PRIVACY POLICY

Procedure for the Retention, Destruction, and Anonymization of Personal Information

1. Overview

Implementing a procedure for the retention, destruction, and anonymization of personal information is essential to protecting individuals' privacy, complying with privacy legislation, preventing privacy incidents involving personal information and security breaches, maintaining client trust, and protecting the organization's reputation.

2. Purpose

The purpose of this procedure is to ensure the protection of individuals' privacy and compliance with legal obligations regarding the protection of personal information.

3. Scope

This procedure covers the entire lifecycle of personal information, from collection to destruction. It applies to all employees and stakeholders involved in collecting, processing, retaining, destroying, and anonymizing personal information, in accordance with legal requirements and privacy protection best practices.

4. Definitions

Personal Information: Any information that directly or indirectly identifies a natural person.

Retention: Secure storage of personal information for the required period.

Destruction: Permanent deletion, disposal, or erasure of personal information.

Anonymization: The process of modifying personal information so that the individuals concerned can no longer be directly or indirectly identified, irreversibly and at any time.

4. Procedure

4.1 Retention Period

4.1.1 Personal information has been categorized as follows:

Information concerning company employees.
Information concerning members of the organization.
Information concerning clients.

4.1.2 The retention period for each category has been established as follows:

Company employees: 7 years after termination of employment.
Members: Varies depending on the type of personal information.
Clients: Varies depending on the type of personal information.

For more details, refer to the complete inventory of personal information held by the organization.

Please note that specific retention periods may apply.

4.2 Secure Storage Methods

4.2.1 Personal information is stored in the following locations: OneDrive and Wix.

4.2.2 The sensitivity level of each storage location has been assessed.

4.2.3 These storage locations, whether physical or digital, are appropriately secured.

4.2.4 Access to these storage locations is restricted to authorized individuals only.

4.3 Destruction of Personal Information

4.3.1 Personal information stored on paper must be completely shredded.

4.3.2 Digital personal information must be completely deleted from devices (computers, phones, tablets, external hard drives), servers, and cloud-based tools.

4.3.3 A destruction schedule must be established based on the retention period defined for each category of personal information. Planned destruction dates must be documented.

4.3.4 Destruction must be carried out in a manner that prevents personal information from being recovered or reconstructed.

4.4 Anonymization of Personal Information

4.4.1 Personal information should only be anonymized if the organization wishes to retain and use it for serious and legitimate purposes.

4.4.2 The selected method for handling personal information is as follows: the information will be deleted after the retention period.

4.4.3 It must be ensured that the remaining information can no longer be used to directly or indirectly identify the individuals concerned, in an irreversible manner. The risk of re-identification of anonymized data must also be regularly assessed through testing and analysis to ensure the effectiveness of the anonymization process.

Important: As of the date this template was drafted, anonymization of personal information for serious and legitimate purposes was not possible. Government regulations must be adopted to establish the applicable criteria and procedures.

4.5 Staff Training and Awareness

4.5.1 Employees must receive regular training on procedures for retaining, destroying, and anonymizing personal information, as well as the risks associated with privacy breaches.

4.5.2 This also includes raising staff awareness of data security best practices and the importance of complying with established procedures.

Last updated: September 1, 2026

Procedure for Access Requests to Personal Information and Complaint Handling

1. Overview

Since individuals may request access to personal information held about them by an organization or submit complaints, it is important to establish predefined guidelines for responding to such requests.

2. Purpose

The purpose of this procedure is to ensure that all access requests are handled confidentially, promptly, and accurately while respecting the rights of the individuals concerned.

3. Scope

This procedure applies to internal personnel responsible for processing access requests and handling complaints, as well as individuals wishing to access their own personal information.

4. Procedure for Access Requests

4.1 Submitting a Request

4.1.1 Individuals wishing to access their personal information must submit a written request to the organization's Privacy Officer. Requests may be sent by email or postal mail.

4.1.2 The request must clearly indicate that it concerns access to personal information and provide sufficient details to identify the individual and the information requested.

4.1.3 Such details may include the individual's name, address, and any other relevant information needed to reliably verify the requester's identity.

4.2 Receipt of the Request

4.2.1 Once the request is received, an acknowledgment of receipt is sent to the individual to confirm that their request has been received.

4.2.2 The request must be processed within thirty (30) days of receipt.

4.3 Identity Verification

4.3.1 Before processing the request, the individual's identity must be reasonably verified. This may involve requesting additional information or verifying their identity in person.

4.3.2 If identity cannot be satisfactorily verified, the organization may refuse to disclose the requested personal information.

4.4 Responding to Incomplete or Excessive Requests

4.4.1 If a request for access to personal information is incomplete or excessive, the Privacy Officer will contact the individual to request additional information or clarification.

4.4.2 The organization reserves the right to refuse a request if it is clearly abusive, excessive, or unjustified.

4.5 Processing the Request

4.5.1 Once identity has been verified, the Privacy Officer responsible for handling access requests proceeds to collect the requested information.

4.5.2 The Privacy Officer reviews relevant records to gather the requested personal information while complying with any applicable legal restrictions.

4.6 Review of Information

4.6.1 Before disclosing personal information to the individual, the Privacy Officer carefully reviews it to ensure that it does not contain confidential third-party information or information that could infringe upon other rights.

4.6.2 If third-party information is present, the Privacy Officer determines whether it can be separated or must be excluded from disclosure.

4.7 Disclosure of Information

4.7.1 Once the necessary verifications have been completed, personal information is provided to the individual within a reasonable timeframe, in accordance with applicable legal requirements.

4.7.2 Personal information may be provided electronically, by secure postal mail, or in person, depending on the individual's preferences and appropriate security measures.

4.8 Monitoring and Documentation

4.8.1 All steps in the process of handling requests for access to personal information must be accurately and thoroughly documented.

4.8.2 Request details, actions taken, decisions made, and corresponding dates must be recorded in an access request tracking register.

This includes:

Date the request was received.
Date the acknowledgment of receipt was sent.
Date identity verification was completed.
Identity verification method.
Decision — access request approved or denied.
Date the information was disclosed, if applicable.

4.9 Confidentiality Protection

4.9.1 All personnel involved in handling requests for access to personal information must respect confidentiality and data protection requirements.

4.10 Complaint Management and Remedies

4.10.1 If an individual is dissatisfied with the response to their request for access to personal information, they must be informed of the complaint procedures and remedies available through the Commission d'accès à l'information du Québec (Quebec Access to Information Commission).

4.10.2 Complaints must be handled in accordance with the organization's internal complaint management policies and procedures, as outlined in the following section.

5. Complaint Handling Procedure

5.1 Receipt of Complaints

5.1.1 Complaints may be submitted in writing, by telephone, by email, or through any other official communication channel. They must be recorded in a centralized register accessible only to designated personnel.

5.1.2 The employee receiving the complaint must immediately notify the person responsible for receiving complaints.

5.2 Preliminary Assessment

5.2.1 The designated person reviews each complaint to assess its relevance and seriousness.

5.2.2 Frivolous, defamatory, or clearly unfounded complaints may be rejected. However, the complainant must be provided with an explanation.

5.3 Investigation and Analysis

5.3.1 The person responsible for the complaint conducts an investigation by collecting evidence, interviewing the parties concerned, and gathering all relevant documentation.

5.3.2 The person responsible must remain impartial and have the necessary authority to resolve the complaint.

5.3.3 The person responsible must maintain the confidentiality of information related to the complaint and ensure that all parties involved are treated fairly.

5.4 Complaint Resolution

5.4.1 The person responsible for the complaint proposes appropriate solutions to resolve it as promptly as possible.

5.4.2 Solutions may include corrective measures, financial compensation, or any other action necessary to resolve the complaint satisfactorily.

5.5 Communication with the Complainant

5.5.1 The person responsible for the complaint communicates regularly with the complainant to keep them informed of the investigation's progress and the resolution process.

5.5.2 All communications must be professional, empathetic, and respectful.

5.6 Closing the Complaint

5.6.1 Once the complaint has been resolved, the person responsible must provide the complainant with a written response summarizing the actions taken and solutions proposed.

5.6.2 All information and documents related to the complaint must be kept in a confidential file.

Last updated: September 1, 2026

Procedure for Requests to De-index and Delete Personal Information

1. Overview

This procedure aims to address our clients' privacy and personal information protection concerns.

2. Purpose

The purpose of this procedure is to provide a structured mechanism for managing requests from our clients to de-index or delete their personal information.

3. Scope

This procedure applies to our internal team responsible for managing requests to de-index and delete personal information.

It covers all information published on our online platforms, including our website, mobile applications, databases, and any other digital media used by our clients.

4. Definitions

Deletion of Personal Information: The act of completely erasing data, making it unavailable and unrecoverable.

De-indexing of Personal Information: Removing information from search engine indexes, making it less visible while potentially remaining directly accessible.

Deletion permanently removes data, whereas de-indexing limits its online visibility.

5. Procedure

5.1 Receipt of Requests

5.1.1 Requests to de-index or delete personal information must be received by the designated responsible team.

5.1.2 Clients may submit their requests through specific channels, such as an online form, a dedicated email address, or a telephone number.

5.2 Identity Verification

5.2.1 Before processing a request, the individual's identity must be reasonably verified.

5.2.2 This may be accomplished by requesting additional information or verifying the individual's identity in person.

5.2.3 If identity cannot be satisfactorily verified, the organization may refuse to proceed with the request.

5.3 Request Assessment

5.3.1 The responsible team must carefully review requests and the personal information concerned to determine whether they qualify for de-indexing or deletion.

5.3.2 Requests must be handled confidentially and within the established timeframes.

5.4 Reasons for Refusal

5.4.1 There are valid reasons why we may refuse to delete or de-index personal information, including:

To continue providing goods and services to the client.
To comply with employment law requirements.
For legal reasons in the event of litigation.

5.5 De-indexing or Deletion of Personal Information

5.5.1 The responsible team must take the necessary measures to de-index or delete personal information in accordance with eligible requests.

5.6 Progress Updates

5.6.1 The responsible team is responsible for communicating with applicants throughout the process, providing acknowledgments of receipt and regular updates on the status of their requests.

5.6.2 Any delays or issues encountered during the processing of requests must be communicated to applicants with clear explanations.

5.7 Monitoring and Documentation

5.7.1 All requests to de-index or delete personal information, as well as the actions taken in response, must be recorded in a dedicated tracking system.

5.7.2 Records must include request details, measures taken, dates, and the results of the actions performed.

Last updated: September 1, 2026

Procedure for Managing Security Incidents and Personal Information Breaches

1. Overview

An incident response plan is essential for effectively managing cybersecurity incidents. During a crisis, it is not always clear how to act or prioritize actions. A response plan helps reduce the risk of overlooking important steps.

2. Purpose

The purpose of this procedure is to ensure that the organization is prepared to respond to a cybersecurity incident and resume operations as quickly as possible.

3. Scope

This procedure covers all networks and systems, as well as stakeholders (clients, partners, employees, subcontractors, and suppliers) who access these systems.

4. Recognizing a Cybersecurity Incident

A cybersecurity incident may not be immediately recognized or detected. However, certain indicators may suggest a security breach, a compromised system, unauthorized activity, or other security concerns.

It is important to remain alert to any signs that a security incident has occurred or is ongoing.

Some of these indicators include:

Excessive or unusual login or system activity, particularly involving inactive user accounts.
Excessive or unusual remote access within the organization, whether by employees or third-party suppliers.
The appearance of any new visible or accessible wireless network (Wi-Fi).
Unusual activity involving malware, suspicious files, or new or unauthorized executable files and programs.
Lost, stolen, or misplaced computers or devices containing payment card information, personal information, or other sensitive data.

5. Contact Information

Person Responsible: Jean-Guy Lamontagne

Telephone: 418-476-3979

Email: info@actifsf.ca

Address: 603-5600 boulevard des Galeries, Québec, QC G2K 2H6

6. Personal Information Breach — Specific Response

If a security incident involving a personal information breach has been confirmed, the following steps must be taken:

Complete the privacy incident register to document the incident.
Investigate the breach to determine whether personal information was lost due to unauthorized access or use, unauthorized disclosure, or any other breach affecting the protection of personal information, and whether there is a risk of serious injury to the individuals concerned.
If such a risk exists, report the incident to the Commission d'accès à l'information du Québec (Quebec Access to Information Commission).
Also notify the individuals whose personal information was affected by the incident.

7. Ransomware — Specific Response

If a ransomware security incident has been confirmed, the following steps must be taken:

Immediately disconnect devices affected by ransomware from the network.
DO NOT DELETE ANYTHING from your devices (computers, servers, etc.).
Examine the ransomware and determine how it infected the device. This will help identify how to remove it.
Contact local authorities to report the incident and cooperate with the investigation.
Once the ransomware has been removed, perform a complete system scan using the latest available antivirus, anti-malware, and other security software to confirm that it has been eliminated from the device.
If the ransomware cannot be removed from the device, which is often the case with stealth malware, the device must be reset using the original installation media or system images.
Before resetting a device using backup media or images, verify that they are free of malware.
If critical data must be restored but cannot be recovered from unaffected backups, look for available decryption tools at nomoreransom.org.
The organization's policy is not to pay the ransom, subject to the circumstances involved. It is also strongly recommended to seek assistance from a cybersecurity incident response expert (breach coach).
Secure systems against further infection by implementing patches and corrective measures to prevent additional attacks.

8. Account Hacking — Specific Response

If an account has been compromised, the following steps must be taken:

Notify our clients and suppliers that they may receive fraudulent emails appearing to come from us, and advise them not to respond or click on links contained in those emails.
Verify whether access to the online account is still possible.
If access has been lost, contact the platform's support team to attempt to recover the account.
Change the password used to access the platform.
If the same password is used elsewhere, change it on all other affected accounts.
Enable two-factor authentication on the platform.
Remove unauthorized connections and devices from the account's login history.

9. Lost or Stolen Device — Specific Response

If equipment has been confirmed lost or stolen, the following steps must be taken:

The loss or theft of property such as a desktop computer, laptop, or mobile device must be reported immediately to local law enforcement authorities. This includes incidents occurring outside regular business hours and on weekends.
If the lost or stolen device contained sensitive data and was not encrypted, assess the sensitivity, type, and volume of the stolen data, including any potentially affected payment card numbers.
Whenever possible, remotely lock or disable lost or stolen mobile devices (such as smartphones, tablets, or laptops) and perform a remote data wipe.

Last updated: September 1, 2026

Legislation

We are committed to complying with the applicable legislation in:

Québec, Canada

Amendments — Law 25

This Privacy Policy may be amended from time to time to maintain compliance with the law and reflect any changes to our data collection practices.

We recommend that users review our Privacy Policy periodically to stay informed of any updates.

Where necessary, we may notify users by email of changes made to this policy.

Last updated: September 1, 2026