Community Health and Social Services Network’s Personal Information Governance Policy Privacy Policy Community Health and Social Services Network (hereinafter “CHSSN“) is committed to collecting, using, disclosing, retaining and destroying your Personal Information, regardless of the format in which it is held or accessed, in accordance with this policy (the “Policy”). This Policy also discloses the roles and responsibilities of CHSSN’ staff from the collection to the destruction of your Personal Information. If you have any questions about your Personal Information and have read the Policy and still have questions, you may contact our Privacy Officer, Jennifer Johnson, at the following email address: privacy@chssn.org 1. Definitions In this Policy, words and expressions have the meanings attributed to them below: “Governmental Authority(ies)” means the following: a) any multinational, federal, provincial, state, regional, municipal or local government, department, court, tribunal, arbitral body, commission, agency, board or office b) any subdivision, agent, commission or authority of any of the foregoing, c) any quasi- governmental or private body exercising a power of regulation, administration, expropriation or any taxing authority under the direction of or on behalf of any of the foregoing, including any private body mandated to render public services; and d) any judicial or quasi-judicial body, court or tribunal; “Act” means the Act respecting the protection of personal information in the private sector, chapter P-39.1, and any subsequent amendments or modifications thereto; “Personal information” means any information relating to a natural person which enables that person to be identified, directly or indirectly; “Privacy Officer” means the Privacy Officer appointed by CHSSN to ensure compliance with and implementation of the Act, who as of the date hereof is Mrs. Jennifer Johnson, who can be reached by email at privacy@chssn.org; 2. Consent By submitting your Personal Information to CHSSN, you consent to the collection, use, disclosure and retention of your Personal Information by CHSSN in accordance with this Policy. 3. Purposes for which personal information is collected CHSSN collects your Personal Information for the following purposes: Respond to your requests or questions; To send you information about our programs, newsletter, or knowledge products; To prevent and detect fraud or to evaluate and improve protection and security measures; Contact you about this Policy; Manage the administration of volunteers and communicate with them in preparation for various activities; Carry out publicity to promote the activities and interests of CHSSN. CHSSN uses your Personal Information solely for the purposes set out in this Policy and undertakes to obtain your consent for any other use that is not provided for herein, except in the case of exceptions provided for in the Act. 4. Means of collecting your personal information CHSSN collects your Personal Information when you: Subscribe to our e-newsletter on this website; Click on an advertisement that CHSSN has placed on a third-party website (e.g. Facebook, etc.); Complete a survey, enter a contest or any other promotion; Fill in a paper form; Contact us by email, telephone or any other means of communication; and Send us your Personal Information by email. 5. Right of access and rectification provided by law At your request, CHSSN will confirm the existence of your Personal Information, provide you with access to it and allow you to obtain a copy of it in a structured and commonly used technological format. You have the right to demand that Personal Information that is inaccurate, incomplete or ambiguous be rectified, or that Personal Information be deleted if its collection, communication or retention is not authorized by law. You have the right to require CHSSN to cease disseminating your Personal Information where such dissemination is contrary to law, a court order or where the following conditions are met: (i) serious harm is caused to your reputation or privacy, (ii) such harm clearly outweighs the public interest in knowing the information or any individual’s interest in free expression, and (iii) the requested cessation of dissemination does not exceed what is necessary to prevent further harm. In all cases, your request for access or rectification must be made in writing, providing proof of your identity as the person concerned by the Personal Information. The Responsible Staff Person at CHSSN’ undertakes to respond to your written request within 30 days of receipt. Access to your Personal Information is free of charge, except where reasonable charges may be made for the transcription, reproduction or transmission thereof. In the event of a refusal to grant your request, the Responsible Staff Person undertakes to give the reasons for the decision and to inform you of the provision of the Act on which the refusal is based, the remedies available to you and the time limit within which they may be exercised. The Responsible Staff Person undertakes to provide you with the necessary assistance to help you understand the refusal. The Responsible Staff Person undertakes to issue, free of charge, a copy of your Personal Information that has been amended or added to or, as the case may be, an attestation of the deletion of your Personal Information. They also undertake to notify, without delay, any person who has received the information in the six months prior to the request of the person concerned and, where applicable, the person from whom the information was received. The Responsible Staff Person undertakes to keep the Personal Information that is the subject of your request for access or rectification for the time required to enable you to exhaust your remedies under the Act. 6. Right to withdraw your consent You have the right to withdraw your consent to the disclosure or use of your Personal Information by CHSSN at any time. To do so, please contact the Privacy Officer using the contact information provided in this Policy. Withdrawal of your consent, however, may result in CHSSN being unable or unwilling to provide its service, where applicable. 7. Personal information collected automatically through our website- cookies CHSSN collects Personal Information provided by cookies. Cookies are data files that are commonly stored on your device when you use websites and online services. They are used for the efficient operation of websites and may provide information and help personalize services. You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually change your browser settings to refuse cookies if you prefer. If you wish to disable the use of cookies, you can do so from your browser’s preferences menu. It is possible to disable cookies or use the private browsing mode when using the website services. By refusing to accept cookies, however, use of the website may be greatly affected. 8. Disclosure of your personal information 8.2. Communication to entities and/or persons in Québec CHSSN wants you to understand with whom it shares the Personal Information it collects about you. Accordingly, CHSSN shares your Personal Information with the following persons/entities: Authorized service providers – CHSSN may share your Personal Information with service providers who perform services on our behalf. The services provided by these service providers include processing credit card payments, processing donations, providing customer service, analyzing and promoting activities, supporting website functionality, conducting contests, sweepstakes and surveys, and supporting other website functions. These service providers may have access to your Personal Information for the sole purpose of performing their functions. In such cases, measures will be put in place to ensure the confidentiality of your Personal Information.Business partners – CHSSN may share your Personal Information with its business partners to be able to provide services to you. In such cases, measures will be put in place to ensure the confidentiality of your Personal Information.Community partners – CHSSN may share your Personal Information with its community partners with the goal of improving the health and well-being of the English-speaking community. In this case, measures will be put in place to ensure the confidentiality of your Personal Information.Public health and social services – CHSSN may share your Personal Information with the staff in the public health and social services sector. In this case, measures will be put in place to ensure the confidentiality of your Personal Information. Government authorities – CHSSN may share your Personal Information with government authorities when required. In such cases, measures will be put in place to ensure the confidentiality of your Personal Information. CHSSN must obtain your consent to communicate or transmit your Personal Information to a third party that is not covered by this Policy, except when justified to do so by virtue of an exception provided for in the Act. 8.2 Communication to entities and/or persons outside Québec Your Personal Information may be disclosed or stored outside Québec. In such cases, CHSSN undertakes to carry out a privacy impact assessment and to make the disclosure only if the assessment demonstrates that the Personal Information disclosed is adequately protected. CHSSN may share your Personal Information with the following companies, which demonstrate or have demonstrated that your Personal Information is adequately protected: ADP RBC Express Desjardins Group Insurance AirTable – a data management software. Zoom – a communications platform. Microsoft Office 365, Sharepoint Hubspot 9. Third-party websites There are several places on our website where you can click on links that take you to other websites that are not subject to the terms of this Policy. Third-party websites may request and collect information about you, including Personal Information, and in some cases may inform us of your activities on those websites. CHSSN recommends that you review the privacy policy of each third-party website you visit by clicking on the “Privacy Policy” link usually located at the bottom of the web page you are visiting. 10. Retention of your personal information CHSSN stores your Personal Information on secure computer servers and, where necessary, in paper format in locked offices. The following is a list of physical locations where your Personal Information may be stored: Gestion Info Solutions- Information Technology service provider CHSSN office and remote workers 11. Safety measures CHSSN takes appropriate security measures, including physical, electronic and procedural measures to protect your Personal Information from unauthorized access and disclosure. CHSSN has taken the following security measures to protect your personal information adequately: Each employee has a unique password to access their computer. A multifactor authentication system is in place. A secured password management system is in place. Each CHSSN staff member signs a confidentiality agreement, as do our suppliers, customers and volunteers, including Board and Committee members. CHSSN staff and volunteers receive training on the application of this Policy and on good practices for storing and protecting Personal Information. Locked filing cabinets are in place, along with a secure method of storing the keys for each of them. 12. How long we keep personal information CHSSN retains Personal Information for as long as it is required to be kept for the purposes set out in this Policy and subject to any retention period provided for by law. Once the purposes for which your Personal Information was collected have been fulfilled, it will be destroyed or anonymized by CHSSN, subject to any retention period provided for by law. We may retain some of your account information for analytical and accounting purposes, as well as for record-keeping integrity and fraud prevention purposes, to collect fees charged, to enforce the Terms of Use, to take any action CHSSN deems necessary to protect the integrity of the Website or its users, or as otherwise permitted by law. In addition, if any of your information has been provided to third parties with your consent, the use and retention of your information will be subject to the policies of those third parties and CHSSN cannot be held responsible in any way. When CHSSN makes plans based on your Personal Information, it is retained for a period of one year in accordance with the Act. 13. Handling complaints If you have a complaint regarding the protection of your Personal Information or the use of your Personal Information by CHSSN, please contact our Privacy Officer at the email address indicated on the first page of this Policy, who will respond to your complaint by email as soon as possible. 14. Staff roles and responsibilities Only authorized employees of CHSSN have access to your Personal Information, that is, employees who need to know or have access to your Personal Information for CHSSN to be able provide its services. Employees authorized by CHSSN to access your Personal Information are given specific access codes and each authorized employee has access only to the Personal Information in their area that is required to perform their duties. The Privacy Officer is responsible for ensuring compliance with and implementation of this Policy. He or she shall also ensure that all authorized CHSSN employees are familiar with the Policy and that they use Personal Information in accordance with its provisions. 15. Access to and means of accessing your Personal Information If you have any questions about access to or use of your Personal Information by CHSSN, please contact our Privacy Officer at the email address listed on the first page of this Policy. The contact information for the Privacy Officer will also be available on our website. 16. Collection of Personal Information from Minors CHSSN may collect Personal Information from a minor during its activities. In such cases, CHSSN will obtain the consent of the parent or legal guardian to the collection of the Personal Information and will only use the Personal Information for the purposes disclosed at the time of collection. 17. Precedence In the event of any inconsistency between this Policy and the Act, the provisions of the Act shall prevail.