Where do we keep your personal information?
We usually keep your personal information in Canada. However, some of our service providers use servers located elsewhere, including in the United States. As a result, your personal information may be stored or processed outside of Quebec or your province of residence in the following situations:
- Cloud and hosting services: Some of our internal systems (e.g., web hosting, backups, CRM) are provided by companies whose servers may be located outside Canada.
- Donation processing and online transactions: Our payment processors or donation platforms may process financial information in other jurisdictions.
- Sending communications (newsletters, campaigns, confirmations): Email distribution or marketing automation providers located outside Canada may process your contact information.
- Specialized technical support: In certain cases, an international service provider may access data when performing diagnostics or maintenance services.
In such cases, your personal information is also subject to the laws of that province or other location. Before we disclose your personal information, we take appropriate measures to protect it. We also sign a contract that includes appropriate security measures for the information communicated.
When we transfer your personal information outside Quebec or Canada, we:
- Conduct a Privacy Impact Assessment (PIA), as required by law;
- Ensure that the service provider implements appropriate security measures;
- Enter into a contract governing the protection and confidentiality of your data;
- Limit access to personal information to what is strictly necessary.
How long do we keep your personal information?
We retain your personal information for as long as necessary to fulfill the purposes described in this Policy. Even if you no longer have a relationship with us, we may need to keep your personal information for a period of time to meet our retention obligations. While we retain it, we continue to protect your personal information and ensure its confidentiality.
When we no longer need the information, we destroy it permanently and securely.
How do we protect your personal information?
Personal information in our possession is protected by various physical, technological and organizational measures against unauthorized access, loss, theft, disclosure or modification. Your personal information will be protected by reasonable security safeguards appropriate to the sensitivity of the information in our files.
We are committed to taking appropriate precautions to protect your personal information from loss, fraud or unwanted use.
We restrict access to your personal information. Only those employees who need to process your personal information to perform their duties have access to it. These people only have access to the information they need to perform their duties.
We have established roles and responsibilities for our employees throughout the life cycle of your personal information, from collection to destruction. These roles and responsibilities are described in our Privacy Governance Framework. We regularly review and update them.
We implement robust security measures. We have put in place several types of measures to protect your personal information against loss, theft and unauthorized access, use or disclosure. These include
- physical measures, such as locked premises;
- technological measures, such as firewalls and payment card industry security standards;
- organizational measures, such as the adoption of an information security policy.
We destroy your personal information once we have fulfilled our obligations. For more information, see How long do we keep your personal information?
What rights do you have regarding your personal information?
