Privacy Policy

1. Foreword

Respect for privacy and the protection of personal information are fundamental principles at the Women's Centre of Montréal-Est / Pointe-aux-Trembles - Maison Gisèle Pomerleau, (hereinafter “the Centre”). In accordance with Bill 25, the Centre is committed to adopting rigorous and ethical practices with respect to the collection, management, retention, destruction and disclosure of personal information.

This policy applies to all persons involved in the activities of the Centre and Maison Gisèle Pomerleau (MGP): members, participants, employees, administrators, volunteers, interns, partners and any other person present in our facilities.

It also aims to publicize the measures in place to deal with complaints and incidents relating to the protection of personal information.

2. Definitions

Worker: Any person who works at the Centre, whether paid or unpaid (employee, subcontractor, volunteer, trainee, etc.). Participant, client, lodger : Any woman who provides personal information to the Centre as part of her participation in an activity, service (including lodging) or event.

Personal information: Any information, regardless of its form (verbal, written, visual, digital, etc.), that makes it possible to identify a natural person, such as name, address, telephone number, medical information, etc.

Confidentiality: Principle of restricting access to personal information to authorized persons only.

Privacy incident: Any unauthorized access, use, disclosure, loss or breach of security of personal information.

Confidentiality incident register: Document in which all incidents are recorded, including nature, date, people affected, assessment of risk of harm and corrective measures taken.

Risk of serious harm: Risk of significant harm to a data subject, analyzed according to the nature of the compromised information, the possible consequences and the likelihood of malicious use.

3. Confidentiality obligation

All persons involved with the Centre formally undertake to respect the confidentiality of personal information to which they have access. This commitment may appear in the employment contract, a separate agreement or any other appropriate form.

This obligation remains in force even after the link with the Centre has ended.

4. Collection and use of personal information

The Centre collects only the information required to provide its services, and only from the person concerned, unless otherwise provided by law or authorized in writing by that person.

Personal information may be used for :

• Manage registrations and participation in services, activities or events;
• Maintain administrative records for staff and volunteers;
• Meet legal or contractual requirements (e.g. tax, insurance, etc.).

As part of the housing services offered by Maison Gisèle Pomerleau, the Centre also collects personal information to assess the eligibility of women and their children for housing, such as marital or family situation, security, confidentiality and health needs, as well as any other information relevant to the support and provision of safe, adapted housing. This information is treated with the utmost confidentiality and is used only for the purposes of admission and the provision of accommodation services.

5. Retention and security of personal information

The Centre's General Manager is designated as the person responsible for the protection of personal information (PRP). She is responsible for :

• Maintain an up-to-date register of confidentiality incidents;
• To authorize access to personal information according to the responsibilities of team members;
• Ensure the physical and digital security of the information stored ;

Employees with access to personal information must :

• Ensure that this information is protected against physical damage and unauthorized access;
• Protect all digital documents containing personal information (especially on removable media) with strong passwords that are regularly updated, especially when personnel changes occur;
• Keep documents in paper format in locked filing cabinets or any other secure location that complies with the Centre's internal standards.

Any incident of confidentiality must be reported immediately to management, so that it can be recorded in the register and measures taken to reduce the risk of harm and prevent the recurrence of such incidents. Incidents are kept in the register for a minimum period of five years following the date on which they were recorded.

Management assesses the seriousness of each incident. In the event of a risk of serious prejudice, it informs the Commission d'accès à l'information as well as any person concerned.

The Centre must also obtain from its technology service providers a formal commitment to preserve the confidentiality and security of personal information, including the obligation to report any confidentiality incident.

Adopted by the Board of Directors on: June 12, 2024