Policy for the protection of personal and confidential information

1. Introduction

OPERATION RED NOSE (hereinafter referred to as "ORN") is committed to respecting your privacy and protecting your personal information. In connection with the use of our services, ORN may collect personal information.

ORN is subject to and complies with applicable privacy laws. ORN is responsible for the personal information in its possession or under its control, including personal information entrusted to third parties. 

This policy applies to all personal information held by ORN and to anyone who processes such personal information.

The purpose of this policy is to inform users about ORN's personal information protection practices, including the following:

1. How personal information held by ORN is protected, collected, used, retained, disclosed and destroyed;

2. ORN's use of cookies on its websites and mobile applications;

3. The rights of individuals with respect to their personal information.

 

2. Personal Information

Personal information means any information about an individual that directly or indirectly identifies that individual. Your personal information may include, without limitation, your first and last name, date of birth, residential address, telephone numbers, sex, email address, information about your family situation, information you provide when creating a profile to access one of our services, and information about your lifestyle or health.

In the case of service users, volunteers and employees, this information may also include a membership number, status with ORN, academic record, curriculum vitae and information relating to liability insurance. 

However, information relating to an individual's performance of a function within a business, such as their name, title and position, as well as the address, email address and telephone number of their workplace, will not be considered personal information.

With respect specifically to our mobile application, we wish to clarify that users' geolocation data is also considered personal information when it can be used to identify an individual. This data is collected with the user's express consent for the purpose of accurately locating the user during their evening of participation and efficiently managing ride requests. This helps improve the speed and efficiency of our services while ensuring greater safety for everyone involved.

We are committed to treating this geolocation data with the same level of confidentiality and protection as other personal information collected, in accordance with applicable laws and our Personal Information Protection Policy. Users may withdraw their consent at any time and disable the geolocation feature, although doing so may affect the performance of our safe ride service.

The term "confidentiality incident" means any access, use or disclosure of personal information not authorized by law, as well as the loss of personal information or any other breach of its protection.

ORN is not responsible for the protection of personal information published by third parties on the Web. 

 

3. Our Commitment

We have established and implemented internal policies and procedures designed to adequately protect the personal information in our possession, regardless of its format or form. We review these policies and procedures on a regular basis.

We ensure transparency in the processing of personal information and implement all necessary measures to ensure its security and preserve the confidentiality of our users' personal information.

We educate our employees about the importance of protecting personal information by requiring them to complete training on this subject and by periodically issuing directives emphasizing their roles and obligations in this regard. We have implemented various security measures with respect to the personal information and confidential data we hold in order to protect it against loss and theft and to prevent unauthorized access, transmission, use or modification, including through the following measures:

 

3.1. Secure IT Environments

Our cloud infrastructure and equipment are hosted in secure environments. We ensure that security measures equivalent to or greater than those required under this Policy are implemented.
Access to ORN's Web services and mobile applications is provided through a secure transmission channel using an SSL certificate (HTTPS).

 

3.2. Privacy Impact Assessments

ORN conducts a privacy impact assessment for any project involving the acquisition, development or redesign of an information system or electronic service delivery system that involves the collection, use, disclosure, retention or destruction of personal information. This assessment documents the serious and legitimate interest in using personal information.

 

3.3. Access Management

ORN personnel and volunteers are authorized to access personal information only on a strict need-to-know basis and in accordance with the purposes for which it was collected. Only employees and volunteers whose duties require such access may access personal or confidential information. Access to data is logged and monitored.
 

4. Purposes for Collecting Personal Information

ORN limits the collection of personal information to data that is useful and necessary for our programs, our annual safe ride campaign and our fundraising activities. 

Without limitation, we may use, disclose and retain personal information for the following purposes:

1. Establishing and maintaining employment and volunteer relationships;

2. Providing the safe ride service when requested;

3. Improving our service offering;

4. Operating and improving our website and solutions while understanding users' usage patterns;

5. Providing any other complementary service associated with the service requested;

6. Complying with applicable laws and regulations;

7. Monitoring customer service quality and preventing errors and fraud.
    

5. Consent

ORN obtains the consent of the individuals concerned before collecting, using or disclosing personal information in accordance with this policy, subject to the exceptions and requirements provided by applicable laws.

In particular, we collect personal information through the application form used to become a volunteer as part of ORN's annual safe ride campaign. 

Personal information may also be collected, used or disclosed without notice to or consent from the individuals concerned, but only to the extent permitted by law.

Before providing us with personal information about another individual, you must obtain that individual's consent. 

In the case of a minor under the age of 14, consent must be given by the holder of parental authority or the minor's guardian. 

You may withdraw your consent to the collection, retention or use of your personal information at any time, subject to certain legal or contractual obligations. 

If you refuse to consent to the collection, use or disclosure of necessary personal information, ORN may be unable to fulfill a service request or complete your registration as a volunteer. 

 

6. Limits on Collection, Use and Disclosure

 

6.1. Collection and Use

We limit the collection of personal information to what is necessary to meet our legal obligations, provide our services and conduct our activities. 

If you post personal information on one of our websites or mobile applications for the purpose of making it public, we will publish it and may use that personal information in accordance with the permissions you grant us.

ORN collects, through legitimate and lawful means, only the personal information it may reasonably consider necessary to meet its legal obligations, provide its services and conduct its activities.

Access to personal information collected is strictly limited to authorized employees and members of the organization and exclusively to the information necessary for the performance of their respective duties.

 

6.2. Disclosure

ORN discloses personal information for the purposes identified in this policy and in accordance with its legal or professional obligations. 

ORN ensures that prior consent is obtained before disclosing personal information, unless the law requires or permits personal information to be used or disclosed without such consent.

ORN may disclose personal information to its professional advisors, suppliers, subcontractors or affiliates to the extent necessary to provide the requested services and for the purposes set out in this policy.

Mobile information, including telephone numbers and data relating to consent to receive text messages (SMS), is neither sold nor disclosed to third parties for promotional or marketing purposes. This information may, however, be disclosed to service providers that assist Operation Red Nose in providing its messaging services, solely to the extent necessary to provide those services.

We require these third parties to maintain such information in accordance with strict confidentiality and security standards.
 

7. Profiling

We automatically collect certain data using third-party analytics programs such as Google Analytics to help us understand how visitors use our Web services. The following information may be collected, retained and used:

1. Information about your computer, including your IP address, geographic location, browser type and version, and operating system;

2. Information about your visits to and use of our websites, including the referring source, duration of the visit, pages viewed and website navigation paths;

3. Information generated through your use of our website, including when, how often and under what circumstances you use it;

We use these types of tools to monitor the performance of our website. We also use them to evaluate the effectiveness of promotional links.

We do not provide personal information to Google Analytics at any time, in accordance with the Google Analytics Terms of Service (available in English). Please note that Google stores data on servers located in the United States and that its activities are subject to U.S. law. We use the data collected to ensure the quality of our website and to better serve you.

Anyone wishing to prevent Google Analytics from collecting data must use the Google Analytics Opt-out Browser Add-on.

 

8. Cookies

ORN's Web services and mobile applications use cookies to identify your browser, enable features and monitor website performance. Cookies are small data files stored in the memory of your computer or mobile device when you visit a website or application. They are used to enhance your user experience by storing certain data. By using ORN's Web services and mobile applications, you consent to this use.
ORN's website uses persistent cookies. More specifically, cookies are used:

1. To maintain and terminate a visitor's session on the website (e.g., save data between two steps of a process or terminate a session after a period of inactivity);

2. To save font size preferences;

3. To enable Web analytics tools (e.g., Google Analytics, Clicktale and iPerceptions; see the previous section for further information).

Cookies are used anonymously and without storing personal information.

 

8.1. Cookies We Use on Our Websites

We use cookies for the following purposes:

1. Authentication: We use cookies to identify you when you visit and navigate our website, Web platforms and mobile applications. Cookies collected for these purposes are used to manage logins and sessions.

2. Personalization: We use cookies to store information about your preferences and enable us to customize the service according to your needs. Cookies used for these purposes are used to record the language selected when using ORN's websites and mobile applications.

 

8.2. Cookies Used by Our Service Providers

In certain situations, one of our services may be provided by an external service provider that may use cookies stored on your computer or mobile device.

 

8.3. Managing Cookies

Visitors who wish to refuse the use of cookies should consult their browser's help menu to disable cookies or allow them only partially. You can configure your browser or device to refuse cookies or delete them after they have been stored. Please consult the "Help" section of your browser or device for instructions. Please note that disabling, deleting or refusing these cookies may adversely affect your user experience and may reduce the performance of the website.
 

9. Retention and Destruction 

When your personal information is no longer required for the purposes for which it was collected, it is destroyed in accordance with the law and our records retention policy, except where otherwise authorized or required by law. In certain circumstances, we may anonymize the personal information we retain.

Your personal and confidential information is retained, either directly or through subcontractors, only for as long as necessary for the requested services and to comply with applicable legal and regulatory requirements. We require our subcontractors to comply with confidentiality commitments and implement policies equivalent to this policy. 

 

10. Management of Confidentiality Incidents

If ORN has reason to believe that a confidentiality incident involving personal information has occurred and that the incident presents a risk of serious harm, ORN will promptly notify the Commission d'accès à l'information and any individual whose personal information is affected by the incident. ORN may also notify any person or organization that may help reduce the risk, disclosing only the personal information necessary for that purpose without the consent of the individual concerned. In all cases, the incident will be documented in a register for reference purposes.

 

11. Rights of Individuals

11.1. Requests for Access, Destruction or Correction

Any individual may obtain confirmation as to whether ORN holds personal information about them and may access that information by submitting a written request to the person responsible for the protection of personal information.

Subject to any regulatory or contractual restrictions, you may access, request the correction of or request the destruction of personal information about you held by ORN.

We undertake to respond to you within 30 days of receiving your written request. Reasonable fees may be charged for the transcription, reproduction or transmission of this information. 

Rights of access, correction and destruction of personal information are subject to exceptions under the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) and other legal obligations.

You may at any time require ORN to cease disseminating personal information about you. 

 

11.2. Data Portability

Individuals have the right to request the portability of their computerized personal information and may request that it be provided to them in the form of a written and intelligible transcript. 

 

12. Requests, Complaints and Questions

We are committed to responding to your questions and concerns regarding the protection of your personal information. You may contact the person responsible for the protection of personal information at the address provided above for this purpose.

A procedure has been established for handling complaints regarding this policy and our personal information practices. You may file a complaint regarding the manner in which ORN collects, uses, discloses or retains your personal information by contacting the person responsible for the protection of personal information. 

If you are not satisfied with the response to a complaint or with our personal information policies and practices, you may file a complaint with the Commission d'accès à l'information du Québec at www.cai.gouv.qc.ca.

 

13. Contact Information for the Person Responsible for the Protection of Personal Information

By mail:
Person Responsible for the Protection of Personal Information
Pavillon Louis-Jacques-Casault, 
1055 Av. du Séminaire, Room 2455,
Québec, QC G1V 0A6

By email:
[email protected]
 

14. Review and Approval

This Policy takes effect upon its adoption and may be reviewed at any time by the person responsible for the protection of personal information.

Amendments may be proposed by various ORN stakeholders and must be submitted in writing to the person responsible for the protection of personal information.

ORN reserves the right to amend this policy at any time. Any amendments will be published on ORN's various Web platforms and mobile applications. Your continued use of the services following the posting of amendments to the policy constitutes acceptance of those amendments.

This Policy should be reviewed at least every two years to ensure that it remains relevant in light of ORN's mission, the activities of its users, and any substantial changes to legislation or regulatory requirements.

 

15. Effective Date

This Policy takes effect on September 1, 2022. It cancels and replaces all previous policies and guidelines relating to this subject.

---