{"id":146,"date":"2026-10-02T18:52:32","date_gmt":"2026-10-02T22:52:32","guid":{"rendered":"https:\/\/soumetstonprojet.ca\/gouvernance-renseignements-personnels\/"},"modified":"2026-10-09T09:16:29","modified_gmt":"2026-10-09T13:16:29","slug":"gouvernance-renseignements-personnels","status":"publish","type":"page","link":"https:\/\/soumetstonprojet.ca\/en\/gouvernance-renseignements-personnels\/","title":{"rendered":"Politique de gouvernance des renseignements personnels"},"content":{"rendered":"<div class=\"et_pb_section_0 et_pb_section et_section_regular et_block_section stp-phero\"><div class=\"et_pb_row_0 et_pb_row et_block_row stp-row\"><div class=\"et_pb_column_0 et_pb_column et_pb_column_4_4 et-last-child et_block_column et_pb_css_mix_blend_mode_passthrough\"><div class=\"et_pb_text_0 et_pb_text et_pb_bg_layout_light et_pb_module et_block_module stp-kicker\"><div class=\"et_pb_text_inner\"><p>Law 25<\/p>\n<\/div><\/div><div class=\"et_pb_text_1 et_pb_text et_pb_bg_layout_light et_pb_module et_block_module stp-h1\"><div class=\"et_pb_text_inner\"><h1>Personal information governance<\/h1>\n<\/div><\/div><div class=\"et_pb_text_2 et_pb_text et_pb_bg_layout_light et_pb_module et_block_module stp-lead\"><div class=\"et_pb_text_inner\"><p>Our internal rules governing the collection, retention, destruction and protection of your information.<\/p>\n<\/div><\/div><\/div><\/div><\/div><div class=\"et_pb_section_1 et_pb_section et_section_regular et_block_section\"><div class=\"et_pb_row_1 et_pb_row et_block_row stp-row stp-narrow\"><div class=\"et_pb_column_1 et_pb_column et_pb_column_4_4 et-last-child et_block_column et_pb_css_mix_blend_mode_passthrough\"><div class=\"et_pb_text_3 et_pb_text et_pb_bg_layout_light et_pb_module et_block_module stp-legal\"><div class=\"et_pb_text_inner\"><p class=\"stp-note\"><strong>To be validated.<\/strong> This text was written to reflect how the platform actually works and the requirements of Law 25. We recommend having it reviewed by a legal advisor before the public launch.<\/p>\n<p><strong>Effective date:<\/strong> October 2, 2026 (updated October 3, 2026)<\/p>\n<p>This policy describes the framework for retaining and destroying personal information, the roles and responsibilities of our staff throughout its life cycle, and the complaint-handling process. It is published in accordance with section 3.2 of the <em>Act respecting the protection of personal information in the private sector<\/em>. It applies to Solutions Techno-R\u00e9dac inc. in operating the Soumets ton projet platform, and to anyone who processes personal information on our behalf.<\/p>\n<h2>1. Principles<\/h2>\n<ul>\n<li><strong>Necessity:<\/strong> we only collect the information needed for purposes determined before collection.<\/li>\n<li><strong>Transparency:<\/strong> we inform people of the purposes, use and disclosure of their information (see the <a href=\"\/en\/politique-de-confidentialite\/\">privacy policy<\/a>).<\/li>\n<li><strong>Consent:<\/strong> we use and disclose information only for the purposes consented to, except as provided by law.<\/li>\n<li><strong>Privacy by default:<\/strong> the platform\u2019s settings offer the highest level of privacy by default (for example, clients\u2019 contact information is never public).<\/li>\n<li><strong>Minimal retention:<\/strong> information is destroyed or anonymized once its purpose has been fulfilled.<\/li>\n<\/ul>\n<h2>2. Roles and responsibilities<\/h2>\n<h3>Person in charge of the protection of personal information<\/h3>\n<p><strong>Anne-Marie Coulombe, President<\/strong> (<a href=\"mailto:info@soumetstonprojet.ca\">info@soumetstonprojet.ca<\/a>) holds this role, which was delegated to her in writing. She ensures compliance with the law and with this policy, in particular by:<\/p>\n<ul>\n<li>approving the policies and practices governing personal information;<\/li>\n<li>receiving and handling requests for access, correction, deletion and portability, as well as complaints;<\/li>\n<li>keeping the register of confidentiality incidents and coordinating the response to incidents;<\/li>\n<li>taking part in privacy impact assessments (PIAs);<\/li>\n<li>making sure staff are aware and trained.<\/li>\n<\/ul>\n<h3>Staff and collaborators<\/h3>\n<ul>\n<li>Access only the information needed to perform their duties.<\/li>\n<li>Keep information confidential, including after their employment or mandate ends.<\/li>\n<li>Report any actual or suspected confidentiality incident to the person in charge without delay.<\/li>\n<\/ul>\n<h3>Service providers<\/h3>\n<p>Service providers that process information on our behalf (hosting, email, payments) are contractually bound to protect it, to use it only for the purposes of their mandate and to notify us of any incident.<\/p>\n<h2>3. Information life cycle<\/h2>\n<h3>Collection<\/h3>\n<p>Information is collected directly from the people concerned, through the platform\u2019s forms (posting a project, expressing interest, subscribing, contacting us, newsletter). Each form only requires the necessary fields.<\/p>\n<h3>Use and disclosure<\/h3>\n<p>Information is used for the purposes described in the privacy policy. A professional\u2019s contact information is only disclosed to the client of the project they express interest in. No information is sold or used for profiling. Message content is encrypted. Soumets ton projet administrators may access it only in exceptional cases, to handle a dispute or a report of abuse, to respond to a request from an authority empowered to require it, or to respond to an access request made under the law. Each access is justified and recorded in a register.<\/p>\n<h3>Retention and destruction<\/h3>\n<table>\n<thead>\n<tr>\n<th>Information<\/th>\n<th>Retention period<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Rejected or unpublished project<\/td>\n<td>90 days after the decision, then destroyed<\/td>\n<\/tr>\n<tr>\n<td>Messages exchanged in the messaging system<\/td>\n<td>24 months after the last message, or as soon as the account or project is deleted, then automatically destroyed<\/td>\n<\/tr>\n<tr>\n<td>Register of administrative access to messages<\/td>\n<td>3 years after the access<\/td>\n<\/tr>\n<tr>\n<td>Published project (listing and client contact information)<\/td>\n<td>For as long as it is published, then 12 months after it is closed or removed<\/td>\n<\/tr>\n<tr>\n<td>Expressions of interest<\/td>\n<td>24 months after they are sent<\/td>\n<\/tr>\n<tr>\n<td>Professional\u2019s account<\/td>\n<td>For the duration of the subscription, then 24 months after the last subscription ends, unless deletion is requested<\/td>\n<\/tr>\n<tr>\n<td>Invoices and payment history<\/td>\n<td>7 years (tax obligations)<\/td>\n<\/tr>\n<tr>\n<td>Messages received through the contact form<\/td>\n<td>24 months after the request is handled<\/td>\n<\/tr>\n<tr>\n<td>Newsletter subscribers<\/td>\n<td>Until they unsubscribe<\/td>\n<\/tr>\n<tr>\n<td>Technical logs and email logs<\/td>\n<td>90 days<\/td>\n<\/tr>\n<tr>\n<td>Register of confidentiality incidents<\/td>\n<td>5 years after the incident becomes known<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>When the period expires, information is securely deleted from the platform and from backups according to their rotation cycle, or irreversibly anonymized for serious and legitimate purposes (for example, overall statistics).<\/p>\n<h2>4. Privacy impact assessment (PIA)<\/h2>\n<p>A PIA is carried out before any project to acquire, develop or overhaul a system involving personal information (for example, adding a messaging system, a marketing tool or a new service provider), and before any disclosure of information outside Quebec.<\/p>\n<h2>5. Confidentiality incidents<\/h2>\n<p>Any unauthorized access, use or disclosure of personal information, or any loss of personal information, is a confidentiality incident. When an incident occurs, we:<\/p>\n<ul>\n<li>promptly take reasonable measures to reduce the risk of harm and prevent it from happening again;<\/li>\n<li>assess the risk of serious harm;<\/li>\n<li>if the risk is serious, promptly notify the Commission d\u2019acc\u00e8s \u00e0 l\u2019information and the people concerned;<\/li>\n<li>record the incident in our register.<\/li>\n<\/ul>\n<h2>6. Complaint handling<\/h2>\n<p>Anyone can file a complaint about the protection of their personal information by writing to <a href=\"mailto:info@soumetstonprojet.ca\">info@soumetstonprojet.ca<\/a>, providing their contact information and the nature of the complaint.<\/p>\n<ul>\n<li>An acknowledgement of receipt is sent within 5 business days.<\/li>\n<li>The person in charge reviews the complaint and may contact the person for more details.<\/li>\n<li>A reasoned written response is sent no later than 30 days after the complaint is received.<\/li>\n<li>If the person is not satisfied, they may contact the <a href=\"https:\/\/www.cai.gouv.qc.ca\/\" target=\"_blank\" rel=\"noopener\">Commission d\u2019acc\u00e8s \u00e0 l\u2019information du Qu\u00e9bec<\/a>.<\/li>\n<\/ul>\n<h2>7. Access and correction requests<\/h2>\n<p>Requests must be sent in writing to <a href=\"mailto:info@soumetstonprojet.ca\">info@soumetstonprojet.ca<\/a>. We verify the requester\u2019s identity and respond within 30 days. Access is free; reasonable fees may be charged for transcription or reproduction, after informing the requester.<\/p>\n<h2>8. Training and awareness<\/h2>\n<p>People with access to personal information are informed of this policy when they join and receive an annual reminder of best practices.<\/p>\n<h2>9. Surveys<\/h2>\n<p>If we conduct a user survey, the person in charge first assesses whether the survey is necessary and its ethical aspects.<\/p>\n<h2>10. Review<\/h2>\n<p>This policy is reviewed at least once a year, or whenever the platform\u2019s activities change significantly.<\/p>\n<h2>11. Contact us<\/h2>\n<p>Solutions Techno-R\u00e9dac inc. \u2014 Soumets ton projet<br \/>Person in charge of the protection of personal information: Anne-Marie Coulombe, President<br \/>Email: <a href=\"mailto:info@soumetstonprojet.ca\">info@soumetstonprojet.ca<\/a><\/p>\n<\/div><\/div><\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"pmpro_default_level":"","footnotes":""},"class_list":["post-146","page","type-page","status-publish","hentry","pmpro-has-access"],"_links":{"self":[{"href":"https:\/\/soumetstonprojet.ca\/en\/wp-json\/wp\/v2\/pages\/146","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/soumetstonprojet.ca\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/soumetstonprojet.ca\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/soumetstonprojet.ca\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/soumetstonprojet.ca\/en\/wp-json\/wp\/v2\/comments?post=146"}],"version-history":[{"count":4,"href":"https:\/\/soumetstonprojet.ca\/en\/wp-json\/wp\/v2\/pages\/146\/revisions"}],"predecessor-version":[{"id":202,"href":"https:\/\/soumetstonprojet.ca\/en\/wp-json\/wp\/v2\/pages\/146\/revisions\/202"}],"wp:attachment":[{"href":"https:\/\/soumetstonprojet.ca\/en\/wp-json\/wp\/v2\/media?parent=146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}