(hereinafter referred to as « The AGENCY » or the « BROKER ») is governed by the Private Sector Privacy Act (RLRQ, c. P-39.1) (the Act).

Personal Information

Personal information is information about an individual that directly or indirectly allows their identification. Written documents, images, videos, and audio recordings may contain personal information. In the course of its professional activities, The AGENCY or the BROKER may collect personal information such as the name, home address, date of birth, identification document details, social insurance number, income information, marital status, and more.

Consent

The AGENCY or the BROKER collects, uses, and shares personal information with the consent of the individual concerned. To be valid, this consent must be clear, free, informed, and given for specific purposes. A person who consents to provide their personal information is presumed to consent to its use and sharing for the purposes for which it was collected.

Any person can withdraw their consent at any time for the collection, use, and sharing of their personal information by The AGENCY or the BROKER. In such a case, if the collection is necessary for the conclusion or execution of a contract by The AGENCY or the BROKER, they may not be able to comply with a service request.

Responsibility

The AGENCY or the BROKER is responsible for the protection of the personal information it holds in the course of real estate brokerage activities. For this purpose, The AGENCY or the BROKER has adopted a privacy policy as well as policies and practices governing the governance of personal information, with the aim of regulating the collection, use, sharing, retention, and destruction of personal information.

Collection of Personal Information

The AGENCY or the BROKER only collects personal information necessary for its real estate brokerage activities. For example, this may include information collected for the purpose of completing a real estate transaction, maintaining records, monitoring professional practice by the Organisme d'autoréglementation du courtage immobilier du Québec (OACIQ), or any other purpose determined by The AGENCY or the BROKER and made known to the person whose consent is requested.

The AGENCY or the BROKER encourages its staff members to explain in simple and clear terms to the individuals concerned the reasons for collecting their personal information and to ensure their understanding.

For the purpose of collecting personal information, The AGENCY or the BROKER encourages its staff members to use standardized forms developed by the OACIQ.

The AGENCY or the BROKER may also collect personal information verbally during correspondence with individuals involved in a transaction or through various documents submitted as part of a real estate transaction (identification documents, financial documents, powers of attorney, etc.).

Use and Sharing of Personal Information

Personal information is used and shared for the purposes for which it was collected and with the consent of the individual concerned. In certain cases provided by law, personal information may be used for other purposes, such as fraud detection and prevention or providing a service to the individual concerned.

The AGENCY or the BROKER may be required to share personal information with third parties, such as suppliers, co-contractors, subcontractors, agents, insurers (such as the Fonds d'assurance responsabilité professionnelle du courtage immobilier du Québec [FARCIQ]), professionals, other regulators, or entities outside Quebec.

The AGENCY or the BROKER may, without the consent of the individual concerned, share personal information with a third party if such sharing is necessary for the execution of a mandate or service contract. In this case, The AGENCY or the BROKER establishes a written mandate or contract in which they specify the measures their agent must take to ensure the protection of the personal information entrusted to them, to ensure it is used only in the course of the mandate or contract, and to ensure its destruction after its conclusion. The co-contractor must also undertake to collaborate with The AGENCY or the BROKER in the event of a breach of the confidentiality of personal information.

Before sharing personal information outside Quebec, The AGENCY or the BROKER takes into account its sensitivity, the purpose of its use, and the protection measures it will receive outside Quebec. The AGENCY or the BROKER will only share personal information outside Quebec if their analysis demonstrates that it will receive adequate protection in the location where it is to be shared.

Retention and Destruction of Personal Information

When the purposes for which personal information was collected or used have been accomplished, The AGENCY or the BROKER must destroy it, subject to a retention period provided by law. In this regard, the professional obligations of The AGENCY or the BROKER require them to retain their records for at least six (6) years following their definitive closure.

Security Measures

During the collection, use, retention, and destruction of personal information, The AGENCY or the BROKER applies the necessary security measures to protect the confidentiality of personal information. Specifically, the applicable measures are:

The BROKER must promptly return any document recovered in the course of their work to The AGENCY. No physical documents can be stored on the premises of the company, unless they are in a compartment or a secured area. The BROKER must immediately return any physical document to the client following its scanning. All scanned documents must be saved on The AGENCY's computer system, which is compliant and approved by the OACIQ, and only accessible to The AGENCY and the BROKER (protected by a password). The BROKER and The AGENCY will only share confidential information to the extent necessary for the performance of their functions (e.g., with the notary). Only share information with the public that is necessary and authorized by the client (e.g., information on the brokerage contract for the property description).

Confidentiality Incident

A confidentiality incident includes unauthorized access, use, communication of personal information contrary to the law, or the loss of personal information, or any other breach of personal information protection.

The AGENCY or the BROKER has established a protocol for managing a confidentiality incident, which identifies the individuals assisting the Personal Information Protection Officer and outlines concrete actions to be taken in the event of an incident. This protocol includes the expected responsibilities at each stage of incident management, including measures to ensure data security.

Roles and Responsibilities

1. The AGENCY or the BROKER
   
   Ensures the confidentiality of information through good information management practices. Specifically, they provide directives, training, and instructions to staff members regarding the collection, use, storage, modification, consultation, communication, and permissible destruction of personal information.
   Implements appropriate protection measures to reduce the risk of confidentiality incidents, such as information security, updating policies related to personal information, staff training, etc.
   Has standardized methods for classifying documents containing personal information.
   Has standardized methods for retaining documents containing personal information, particularly regarding the scanning procedure.
   Manages physical and computer access to personal information based on its sensitivity.
   Ensures the secure destruction of personal information. Specifically, they provide directives or instructions to staff members regarding the secure destruction method, destruction timelines, etc.
   
   
2. Personal Information Protection Officer
   
   In accordance with the law, The AGENCY or the BROKER has appointed a Personal Information Protection Officer.
   The Personal Information Protection Officer ensures that these policies are respected and comply with applicable regulations. The name and contact information of this individual can be found in the « Access, Withdrawal, and Rectification Rights » section.
   The Personal Information Protection Officer manages confidentiality incidents and, in this context, takes actions as prescribed by the law.
   The Personal Information Protection Officer handles requests for access and rectification of personal information. They also address complaints regarding the processing of personal information by The AGENCY or the BROKER.
   The Personal Information Protection Officer is consulted in the context of a privacy impact assessment for any project involving the acquisition, development, or overhaul of an information system or electronic service delivery involving the collection, use, communication, retention, or destruction of personal information. They can suggest measures to protect personal information in such a project.
   
   
3. Staff Members
   
   A staff member of The AGENCY or the BROKER may access personal information only to the extent necessary for the performance of their duties or mandate.
   The staff member of The AGENCY or the BROKER:
   Ensures the integrity and confidentiality of personal information held by The AGENCY or the BROKER.
   Complies with all policies and directives of The AGENCY or the BROKER regarding access, collection, use, communication, destruction of personal information, and information security and follows the instructions provided.
   Adheres to security measures implemented on their workstation and on any equipment containing personal information.
   Uses only equipment and software authorized by The AGENCY or the BROKER.
   Ensures the secure destruction of personal information in accordance with received instructions.
   Immediately reports to their superior any act they become aware of that may constitute an actual or suspected breach of personal information security rules.
   
   

Access, Withdrawal, and Rectification Rights

An individual (or their authorized representative) may request access to personal information about them held by The AGENCY or the BROKER. An individual may withdraw their consent to the collection, use, and communication of their personal information at any time. This withdrawal is then recorded in writing.

An individual may request correction of personal information in a record concerning them that they believe is inaccurate, incomplete, or ambiguous.

The AGENCY or the BROKER may refuse a request for access or rectification in cases provided for by the law.

Complaints

An individual who believes they have been harmed can file a complaint regarding the processing of their personal information by The AGENCY or the BROKER. This complaint will be handled promptly within a maximum of 7 days by the Personal Information Protection Officer, and a written response will be provided.

To request access or rectification of your personal information or to submit a complaint regarding the processing of personal information, please communicate in writing with: Jessika Lovasco, agency leader, info@agencev.ca.