Personal information governance policy

Purpose

This policy establishes the framework for the collection, use, disclosure, retention, and destruction of personal information by Déménagement André Bélair, in compliance with applicable laws, including Québec’s Law 25 and Canada’s PIPEDA.

Scope

This policy applies to all individuals who have access to personal information in the course of Déménagement André Bélair’s activities, including employees, officers, consultants, contractors, and service providers.

Accountability

Déménagement André Bélair is responsible for the personal information under its control. The person in charge of the protection of personal information oversees the implementation of this policy and compliance with applicable laws.

Collection of Personal Information

Personal information is collected only when necessary for specific, explicit, and legitimate purposes, and in accordance with data minimization principles.

Use and Disclosure

Personal information is used solely for the purposes for which it was collected. Any disclosure to a third party is governed by contractual or legal measures designed to ensure confidentiality and security.

Security Measures

Security measures implemented include, but are not limited to:

• Role‑based access controls
• Strong authentication and access management
• Protection of IT systems and infrastructure
• Secure destruction of paper and electronic records
• Immediate removal of access upon termination of employment or business relationship

Retention and Destruction

Personal information is retained for the period necessary to meet legal and operational requirements, after which it is securely destroyed or anonymized.

Confidentiality Incidents

Any confidentiality incident must be reported without delay to the person in charge of the protection of personal information. An incident register is maintained and notification obligations are fulfilled where required.

Access, Correction, and Portability

Any request for access, correction, or portability must be submitted in writing to the person in charge. A response will be provided within the time limits prescribed by law.

Complaints Handling

Any complaint regarding the handling of personal information may be submitted to the designated person in charge. An internal investigation will be conducted and a response provided within the legally prescribed timeframe.