Personal Information Retention, Destruction, and Anonymization Procedure

1. Overview

It is important to establish a procedure for the retention, destruction, and anonymization of personal information to protect individuals’ privacy, comply with privacy legislation, prevent privacy incidents involving personal information and security breaches, maintain customer trust, and protect the organization's reputation.

2. Purpose

The purpose of this procedure is to protect individuals’ privacy and comply with legal obligations regarding the protection of personal information.

3. Scope

This procedure covers the entire lifecycle of personal information, from collection to destruction. It applies to all employees and stakeholders involved in the collection, processing, retention, destruction, and anonymization of personal information, in accordance with legal requirements and privacy protection best practices.

4. Definitions

Personal Information: Any information that allows an individual to be identified, directly or indirectly.

Retention: Secure storage of personal information for the required period.

Destruction: Permanent deletion, disposal, or erasure of personal information.

Anonymization: The process of modifying personal information so that the individuals concerned can no longer be identified, directly or indirectly, at any time and in an irreversible manner.

4. Procedure

4.1 Retention Period

4.1.1 Personal information has been categorized as follows:

• Information concerning company employees.

• Information concerning members of the organization.

• Information concerning customers.

4.1.2 The retention period for each category has been established as follows:

• Company employees: 7 years after termination of employment.

• Members: Varies depending on the type of personal information.

• Customers: Varies depending on the type of personal information.

For further details, refer to the complete inventory of personal information held by the organization.

Please note that specific retention periods may apply.

4.2 Secure Storage Methods

4.2.1 Personal information is stored in the following locations: OneDrive and Wix.

4.2.2 The sensitivity level of each storage location has been assessed.

4.2.3 These storage locations, whether physical or digital, are adequately secured.

4.2.4 Access to these storage locations is restricted to authorized individuals only.

4.3 Destruction of Personal Information

4.3.1 Personal information stored on paper must be completely shredded.

4.3.2 Digital personal information must be completely deleted from devices (computers, phones, tablets, external hard drives), servers, and cloud-based tools.

4.3.3 A destruction schedule must be established based on the retention period defined for each category of personal information. Planned destruction dates must be documented.

4.3.4 Destruction must be carried out in a manner that prevents personal information from being recovered or reconstructed.

4.4 Anonymization of Personal Information

4.4.1 Personal information should only be anonymized if the organization wishes to retain and use it for serious and legitimate purposes.

4.4.2 The selected method for handling personal information is as follows: personal information will be deleted after the retention period.

4.4.3 It must be ensured that the remaining information can no longer be used to identify individuals, directly or indirectly, in an irreversible manner. The risk of re-identification of anonymized data must also be regularly assessed through testing and analysis to ensure the effectiveness of the anonymization process.

Important: At the time this template was drafted, the anonymization of personal information for serious and legitimate purposes was not permitted. A government regulation was required to establish the applicable criteria and procedures.

4.5 Employee Training and Awareness

4.5.1 Employees must receive regular training on the procedures for retaining, destroying, and anonymizing personal information, as well as the risks associated with privacy breaches.

4.5.2 This also includes raising employee awareness of data security best practices and the importance of following established procedures.

Last updated: July 1, 2026

Procedure for Access Requests to Personal Information and Complaint Handling

1. Overview

Individuals may request access to the personal information an organization holds about them or submit complaints. Therefore, it is important to establish predefined guidelines for responding to such requests.

2. Purpose

The purpose of this procedure is to ensure that all access requests are handled confidentially, promptly, and accurately while respecting the rights of the individuals concerned.

3. Scope

This procedure applies to internal personnel responsible for handling access requests and complaints, as well as individuals wishing to access their own personal information.

4. Personal Information Access Request Procedure

4.1 Submitting a Request

4.1.1 Individuals wishing to access their personal information must submit a written request to the organization's Privacy Officer. Requests may be sent by email or postal mail.

4.1.2 The request must clearly state that it concerns access to personal information and provide sufficient details to identify the individual and the information requested.

4.1.3 This information may include the individual's name, address, and any other relevant details necessary to reliably verify their identity.

4.2 Receiving the Request

4.2.1 Upon receipt of the request, an acknowledgment will be sent to the individual confirming that their request has been received.

4.2.2 The request must be processed within thirty (30) days of receipt.

4.3 Identity Verification

4.3.1 Before processing a request, the individual's identity must be reasonably verified. This may involve requesting additional information or verifying the individual's identity in person.

4.3.2 If the individual's identity cannot be satisfactorily verified, the organization may refuse to disclose the requested personal information.

4.4 Responding to Incomplete or Excessive Requests

4.4.1 If a personal information access request is incomplete or excessive, the Privacy Officer will contact the individual to request additional information or clarification.

4.4.2 The organization reserves the right to refuse a request if it is clearly abusive, excessive, or unjustified.

4.5 Processing the Request

4.5.1 Once the individual's identity has been verified, the Privacy Officer responsible for handling access requests will collect the requested information.

4.5.2 The Privacy Officer will review relevant records to gather the requested personal information while respecting any applicable legal restrictions.

4.6 Reviewing the Information

4.6.1 Before disclosing personal information, the Privacy Officer will carefully review it to ensure that it does not contain confidential third-party information or information that could infringe upon other rights.

4.6.2 If third-party information is present, the Privacy Officer will determine whether it can be separated or must be excluded from disclosure.

4.7 Disclosing the Information

4.7.1 Once all verifications have been completed, the personal information will be provided to the individual within a reasonable timeframe, in accordance with applicable legal requirements.

4.7.2 Personal information may be provided electronically, by secure postal mail, or in person, depending on the individual's preferences and appropriate security measures.

4.8 Tracking and Documentation

4.8.1 Every step of the personal information access request process must be accurately and thoroughly documented.

4.8.2 Request details, actions taken, decisions made, and corresponding dates must be recorded in an access request tracking register.

The register must include:

• Date the request was received.

• Date the acknowledgment was sent.

• Date identity verification was completed.

• Method used to verify identity.

• Decision — access request approved or denied.

• Date the information was disclosed, if applicable.

4.9 Confidentiality Protection

4.9.1 All personnel involved in processing personal information access requests must respect confidentiality and data protection requirements.

4.10 Complaint Management and Recourse

4.10.1 If an individual is dissatisfied with the response to their personal information access request, they must be informed of the complaint procedures and available remedies before the Commission d'accès à l'information du Québec (Quebec Access to Information Commission).

4.10.2 Complaints must be handled in accordance with internal complaint management policies and procedures, as described in the following section.

5. Complaint Handling Procedure

5.1 Receiving Complaints

5.1.1 Complaints may be submitted in writing, by telephone, by email, or through any other official communication channel. They must be recorded in a centralized register accessible only to designated personnel.

5.1.2 The employee receiving the complaint must immediately notify the person responsible for complaint management.

5.2 Preliminary Assessment

5.2.1 The designated person will review each complaint to assess its relevance and seriousness.

5.2.2 Frivolous, defamatory, or clearly unfounded complaints may be rejected. However, an explanation must be provided to the complainant.

5.3 Investigation and Analysis

5.3.1 The person responsible for handling the complaint will conduct an investigation by collecting evidence, interviewing the parties involved, and gathering all relevant documentation.

5.3.2 The responsible person must remain impartial and have the necessary authority to resolve the complaint.

5.3.3 The responsible person must maintain the confidentiality of complaint-related information and ensure that all parties involved are treated fairly.

5.4 Complaint Resolution

5.4.1 The person responsible for handling the complaint will propose appropriate solutions to resolve the issue as quickly as possible.

5.4.2 Solutions may include corrective measures, financial compensation, or any other action necessary to resolve the complaint satisfactorily.

5.5 Communication with the Complainant

5.5.1 The person responsible for the complaint will communicate regularly with the complainant to provide updates on the investigation and resolution process.

5.5.2 All communications must be professional, empathetic, and respectful.

5.6 Closing the Complaint

5.6.1 Once the complaint has been resolved, the responsible person must provide the complainant with a written response summarizing the measures taken and solutions proposed.

5.6.2 All information and documentation relating to the complaint must be retained in a confidential file.

Last updated: July 1, 2026

Procedure for De-indexing and Deletion Requests of Personal Information

1. Overview

This procedure aims to address our customers' concerns regarding privacy and the protection of personal information.

2. Purpose

The purpose of this procedure is to provide a structured mechanism for managing requests from customers to de-index or delete their personal information.

3. Scope

This procedure applies to our internal team responsible for managing requests to de-index and delete personal information. It covers all information published on our online platforms, including our website, mobile applications, databases, and any other digital media used by our customers.

4. Definitions

Deletion of Personal Information: The complete erasure of data, making it unavailable and unrecoverable.

De-indexing of Personal Information: The removal of information from search engine indexes, making it less visible while remaining directly accessible.

Deletion permanently removes data, whereas de-indexing limits its online visibility.

5. Procedure

5.1 Receiving Requests

5.1.1 Requests to de-index or delete personal information must be received by the designated responsible team.

5.1.2 Customers may submit requests through specific channels, such as an online form, a dedicated email address, or a telephone number.

5.2 Identity Verification

5.2.1 Before processing a request, the individual's identity must be reasonably verified.

5.2.2 This may involve requesting additional information or verifying the individual's identity in person.

5.2.3 If the individual's identity cannot be satisfactorily verified, the organization may refuse to process the request.

5.3 Request Assessment

5.3.1 The responsible team must carefully review the requests and the personal information concerned to determine eligibility for de-indexing or deletion.

5.3.2 Requests must be handled confidentially and within the prescribed timeframes.

5.4 Reasons for Refusal

5.4.1 There are also valid reasons why we may refuse to delete or de-index personal information:

• To continue providing goods and services to the customer.

• To comply with employment law requirements.

• For legal reasons in the event of litigation.

5.5 De-indexing or Deletion of Personal Information

5.5.1 The responsible team must take the necessary measures to de-index or delete personal information in accordance with eligible requests.

5.6 Communication and Follow-up

5.6.1 The responsible team is responsible for communicating with applicants throughout the process, providing acknowledgment confirmations and regular updates on the status of their requests.

5.6.2 Any delays or issues encountered while processing requests must be communicated to applicants with clear explanations.

5.7 Tracking and Documentation

5.7.1 All requests to de-index or delete personal information, along with the actions taken in response, must be recorded in a dedicated tracking system.

5.7.2 Records must include request details, actions taken, dates, and the outcomes of the actions performed.

Last updated: July 1, 2026

Security Incident and Personal Information Breach Management Procedure

1. Overview

An incident response plan is essential for effectively managing cybersecurity incidents. During a crisis, it is not always clear how to respond or prioritize actions. An incident response plan helps reduce the stress associated with potentially overlooking important steps.

2. Purpose

The purpose of this procedure is to ensure that the organization is prepared to respond to cybersecurity incidents and resume its operations as quickly as possible.

3. Scope

This procedure covers all networks and systems, as well as stakeholders (customers, partners, employees, subcontractors, and suppliers) who have access to these systems.

4. Recognizing a Cybersecurity Incident

A cybersecurity incident may not be immediately recognized or detected. However, certain indicators may suggest a security breach, a compromised system, unauthorized activity, or other security issues.

It is important to remain vigilant for any signs that a security incident has occurred or is ongoing.

Some of these indicators include:

• Excessive or unusual login and system activity, particularly involving inactive user accounts.

• Excessive or unusual remote access within the organization, whether by employees or third-party suppliers.

• The appearance of any new visible or accessible wireless (Wi-Fi) network.

• Unusual activity involving malware, suspicious files, or new or unauthorized executable files and programs.

• Lost, stolen, or misplaced computers or devices containing payment card information, personal information, or other sensitive data.

5. Contact Information

Company: Richard Bélisle

Contact Person: Sylvie Hubert

Email: sylvie@richardbelisle.com

Phone: 450-242-2222, extension 1

Address: 18, Allée des Sommets, Bolton-Ouest, QC J0E 2T0

Website: richardbelisle.com

6. Personal Information Breach – Specific Response

If a security incident involving a personal information breach has been confirmed, the following steps must be taken:

• Complete the privacy incident register to document the incident.

• Investigate the personal information breach to determine whether personal information was lost as a result of unauthorized access, unauthorized use, unauthorized disclosure, or another breach of personal information protection, and whether there is a risk of serious harm to the individuals concerned.

• If there is a risk of serious harm, report the incident to the Commission d'accès à l'information du Québec (Quebec Access to Information Commission).

• Also notify the individuals whose personal information was affected by the incident.

7. Ransomware – Specific Response

If a ransomware incident has been confirmed, the following steps must be taken:

• Immediately disconnect affected devices from the network.

• DO NOT DELETE ANYTHING from your devices (computers, servers, etc.).

• Investigate the ransomware and determine how it infected the device. This will help identify how to remove it.

• Contact local authorities to report the incident and cooperate with the investigation.

• Once the ransomware has been removed, perform a complete system scan using the latest available antivirus, anti-malware, and other security software to confirm that it has been eliminated from the device.

• If the ransomware cannot be removed from the device (which is often the case with stealth malware), the device must be reset using its original installation media or system images.

• Before restoring the device from backup media or images, verify that they are not infected with malware.

• If the data is critical and must be restored but cannot be recovered from unaffected backups, search for available decryption tools at No More Ransom.

• The organization's policy is not to pay the ransom, subject to the circumstances involved. It is also strongly recommended to seek assistance from a cybersecurity incident response expert (breach coach).

• Protect systems against further infection by implementing patches and security fixes to prevent additional attacks.

8. Account Hacking – Specific Response

If an account has been compromised, the following steps must be taken:

• Notify customers and suppliers that they may receive fraudulent emails appearing to come from our organization, and advise them not to reply to or click on links in those emails.

• Check whether access to the online account is still available.

• If access has been lost, contact the platform's support team to attempt to recover the account.

• Change the password used to log in to the platform.

• If the same password has been used elsewhere, change those passwords as well.

• Enable two-factor authentication on the platform.

• Remove unauthorized connections and devices from the account's login history.

9. Lost or Stolen Device – Specific Response

If a device has been lost or stolen, the following steps must be taken:

• The theft or loss of equipment, such as a desktop computer, laptop, or mobile device, must be reported immediately to local law enforcement authorities. This also applies to incidents occurring outside regular business hours and on weekends.

• If the lost or stolen device contained sensitive data and was not encrypted, conduct an assessment of the sensitivity, type, and volume of the compromised data, including any potentially affected payment card numbers.

• Whenever possible, remotely lock or disable lost or stolen mobile devices (such as smartphones, tablets, and laptops) and remotely erase their data.

Last updated: July 1, 2026

Legislation

We are committed to complying with the legislative provisions set out in:

Quebec – Amendments Under Law 25 (Act 25)

This Privacy Policy may be amended from time to time to maintain compliance with applicable legislation and reflect any changes to our data collection processes.

We recommend that users review our Privacy Policy periodically to stay informed of any updates.

Where necessary, we may notify users by email of changes made to this policy.

Last updated: July 1, 2026