Personal information governance policy

This policy governs personal information in accordance with s. 3.2 of the Act respecting the protection of personal information in the private sector (as amended by Law 25). Its scope and retention schedule are generated from our personal information register.

Roles and responsibilities

The person in charge of personal information protection is responsible for oversight of this policy across the entire life cycle of personal information and serves as the point of contact for the individuals concerned and for the Commission d'accès à l'information. This function is held by: David Tucker, President and Chief Executive Officer - david.tucker@ophelios.com. Staff members must protect personal information in the performance of their duties and report incidents to the person in charge.

Scope

We hold the following categories of personal information as at the date of this version: Business contracts and agreements: name, contact details, company, terms and signatures, Name and email address of Agreely early-access participants, Visits to ophelios.com measured by our audience tool (pages, referrer, device, approximate location), Meetings booked on rdv.ophelios.com: name, email address, optional notes, time slot, time zone and language, corvee.ca browsing data, collected by our audience measurement tool (pages, referrer, device, approximate location), La Corvée contact form messages: name, email address, message content and our replies, Platform administration log (Ophelios operators' acts), Cookie consent logs for client websites (identifier, choices, language; optional truncated IP and user agent) (mandate), Requests and correspondence: name, email address, company, message content and our replies, agreely.ca browsing data, collected by our audience measurement tool (pages, referrer, device, approximate location), Client invoices and accounting records (Memento), Client representatives' contact details (name, position, work email and phone), Activity log held for client enterprises (mandate), Records of organizations subscribed to La Corvée: people served, volunteers, members, donors (mandate), La Corvée activity log and technical logs (identifiers, timestamps, actions taken), Organizations subscribed to La Corvée (contact person, contact details, team size, subscription, invoices and payments), La Corvée user accounts (name, email, hashed password, sign-in factors, sessions), Client registry of client enterprises (encrypted name and email), Rights-request register held for client enterprises, Consent records held for client enterprises (mandate), Rights-exercise proofs (self-signed withdrawal and erasure), Citizen consent index (per-DID snapshots), Pseudonymous citizen identity (DID identifier, public part of your passkeys and of your recovery key), Professional invitation contact details (work email, role), Billing information (Stripe identifiers, invoices), Security and anti-abuse logs (IP, user agent, timestamps), Authentication credentials (password hash, 2FA, passkeys, session cookies), Workspace account (name, email, role, language) (proportionality, s. 3.2).

Retention schedule by category

Retention must be limited to the period necessary for the purposes of collection, followed by destruction or anonymization (s. 23). The periods below are declared rules, not proof of completed destruction. Platform administration log: kept for 36 months after the decision, then destroyed. As this information is used to make a decision, it is kept for at least one year after that decision (s. 11, para. 2). Correspondence and requests: kept for 24 months after the last exchange, then destroyed. Client representatives' contact details (Memento): kept for 24 months after the last activity, then destroyed. Umami audience measurement: raw events: kept for 13 months from collection, then destroyed. La Corvée contact form messages: kept for 24 months after the last exchange, then destroyed. Activity log held for client enterprises: kept for 24 months from collection, then destroyed. La Corvée organization accounts and records: kept for 24 months after the end of the organization's subscription, then destroyed. La Corvée activity log: kept for 24 months from collection, then destroyed. Transient data (tokens, codes, sessions): kept for 1 month from collection, then destroyed. Cookie consent logs (Témoins): kept for 36 months from collection, then destroyed. Proofs of exercised rights (citizen): kept for 60 months after the purposes are achieved, then destroyed. Mandate records (client companies): kept for 6 months after the purposes are achieved, then destroyed. Citizen wallet (identity and index), except the fingerprints recorded on the blockchain, which are permanent: kept for 12 months after the purposes are achieved, then destroyed. Billing and tax records: kept for 72 months after the purposes are achieved, then destroyed. Security and anti-abuse logs: kept for 12 months from collection, then destroyed. Workspace accounts: kept for 36 months after the purposes are achieved, then destroyed.

Destruction and anonymization

Once the purposes are achieved, s. 23 calls for destruction or anonymization. The register records rules, not completed destruction. Information used to render a decision must be kept for at least one year after the decision (s. 11, para. 2).

Security measures

Security measures must protect personal information throughout its life cycle, taking into account its sensitivity, purpose, quantity, distribution and medium (s. 10). The register below documents declared measures, not their effectiveness. The security-measures register documents 10 measures. They include, in particular: training and confidentiality undertakings, incident response, secure destruction, minimization and de-identification, logging and monitoring, access control, encryption, backups and recovery, as well as another measure recorded in the register. A secure destruction method is recorded in the security-measures register; this entry does not show that any destruction was carried out. As sensitive information is held, a measure marked as covering it is recorded, sensitivity being one of the factors listed in s. 10.

Confidentiality-incident handling

Every confidentiality incident (s. 3.6) is handled under the "incident response" measure of the security measures register: measures to reduce the risk of injury and prevent recurrence (s. 3.5, para. 1), risk assessment with the person in charge (s. 3.7), prompt notice to the Commission d'accès à l'information and to the persons concerned when there is a risk of serious injury (s. 3.5, para. 2), and entry in the incident register (s. 3.8).

Complaint handling

Any complaint about the protection of personal information is addressed in writing to the person in charge identified above. The person in charge acknowledges it within 5 business days, examines it and answers in writing within 30 days, stating the measures taken, if any. A person who is not satisfied may contact the Commission d'accès à l'information.

Communication outside Québec and assessments

Each recorded outside-Québec event is linked to a completed PIA. Projects covered by s. 3.3 also require a PIA.

Training and awareness

A staff training and awareness measure is recorded in the security-measures register.

Internal access

Access-control measures are recorded in the security-measures register; that register does not verify actual access.