Politique de confidentialité et de gouvernance des renseignements personnels

Last update : 2023, 31st August

At the Véro & Louis Foundation, we treat your personal information with the same rigour with which we carry out our mission, which is to build long-term living environments adapted to the needs of autistic adults over the age of 21, while supporting them with educational programming.

In recent months, we have therefore updated our various policies in this area and reviewed our procedures with a view to demonstrating greater transparency and complying with the terms of the Act to modernize legislative provisions respecting the protection of personal information (commonly known as "Bill 25").

PRIVACY POLICY

As we are an organization that works to receive funds for the health and social services sector (housing), we collect, use, and disclose information on a daily basis in order to deliver our services in terms of solicitation, various forms of contributions, participation in events, and other information. We adhere to the highest ethical standards when processing any information, especially that of a personal nature.

This Privacy Policy is intended to provide an understanding of our practices regarding the collection, use, disclosure and retention of personal information. By sharing your personal information with us (through our website, by filling out an event participation form, by email, in person, or over the phone), you agree to this information being processed as set out in this Privacy Policy, and you authorize the Véro & Louis Foundation, its third-party suppliers, and its service providers to process your personal information for the purposes provided below.

This Privacy Policy does not apply to third-party websites to which you may be directed when clicking one of the links on the Foundation’s website. The Véro & Louis Foundation assumes no responsibility for third-party websites, each of which will have its own privacy policy. When following a link to a third-party website, we recommend that you review its privacy policy before submitting any personal information.

WHO ARE WE AND WHAT DO WE DO?

The mission of the Véro & Louis Foundation is to create long-term homes designed for autistic adults aged 21 and over, with or without intellectual disabilities.

This social innovation project is supported by various research projects to validate and improve its approach in real time. The Véro & Louis Home was built using the world's best architectural practices to ensure an ideal physical environment for autistic residents.

The Véro & Louis Home is more than simple housing; it’s a stimulating and educational environment with personalized daily programming specially designed to help residents develop their potential and independence throughout their lifetimes.

WHAT PERSONAL INFORMATION DO WE COLLECT?

We may collect and process various types of personal information in the course of our activities and the provision of our services, including:

• Professional and/or personal contact information, such as first name, last name, address(es), email address(es), date of birth, and telephone number(s);

• Biographical information, such as a job title, employer, professional and/or personal background, photos, and video or audio content;

• Information related to marketing and communication preferences and to information, such as dietary preferences, comments, and survey responses;

• Information related to one’s history of contributions or participation in organization events, and billing and financial information, such as billing address, bank account information, or payment data;

• Service-related information, such as details of services we have provided to you;

• Information on your professional background, networks, social involvement, professional affiliations, and family ties;

• Recruitment information, such as a resumé, education and employment history, details of professional affiliations, and other information relevant to potential recruitment by the Véro & Louis Foundation;

• Website usage and other technical information, such as data on visits to our websites, your interaction with our advertising and online content, or information collected by cookies or other tracking technologies;

• Information provided to us by or on behalf of our clients or that we produce in the provision of our services and which may, where relevant, include special categories or personal information (such as race or ethnicity, political opinions, religious or philosophical beliefs, etc.);

• Information like your donation and community investment policy, your contributions, beneficiary organizations and their causes, where applicable, recognition received, the decision-making process, and the people within the organization involved in this process;

• Any other personal information you provide. Please note that if you provide us with personal information about other individuals (such as your customers/clients, administrators, directors, shareholders, or beneficial owners), you must first duly inform them that you are providing us with their information and obtain their consent to such disclosure;

• Evidence of consent given to us (date, time, means) in cases where such consent is necessary to process personal information.

We do not knowingly collect information from children or any other individual under 14 years old. If you are a minor under the age of 14, please do not provide us with your personal information without the express consent of a parent or guardian. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us. If we learn that we have collected personal information from any minor without verification of parental consent, we will take measures to delete this information from our servers.

HOW DO WE COLLECT YOUR PERSONAL INFORMATION?

We collect your personal information through our interactions with you as follows:

• When you register for events, training sessions, and newsletters;

• When you register for charity events;

• When you make any form of donation to our organization;

• When you sign up as a volunteer for our organization;

• In the course of providing you services;

• In exchanges by mail, email, or telephone.

We also collect publicly available information, such as information on public platforms and on our website.

HOW DO WE USE YOUR PERSONAL INFORMATION?

We may use personal information in any of the manners listed below, with your consent or, where applicable, on another legal basis. In each case, we indicate the purposes for which we are using your personal information:

• To provide our services and conduct our business, and to administer and perform our services, including fulfilling our obligations to any agreement between you and us;

• To facilitate the use of our websites, and ensure that this content is relevant and presented as effectively as possible for you and your device;

• For marketing and business development purposes: to provide details of new services, information on developments within our organization and sector, and invitations to seminars and events when the individual has opted to receive such information;

• For research and development purposes (including security): to carry out analyses to better understand our clients’ service and marketing requirements and to better understand our organization and develop our services and offerings;

• For recruitment purposes: to allow us to process job applications and assess whether an individual fulfils the requirements of the position for which they are applying at the Véro & Louis Foundation;

• To fulfil our legal, regulatory, or risk management obligations;

• To prevent fraud and/or carry out other background checks that may be required at any time by the law, applicable regulations and/or best practices (if false or inaccurate information is provided or if fraud is detected or suspected, information may be forwarded to fraud prevention organizations and may be recorded by us or by such organizations); When we process special categories of personal information, we may also consider important public interests (crime prevention or detection) or legally founded claims;

• To assert our rights, fulfil our legal or regulatory reporting obligations, or protect the rights of third parties;

• To ensure we receive payment: to collect payments we are owed and, as applicable, to enforce such collections by debt collection agencies or through other legal means (including legal proceedings);

• To reorganize or change our organization: if we undertake a reorganization (for example, by merging, consolidating, or transferring part of our organization's mission), we may need to transmit some or all personal information to an applicable third party (or its advisors) as part of any due diligence process or part of a transfer to such a reorganized entity or third party for the same purposes as set out in this Privacy Policy or for the purposes of analyzing any proposed reorganization. In such a situation, we will take all possible steps to ensure the protection and security of personal information.

WITH WHOM DO WE SHARE PERSONAL INFORMATION?

The Véro & Louis Foundation is a non-profit organization duly incorporated and recognized as a charitable organization; therefore, the personal information we collect may be transmitted to and processed by any entity in the Véro & Louis Foundation network. We may also share personal information with certain third parties, including the following:

• Volunteers and clients of the Véro & Louis Foundation for the purposes of recruiting human resources or volunteers and soliciting financial or other contributions;

• Third-party service providers and/or partners, including those who provide us with donation solicitation services, database analysis, website services, app development, hosting, maintenance, and other services.

• These third parties may have access to or process personal information in connection with the services they provide to us. We limit the information we provide to these service providers to that which is reasonably required for them to perform their duties, and our contracts with these service providers require them to maintain the confidentiality of such information;

• Government authorities and law enforcement agencies when required by applicable law. More specifically, we may disclose personal and other information if we are required to do so by tax law or other legislation; if we believe in good faith that such disclosure is necessary to comply with applicable laws; in response to a court order, subpoena, or government search warrant; or to otherwise cooperate with such government authorities and law enforcement agencies;

• The purchaser, successor, or assignee of any merger, acquisition, debt financing, asset sale, or similar transaction, or in the event of insolvency, bankruptcy, or receivership involving the transfer of personal information as a business asset to one or more third parties;

• We will use this personal information solely for the primary and legitimate purpose for which it was collected, or for purposes compatible with that primary purpose.

The organization uses the services of third-party sites, such as Facebook, LinkedIn, YouTube, and Google, to promote its content and offerings.

When you visit our website, these third parties may use cookies, web beacons, or similar technologies on your hard drive to collect or receive information about your browsing on the website and elsewhere on the Internet. These technologies enable us to deliver relevant advertising targeted to your interests. You can view the cookies and delete them if you wish. You therefore have full control. We advise you to refer to your browser settings to make the appropriate changes.

If you would like third-party sites to store cookies on your hard drive in order to offer you targeted advertising, you can enable this option.

For further information, please consult our Cookie Policy.

HOW LONG DO WE RETAIN PERSONAL INFORMATION?

Personal information is only kept as long as necessary for the purposes set out in this Privacy Policy and to comply with our legal and regulatory obligations.

To find out more about how long we keep personal information, please contact us at the phone number or email address listed in our Contact section.

WHERE DO WE STORE PERSONAL INFORMATION?

Personal information is stored in secure files in our database, which is only accessible to authorized persons, on the Véro & Louis Foundation server. Personal information is never transferred outside of Quebec.

HOW DO WE PROTECT PERSONAL INFORMATION?

We follow generally accepted industry standards to protect the information submitted to us, at the time of its transmission and once we have received it. We maintain appropriate physical, technical, and administrative safeguards to protect personal information against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access, misuse, or any other unlawful form of processing personal information in our possession. We have taken steps to ensure that the only employees who have access to your personal information are those who have a need to know it or reasonably require it to execute their duties.

However, no method of transmission over the Internet, nor any means of electronic storage, is 100% secure. We therefore cannot ensure or warrant the security of any information you transmit or provide to us, and you do so at your own risk. Nor can we guarantee that such information will not be accessed, obtained, disclosed, modified, or destroyed as a result of a breach of our physical, technical, or administrative safeguards. If you have reason to believe personal information in our possession has been compromised, please contact us at the phone number or email address listed in our Contact section. In the event of a privacy incident involving your personal information, we will notify you as soon as we become aware of the incident. We will take reasonable steps to minimize the risk of harm and to prevent incidents of the same nature in the future.

WHAT RIGHTS DOES AN INDIVIDUAL HAVE WITH RESPECT TO THEIR PERSONAL INFORMATION?

Under certain circumstances and in accordance with applicable data protection laws, an individual has the following rights:

• Access: the right to ask whether we process information and, if so, to request access to this personal information; Subject to the applicable law and, where applicable, the payment of a monetary sum, the individual may thus receive a copy of the personal information we keep and certain other information concerning the individual;

• Accuracy: we are required to take reasonable steps to ensure that personal information in our possession is accurate, complete, non-misleading, and up to date;

• Rectification: the right to request rectification of any incomplete or inaccurate personal information we hold;

• De-indexing: the right to request that we stop disseminating their personal information or that we de-index any hyperlink connected to their name providing access to information if such dissemination causes prejudice to the individual or contravenes the law or a court order (right to be forgotten or right to oblivion);

• Anonymization: our organization can, instead of destroying personal information, anonymize it and use it only for serious and legitimate reasons (e.g., keeping information required for tax inspection purposes);

• The right to be informed when you are the subject of a decision based exclusively on automated processing;

• The right to be informed when identification, location, or profiling technology is used and of the means available to enable these settings;

Finally, it is also possible to lodge a complaint with a data protection supervisory authority in the country, province, or state in which you normally reside, in which we are located (Quebec: the Commission d'accès à l'information), or in which an alleged breach of data protection laws has occurred.

To exercise any of these rights, please contact us at the phone number or email address listed in our Contact section.

HOW DO WE USE COOKIES AND SIMILAR TECHNOLOGIES?

For detailed information about the cookies we use, please refer to our Cookie Policy below, which forms part of this Privacy Policy.

HOW CAN YOU CONTACT US?

If you have any questions, comments, or complaints about this Privacy Policy or concerning your personal information, or if you wish to exercise your rights, file a complaint, or obtain information about our policies and practices with respect to our service providers outside Canada, please contact our Privacy Officer:

Katty Taillon, Executive Director
Véro & Louis Foundation
550-651 Notre-Dame West, Montreal, QC H3C 1H9

Office: 514-933-2462, ext. 310, ktaillon@fondationverolouis.com

HOW DO WE UPDATE THIS PRIVACY POLICY?

We may change the content of our websites and the way we use cookies without notice and, as a result, our Privacy Policy and Cookie Policy may change from time to time in the future. We therefore encourage you to review them each time you visit the website to stay informed about how we handle personal information.

The present Privacy Policy was last updated August 31, 2023.

COOKIE POLICY

CONSENT

By using our website https://fondationverolouis.com, you consent to the use of cookies in accordance with this Cookie Policy. You will have seen an invitation to do so on your first visit to the website. Although it is not usually displayed on subsequent visits, you may withdraw your consent at any time by following the instructions below.

DISABLING COOKIES

Where the organization setting the cookie(s) provides an automated disabling tool for its cookie(s), we list the name of that organization, the category of cookies it sets, and a link to its automated disabling tool. In all other cases, we list the names of the cookies themselves and their source at the date of this Cookie Policy so that you can easily identify and disable them if you wish to through your browser controls.

If you do not agree to the use of cookies, please disable them by following the instructions for your browser at the following site (All About Cookies) or use an automated disabling tool, if available. However, some services will not function as well if cookies are disabled.

We may change the cookies we use after your initial visit to this website. This Cookie Policy will always allow you to know who is placing cookies and for what purposes, and provide you with the means to disable them. You should therefore continue to check this Policy from time to time.

WHAT TYPES OF COOKIES ARE USED BY THE VÉRO & LOUIS FOUNDATION?

The categories of cookies used by the Véro & Louis Foundation and its suppliers are described below.

Strictly necessary cookies

These cookies are essential to enable you to browse the website and use its features.

Without these cookies, services that you request (such as navigating to another page) cannot be assured.

Performance cookies

We use analytical cookies to analyze how our visitors use our websites and to monitor website performance. This allows us to ensure a high-quality experience by customizing our offering and quickly identifying and correcting any problems. For example, we may use performance cookies to track which pages are most popular, to establish which method of linking pages is most effective, and to determine why certain pages are receiving error messages. We may also use these cookies to highlight articles or services on the website that we think will be of interest to you based on your usage of the site. We and our suppliers do not associate the information collected by these cookies with your personal information.

Website functionality cookies

We use cookies to provide you with certain functionalities. For example, they allow the website to remember your choices (such as your username, language, and region), recognize the platform from which you access the site, and provide you with enhanced and more personalized features. These cookies are not used to track browsing on other sites.

Targeting cookies

Targeting cookies (or advertising cookies) collect information about your browsing habits and are used to better tailor advertising to you and your interests. They are used by services provided by third parties, such as the Like or Share buttons. Third parties provide these services in exchange for the knowledge that you visited our website. When you use LinkedIn, X (formerly Twitter), or other available sharing buttons, you are directed to a page controlled by these companies, which may store cookies (including targeting cookies) on your device. In these cases, you will be subject to the respective cookie policies of LinkedIn, X, or any other relevant website.

Use of IP addresses and web logs

We may also use your IP address and browser type to help diagnose problems with our server, administer our website, and improve the services we provide you. An IP address is a numeric code that identifies your computer on the Internet. Your IP address may also be used to gather broad demographic information.

We may use Referer headers to determine the web page you came from (e.g. google.com) in order to get a better picture of our users' demographics.
Information from these types of cookies and technologies is not associated with information about you from any other source and cannot be used to identify you.

Invisible pixels in HTML emails and webinars

Our marketing emails contain a unique campaign-specific "web beacon" that notifies us if our emails are opened and, combined with other technology, notes clicks on links within the email. We may use this information for a variety of purposes, including to determine which of our emails are of most interest to you, and to ask users who do not open our emails if they wish to continue receiving them. The pixel will be removed when you delete the email. If you do not want the pixel to be downloaded to your device, you may choose not to click on the links we send you. This information may be linked to your personal identity.

Our Cookie Policy does not cover third-party websites

Please note that this Cookie Policy does not apply to the privacy practices of third-party websites that may be linked to or from our website, and that we are not responsible for their practices.

Changes to our Cookie Policy

We may update this Cookie Policy in the future and encourage you to review the policy from time to time to stay up to date on how we use these cookies. This Cookie Policy was last updated on August 31, 2023.

PRIVACY POLICY GOVERNANCE POLICY OF BEST PRACTICES FOR THR RETENTION OF PERSONAL INFORMATION (PI)

To ensure that Véro & Louis Foundation staff comply with the Act to modernize legislative provisions as regards the protection of personal information, also known as Law 25, we are proposing to validate and adapt the Véro & Louis Foundation’s practices in this area as applicable. Law 25 brings significant changes to the provisions of the Act respecting the protection of personal information in the private sector (or, “Private Sector Act”), to which not-for-profit organizations in Quebec were already subject.

We would like to remind you that corporate information, as well as the professional contact information of individuals, does not constitute private information (PI) subject to the Act.

DEFINITION OF PERSONAL INFORMATION (PI):

The below constitutes personal information:

• Name, race, ethnic origin, religion, marital status, and level of education;

• Email address, email messages, IP address, and cookie information

• Age, height, weight, medical records, blood type, DNA, fingerprints, and voice signature;

• Income, purchases, consumer habits, banking information, credit or debit card data, loan or credit reports, and tax returns;

• Social insurance number (SIN) or other identification numbers.

Here are some points to consider and put into practice to help you comply with the legislative provisions, most of which have been in force since September 2023.

1. COLLECTION OF PERSONAL INFORMATION AND OBTENTION OF CONSENT

The Véro & Louis Foundation may collect personal information in order to properly manage its relationship and services with each concerned individual and limits the collection of information to that which is necessary for this purpose. The consent of the individual is also required for the lawful use of personal information provided to the Véro & Louis Foundation.

The Véro & Louis Foundation must therefore implement a process for obtaining consent from each individual in order to document when and how consent was obtained or renewed. The Véro & Louis Foundation’s database should therefore include and document the consent obtained or renewed and the date on which it was obtained or renewed.

1. CONSULTATION AND USE OF PERSONAL INFORMATION

The Véro & Louis Foundation must ensure compliance with the following parameters:

• Limit access to personal information to only those persons authorized to receive it within the company, when this information is necessary for the performance of their duties;

• Limit the use of personal information by obtaining the consent of the individual concerned to use their information once the purpose of the file has been fulfilled, unless an exception is provided for by law;

• Implement security measures to ensure the protection of personal information that is collected, used, disclosed, retained, or destroyed.

1. COMMUNICATION OF INFORMATION

Personal information held by the Véro & Louis Foundation about an individual must be disclosed to the individual at their request. This right of the individual must be mentioned on the Véro & Louis Foundation website.

Moreover, section 27 of the Private Sector Act provides for the right to portability of PI, effective as of September 22, 2024. At the request of the person concerned, organizations have the obligation to communicate to them, in a structured and commonly used technological format, computerized personal information collected from them. At the individual’s request, this information may also be transmitted to any other person or entity authorized to collect such information.

The law also provides that the Véro & Louis Foundation may disclose an individual's personal information at the request of a third party or government organization:

• To their attorney;

• To the Director of Criminal and Penal Prosecutions if the information is required for prosecution of an offence under a law applicable in Quebec;

• To an organization responsible by law for preventing, detecting, or repressing crime or infringement of the law and that requires it in the exercise of its functions, if the information is required for the prosecution of an offence under a law applicable in Quebec;

• To a person to whom it is necessary to transmit the information within the framework of a law applicable in Quebec or for the application of a collective agreement;

• To a public body within the meaning of the Act respecting access to documents held by public bodies and the protection of public information that, through a representative, collects it in the exercise of its powers or the implementation of a program under its management;

• To a person or body with the power to compel disclosure and who requires it in the course of their duties;

• To a person to whom this information must be transmitted because of an emergency situation endangering the life, health, or safety of the individual concerned;

• To third parties in order to prevent an act of violence, including suicide, where there is reasonable cause to believe that there is a serious risk of death or of serious bodily injury threatening an individual or identifiable group of individuals and where the nature of the threat generates a sense of urgency;

• To an archive under certain conditions and/or after a certain period of time;

• To a person who may use this information for study, research, or statistical purposes in accordance with section 21 or to a person who is authorized in accordance with section 21.1 of the Private Sector Act;

• To a person who, by law, may collect debts on behalf of others and who requires it for this purpose in the performance of their duties;

• To an individual if the information is required to collect a debt owed by the company;

• To any person or organization likely to reduce a risk following a confidentiality incident involving personal information, communicating only the personal information necessary for this purpose;

• To their spouse or close relative in the case of the individual’s death if this information is likely to help that person in their grieving process unless the deceased person has recorded in writing their refusal to grant this right of access;

• To the holder of parental authority or the guardian of a minor under the age of 14, where the collection is clearly for the benefit of the minor.[1]

1. RETENTION OF PERSONAL INFORMATION

The Véro & Louis Foundation is required by law to implement rules for the retention and destruction of personal information.

Physical files:

The Véro & Louis Foundation must therefore document the location of material and paper files containing personal information and limit access to these files to individuals who require this information. For example, the Véro & Louis Foundation could put all files containing personal information together in one or more filing cabinets in a room to which access is restricted and/or that is locked with a lock to which only individuals with a need to consult the files have a key.

EXAMPLE:

TYPE OF PERSONAL INFORMATION	LOCATION OF PI	PERSONS WITH ACCESS TO PI	JUSTIFICATION FOR ACCESS	SECURITY OF PI
Addresses and contact information of donors at a given event	Filing cabinet No. 1 in office 102 used by the development division	Executive leadership, development division, clerk who issues tax receipts	For the purposes of solicitation and issuing and consulting receipts	Office locked outside of office hours; locked filing cabinet only accessible to the aforementioned individuals
List of participants at a given event and their contact information	List given to committee members for a given event	Development division and members of the committee for the given event		Agreement to confidentiality and the destruction of the lists, signed by all members of the committee for the given event
HR files: Resumés of job applicants, contracts and personal files of staff members, volunteer information files, etc.

Digital files:

The Véro & Louis Foundation must also document the location of digital files containing personal information and limit access to these files to individuals who require this information. Digital files are generally on the Véro & Louis Foundation computer network.

It is therefore necessary to establish who authorizes access privileges to the various digital files and who configures the access rights to these files.

Following this, it is necessary to make an inventory of the digital files which may contain PI, reorganize the tree structure of digital files if applicable, and limit access to the digital files that contain PI to only the individuals who need to access or consult this information in the performance of their duties.

EXAMPLE:

Person who authorizes access privileges and their configuration:

__Katty Taillon___ Substitute in case of absence:_Stéphane Rochon_

Person who configures access privileges:

__Katty Taillon__ Substitute in case of absence: _Stéphane Rochon__

TYPE OF PERSONAL INFORMATION	LOCATION OF PI	PERSONS WITH ACCESS TO PI	JUSTIFICATION FOR ACCESS	SECURITY OF PI
Prodon database: History of all donors or individuals solicited by the Véro & Louis Foundation	External or cloud database	Véro & Louis Foundation executives, development division, database manager, communications coordinators	Transaction and communications history; Donor information	Weekly data backup [specific time], copy available from Logilys on their servers located in [place]
List of participants at a given event and their contact information	List given to committee members for a given event	Development division and members of the committee for the given event		Agreement to confidentiality and the destruction of the lists, signed by all members of the committee for the given event
HR files: Resumés of job applicants, contracts and personal files of staff members, volunteer information files, etc.	Foundation server in a file with restricted access	Executive director, accountant	Payroll and tax slip production	Secure file with access limited to authorized persons
Other

Location of computer server(s):

As the computer server used by the Véro & Louis Foundation is located on the Foundation’s premises, the Véro & Louis Foundation must ensure that access to the premises in question be limited to persons who require access to PI or to IT personnel responsible for server maintenance.

The following is recommended:

• The Véro & Louis Foundation implement security measures that restrict access to its computer servers;

• The Véro & Louis Foundation’s IT network manager assess the risks associated with access to PI and network security and recommend measures to limit and reduce unauthorized access, including but not limited to external intrusion attempts, phishing, etc.

The law also requires that the Véro & Louis Foundation conduct a privacy impact assessment (PIA), particularly before transmitting personal information outside of Quebec. This assessment could be conducted by the Véro & Louis Foundation’s IT network manager or an external consultant.

1. DESTRUCTION OF PERSONAL INFORMATION

The Véro & Louis Foundation must define rules for the destruction of personal information held about an individual. Consent is also given for specific purposes and for the duration necessary to achieve the purposes for which it was requested.

Since the obligations of a charitable organization require it to retain information related to the issuance of tax receipts to its donors for a period of six years, it is necessary to retain this personal information.

As a charitable organization, the Véro & Louis Foundation must include the following details on official donation receipts issued for income tax purposes:

• A statement that the document is an official receipt for income tax purposes;

• The name and address of the Véro & Louis Foundation as a charity registered with the Canada Revenue Agency (CRA);[2]

• The Véro & Louis Foundation’s charity registration number;

• The receipt serial number;

• The place or region where the receipt was issued;

• The date or year the donation was received;

• The date on which the receipt was issued, if different from the date on which the donation was received;

• Donor's name and address, including first name and initial;

• The amount of the donation;

• The value and description of any benefits received by the donor;

• The eligible amount of the donation;

• The signature of a person who has been authorized by the Véro & Louis Foundation to acknowledge donations;

• The name and address of the CRA website.

Each organization must, therefore, define the necessary duration of the consent obtained from its donors and stakeholders according to the purpose for which the PI was obtained. The Véro & Louis Foundation considers that it will keep the PI obtained from its donors for a maximum of 10 years following the date of their latest donation or their latest consent to the use of their personal information, whichever is more recent.

It should be remembered that this consent may be renewed by donors and stakeholders as part of their ties and transactions with the Véro & Louis Foundation, and that a mechanism must be established to document the consent obtained.

Individuals who have consented to share PI with the Véro & Louis Foundation may request at any time that their personal information be destroyed, de-indexed (s. 28.1 of the Private Sector Act), or anonymized (with the exception of previously required information appearing on tax receipts for a period of six years).

6. CONFIDENTIALITY COMMITMENTS OF STAFF, CONTRACTORS, AND VOLUNTEERS WITH ACCESS TO PERSONAL INFORMATION

Any person who may have access to an individual's personal information held by the Véro & Louis Foundation is required to sign a confidentiality agreement with the Véro & Louis Foundation.

The following commitment could be undertaken by the Véro & Louis Foundation’s stakeholders:

"For the duration of and following the termination of my involvement with the Véro & Louis Foundation, I undertake and agree not to disclose or divulge to anyone, directly or indirectly, any personal information of an individual held by the Véro & Louis Foundation and to which I may have access. Personal information includes, without limiting the generality of the foregoing:

• Name, race, ethnic origin, religion, marital status, and level of education;

• Email address, email messages, IP address, and cookie information;

• Age, height, weight, medical records, blood type, DNA, fingerprints, and voice signature;

• Income, purchases, consumer habits, banking information, credit or debit card data, loan or credit reports, and tax returns;

• Social insurance number (SIN) or other identification numbers.

I also undertake not to use any personal information for personal purposes or for purposes other than the involvement required of me by the Véro & Louis Foundation.

Notwithstanding any other provision of this undertaking, I will not be in default or contravention of this undertaking by reason of any disclosure of personal information if I am compelled by law to disclose such information, provided that I have made best efforts to notify the Véro & Louis Foundation in a timely manner so that the Véro & Louis Foundation may take appropriate steps to prevent such disclosure if necessary.”

Confidentiality commitment of a third-party contractor with access to personal information

The following commitment could be undertaken by the Véro & Louis Foundation’s stakeholders:

“Whereas the Véro & Louis Foundation may decide to issue various mandates to other organizations or third parties and that the execution of these contracts may require them to transmit and/or access personal information held by the Véro & Louis Foundation.

Whereas these organizations or third parties undertake to take all measures required to ensure the protection and confidentiality of personal information held by the Véro & Louis Foundation.

It is agreed that the preamble forms an integral part of this undertaking.

It is agreed that for the duration of and following the termination of my involvement with the Véro & Louis Foundation, I undertake and agree not to disclose or divulge to anyone, directly or indirectly, any personal information of an individual held by the Véro & Louis Foundation and to which I may have access. Personal information includes, without limiting the generality of the foregoing:

• Name, race, ethnic origin, religion, marital status, and level of education;

• Email address, email messages, IP address, and cookie information;

• Age, height, weight, medical records, blood type, DNA, fingerprints, and voice signature;

• Income, purchases, consumer habits, banking information, credit or debit card data, loan or credit reports, and tax returns;

• Social insurance number (SIN) or other identification numbers.

I also undertake not to use any personal information for personal purposes or for purposes other than the involvement required of me by the Véro & Louis Foundation.

Notwithstanding any other provision of this undertaking, I will not be in default or contravention of this undertaking by reason of any disclosure of personal information if I am compelled by law to disclose such information, provided that I have made best efforts to notify the Véro & Louis Foundation in a timely manner so that the Véro & Louis Foundation may take appropriate steps to prevent such disclosure if necessary.

In addition, I undertake that all members of my staff involved in this contract will adhere to this undertaking. Any corporation or person associated with the Véro & Louis Foundation and who has access to personal information transmitted by the Véro & Louis Foundation is bound by this undertaking.

On completion of the contract, I agree that the personal information transmitted by the Véro & Louis Foundation and processed by me or my staff be returned to the Véro & Louis Foundation and then destroyed along with any backup copies.