Policies and Practices Governing the Protection of Personal Information

Stéphane Bonin Real Estate Agency Inc. (hereinafter referred to as "THE AGENCY" or the "BROKER") is governed by the Act Respecting the Protection of Personal Information in the Private Sector (RLRQ, c. P-39.1) (the "Act").

Personal Information

Personal information is any information relating to a natural person that directly or indirectly identifies them. Written documents, images, videos, and audio recordings may contain personal information. In the course of its professional activities, THE AGENCY or the BROKER may collect personal information such as name, home address, date of birth, identification document details, social insurance number, income information, marital status, etc.

Consent

THE AGENCY or the BROKER collects, uses, and discloses personal information with the consent of the individual concerned. For consent to be valid, it must be explicit, freely given, informed, and provided for specific purposes. A person who consents to providing their personal information is presumed to consent to its use and disclosure for the purposes for which it was collected.

An individual may withdraw their consent at any time regarding the collection, use, or disclosure of their personal information by THE AGENCY or the BROKER. In such cases, if the collection is necessary for the execution or performance of a contract by THE AGENCY or the BROKER, the latter may not be able to fulfill a service request.

Accountability

THE AGENCY or the BROKER is responsible for protecting the personal information it holds in the course of its real estate brokerage activities. To this end, THE AGENCY or the BROKER has adopted a confidentiality policy, as well as policies and practices governing the protection of personal information, aimed at regulating the collection, use, disclosure, retention, and destruction of personal information.

Collection of Personal Information

THE AGENCY or the BROKER only collects personal information necessary for its real estate brokerage activities. For example, this may include information collected for the purpose of completing a real estate transaction, maintaining records, professional practice oversight by the Organisme d’autoréglementation du courtage immobilier du Québec (OACIQ), or any other purpose determined by THE AGENCY or the BROKER and disclosed to the individual when obtaining consent.

THE AGENCY or the BROKER encourages its staff to explain in simple and clear terms the reasons for collecting personal information and to ensure the individual’s understanding. For the collection of personal information, THE AGENCY or the BROKER encourages its staff to use standardized forms developed by the OACIQ.

THE AGENCY or the BROKER may also collect personal information verbally during correspondence with individuals involved in a transaction or through various documents submitted as part of a real estate transaction (identification documents, financial records, powers of attorney, etc.).

Use and Disclosure of Personal Information

Personal information is used and disclosed for the purposes for which it was collected and with the consent of the individual concerned. In certain cases permitted by law, personal information may be used for other purposes, such as detecting and preventing fraud or providing a service to the individual.

THE AGENCY or the BROKER may be required to disclose personal information to third parties, such as suppliers, co-contractors, subcontractors, agents, insurers (e.g., the Fonds d’assurance responsabilité professionnelle du courtage immobilier du Québec [FARCIQ]), professionals, other regulators, or parties outside Quebec.

THE AGENCY or the BROKER may, without the individual’s consent, disclose personal information to a third party if such disclosure is necessary for the execution of a mandate or service contract. In such cases, THE AGENCY or the BROKER establishes a written mandate or contract specifying the measures the agent must take to protect the personal information entrusted to them, ensuring it is used only for the mandate or contract and destroyed upon completion. The co-contractor must also agree to cooperate with THE AGENCY or the BROKER in the event of a breach of confidentiality.

Before disclosing personal information outside Quebec, THE AGENCY or the BROKER considers its sensitivity, the purpose of its use, and the protective measures in place in the destination jurisdiction. THE AGENCY or the BROKER will only disclose personal information outside Quebec if its analysis confirms that adequate protection will be provided.

Retention and Destruction of Personal Information

Once the purposes for which personal information was collected or used have been fulfilled, THE AGENCY or the BROKER must destroy it, subject to any retention period required by law. In this regard, professional obligations require THE AGENCY or the BROKER to retain records for at least six (6) years after their final closure.

Security Measures

During the collection, use, retention, and destruction of personal information, THE AGENCY or the BROKER applies necessary security measures to protect its confidentiality.

Confidentiality Incident

A confidentiality incident refers to unauthorized access, use, or disclosure of personal information under the Act, loss of personal information, or any other breach of personal information protection.

THE AGENCY or the BROKER has established a confidentiality incident management protocol identifying the individuals assisting the Privacy Officer and outlining concrete actions to be taken in case of an incident. This protocol defines responsibilities at each stage of incident management, including measures to ensure data security.

Roles and Responsibilities

THE AGENCY or the BROKER

Ensures information confidentiality through sound information management practices, including providing staff with directives, training, and instructions on the collection, use, storage, modification, consultation, disclosure, and permitted destruction of personal information.
Implements adequate protective measures to reduce the risk of confidentiality incidents (e.g., IT security, policy updates, staff training).
Maintains standardized document classification and retention methods, including digitization procedures.
Manages physical and digital access to personal information based on sensitivity.
Ensures secure destruction of personal information, providing staff with instructions on destruction methods and timelines.

Privacy Officer

In accordance with the Act, THE AGENCY or the BROKER has appointed a Privacy Officer who ensures compliance with these policies and applicable regulations. Their name and contact details are listed in the "Access, Withdrawal, and Rectification Rights" section.

The Privacy Officer manages confidentiality incidents, handles access and rectification requests, and addresses complaints regarding personal information processing. They are also consulted for privacy impact assessments related to new systems or services involving personal information.

Staff Members

May access personal information only as necessary for their duties.
Must ensure the integrity and confidentiality of personal information held by THE AGENCY or the BROKER.
Comply with all policies and directives on personal information access, collection, use, disclosure, destruction, and information security.
Follow workplace security measures and use only authorized equipment and software.
Securely destroy personal information as instructed and immediately report any suspected breaches.

Access, Withdrawal, and Rectification Rights

An individual (or their authorized representative) may request access to their personal information held by THE AGENCY or the BROKER. They may also withdraw consent for the collection, use, or disclosure of their personal information at any time, with such withdrawal documented in writing.

An individual may request the correction of personal information they deem inaccurate, incomplete, or ambiguous. THE AGENCY or the BROKER may refuse access or rectification requests in cases permitted by law.

Complaints

An individual who believes their rights have been violated may file a complaint regarding the handling of their personal information. Complaints will be addressed promptly within a maximum of 5 days by the Privacy Officer, with a written response provided.

To submit an access or rectification request or file a complaint, please contact:
Stéphane Bonin, Agency Director
514-622-6508 | stephanebonin@hotmail.com ↗