Privacy Policy

1) OBJECTIVES

The purpose of this policy is to govern Domaine de Rouville Inc. doing business under the name Domaine International de Rouville (hereinafter "Domaine International de Rouville") both when collecting personal information through technology that includes identification, location or profiling functions, and when using personal information. It requires Domaine International de Rouville to take all necessary measures to mitigate the risks of infringement of citizens' right to privacy, pursuant to articles 35 to 40, addressing respect for privacy, as well as article 1525 of the Civil Code of Québec1 on solidarity between debtors of an obligation contracted for the service or operation of the business.

2) SCOPE

This policy applies to all company personnel, and at all hierarchical levels, particularly in situations requiring communication by any technological means whatsoever. It aims to comply with Law 252, which modernizes the provisions regarding the protection of information, by making the legislative provisions more adapted to deal with new technologies and changes in the digital age.

3) DEFINITIONS

3.1. Law 25 on the protection of personal information
Refers to the Act to modernize legislative provisions relating to the protection of personal information3, which was assented to on September 22, 2021, with entry into force scheduled for September 22, 2022 and 2023. This Act amends the Act respecting the protection of personal information in the private sector4.

3.2. Information
The Act respecting the protection of personal information in the private sector defines this term as follows: “Personal information is any information that concerns a natural person and allows them to be identified” 5.

3.3. Responsible for the protection of personal information
Refers to the person within the company who has the highest authority and who must therefore ensure compliance with and implementation of this policy. This role is, by default, assigned to the company's top manager, who has the option to delegate part or all of his or her responsibilities to the Privacy Officer.

3.4. Profiling
Means the collection and use of personal information to assess certain characteristics of a natural person, including for the purposes of analyzing that person's job performance, economic situation, health, personal preferences, interests or behavior.

3.5. Confidentiality incident

This means: 1° access to personal information not authorized by law; 2° use of personal information not authorized by law; 3° communication of personal information not authorized by law; 4° loss of personal information or any other breach of the protection of such information.

4) POLICY STATEMENT

• Domaine International de Rouville undertakes to take reasonable steps to: o Provide a work environment aimed at protecting and respecting the personal data of its customers;
• Mitigate the risks of infringement of citizens' right to privacy;
• Establish policies governing the governance of personal information and publish detailed information on its website;
• Disseminate the policy in such a way as to make it accessible to all staff;
• Maintain, in the event of a confidentiality incident, a record of incidents and take measures as quickly as possible to reduce the risk of harm being caused to the persons concerned;
• Notify the Commission d’accès à l’information (hereinafter the “Commission”) established by section 103 of the Act respecting Access to documents held by public bodies and the Protection of personal information7 and the persons concerned of any incident presenting a risk of serious harm;
• Disclose to the Commission in advance the verification or confirmation of identity made by means of biometric characteristics or measures;
• Take reasonable steps to limit the risk of harm and prevent the recurrence of such accidents;
• Designate a person responsible for the protection of personal information and publish their title and contact details on their website;
• Provide the highest confidentiality of personal information by default;
• Comply with the new framework applicable to the communication of personal information without the consent of the person concerned, in the context of a commercial transaction or for the purposes of study, research or the production of statistics.

5) NEW OBLIGATIONS TO BE COMPLIED WITH REGARDING OUTSOURCING AND CROSS-BORDER TRANSFERS

The Domaine International de Rouville undertakes to:
− Indicate the categories of service providers to whom it is likely to transmit personal information.
− Mention that personal information could be transferred outside Quebec.
− Communicate personal information to their service providers without the consent of individuals, provided that a written agreement providing for specific protection measures is entered into between the two parties.

6) SPECIFIC INFORMATION TO BE MADE AVAILABLE TO THE PUBLIC
When collecting personal information, Domaine International de Rouville undertakes to make available, in simple and clear terms:
− The objectives of the collection;
− The means of collection;
− The rights of access and rectification;
− The right of the individual to withdraw consent to the use of the information collected.

7) PRIVACY FACTORS ASSESSMENT
The Domaine International de Rouville undertakes to carry out an assessment with regard to, in particular:
− Any project for the acquisition, development and redesign of an information system;
− Electronic provision of services involving the collection, use, communication, retention or destruction of personal information.

8) RESPONSIBILITIES OF THE PERSONAL INFORMATION PROTECTION OFFICER
His responsibilities include: −
The implementation and publication of policies and practices relating to the protection of personal information;
− Carry out privacy impact assessments;
− Implement privacy requirements.

9) RESPONSIBILITIES OF SERVICE PROVIDERS (THIRD PARTIES)
Suppliers undertake to:
− Describe measures taken to ensure the confidentiality of personal information obtained;
− Certify that you will use the information obtained only for the purpose of providing services and will not retain this information after the contract expires;
− Inform the Privacy Officer without delay of any breach or attempted breach of the confidentiality of information and allow the Privacy Officer to carry out any verification relating to confidentiality requirements.

10) NEW RIGHTS GRANTED TO INDIVIDUALS CONCERNING THEIR PERSONAL INFORMATION:
The person collecting personal information from the data subject must, at the time of collection and subsequently upon request, inform the data subject:
− The purposes for which this information is collected;
− The means by which the information is collected;
− Rights of access and rectification provided for by law;
− His right to withdraw his consent to the communication or use of the information collected.

In the event of collection of personal information by a technology that makes it possible to identify, locate or profile the persons concerned, Domaine International de Rouville must inform them in advance so that they can give informed consent to such collection and explain to them how to activate such functions once they have given their consent.

11) CONSENT NOT REQUIRED
However, personal information may be used for another purpose without the consent of the person concerned in the following cases only:
− When its use is for purposes compatible with those for which it was collected;
− When its use is clearly for the benefit of the person concerned;
− When its use is necessary for the purposes of preventing and detecting fraud or evaluating and improving protection and security measures;
− When its use is necessary for the purposes of supplying or delivering a product or providing a service requested by the data subject;
− When its use is necessary for study, research or statistical production purposes and it is depersonalized.

12) MINORS UNDER 14 YEARS OLD
Obtaining the consent of the holder of parental authority or guardian for the collection, use or disclosure of personal information concerning a minor under 14 years of age is non-negotiable.

13) RULES FOR COMMUNICATING PERSONAL INFORMATION TO FACILITATE THE GRIEFING PROCESS
Domaine International de Rouville undertakes to respect the right to be forgotten, in particular by considering a written request for access or rectification made by a person concerned.

APPENDIX 1 – PERSONAL INFORMATION PROTECTION OFFICER DESIGNATED BY THE EMPLOYER
Rouville International Estate
− will ensure that the designated responsible person will be duly trained and will have the necessary tools at their disposal for the processing and follow-up of the complaint or report;
− will free up working time so that the designated responsible person can carry out the functions assigned to them.
The following person is designated to act as the person responsible for the application of the Personal Information Protection Policy of Domaine International de Rouville:
GUY CUSSON, general manager of Domaine de Rouville Inc.

This responsible person must mainly:
− Inform staff about the company's policy on the protection of personal information;
− Receive complaints and reports;
− Recommend the nature of the actions to be taken to stop the harassment;
− Carry out privacy impact assessments;
− Implement privacy requirements.

Commitment of the responsible person
I hereby declare my commitment to comply with this policy and I assure that my intervention will be impartial, respectful and confidential.

Guy Cusson
General manager
guy@domaineinternationalderouville.com