Privacy Policy
Policies and practices governing the protection of personal information
Context
As of September 22, 2023, real estate agencies and brokers operating on their own must publish detailed information on their website regarding their policies and practices relating to personal information. If they do not have a website, they must make this information accessible by any other appropriate means, with the objective that the public can easily refer to it.
You may adapt your policies and practices to the reality of your business so that they are proportionate to the nature and importance of its activities. However, they must at a minimum include the following mandatory elements:
i) Rules applicable to the retention and destruction of personal information;
ii) The roles and responsibilities of staff members regarding the collection, use, disclosure, retention, and destruction of personal information;
iii) A complaint-handling process related to the protection of personal information.
MODEL
Royal LePage Triomphe (hereinafter referred to as “THE AGENCY” or “THE BROKER”) is governed by the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) (the Act).
Personal Information
Personal information is information about a natural person that allows, directly or indirectly, their identification. A writing, an image, a video, and an audio recording may contain personal information.
As part of its professional activities, THE AGENCY or THE BROKER may collect personal information such as name, home address, date of birth, ID information, social insurance number, income details, marital status, etc.
Consent
THE AGENCY or THE BROKER collects, uses, and discloses personal information with the consent of the person concerned. To be valid, this consent must be manifest, free, informed, and given for specific purposes. A person who consents to provide their personal information is deemed to consent to its use and disclosure for the purposes for which it was collected.
Anyone may withdraw their consent at any time regarding the collection, use, and disclosure of their personal information by THE AGENCY or THE BROKER. In such case, if the collection is necessary for the conclusion or performance of the contract by THE AGENCY or THE BROKER, it may not be possible to fulfill the service request.
Responsibility
THE AGENCY or THE BROKER is responsible for the protection of personal information held in the course of carrying out real estate brokerage activities. To this end, THE AGENCY or THE BROKER has adopted a privacy policy as well as policies and practices governing the protection of personal information, which aim to regulate the collection, use, disclosure, retention, and destruction of personal information.
Collection of Personal Information
THE AGENCY or THE BROKER collects only the personal information necessary for the performance of its real estate brokerage activities. For example, this may include information collected for the purpose of completing a real estate transaction, recordkeeping, oversight by the Organisme d’autoréglementation du courtage immobilier du Québec (OACIQ), or any other purpose determined by THE AGENCY or THE BROKER and disclosed to the individual when obtaining consent.
THE AGENCY or THE BROKER encourages its staff to explain in simple and clear terms to the concerned person the reasons for collecting their personal information and to ensure their understanding.
To collect personal information, THE AGENCY or THE BROKER encourages the use of standardized forms developed by the OACIQ.
THE AGENCY or THE BROKER may also collect personal information verbally during conversations with parties involved in a transaction or through various documents submitted in the course of completing a real estate transaction (ID documents, financial documents, powers of attorney, etc.).
Use and Disclosure of Personal Information
Personal information is used and disclosed for the purposes for which it was collected and with the consent of the person concerned. In certain cases provided by law, personal information may be used for other purposes, for example, to detect and prevent fraud or to provide a service to the person concerned.
THE AGENCY or THE BROKER may be required to disclose personal information to third parties, for example, to suppliers, contractors, subcontractors, agents, insurers (such as the Fonds d’assurance responsabilité professionnelle du courtage immobilier du Québec [FARCIQ]), professionals, other regulators, or outside of Quebec.
THE AGENCY or THE BROKER may, without the consent of the person concerned, disclose personal information to a third party if the disclosure is necessary for the execution of a mandate or service/business contract. In this case, THE AGENCY or THE BROKER establishes a written contract or mandate in which they specify the measures the third party must take to protect the personal information entrusted to them, ensure that it is used only for the execution of the contract, and is destroyed upon its completion. The third party must also agree to cooperate with THE AGENCY or THE BROKER in case of a privacy breach.
Before disclosing personal information outside of Quebec, THE AGENCY or THE BROKER assesses the sensitivity of the information, the purpose of its use, and the protection measures available in the destination. THE AGENCY or THE BROKER will only disclose the information outside Quebec if their analysis demonstrates that the data will be adequately protected.
Retention and Destruction of Personal Information
Once the purposes for which personal information was collected or used have been fulfilled, THE AGENCY or THE BROKER must destroy the information, subject to retention periods required by law. In this regard, professional obligations require THE AGENCY or THE BROKER to retain files for at least six (6) years following their final closure.
Security Measures
During the collection, use, retention, and destruction of personal information, THE AGENCY or THE BROKER applies the necessary security measures to ensure confidentiality. Specifically, the following measures apply:
-
Restricted Access: Access to personal information is limited to authorized employees only. Access levels are assigned based on each employee’s needs.
-
Staff Training: We ensure all staff are trained in the protection of personal information and understand the policies and procedures in place.
-
Strong Passwords: Strong passwords are required to access systems containing personal information, and regular password changes are encouraged.
-
Regular Updates: All software and systems are regularly updated to correct security vulnerabilities.
-
Data Backups: Regular backups of critical data are performed and stored securely in case of loss or damage.
Privacy Incident
A privacy incident is any unauthorized access, use, disclosure, or loss of personal information, or any other breach of personal data protection.
THE AGENCY or THE BROKER has implemented a privacy incident management protocol identifying those assisting the Privacy Officer and outlining concrete actions to be taken in the event of an incident. This protocol details the responsibilities at each stage of incident handling, including measures to ensure data security.
Roles and Responsibilities
- THE AGENCY or THE BROKER
THE AGENCY or THE BROKER:
-
Ensures confidentiality through sound information management practices, particularly by giving directives, training, and instructions to staff about the collection, use, storage, modification, access, disclosure, and permitted destruction of personal information.
-
Implements appropriate protective measures to reduce the risk of privacy incidents (e.g., IT security, updating policies, staff training).
-
Uses standardized methods for filing and storing documents containing personal information, including digitization procedures.
-
Manages physical and IT access to personal information according to sensitivity.
-
Carries out the secure destruction of personal information and provides guidance to staff on destruction methods and timelines.
-
Privacy Officer
In accordance with the law, THE AGENCY or THE BROKER has appointed a Privacy Officer.
This person ensures compliance with the present policies and applicable regulations. Their name and contact information are provided in the “Access, Withdrawal, and Rectification Rights” section.
The Privacy Officer manages privacy incidents and takes actions as required by law.
They also handle access and correction requests as well as complaints related to the handling of personal information.
They are consulted during privacy impact assessments for any project involving the acquisition, development, or redesign of information systems or electronic service delivery involving personal information and may suggest protective measures. -
Staff Members
An employee of THE AGENCY or THE BROKER may only access personal information to the extent required to perform their duties.
Staff must:
-
Ensure the integrity and confidentiality of personal information held by THE AGENCY or THE BROKER.
-
Comply with all policies and directives on access, collection, use, disclosure, destruction, and information security.
-
Follow the security measures on their workstation and any equipment containing personal information.
-
Use only equipment and software authorized by THE AGENCY or THE BROKER.
-
Securely destroy personal information as instructed and immediately report any actual or suspected breach of personal information security to their supervisor.
Access, Withdrawal, and Rectification Rights
A person (or their authorized representative) may request access to the personal information held by THE AGENCY or THE BROKER. They may withdraw their consent at any time. This withdrawal must be recorded in writing.
They may request a correction to personal information they consider inaccurate, incomplete, or equivocal.
THE AGENCY or THE BROKER may refuse access or correction requests in cases provided for by law.
Complaints
A person who feels wronged may file a complaint regarding how THE AGENCY or THE BROKER handles their personal information. This complaint will be processed promptly within a maximum of 5 days by the Privacy Officer, and a written response will be provided.
To request access or correction of your personal information, or to file a complaint, please contact:
Marie-Catherine Jetté, President
450-462-4414
triomphe@royallepage.ca ↗