Personal Information Protection Policy and Privacy Policy

Personal Information Protection Policy and Privacy Policy

1. Context

Services funéraires Azur incinération inc. is a company incorporated in Quebec that processes personal information as part of its activities. This policy aims to ensure the protection of personal information and to govern how Services funéraires Azur incinération inc. collects, uses, communicates, retains, and destroys it, or otherwise manages it. Furthermore, it aims to inform any interested party about how Services funéraires Azur incinération inc. processes their personal information. It also covers the processing of personal information collected by Services funéraires Azur incinération inc. through technological means.

2. Application and Definitions

This policy applies to Services funéraires Azur incinération inc., which includes its officers, employees, consultants, volunteers, as well as any person who otherwise provides services on behalf of Services funéraires Azur incinération inc. It also applies to the website of Services funéraires Azur incinération inc., as well as all websites controlled and maintained by Services funéraires Azur incinération inc. It covers all types of personal information managed by Services funéraires Azur incinération inc., whether it concerns its current or potential clients, consultants, employees, members, or any other individuals (such as visitors to its websites or otherwise). For the purposes hereof, personal information is information that relates to a natural person and allows, directly or indirectly, to identify them. For example, this could include a person’s name, address, email address, phone number, gender, or banking information, as well as information about their health, ethnic origin, language, etc. Sensitive personal information is information for which there is a high degree of reasonable expectation of privacy, e.g. health information, banking information, biometric information, sexual orientation, ethnic origin, political opinions, religious or philosophical beliefs, etc. Generally, a person’s professional or business contact information does not constitute personal information, for example, a person’s name, title, address, email address, or work phone number. More specifically and for clarity, within the meaning of Quebec’s Act respecting the protection of personal information in the private sector, and as of September 22, 2023, sections 3 (collection, use, communication), 4 (retention and destruction), and 6 (data security) do not apply to a person’s information related to the exercise of a function within a business, such as their name, title, function, as well as the address, email address, and phone number of their workplace. These same paragraphs also do not apply to personal information that is public under the law, effective upon the entry into force of this policy.

3. Collection, Use, and Communication

As part of its activities, Services funéraires Azur incinération inc. may collect different types of information for various purposes. The types of information that Services funéraires Azur incinération inc. may collect, their use (or intended purpose), and the means by which the information is gathered are indicated in Appendix A of this policy. Services funéraires Azur incinération inc. will also inform the individuals concerned, at the time of personal information collection, of any other information collected, the purposes for which it is collected, and the means of collection, in addition to other information to be provided as required by law. Services funéraires Azur incinération inc. applies the following general principles regarding the collection, use, and communication of personal information: Consent:

• Generally, Services funéraires Azur incinération inc. collects personal information directly from the individual concerned and with their consent, unless an exception is provided by law. Consent may be obtained implicitly in certain situations, for example, when the individual decides to provide their personal information after being informed by this policy about its use and communication for the purposes indicated therein (see Appendix A for more details). Thus, this policy and the information it contains may be consulted by the individual concerned at the time of personal information collection.
• Normally, Services funéraires Azur incinération inc. must also obtain the consent of the individual concerned before collecting their personal information from third parties, before communicating it to third parties, or for any secondary use thereof. However, Services funéraires Azur incinération inc. may act without consent in certain cases provided by law and under the conditions stipulated therein. The main situations where Services funéraires Azur incinération inc. may act without consent are indicated in the relevant sections of this policy.

Collection:

• In all cases, Services funéraires Azur incinération inc. only collects information if it has a valid reason to do so. Furthermore, collection will be limited only to the necessary information required to fulfill the intended purpose.
• Please note that the services and programs of Services funéraires Azur incinération inc. do not target minors, and more generally, Services funéraires Azur incinération inc. does not intentionally obtain personal information concerning minors (in such cases, information cannot be collected from them without the consent of a parent or guardian).
• Collection from Third Parties. Services funéraires Azur incinération inc. may collect personal information from third parties. Unless an exception is provided by law, Services funéraires Azur incinération inc. will request the consent of the individual concerned before collecting personal information about them from a third party. In cases where such information is not collected directly from the individual, but from another organization, the individual concerned may request the source of the collected information from Services funéraires Azur incinération inc.

In certain situations, Services funéraires Azur incinération inc. may also collect personal information from third parties, without the consent of the individual concerned, if it has a serious and legitimate interest in doing so and a) if the collection is in the person’s interest and it is not possible to do so from them in a timely manner, or b) if this collection is necessary to ensure the accuracy of the information. Additionally, Services funéraires Azur incinération inc. may collect personal information indirectly, notably by using:

• Clover. Clover has its own terms and privacy policy, which can be consulted for more information.
• Global Payments. Global Payments has its own terms and privacy policy, which can be consulted for more information.
• Stripe. Stripe has its own terms and privacy policy, which can be consulted for more information.

This collection through third parties may be necessary to use certain services or programs, or to otherwise do business with Services funéraires Azur incinération inc. When required, Services funéraires Azur incinération inc. will obtain the individual’s consent at the appropriate time. Retention and Use:

• Services funéraires Azur incinération inc. ensures that the information it holds is up-to-date and accurate at the time of its use to make a decision concerning the individual concerned.
• Services funéraires Azur incinération inc. may only use an individual’s personal information for the reasons indicated herein or for any other reasons provided at the time of collection. As soon as Services funéraires Azur incinération inc. wishes to use this information for another reason or purpose, new consent must be obtained from the individual concerned, which must be obtained expressly if it concerns sensitive personal information. However, in certain cases provided by law, Services funéraires Azur incinération inc. may use the information for secondary purposes without the individual’s consent, e.g.:
  • when such use is clearly for the benefit of that person;
  • when necessary to prevent or detect fraud;
  • when necessary to assess or improve protection and security measures.
• Limited Access. Services funéraires Azur incinération inc. must implement measures to limit access to personal information only to employees and individuals within its organization who are authorized to access it and for whom this information is necessary in the performance of their duties. Services funéraires Azur incinération inc. will request the individual’s consent before granting access to any other person.

Communication:

• Generally, and unless an exception is indicated in this policy or otherwise provided by law, Services funéraires Azur incinération inc. will obtain the consent of the individual concerned before communicating their personal information to a third party. Furthermore, when consent is necessary and when it concerns sensitive personal information, Services funéraires Azur incinération inc. must obtain the explicit consent of the individual before communicating the information.
• However, the communication of personal information to third parties is sometimes necessary. Thus, personal information may be communicated to third parties without the consent of the individual concerned in certain cases, including, but not limited to, the following:
  • Services funéraires Azur incinération inc. may communicate personal information, without the consent of the individual concerned, to a public body (such as the government) which, through one of its representatives, collects it in the exercise of its functions or the implementation of a program it manages.

• • Personal information may be transmitted to its service providers to whom it is necessary to communicate the information, and this, without the individual’s consent. For example, these service providers may include event organizers, subcontractors of Services funéraires Azur incinération inc. designated for the execution of mandates in programs administered by Services funéraires Azur incinération inc. and cloud service providers. In these cases, Services funéraires Azur incinération inc. must have written contracts with these providers that specify the measures they must take to ensure the confidentiality of the personal information communicated, that the use of this information is only made within the scope of the contract’s execution, and that they cannot retain this information after its expiration. Furthermore, these contracts must stipulate that providers must notify the personal information protection officer of Services funéraires Azur incinération inc. (indicated in this policy) of any breach or attempted breach of confidentiality obligations concerning the personal information communicated and must allow this officer to carry out any verification related to this confidentiality.

• • If necessary for the purpose of concluding a commercial transaction, Services funéraires Azur incinération inc. could also communicate personal information, without the consent of the individual concerned, to the other party of the transaction and subject to the conditions provided by law.

• Communication Outside Quebec: It is possible that personal information held by Services funéraires Azur incinération inc. may be communicated outside Quebec, for example, when Services funéraires Azur incinération inc. uses cloud service providers whose server(s) are located outside Quebec or when Services funéraires Azur incinération inc. does business with subcontractors located outside the province.

Additional Information on Technologies Used:

• Use of Cookies Cookies are data files transmitted to a website visitor’s computer by their web browser when they visit that site and can have several uses.

Websites controlled by Services funéraires Azur incinération inc. use cookies, notably:

• To remember visitors’ settings and preferences, for example, for language selection and to allow current session tracking.
• For statistical purposes to understand visitor behavior, content viewed, and to allow for website improvement.

Websites controlled by Services funéraires Azur incinération inc. use the following types of cookies:

• Session cookies: These are temporary cookies that are kept in memory only for the duration of the website visit.
• Persistent cookies: These are kept on the computer until they expire and will be retrieved during the next visit to the site.

Some cookies may be disabled by default, and visitors may choose whether or not to activate these functions when browsing the websites of Services funéraires Azur incinération inc. It is also possible to enable and disable the use of cookies by changing preferences in the settings of the browser used.

• Use of Google Analytics

All sites under the control of Services funéraires Azur incinération inc. use Google Analytics to enable continuous improvement. Google Analytics notably allows for the analysis of how a visitor interacts with a Services funéraires Azur incinération inc. website. Google Analytics uses cookies to generate statistical reports on the behavior of visitors to these websites and the content viewed. Information from Google Analytics will never be shared by Services funéraires Azur incinération inc. with third parties. It is possible to install a browser add-on to disable Google Analytics.

• Other Technological Means Used

Services funéraires Azur incinération inc. also collects personal information through technological means such as web forms integrated into a website controlled by Azur Funeral Services Incineration Inc. (for example, its contact form, its membership application form, its newsletter and seminar registration form), online questionnaires on its platforms and applications, as well as other form platforms or tools (e.g., Microsoft Forms). If Azur Funeral Services Incineration Inc. collects personal information by offering a technological product or service with privacy settings, Azur Funeral Services Incineration Inc. must ensure that these settings offer the highest level of privacy by default (cookies are not covered).

4. Retention and Destruction of Personal Information

Unless a minimum retention period is required by applicable law or regulation, Azur Funeral Services Incineration Inc. will only retain personal information for the period necessary to fulfill the purposes for which it was collected. Personal information used by Azur Funeral Services Incineration Inc. to make a decision concerning an individual must be retained for a period of at least one year following the decision in question, or even seven years after the end of the fiscal year in which the decision was made if it has tax implications, for example, the circumstances of an employment termination. At the end of the retention period or when personal information is no longer necessary, Azur Funeral Services Incineration Inc. will ensure:

1. their destruction; or
2. their anonymization (meaning they can no longer, irreversibly, identify the individual and it is no longer possible to establish a link between the individual and the personal information) for serious and legitimate purposes.

The destruction of information by Azur Funeral Services Incineration Inc. must be carried out securely, to ensure the protection of this information. This section may be supplemented by any policy or procedure adopted by Azur Funeral Services Incineration Inc. regarding the retention and destruction of personal information, where applicable. Please contact the Privacy Officer at Services funéraires Azur incinération inc. (indicated in this policy) to learn more.

5. Responsibilities of Azur Funeral Services Incineration Inc.

Generally, Azur Funeral Services Incineration Inc. is responsible for the protection of the personal information it holds. The Personal Information Protection Officer of Azur Funeral Services Incineration Inc. is the President of the organization. He must, in general, ensure compliance with applicable legislation concerning the protection of personal information. The Officer must approve the policies and practices governing the management of personal information. More specifically, this person is responsible for implementing this policy and ensuring that it is known, understood, and applied. In the event of the absence or inability of this officer to act, the President of the company will assume the duties of the Personal Information Protection Officer. The staff members of Azur Funeral Services Incineration Inc. who have access to personal information or are otherwise involved in its management must ensure its protection and comply with this policy. The roles and responsibilities of employees of Azur Funeral Services Incineration Inc. throughout the lifecycle of personal information may be specified by any other policy of Azur Funeral Services Incineration Inc. in this regard, where applicable.

6. Data Security

Services funéraires Azur incinération inc. is committed to implementing reasonable security measures to ensure the protection of the personal information it manages. The security measures in place correspond, among other things, to the purpose, quantity, distribution, medium, and sensitivity of the information. Thus, this means that information that can be qualified as sensitive (see the definition provided in section 2) will require more significant security measures and will need to be better protected. In particular, and in accordance with what was previously mentioned regarding limited access to personal information, Azur Funeral Services Incineration Inc. must implement necessary measures to impose restrictions on the usage rights of its information systems so that only employees who need access are authorized to access them.

7. Rights of Access, Rectification, and Withdrawal of Consent

To assert their rights of access, rectification, or withdrawal of consent, the data subject must submit a written request to this effect to the Personal Information Protection Officer of Azur Funeral Services Incineration Inc., at the email address indicated in the next section. Subject to certain legal restrictions, data subjects may request access to their personal information held by Azur Funeral Services Incineration Inc. and request its correction if it is inaccurate, incomplete, or ambiguous. They may also demand the cessation of dissemination of personal information concerning them or that any hyperlink attached to their name allowing access to this information by technological means be de-indexed, when the dissemination of this information contravenes the law or a judicial order. They may do the same, or demand that the hyperlink allowing access to this information be re-indexed, when certain conditions provided by law are met. The Personal Information Protection Officer of Azur Funeral Services Incineration Inc. must respond in writing to these requests within 30 days of the date of receipt of the request. Any refusal must be justified and accompanied by the legal provision justifying the refusal. In such cases, the response must indicate the remedies under the law and the deadline for exercising them. The officer must assist the applicant in understanding the refusal if necessary. Subject to applicable legal and contractual restrictions, data subjects may withdraw their consent to the communication or use of the collected information. They may also ask Azur Funeral Services Incineration Inc. what personal information has been collected from them, the categories of individuals at Azur Funeral Services Incineration Inc. who have access to it, and its retention period.

8. Complaint Handling Process

Receipt Any person wishing to file a complaint regarding the application of this policy or, more generally, the protection of their personal information by Azur Funeral Services Incineration Inc., must do so in writing by contacting the Personal Information Protection Officer of Azur Funeral Services Incineration Inc., at the email address indicated in the next section. The individual must provide their name, contact details, including a phone number, as well as the subject and reasons for their complaint, providing sufficient details for it to be evaluated by Azur Funeral Services Incineration Inc.. If the complaint is not sufficiently precise, the Personal Information Protection Officer may request any additional information deemed necessary to evaluate the complaint. Processing Azur Funeral Services Incineration Inc. is committed to handling any received complaint confidentially. Within 30 days following the receipt of the complaint or following the receipt of all additional information deemed necessary and requested by the Personal Information Protection Officer of Azur Funeral Services Incineration Inc. to process it, the latter must evaluate it and provide a reasoned written response by email to the complainant. This evaluation will aim to determine whether the processing of personal information by Azur Funeral Services Incineration Inc. complies with this policy, any other policies and practices in place within the organization, and applicable legislation or regulations. Should the complaint not be able to be processed within this timeframe, the complainant must be informed of the reasons justifying the extension, the progress of their complaint’s processing, and the reasonable time required to provide a definitive response. Services funéraires Azur incinération inc. must create a separate file for each complaint addressed to it. Each file contains the complaint, the analysis and documentation supporting its evaluation, as well as the response sent to the person who originated the complaint. It is also possible to file a complaint with the Commission d’accès à l’information du Québec or any other personal information protection oversight body responsible for enforcing the law relevant to the subject of the complaint. However, Services funéraires Azur incinération inc. invites any interested person to first contact its Personal Information Protection Officer and await the completion of the processing by Azur Funeral Services Incineration Inc..

9. Approval

This policy is approved by the Privacy Officer of Services funéraires Azur incinération inc., whose business contact details are as follows: Privacy Officer: Denis Lachance President 260, chemin St-Michel Crabtree, Quebec J0K 1B0 For any request, question, or comment regarding this policy, please contact the officer by email at info@sfazur.ca.

10. Publication and Amendments

This policy is published on the website of Azur Funeral Services Incineration Inc., as well as on all websites controlled and maintained by Azur Funeral Services Incineration Inc. to which this policy applies, concerning the personal information collected therein. This policy is also disseminated by any means appropriate to reach the data subjects. Azur Funeral Services Incineration Inc. reserves the right to amend this policy at any time. Azur Funeral Services Incineration Inc. must also do the same for all amendments to this policy, which will also be subject to a notice to inform the data subjects. *Notes: Please note that the use of the masculine gender is intended to simplify this policy and facilitate its reading. Version and Change Table:

Here is a non-exhaustive list of the types of information that Azur Funeral Services Incineration Inc. may collect, their use, or the intended purpose, as well as the means by which the information is collected. Thus, this includes, but is not limited to, the following elements. Please note that most personal information managed by Azur Funeral Services Incineration Inc. consists of information from clients, employee personnel, job applicants, and consultants.