Privacy Policy on the Protection of Personal Information

1. Purpose

This policy (hereinafter the “Policy”) sets out the guidelines relating to the collection, use, communication, retention and destruction of documents containing Personal Information held by Sundae Creative Agency Inc. (hereinafter “Sundae Creative Agency”) in the performance of its duties in accordance with the Act Respecting the Protection of Personal Information in the Private Sector (CQLR c. P-39.1) as amended by the Act to Modernize Legislation Provisions Respecting the Protection of Personal Information (SQ 2021, c. 25) (hereinafter collectively the “Act”). 

2. Scope

This Policy applies to Sundae Creative Agency, which includes, but is not limited to, its employees, members of the Board of Directors, interns and volunteers, if applicable, as well as any person who otherwise provides services on behalf of Sundae Creative Agency, but particularly to those who collect, use, communicate, retain or destroy documents containing Personal Information.
It applies to all Personal Information collected, used and retained by Sundae Creative Agency, regardless of its form. The Policy covers Personal Information contained in all types of physical or digital records, in the broad sense, whether written, graphic, audio, visual, computerized or otherwise.

3. Definitions

“Personal Information” means any information or combination of information that relates to an individual and that allows that individual to be identified, directly or indirectly, such as identity information (name, address, date of birth, social security number, etc.), contact information (email address, telephone number, etc.). Personal information about an individual is confidential and should be treated as such.
“Privacy Incidents” means unauthorized access, use or disclosure by the Act to, loss of, or any other breach of Personal Information.
“Privacy Officer” means the person designated by Sundae Creative Agency to perform the duties of Privacy Officer under the Act.

4. Roles and Responsibilities

4.1 Sundae Creative Agency

Sundae Creative Agency safeguards information confidentiality by implementing effective information management protocols, which involve offering guidance, training, and instructions to its employees on matters such as the collection, use, storage, modification, access, disclosure and permitted destruction of Personal Information.

4.2 Privacy Officer

The Privacy Officer appointed by Sundae Creative Agency is Karim Leduc and can be contacted by phone at 514-578-4396 or by email at karim@sundaecreative.com
The Privacy Officer ensures compliance with and implementation of the Act within Sundae Creative Agency. He participates in the development of policies and practices on the protection of Personal Information. He responds to requests and complaints relating to Personal Information and coordinates the management of Privacy Incidents.

4.3 Employees, Interns, Volunteers, Consultants and Service Providers

An employee, intern, volunteer, consultant or service provider of Sundae Creative Agency may access Personal Information only to the extent that it is essential for the performance of his or her duties. They ensure the protection of Personal Information by complying with the Policy.

5. Consent

Sundae Creative Agency collects, uses and communicates Personal Information only with the explicit, voluntary, well-informed, and purpose-specific consent of the individual. When an individual consents to provide their Personal Information, it is presumed that they are also permitting its use and disclosure for the initially designated purposes.
Individuals may revoke in writing their consent for Sundae Creative Agency to collect, use, and disclose their Personal Information at any point. However, if this data collection is essential for Sundae Creative Agency to fulfill its contractual obligations, it may hinder Sundae Creative Agency’s ability to provide services.

6. Collection of Personal Information

Sundae Creative Agency only collects Personal Information that is necessary to carry out its activities. In general, Sundae Creative Agency collects Personal Information directly from the individual concerned and with his or her consent, unless an exception is provided for by law.

7. Use and Disclosure of Personal Information

Sundae Creative Agency undertakes to use and disclose the Personal Information only for the purposes for which it was collected and for which it is authorized by law to use it. It can however, collect, use or disclose it without the consent of the individual where permitted or required by law.
Access to Personal Information will be limited to employees who have a need to know within Sundae Creative Agency, when the Personal Information is necessary for the performance of their duties.
Sundae Creative Agency may need to disclose Personal Information to third parties, which could include suppliers, contractors, subcontractors, agents, insurers, professionals, other regulatory entities, or entities located outside of Quebec. Sundae Creative Agency can, without the consent of an individual, disclose Personal Information to such third party when it is essential for the execution of a mandate or a contractual service.
In specific situations, Sundae Creative Agency has the authority to collect, use, or disclose Personal Information without the individual's consent. These situations primarily arise when, due to legal or security reasons, obtaining consent from the individual is unfeasible or improbable, and when the use of such information is evidently in the individual's best interest or when it is imperative to avert or uncover fraud, or for other compelling reasons.

8. Disclosure Outside of Quebec

Prior to disclosing Personal Information outside of Quebec, Sundae Creative Agency will consider factors like the information's sensitivity, the intended purpose of its utilization, and the protective measures available in the external jurisdiction. Sundae Creative Agency will disclose Personal Information outside of Quebec only if its assessment concludes that the information will be subject to sufficient safeguards and protection in the external jurisdiction.

9. Retention and Destruction of Personal Information

Sundae Creative Agency may retain the Personal Information for a period provided for in the Act, in any form whatsoever, regardless of whether or not the Personal Information is actively used.
Subject to such retention period, where the purposes for which the Personal Information was collected or used have been fulfilled, Sundae Creative Agency must destroy it.

10. Privacy Impact Assessments

Sundae Creative Agency will carry out privacy impacts assessments for new and existing projects that involve the collection, use or disclosure of Personal Information.
The extent of the privacy impact assessment undertaken should correspond to the sensitivity of the information at hand, the intended utilization, the volume, dispersion, and the medium of the information.
Sundae Creative Agency may employ the “Guide d'accompagnement - Réaliser une évaluation des facteurs relatifs à la vie privée” developed by the Commission d'accès à l'information to conduct the privacy impact assessment.

11. Cookies Management

In line with Sundae Creative Agency’s commitment to transparency and the protection of Personal Information, Sundae Creative Agency employs Cookie Management Platforms (CMP) to manage cookies on its website. All documents and policies pertaining to this regulation will be prominently displayed on its official website.
The platform provides users with clear information about how their data will be used before obtaining their explicit consent. Users have the option to agree to certain uses of their data while declining others, allowing a degree of personalization that respects their choices.

12. Privacy Incident

When Sundae Creative Agency has reasonable grounds to believe that a Privacy Incident has occurred, it takes reasonable measures to reduce the risk of harm being caused and to prevent future incidents of the same nature from occurring. Any Privacy Incident needs to be reported to the Privacy Officer.
In case of a Privacy Incident, Sundae Creative Agency initiates an assessment of the damage. This assessment considers factors such as the sensitivity of the information, the possible misuse of it, the expected repercussions of its use, and the probability of it being employed for malicious purposes.
When the Privacy Incident presents a risk of a serious harm to an individual, Sundae Creative Agency will notify in writing the Commission d'accès à l'information and the individual concerned.
Sundae Creative Agency shall maintain a record of Privacy Incidents in its “Registry of Privacy Incidents of Personal Information”.

13. Management of Complaints

Any person concerned by the protection of his or her Personal Information or by the application of this Policy may file a writing complaint directly with the Privacy Officer.

14. Coming into Force

The Policy is effective as of September 1st, 2024.
The Policy has been approved by the Privacy Officer.
The Policy may be amended from time to time to comply with the Act and any amended Policy will be made available.