Policies and Practices Governing the Handling of Personal Information
Profusion Real Estate Inc. (hereafter referred to as “THE AGENCY”) is governed by the Act Respecting the Protection of Personal Information in the Private Sector (RLRQ, c. P-39.1) (the Law). Depending on the context, the term THE AGENCY may include or be substituted by the term THE BROKER.
Terms of use THE AGENCY’s Website
Our website is provided as a service to visitors. THE AGENCY reserves the right to modify, add or delete content on this website, at any time and for any reason, without notice.
Privacy Notice
Communications sent by email may contain personal and/or confidential information. If by mistake you receive a communication that is not intended for you, please notify the sender and destroy the communication, without sharing its contents or keeping a copy.
Browsing data is non-personal information since it does not identify a person. All of our business partners, without exception, are required by law to adhere to recognized principles regarding the protection of privacy.
IP Address
During your visit to our website, our servers may collect the IP address of your device (computer, mobile device, tablet, etc.) and the name of your internet service provider. By using our website, by consulting our social networks or specialized applications, you consent to the use that we will make of the browsing data that is collected.
Cookies files
Certain information is collected, when you visit our website, through cookies, commonly known as “cookies”. These cookies are saved directly on the hard drive of your device, by an HTTP type server. These files do not contain any personal information, they are simply unique numbers allowing you to be identified during your visits in order to facilitate the downloading of the pages which have already been visited as well as to provide you with content likely to interest you, all, in order to offer you an optimal experience.
Google Analytics
THE AGENCY uses the Google Analytics tool to collect data on the browsing activities of visitors to its website, including, but not limited to, the source, the time spent on our website and the pages consulted.
Pixels
THE AGENCY or one of its partners may use “Web beacons” for the purpose of collecting data related to users of its website, including demographic data or browsing behavior.
Personal Information
Personal information is information relating to an individual that allows, directly or indirectly, their identification. A written document, an image, a video, and a sound recording can contain personal information. In the course of its professional activities, THE AGENCY may collect personal information such as name, home address, date of birth, identification document details, social security number, income information, marital status, etc.
Consent
THE AGENCY collects, uses, and discloses personal information with the consent of the individual concerned. For consent to be valid, it must be explicit, voluntary, informed, and given for specific purposes. The person giving their personal information is presumed to consent to its use and disclosure for the purposes for which it was collected.
Anyone can withdraw their consent to the collection, use, and disclosure of their personal information by THE AGENCY at any time. In this case, if the collection is necessary for the conclusion or performance of a contract by THE AGENCY, it might not be able to fulfill a service request.
Liability
THE AGENCY is responsible for protecting personal information it holds in the context of real estate brokerage activities. To this end, THE AGENCY has adopted a confidentiality policy as well as policies and practices governing the handling of personal information aimed at overseeing the collection, use, disclosure, storage, and destruction of personal information.
Collection of Personal Information
THE AGENCY only collects personal information necessary for its activities in the field of real estate brokerage. For example, this might be information collected for the completion of a real estate transaction, for record-keeping, for professional practice monitoring by the Self-regulatory Organization of Quebec’s Real Estate Brokerage (OACIQ), or any other purpose determined by THE AGENCY and made known to the person giving their consent.
THE AGENCY advises its staff to explain, in simple and clear terms, the reasons for collecting the person’s personal information and to ensure they understand.
For the purpose of collecting personal information, THE AGENCY encourages its staff to use standardized forms developed by the OACIQ.
THE AGENCY may also verbally collect personal information during correspondence with individuals involved in a transaction or through various documents submitted in the course of a real estate transaction (identification documents, financial documents, proxies, etc.).
Use and Disclosure of Personal Information
Personal information is used and disclosed for the purposes for which it was collected and with the consent of the individual concerned. In some cases provided for by law, personal information may be used for other purposes, for example, to detect and prevent fraud, or to provide a service to the individual concerned.
THE AGENCY may be required to disclose personal information to third parties, for example, to suppliers, contractors, subcontractors, agents, insurers (such as the Professional Liability Insurance Fund of Quebec Real Estate Brokerage [FARCIQ]), professionals, other regulators like FINTRAC, or outside Quebec.
THE AGENCY may, without the consent of the individual concerned, disclose personal information to a third party if this disclosure is necessary for the execution of a mandate or a service or business contract. In this case, THE AGENCY establishes a written mandate or contract in which it specifies the measures its agent must take to ensure the protection of the personal information entrusted to them, so that this information is used only for the purpose of the mandate or contract and is destroyed after its completion. The co-contractor must also commit to collaborating with THE AGENCY in case of a breach of the confidentiality of personal information.
Before disclosing personal information outside Quebec, THE AGENCY takes into account its sensitivity, the purpose of its use, and the protection measures that will be applied to it outside Quebec. THE AGENCY will only disclose personal information outside Quebec if its analysis shows that the information will benefit from adequate protection in the location where it is to be disclosed.
Personal data will not be shared with third parties for marketing or promotional purposes.
Preservation and Destruction of Personal Information
Once the purposes for which the personal information was collected or used have been fulfilled, THE AGENCY must destroy it, subject to a retention period provided for by law. In this regard, THE AGENCY’s professional obligations require it to keep its records for at least six (6) years following their final closure. Other entities like FINTRAC may require a period that can be longer depending on the specific circumstances of the file.
Security Measures
During the collection, use, storage, and destruction of personal information, THE AGENCY implements the necessary security measures to protect the confidentiality of personal information. More specifically, the following are the applicable measures for the protection of personal information:
- **Access Control**: Only authorized personnel and the broker(s) who identified the client have access to the data, and only for specific tasks.
- **Staff Training**: Regular training of staff on best practices for data management and information security.
- **Audit and Monitoring**: Regular audits are carried out to ensure compliance with security policies.
- **Regular Security Updates**: Software and systems are regularly updated to correct potential security vulnerabilities.
- **Firewalls and Antivirus Software**: Installation and maintenance of firewalls and antivirus software.
- **Backup Protocols**: Regular and secure backups of data are made and stored in a secure location.
- **Incident Response Plan**: An action plan is in place in case of data breaches or other security incidents.
- **Secure Archiving**: Data is archived securely when no longer needed by brokers, in accordance with data protection laws. Only authorized internal personnel can access it using a password.
- **Risk Assessment**: Regular risk assessments are performed to identify and mitigate potential vulnerabilities.
- **Transparency and Consent**: Individuals are informed about how their data is used and stored, and informed consent is obtained.
Privacy Incident
A privacy incident includes unauthorized access, use, or disclosure of personal information as defined by law, as well as the loss of personal information or any other violation of the protection of personal information. THE AGENCY has implemented a protocol for managing a privacy incident that identifies those responsible for assisting the Personal Information Protection Officer and outlines the specific actions to be taken in case of an incident. This protocol defines responsibilities at each stage of incident management, including measures to ensure data security.
Roles and Responsibilities
- THE AGENCY
THE AGENCY :
• Ensures the confidentiality of information through good information management practices. Specifically, it provides guidelines, training, and instructions to staff members related to the collection, use, storage, modification, review, disclosure, and permitted destruction of personal information.
• Implements appropriate protective measures to reduce the risk of a privacy incident, such as cybersecurity measures, policy updates related to personal information, staff training, etc.
• Has standardized methods for filing and storing documents containing personal information, including digitization procedures.
• Manages physical and digital access to personal information based on their sensitivity.
• Proceeds with the secure archiving of personal information, providing guidelines or instructions to staff members on secure archiving methods, archiving timelines, etc.
- Personal Information Protection Officer
In accordance with the law, THE AGENCY has appointed a Personal Information Protection Officer. This officer ensures compliance with this policy and applicable regulations. The name and contact information for this person are provided in the “Right to Access, Withdrawal, and Correction” section. The officer manages privacy incidents and, in this context, takes actions as prescribed by law. The officer also handles access and correction requests for personal information and complaints about how THE AGENCY processes personal information.
The officer is consulted for Privacy Impact Assessments in any project involving the collection, use, disclosure, storage, archiving, or destruction of personal information. The officer may suggest measures to protect personal information within such projects.
- Staff Members
Staff members may access personal information only as needed to fulfill their duties. Staff members:
• Ensure the integrity and confidentiality of personal information held by THE AGENCY.
• Comply with all policies and directives of THE AGENCY regarding access, collection, use, disclosure, archiving, destruction of personal information, and information security, and follow all instructions provided.
• Comply with security measures in place on their workstation and on any equipment containing personal information.
• Use only the equipment and software authorized by THE AGENCY.
• Ensure, when appropriate, the secure archiving of personal information in accordance with received instructions.
• Immediately report to their supervisor any known acts that may constitute an actual or presumed violation of personal information security rules.
Right to Access, Withdrawal, and Correction
An individual (or their authorized representative) can request access to their personal information held by THE AGENCY. An individual may withdraw consent to the collection, use, and disclosure of their personal information at any time, documented in writing.
An individual can request the correction of personal information in their file that they consider to be inaccurate, incomplete, or ambiguous.
THE AGENCY may deny an access or correction request in cases provided for by law.
Complaints
Any person who feels aggrieved can file a complaint regarding the handling of their personal information by THE AGENCY. This complaint will be diligently processed within a maximum of 10 business days by the Personal Information Protection Officer, and a written response will be sent to you.
- **Complaint Receipt**: Upon receiving the complaint, an acknowledgment of receipt will be sent to the complainant within 48 hours.
- **Complaint Recording**: The complaint will be logged in a dedicated tracking system to ensure effective and transparent follow-up.
- **Initial Assessment**: The Personal Information Protection Officer will assess the complaint to determine its validity and urgency.
- **Investigation**: A comprehensive investigation will be conducted to understand the circumstances surrounding the complaint. This may include interviews with the concerned staff and a review of systems and activity logs.
- **Documentation**: All evidence and findings will be thoroughly documented.
- **Decision and Corrective Actions**: Based on the findings, corrective actions will be taken if necessary, and a decision will be made regarding the complaint.
- **Notification to the Complainant**: A detailed written response outlining the findings of the investigation and actions taken will be sent to the complainant within the 10-business-day time frame.
- **Appeal**: If the complainant is not satisfied with the response, they will be informed of the available avenues for appeal, including the possibility of taking the complaint to the competent authorities.
- **Internal Review**: A review of processes will be conducted to identify lessons learned and implement future improvements.
- **Archiving**: The complaint and all associated actions will be securely archived for future auditing needs.
To request access to or correction of your personal information, or to file a complaint regarding the handling of your personal information, please contact:
Christina Miller, Certified Real Estate Agent
Profusion immobilier inc.
