EMBASSY CEILINGS INC. PRIVACY POLICY
Published on:
1. General Provisions
Embassy Ceilings Inc., hereinafter referred to as “ECI,” is a federally incorporated corporation that offers products to customers of all categories. This Policy is intended to ensure the protection of personal information and to govern the manner in which ECI collects, uses, discloses, retains, destroys, or otherwise manages such information. It also aims to inform any interested person of how ECI processes their personal information. This Policy also applies to the processing of personal information collected by ECI through technological means.
This Policy applies to ECI, including, without limitation, its officers, employees, consultants, volunteers, and any person otherwise providing services on behalf of ECI. It also applies to ECI’s website.
2. Scope and Definitions
This Policy applies to all types of personal information managed by ECI, whether relating to its prospective or current customers, consultants, suppliers, employees, members, or any other persons, such as visitors to its website.
For the purposes of this Policy, personal information means any information about an identifiable individual, whether directly or indirectly. For example, this may include a person’s name, address, email address, telephone number, gender, banking information, health information, ethnic origin, language, etc.
Sensitive personal information is information for which there is a high reasonable expectation of privacy, such as health information, banking information, biometric information, sexual orientation, ethnic origin, political opinions, religious or philosophical beliefs, etc. Generally, an individual’s professional or business contact information does not constitute personal information, such as a person’s name, title, business address, business email address, or business telephone number. More specifically, for clarity, within the meaning of Québec’s Act respecting the protection of personal information in the private sector, and effective September 22, 2023, Sections 3 (Collection, Use and Disclosure), 4 (Retention and Destruction), and 6 (Data Security) do not apply to information relating to an individual’s performance of duties within an enterprise, such as their name, title, position, work address, work email address, and work telephone number.
These same sections also do not apply to personal information that is public by law, effective as of the coming into force of this Policy.
3. Consent
Generally, ECI collects personal information directly from the individual concerned and with that individual’s consent, except where an exception is provided by law. Consent may be implied in certain situations, for example, where an individual chooses to provide personal information after having been informed, through this Policy, of the intended use and disclosure for the purposes set out herein. See Appendix “List” for further details.
Accordingly, this Policy and the information it contains may be consulted by the individual concerned at the time personal information is collected.
ECI must also normally obtain the individual’s consent before collecting personal information from third parties, before disclosing it to third parties, or before using it for any secondary purpose. However, ECI may act without consent in certain cases provided for by law and subject to the conditions set out therein. The principal circumstances in which ECI may act without consent are identified in the relevant sections of this Policy.
4. Collection, Use and Disclosure
In the course of its activities, ECI may collect different types of information for different purposes. The types of information ECI may collect, their use or intended purpose, and the means by which the information is collected are set out in Appendix “List” to this Policy.
At the time personal information is collected, ECI will also inform individuals of any other information collected, the purposes for which it is collected, and the means of collection, in addition to any other information required by law.
a) Collection:
- In all cases, ECI collects information only where it has a valid reason to do so. Furthermore, collection will be limited to the information necessary to fulfill the intended purpose.
- Please note that ECI’s products are not intended for minors. More generally, ECI does not knowingly obtain personal information about minors. In such cases, personal information may not be collected from a minor without the consent of a parent or legal guardian.
- ECI may collect personal information from third parties. Unless an exception is provided by law, ECI will obtain the individual’s consent before collecting personal information about that individual from a third party. Where such information is not collected directly from the individual but rather from another organization, the individual may ask ECI about the source of the information collected.
- In certain situations, ECI may also collect personal information from third parties without the individual’s consent where it has a serious and legitimate interest in doing so, the collection is in the individual’s interest and it is not possible to collect the information from the individual in a timely manner; or the collection is necessary to ensure that the information is accurate.
b) Use:
- ECI takes reasonable steps to ensure that the information it holds about an individual is accurate and up to date when used to make decisions concerning that individual.
- ECI may use an individual’s personal information only for the purposes indicated in this Policy or for any other purposes identified at the time of collection. If ECI wishes to use such information for another purpose, it must obtain new consent from the individual concerned. Such consent must be explicit where sensitive personal information is involved.
- Limited access: ECI has procedures in place to limit access to personal information to employees and other persons within its organization who are authorized to access it and for whom the information is necessary in the performance of their duties. ECI will obtain the individual’s consent before granting access to any other person.
c) Disclosure:
Generally, unless an exception is identified in this Policy or otherwise provided by law, ECI will obtain the individual’s consent before disclosing their personal information to a third party. In addition, where consent is required and sensitive personal information is involved, ECI must obtain the individual’s explicit consent before disclosing the information.
However, disclosure of personal information to third parties is sometimes necessary. Personal information may therefore be disclosed to third parties without the individual’s consent in certain cases, including, but not limited to, the following:
- ECI may disclose personal information, without the individual’s consent, to a public body, such as a government body, where one of its representatives collects the information in the exercise of its functions or for the implementation of a program under its administration.
- Personal information may be disclosed, without the individual’s consent, to service providers where such disclosure is necessary. For example, these service providers may include group insurance brokers, marketing firms, and ECI subcontractors appointed to carry out mandates under programs administered by ECI. In such cases, ECI must have written agreements with these service providers setting out the measures they must take to ensure the confidentiality of disclosed personal information; requiring that the information be used only for the performance of the agreement; and preventing them from retaining the information after the agreement expires. These agreements must also require service providers to notify ECI’s Privacy Officer, identified in this Policy, of any breach or attempted breach of confidentiality obligations relating to disclosed personal information, and must allow the Privacy Officer to carry out any verification relating to such confidentiality.
- Where necessary for the purposes of concluding a commercial transaction, ECI may also disclose personal information, without the individual’s consent, to the other party to the transaction, subject to the conditions provided by law.
5. Accuracy of Your Personal Information
In order to assist you professionally, the personal information collected by ECI must be accurate, complete, and up to date. You may access the personal information under ECI’s control and custody, update it, and correct any inaccuracies by sending an email to ifrechette@embassyinc.ca.
6. Security of Personal Information
ECI protects your personal information by taking security measures that consider the sensitivity of the personal information in question. Personal information is stored in secure environments that are not accessible to the public, such as restricted-access premises, locked rooms, and locked filing cabinets.
7. Transfers of Personal Information to Other Countries
In certain cases, personal information may be processed and stored outside Canada by ECI, its affiliates or related companies, or a third-party service provider. Such personal information may be subject to disclosure in accordance with applicable laws in the jurisdictions where it is processed or stored. Those laws may not provide the same level of protection as Canadian privacy laws.
8. Retention and Destruction of Personal Information
Unless a minimum retention period is required by applicable law or regulation, ECI will retain personal information only for as long as necessary to fulfill the purposes for which it was collected.
Personal information used by ECI to make a decision concerning an individual must be retained for at least one year following the decision in question, or for up to seven years after the end of the fiscal year in which the decision was made if it has tax implications, for example, in circumstances involving the termination of employment.
At the end of the retention period, or when personal information is no longer required, ECI will ensure that it is either:
- Destroyed; or
- Anonymized, meaning that it no longer permits the irreversible identification of an individual and it is no longer possible to establish a link between the individual and the personal information, so that it may be used for serious and legitimate purposes.
ECI will destroy personal information securely to protect it. This section may be supplemented by any policy or procedure adopted by ECI regarding the retention and destruction of personal information, where applicable. Please contact ECI’s Privacy Officer, identified in this Policy, for details.
9. ECI’s Responsibilities
Generally, ECI is responsible for the protection of the personal information it holds.
ECI’s Privacy Officer is identified at the end of this Policy. The Privacy Officer is generally responsible for ensuring compliance with applicable personal information protection legislation. The Privacy Officer must approve the policies and practices governing personal information management. More specifically, this person is responsible for implementing this Policy and ensuring that it is known, understood, and applied.
ECI personnel who have access to personal information or are otherwise involved in its management must protect such information and comply with this Policy.
The roles and responsibilities of ECI employees throughout the personal information life cycle may be further specified in any other ECI policy on this matter, where applicable.
If you have any questions, comments, or concerns about our privacy practices or the protection of your privacy, or if you wish to challenge them, please contact the Privacy Officer by email at ifrechette@embassyinc.ca or by telephone at 819-489-0382.
10. Data Security and Personal Information
ECI is committed to implementing reasonable security measures to protect the personal information it manages. The security measures in place are proportionate, among other things, to the purpose, quantity, distribution, medium, and sensitivity of the information.
Accordingly, information that may be considered sensitive, as defined in Section 2, must be subject to stronger security measures and enhanced protection. In particular, and in accordance with the foregoing regarding limited access to personal information, ECI must implement the measures necessary to restrict access rights within its information systems so that only employees who require access to perform their duties are authorized to access the information.
11. Rights of Access, Rectification and Withdrawal of Consent
To exercise rights of access, rectification, or withdrawal of consent, an individual must submit a written request to ECI’s Privacy Officer at the email address provided in the following section.
Subject to certain legal restrictions, individuals may request access to their personal information held by ECI and request its correction where it is inaccurate, incomplete, or equivocal. They may also require the cessation of the dissemination of personal information concerning them, or the de-indexing of any hyperlink attached to their name that enables access to such information by technological means, where dissemination of the information contravenes the law or a court order. They may also do so or require that the hyperlink enabling access to the information be re-indexed, where the conditions provided by law are met.
ECI’s Privacy Officer must respond in writing to these requests within 30 days of receipt. Any refusal must be reasoned and accompanied by the legal provision supporting the refusal. In such cases, the response must identify the legal remedies available and the time limit for exercising them. The Privacy Officer must assist the applicant in understanding the refusal, where necessary.
Subject to applicable legal and contractual restrictions, individuals may withdraw their consent to the disclosure or use of the information collected.
They may also ask ECI what personal information has been collected from them, the categories of persons at ECI who have access to it, and the retention period applicable to it.
12. Complaint Handling Process
Any person who wishes to file a complaint concerning the application of this Policy or, more generally, the protection of their personal information by ECI must do so in writing by contacting ECI’s Privacy Officer at ifrechette@embassyinc.ca.
The individual must provide their name, contact information, including a telephone number, as well as the subject matter and reasons for the complaint, with sufficient detail for ECI to assess it. If the complaint is not sufficiently precise, the Privacy Officer may request any additional information deemed necessary to assess the complaint.
ECI undertakes to handle all complaints confidentially. Within 30 days after receiving the complaint, or after receiving all additional information deemed necessary and requested by ECI’s Privacy Officer in order to process it, the Privacy Officer must assess the complaint and provide the complainant with a reasoned written response by email. This assessment will determine whether ECI’s handling of personal information complies with this Policy, any other policies and practices in place within the organization, and applicable legislation or regulations.
Where the complaint cannot be handled within that time frame, the complainant must be informed of the reasons for the extension, the status of the complaint, and the reasonable time required to provide a final response.
ECI must create a separate file for each complaint it receives. Each file must contain the complaint, the analysis and supporting documentation for the assessment, and the response sent to the person who made the complaint.
It is also possible to file a complaint with Québec’s Commission d’accès à l’information (“CAI”) or with any other privacy oversight body responsible for enforcing the law applicable to the subject matter of the complaint.
However, ECI invites any interested person to first contact its Privacy Officer and await the completion of ECI’s complaint-handling process.
13. Appendix “List” of Information Collected
For security reasons, ECI does not publicly disclose the list of information it collects.
To obtain this list, please submit a formal request by email to the Privacy Officer.
14. Person Responsible for Access to Documents or the Protection of Personal Information
This Policy is approved by ECI’s Privacy Officer, whose business contact information is as follows:
Ivanie Fréchette CPA, Controller
Embassy Ceilings Inc.
365, 6th Street
Daveluyville, Québec G0Z 1C0
Email: ifrechette@embassyinc.ca
Telephone: 819-489-0382
15. Updates to the Privacy Policy
ECI may review this Privacy Policy from time to time. If ECI decides to amend this Policy, the revised version will be posted here.
Version 1.0: Effective September 12, 2023