and Use:

• Urnes dépôt inc. ensures that the information it holds is up to date and accurate at the time it is used to make a decision regarding the person concerned.
• Urnes dépôt inc. may only use a person’s personal information for the reasons indicated herein or for any other reasons provided at the time of collection. As soon as Urnes dépôt inc. wishes to use this information for another reason or another purpose, a new consent must be obtained from the individual concerned, which must be obtained expressly if it concerns sensitive personal information. However, in certain cases provided by law, Urnes dépôt inc. may use the information for secondary purposes without the consent of the person, e.g.:
  • when such use is clearly for the benefit of that person;
  • when it is necessary to prevent or detect fraud;
  • when it is necessary to evaluate or improve protection and security measures.
• Limited Access. Urnes dépôt inc. must implement measures to limit access to personal information only to employees and persons within its organization who are authorized to review it and for whom this information is necessary in the performance of their duties. Urnes dépôt inc. will request the person’s consent before granting access to any other person.

Communication:

• Generally, and unless an exception is indicated in this policy or otherwise provided by law, Urnes dépôt inc. will obtain the consent of the individual concerned before communicating their personal information to a third party. Furthermore, when consent is necessary and when it concerns sensitive personal information, Urnes dépôt inc. must obtain the explicit consent of the person before communicating the information.
• However, the communication of personal information to third parties is sometimes necessary. Thus, personal information may be communicated to third parties without the consent of the individual concerned in certain cases, including, but not limited to, the following cases:
  • Urnes dépôt inc. may communicate personal information, without the consent of the individual concerned, to a public body (such as the government) which, through one of its representatives, collects it in the exercise of its functions or the implementation of a program it manages.

• • Personal information may be transmitted to its service providers to whom it is necessary to communicate the information, without the person’s consent. For example, these service providers may be event organizers, subcontractors of Urnes dépôt inc. designated for the execution of mandates in programs administered by Urnes dépôt inc., and cloud service providers. In these cases, Urnes dépôt inc. must have written contracts with these providers indicating the measures they must take to ensure the confidentiality of the personal information communicated, that the use of this information is only made within the framework of the execution of the contract, and that they cannot retain this information after its expiration. Furthermore, these contracts must provide that the providers must notify the person responsible for the protection of personal information at Urnes dépôt inc. (indicated in this policy) of any breach or attempted breach of confidentiality obligations regarding the personal information communicated and must allow this person to perform any verification relating to this confidentiality.

• • If necessary for the purpose of concluding a commercial transaction, Urnes dépôt inc. may also communicate personal information, without the consent of the individual concerned, to the other party to the transaction and subject to the conditions provided by law.

• Communication outside Quebec: It is possible that personal information held by Urnes dépôt inc. may be communicated outside Quebec, for example, when Urnes dépôt inc. uses cloud service providers whose server(s) are located outside Quebec or when Urnes dépôt inc. does business with subcontractors located outside the province.

Additional Information on Technologies Used:

• Use of Cookies
  Cookies are data files transmitted to a website visitor’s computer by their web browser when they visit that site and can serve several purposes.

Websites controlled by Urnes dépôt inc. use cookies notably:

• To remember visitors’ settings and preferences, for example for language choice and to allow tracking of the current session.
• For statistical purposes to understand visitor behavior, the content viewed, and to allow for the improvement of the website.

Websites controlled by Urnes dépôt inc. use the following types of cookies:

• Session Cookies: These are temporary cookies that are kept in memory for the duration of the website visit only.
• Persistent Cookies: These are kept on the computer until they expire and will be retrieved during the next visit to the site.

Certain cookies may be deactivated by default, and visitors may choose to activate these functions or not when visiting Urnes dépôt inc. websites.

It is also possible to activate and deactivate the use of cookies by changing the preferences in the settings of the browser used.

• Use of Google Analytics

All sites under the control of Urnes dépôt inc. use Google Analytics to allow for continuous improvement. Google Analytics notably allows for the analysis of how a visitor interacts with an Urnes dépôt inc. website. Google Analytics uses cookies to generate statistical reports on the behavior of visitors to these websites and the content viewed.

Information from Google Analytics will never be shared by Urnes dépôt inc. with third parties.

It is possible to install a browser add-on to deactivate Google Analytics.

• Other Technological Means Used

Urnes dépôt inc. also collects personal information through technological means such as web forms integrated into a website controlled by Urnes dépôt inc. (for example, its contact form, its membership application form, its newsletter and seminar registration form), questionnaires accessible online on its platforms and applications, as well as other form platforms or tools (e.g., Microsoft Forms).

If Urnes dépôt inc. collects personal information by offering a technological product or service that has privacy settings, Urnes dépôt inc. must ensure that these settings offer the highest level of privacy by default (cookies are not covered).

4. Retention and Destruction of Personal Information

Unless a minimum retention period is required by law or applicable regulation, Urnes dépôt inc. will only retain personal information for the duration necessary to achieve the purposes for which it was collected.

Personal information used by Urnes dépôt inc. to make a decision regarding a person must be retained for a period of at least one year following the decision in question, or even seven years after the end of the fiscal year in which the decision was made if it has tax implications, for example, the circumstances of a termination of employment.

At the end of the retention period or when the personal information is no longer necessary, Urnes dépôt inc. will ensure:

1. to destroy it; or
2. to anonymize it (meaning it no longer allows, irreversibly, for the identification of the person and it is no longer possible to establish a link between the person and the personal information) to use it for serious and legitimate purposes.

The destruction of information by Urnes dépôt inc. must be done securely to ensure the protection of this information.

This section may be supplemented by any policy or procedure adopted by Urnes dépôt inc. regarding the retention and destruction of personal information, as applicable. Please contact the person responsible for the protection of personal information at Urnes dépôt inc. (indicated in this policy) to learn more.

5. Responsibilities of Urnes dépôt inc.

Generally, Urnes dépôt inc. is responsible for the protection of the personal information it holds.

The person responsible for the protection of personal information at Urnes dépôt inc. is the president of the organization. He must, generally, ensure compliance with applicable legislation regarding the protection of personal information. The responsible person must approve the policies and practices governing the governance of personal information. More specifically, this person is responsible for implementing this policy and ensuring that it is known, understood, and applied. In the event of the absence or inability to act of this responsible person, the President will perform the functions of the person responsible for the protection of personal information.

Staff members of Urnes dépôt inc. having access to personal information or being otherwise involved in the management thereof must ensure its protection and comply with this policy.

The roles and responsibilities of Urnes dépôt inc. employees throughout the life cycle of personal information may be specified by any other Urnes dépôt inc. policy in this regard, as applicable.

6. Data Security

Urnes dépôt inc. is committed to implementing reasonable security measures to ensure the protection of the personal information it manages. The security measures in place correspond, among other things, to the purpose, quantity, distribution, medium, and sensitivity of the information. Thus, this means that information that can be qualified as sensitive (see the definition provided in section 2) must be subject to greater security measures and must be better protected. Notably, and in accordance with what was previously mentioned regarding limited access to personal information, Urnes dépôt inc. must implement necessary measures to impose constraints on the rights of use of its information systems so that only employees who need access are authorized to access them.

7. Rights of Access, Rectification, and Withdrawal of Consent

To exercise their rights of access, rectification, or withdrawal of consent, the individual concerned must submit a written request to this effect to the person responsible for the protection of personal information at Urnes dépôt inc., at the email address indicated in the following section.

Subject to certain legal restrictions, individuals concerned may request access to their personal information held by Urnes dépôt inc. and request its correction in the event that it is inaccurate, incomplete, or equivocal. They may also demand the cessation of the dissemination of personal information concerning them or that any hyperlink attached to their name allowing access to this information by technological means be de-indexed, when the dissemination of this information contravenes the law or a court order. They may do the same, or even demand that the hyperlink allowing access to this information be re-indexed, when certain conditions provided by law are met.

The person responsible for the protection of personal information at Urnes dépôt inc. must respond in writing to these requests within 30 days of the date of receipt of the request. Any refusal must be reasoned and accompanied by the legal provision justifying the refusal. In these cases, the response must indicate the remedies under the law and the time limit for exercising them. The responsible person must assist the applicant in understanding the refusal if necessary.

Subject to applicable legal and contractual restrictions, individuals concerned may withdraw their consent to the communication or use of the information collected.

They may also ask Urnes dépôt inc. what personal information has been collected from them, the categories of persons at Urnes dépôt inc. who have access to it, and its retention period.

8. Complaint Handling Process

Receipt

Any person wishing to file a complaint regarding the application of this policy or, more generally, the protection of their personal information by Urnes dépôt inc., must do so in writing by contacting the person responsible for the protection of personal information at Urnes dépôt inc., at the email address indicated in the following section.

The individual must indicate their name, contact information to reach them, including a telephone number, as well as the subject and reasons for their complaint, providing sufficient detail so that it can be evaluated by Urnes dépôt inc. If the complaint formulated is not sufficiently precise, the person responsible for the protection of personal information may request any additional information they deem necessary to be able to evaluate the complaint.

Processing

Urnes dépôt inc. is committed to processing any complaint received confidentially.

Within 30 days following receipt of the complaint or following receipt of all additional information deemed necessary and required by the person responsible for the protection of personal information at Urnes dépôt inc. to be able to process it, the latter must evaluate it and formulate a reasoned written response by email to the complainant. This evaluation will aim to determine if the processing of personal information by Urnes dépôt inc. complies with this policy, any other policy and practice in place within the organization, and applicable legislation or regulation.

In the event that the complaint cannot be processed within this timeframe, the complainant must be informed of the reasons justifying the extension of the timeframe, the progress of the processing of their complaint, and the reasonable timeframe necessary to be able to provide them with a final response.

Urnes dépôt inc. must create a separate file for each of the complaints addressed to it. Each file contains the complaint, the analysis and documentation supporting its evaluation, as well as the response sent to the person who initiated the complaint.

It is also possible to file a complaint with the Commission d’accès à l’information of Quebec or any other supervisory body for the protection of personal information responsible for the application of the law concerned by the subject of the complaint.

However, Urnes dépôt inc. invites any interested person to first contact its person responsible for the protection of personal information and to wait for the end of the processing process by Urnes dépôt inc.

9. Approval

This policy is approved by the person responsible for the protection of personal information at Urnes dépôt inc., whose business contact information is as follows:

Person Responsible for the Protection of Personal Information:

Denis Lachance
President

39, rue de la Visitation

St-Charles-Borromée, QC

J6E 4N1

For any request, question, or comment within the framework of this policy, please contact the responsible person by email at info@urnesdepot.com.

10. Publication and Modifications

This policy is published on the Urnes dépôt inc. website, as well as on all websites controlled and maintained by Urnes dépôt inc., to which this policy applies, regarding the personal information collected therein. This policy is also disseminated by any means appropriate to reach the persons concerned.

Urnes dépôt inc. reserves the right to modify this policy at any time.

Urnes dépôt inc. must also do the same for all modifications to this policy, which must also be subject to a notice to inform the persons concerned.

*Notes: Please note that the use of the masculine gender is intended to simplify this policy and facilitate its reading.

Table of Versions and Changes:

Appendix A

The following is a non-exhaustive list of the types of information that Urnes dépôt inc. might collect, their use, or the intended objective, as well as the means by which the information is collected. Thus, this includes, but is not limited to, the following elements.

Please note that most of the personal information managed by Urnes dépôt inc. is information from personal clients, employees, job candidates, and consultants.