EXTERNAL PRIVACY POLICY ON THE PROTECTION OF PERSONAL INFORMATION
Welcome to the Paco Spiralift Website (https://www.pacospiralift.com/). By browsing our Website, you agree to the following Terms and Conditions of use. If that is not your intention, then please do not access or use this Website.
“Paco Spiralift”
In the course of its activities, Paco Spiralift may come into contact with your Personal Information. Paco Spiralift takes the protection of your privacy and the security of your Personal Information very seriously. The purpose of this Policy is to help you understand our practices regarding the collection, use, disclosure, retention and destruction of Personal Information.
This Policy therefore applies to the Paco Spiralift “Website”:
Acceptance of the Policy is an essential condition for the use of all Paco Spiralift services, except under the conditions specified by the law. By providing us with Personal Information (via our Website, job boards, e-mail, in person or by telephone), you agree to its processing in accordance with this Policy, and you authorize Paco Spiralift to use such information for the purposes set forth herein.
Furthermore, please note that this Paco Spiralift Website, including any content appearing on or accessible through the site, is protected by copyright. Any adaptation or distribution is prohibited unless prior written authorization to do so has been obtained from an authorized representative, and this, for a specific use and duration.
This Policy is intended to protect Personal Information. The Loi sur la protection des renseignements personnels dans le secteur privé (Act respecting the protection of personal information in the private sector) defines Personal Information as any information concerning a natural person and allowing, directly or indirectly, that person to be identified (“Personal Information“).
It can therefore be any information about an identifiable individual, or information that allows an individual to be identified. Personal Information may include your last name, first name, address, telephone number, e-mail address or any other personal or demographic information.
When collecting Personal Information and subsequently upon request, Paco Spiralift informs you of the purposes for which the Personal Information is collected, the means by which the Personal Information is collected, legal rights of access and rectification, your right to withdraw your consent to the disclosure or use of the Personal Information collected.
Paco Spiralift is responsible for protecting the Personal Information it holds. As such, Paco Spiralift has established and implemented policies and practices to govern the handling and protection of Personal Information, including this Policy. These include the framework applicable to the retention and destruction of Personal Information, the roles and responsibilities of its staff members throughout the lifecycle of such Personal Information and a process for handling complaints relating to the protection of such Personal Information.
Paco Spiralift has therefore appointed Philippe Laforest as Privacy Officer to ensure compliance with and implementation of the Loi sur la protection des renseignements personnels dans le secteur privé. In this Policy, the term “Privacy Officer” refers to the person designated as such, as well as to any person to whom he or she may have delegated this function in whole or in part in writing, as applicable.
If you have any questions, requests or other inquiries regarding the interpretation or application of this Policy, please contact the Privacy Officer using the following contact details:
Name: Philippe Laforest
Email: info@groupepaco.com
Phone: 450 678 7226
Please note that the Privacy Officer has approved all policies and practices. Paco Spiralift undertakes to publish detaild information about these policies and practices in clear and plain terms on its Website, and to update them from time to time.
Paco Spiralift may collect Personal Information for a variety of purposes. Paco Spiralift only collects Personal Information that is necessary for the purposes identified in this Policy.
Consultation of our Website does not require prior registration or identification. You do not need to provide any personal data (last name, first name, address, etc.). We do not record any personal data for the simple purpose of consulting the Website.
By accepting the conditions of use of our Website, you consent to the collection of connection data (e.g. IP address) and location data (e.g. country of origin). This data is used for the purpose of improving our services and compiling usage statistics. This data is collected through the use of cookies.
Some of the electronic tools we use to better respond to your questions involve the collection of Personal Information in order to contact you, for example through forms on Paco Spiralift Websites.
You may be required to complete forms online on our Website, in order to receive Paco Spiralift newsletter or to send us your application. By using our online forms, you agree that we may collect Personal Information for the purpose of contacting you again (name and contact information, including email and/or phone number). For these purposes, we encourage you to complete the mandatory fields marked with an asterisk (*) on our forms. Completion of non-mandatory fields is optional, and remains at your discretion, particularly with regard to receiving our newsletter.
Please note that this Policy does not apply to the various links and/or third-party links on our Websites, including, but not limited to, search results and purchase of goods and services through third-party payment platforms, credit card companies and other providers. These sites are owned and operated by independent companies over which we have no control and which are not covered by this Policy. We are not responsible for their content or for the collection and use of their information.
In the course of its activities, Paco Spiralift is required to evaluate applications from a number of individuals for positions to be filled. Applications include the candidate’s first and last name, contact information and CV. Applications may also include names, first names and contact information of past job references, and psychometric test results when these are part of the recruitment process.
This Personal Information is collected through our Websites, e-mail addresses, phone numbers, job boards and partner recruitment agencies.
In order to provide you with an estimate for your project or for any service you may require, we may ask you for your mailing address and contact information (phone number, e-mail address).
When you consent to receive our services, you also consent to the collection of the Personal Information required to provide them. This includes the collection of banking information required to bill our services (e.g. cheque, credit card number, bank transfer).
This Personal Information may be collected via our Website, by telephone, electronically or in person by one of our authorized employees.
Paco Spiralift ensures that all Personal Information is processed according to a pre-established life cycle.
Please note that Paco Spiralift does not establish a file on a natural person unless it has a serious and legitimate interest in doing so. It will only collect Personal Information that is relevant to the stated purpose of the file, and does not disclose it to third parties or use it for purposes that are inconsistent with those for which the file was compiled. Nor will Paco Spiralift otherwise violate the privacy or reputation of the person concerned in the creation or use of the file
Prior to making a decision concerning the individual concerned, Paco Spiralift shall ensure that the Personal Information held on that individual is up-to-date and accurate at the time it is used. The Personal Information used to make such a decision is kept for at least one year following the decision.
Paco Spiralift shall inform individuals of their right to access and rectify their Personal Information, and shall inform them of how to exercise those rights when required by law, within the prescribed time.
Access to Personal Information within Paco Spiralift will be limited to those employees who need the information to perform their duties. These employees will treat Personal Information as strictly confidential and will not provide access to such Personal Information to any unauthorized person. The level of access to Personal Information will be granted to employees on a need-to-know basis.
The management of Personal Information throughout its life cycle, including its retention or destruction, is carried out by Paco Spiralift employees, or by any person authorized to do so in accordance with the terms of the Loi sur la protection des renseignements personnels dans le secteur privé.
In any organization, failure to protect Personal Information can increase the risk of privacy breaches. Such breaches can lead to a variety of issues, such as damaging the person’s reputation or enabling fraud or identity theft.
Paco Spiralift therefore takes reasonable security measures to ensure the protection of Personal Information that is collected, used, disclosed, retained or destroyed.
We will protect Personal Information against loss or theft, unauthorized access, use or disclosure, alteration or destruction, through appropriate administrative, technical and physical security and protection measures.
The level of protection afforded to Personal Information depends on the following:
We use secure networks to store data in order to limit hacking or data leakage.
While we strive to use appropriate means to protect your Personal Information, we cannot guarantee its absolute security. Only communications or transactions made through a data encryption system are systematically secured. We therefore do not recommend using your e-mail software to transmit Personal Information to Paco Spiralift.
We have procedures in place to deal with any alleged violations that we will notify you and any relevant regulatory body when we are legally required to do so.
Moreover, Paco Spiralift will only disclose Personal Information outside Quebec if a privacy impact assessment shows that the Personal Information would benefit from adequate protection, in particular with regard to generally accepted Personal Information protection principles. Any such disclosure shall be subject to a written agreement taking into account the results of the evaluation and, where appropriate, the agreed upon terms and conditions to mitigate the risks identified in the assessment. The same applies when Paco Spiralift assigns a person or organization outside Quebec with the task of collecting, using, communicating or retaining such Personal Information on its behalf.
Except as provided by law, Paco Spiralift must obtain valid consent from the person concerned before collecting, using or disclosing any Personal Information. When obtaining your consent, Paco Spiralift ensures that it is manifest, free, informed and given for specific purposes. Whenever possible, you will be asked for your consent for each of these purposes, in clear and plain terms.
Wherever possible, we try to obtain your consent before collecting your Personal Information. The form of consent may vary depending on the circumstances and the type of Personal Information sought. Consent may be expressed or implied and may be provided directly by the individual.
When the request for consent is made in writing, it will be presented separately from any other information communicated to the person concerned. When requested, Paco Spiralift will assist the individual in understanding the scope of the requested consent.
We prefer to obtain express consent, whether verbally, electronically or in writing. Implied consent may be reasonably inferred from an individual’s action or inaction, for example, providing a name and address to submit an application, or a name and telephone number to obtain an answer to a question. In determining the appropriate type of consent, we take into account the sensitivity of the Personal Information in question, the purposes for which it is collected and the reasonable expectations of the individual. If we wish to use Personal Information for a new purpose, we will describe the intended use and ask for consent again.
When we wish to use or disclose sensitive Personal Information, we must obtain your express consent.
Personal Information is considered sensitive within the meaning of this Policy and the Loi sur la protection des renseignements personnels dans le secteur privé when, due to its medical, biometric or other intimate nature, or due to the context of its use or communication, it raises a high degree of reasonable expectation of privacy.
Furthermore, Paco Spiralift does not collect Personal Information from minors under the age of 14 without the consent of a parent or guardian. By continuing to use Paco Spiralift Website or any of Paco Spiralift services, you confirm that you are 14 years of age or older or that you have parental or guardian consent to the collection of Personal Information on behalf of the person concerned.
Consent is valid only for the time necessary to achieve the purposes for which it was requested.
We use your Personal Information only for the purposes for which it was collected or for a use consistent with those purposes, unless you have the consent of the individual concerned.
Personal Information may, however, be used for another purpose by Paco Spiralift without the consent of the person concerned only in the following cases:
If Paco Spiralift uses Personal Information for commercial or philanthropic prospecting purposes, it must identify itself to the person to whom it is addressed and inform him or her of his or her right to withdraw consent to the use of his or her Personal Information for these purposes. When the person concerned withdraws his or her consent to the use of Personal Information concerning him or her for commercial or philanthropic prospecting purposes, Paco Spiralift will cease to use such information in this way.
We will not disclose to a third party any Personal Information that we hold about another person, unless the person concerned consents to such disclosure or unless it is required by law.
Consent to the disclosure of Personal Information by a third party may be given by the person concerned to Paco Spiralift for collection from that third party.
Paco Spiralift may, without the consent of the person concerned, disclose Personal Information to any person or organization if such disclosure is necessary for the exercise of a mandate or the execution of a service or business contract that it entrusts to such person or organization. Paco Spiralift will then entrust the mandate or contract in writing, and will indicate therein the measures that the mandatary or the executor of the contract must take to ensure the protection of the confidential nature of the Personal Information communicated, to ensure that this Personal Information is only used in the exercise of its mandate or the execution of its contract and that it is not retained after its expiry, subject to the measures provided for by law.
A person or an organization exercising a mandate or performing such a service or business contract shall promptly notify the Privacy Officer of any breach or attempted breach by any person of any of the obligations relating to the confidentiality of the Personal Information communicated and shall also allow the Privacy Officer to carry out any verification relating to such confidentiality.
Paco Spiralift may be required to disclose Personal Information when it is necessary for the purpose of entering into a commercial transaction to which it is a party. A business transaction is defined in this Policy as the disposition or lease of all or part of Paco Spiralift or its assets, a change in its legal structure by merger or otherwise, obtaining a loan or other form of financing by it, or security interest taken to guarantee any of these obligations.
In this situation, Paco Spiralift may then communicate such Personal Information to the other party to the transaction, without the consent of the person concerned.
Where applicable, Paco Spiralift will have concluded an agreement with the other party beforehand, stipulating in particular that the latter party undertakes:
Likewise, when Paco Spiralift enters into a commercial transaction and wishes to continue to use or disclose Personal Information, Paco Spiralift will only use or disclose such Personal Information in accordance with the law. Within a reasonable period of time following the conclusion of a business transaction through which Paco Spiralift obtains Personal Information, Paco Spiralift will notify the person concerned that it now holds Personal Information about him or her as a result of said business transaction.
Under certain conditions, Paco Spiralift may disclose Personal Information without the consent of the persons concerned to a person or organization that wishes to use this Personal Information for study, research or statistical purposes.
Beforehand, Paco Spiralift shall carry out an assessment of the factors relating to privacy. This assessment must conclude that:
Paco Spiralift will refuse any request that does not comply with the terms of the Loi sur la protection des renseignements personnels dans le secteur privé from a person or organization wishing to use Personal Information for study, research or statistical purposes.
If Paco Spiralift discloses such Personal Information in accordance with this Policy, it must first enter into an agreement with the person or organization to whom it discloses such Personal Information stipulating, among other things, that such Personal Information:
This agreement must also:
The aforementioned agreement is then forwarded to the Commission d’accès à l’information du Québec, and takes effect 30 days after it is received by the latter.
Paco Spiralift retains Personal Information only as long as necessary for the purposes set out in this Policy. In particular, we comply with all legal requirements for the retention of Personal Information in terms of duration.
For example, sensitive Personal Information that we retain during the recruitment process will be retained during that process and then destroyed.
The Personal Information that we use to re-contact you following your information request is used for the time we need it to re-contact you If necessary, the Personal Information in question will then be anonymized in the appropriate manner according to the corresponding needs of these internal statistics.
Our methods of retaining Personal Information are adapted to the nature of the information and the medium on which it is stored. Paco Spiralift shall take the reasonable steps necessary to ensure the retention of all Personal Information it holds.
Paco Spiralift takes reasonable measures to limit the risk of anyone identifying a natural person with de-identified information.
Under the Loi sur la protection des renseignements personnels dans le secteur privé, Personal Information is de-identified when it can no longer be used to directly identify the person concerned.
When the purposes for which Personal Information was collected or used have been fulfilled, Paco Spiralift destroys or anonymizes it in order to use it for serious and legitimate purposes, subject to a retention period stipulated by law.
Personal Information anonymized in accordance with this Policy will be anonymized in accordance with generally accepted best practices and in accordance with the criteria and procedures determined by Paco Spiralift legal obligations.
For the purposes of this Policy, anonymizing Personal Information means making it reasonably foreseeable in the circumstances that Personal Information concerning a natural person no longer makes it possible to directly or indirectly identify that person, in the circumstances referred to, and irreversibly.
At the request of any person concerned, Paco Spiralift will confirm the existence of Personal Information about him or her, if it holds such Personal Information, and will provide him or her with a copy in the form of a written and intelligible transcript.
It also informs the individual, upon request, of the Personal Information collected from him or her, the categories of persons who have access to this Personal Information within Paco Spiralift, the duration of the retention of this Personal Information, and the contact information of the Privacy Officer.
Paco Spiralift communicates the information to the person concerned in simple and plain terms, regardless of the means used to collect the Personal Information. Where the requesting party is a person with a disability, reasonable accommodations will be made, upon request, to enable him or her to exercise his or her right of access as set out in this Policy.
Notwithstanding the foregoing, when Paco Spiralift holds a file that it has compiled on a person concerned, it may refuse to allow that person to consult it only if this would cause serious harm to his or her health and provided that Paco Spiralift offers the person the opportunity to designate a health professional of his or her choice to receive communication of such Personal Information and to communicate it to that professional.
In addition, Paco Spiralift may refuse to disclose Personal Information to an individual where disclosure of the Personal Information could reasonably be expected to:
Paco Spiralift refuses to disclose Personal Information concerning a person when its disclosure would likely reveal Personal Information about a third party or the existence of such Personal Information, and such disclosure would be likely to seriously harm the third party, unless the third party consents to its disclosure or unless it is an emergency endangering the life, health or safety of the person concerned.
Paco Spiralift refuses to disclose Personal Information to the testamentary executor, the beneficiary of a life insurance policy or death benefit, the heir or successor of the person concerned by such Personal Information, unless such disclosure would jeopardize the interests and rights of the person requesting it as executor, beneficiary, heir or successor. However, Paco Spiralift may communicate to the spouse or close relative of a deceased person any Personal Information it holds concerning that person, if knowledge of this Personal Information is likely to help the applicant in his or her grieving process and if the deceased person has not recorded in writing his or her refusal to grant this right of access.
At the request of any person concerned, Paco Spiralift will rectify Personal Information concerning him or her that is inaccurate, incomplete or equivocal, or if its collection, disclosure or retention is not authorized by law.
When the Privacy Officer agrees to a request for rectification, he will issue to the person who made the request, free of charge, a copy of any Personal Information amended or added, or, as the case may be, an attestation of the deletion of such Personal Information.
The Privacy Officer immediately notifies any person who has received Personal Information in the previous six months of the rectification and, where applicable, the person from whom the Personal Information was received. The same applies to the request for rectification, if it is contested.
At the request of any person concerned, Paco Spiralift will cease to disseminate Personal Information or will de-index any hyperlink attached to its name allowing access to it by technological means where the dissemination of such Personal Information contravenes the law or a court order.
At the request of any person concerned, Paco Spiralift will do the same, or will ensure that the hyperlink allowing access to this Personal Information is re-indexed when the following conditions are met:
In assessing the above criteria, Paco Spiralift takes into account, among other things, whether the person concerned is a public figure, whether the Personal Information concerns the person while he or she is a minor, whether it is up-to-date or accurate, its sensitivity, the general context in which it is disseminated, the time elapsed between its disclosure and the request made by the person concerned under this Policy, and, if the Personal Information concerns criminal or penal proceedings, obtaining a pardon or the application of a restriction on access to court records.
In order to make a request for access to or rectification of Personal Information, a person must make such a request in writing to the Privacy Officer, providing proof of his or her identity as the person concerned or in one or more of the following capacities in relation to the person concerned:
When the request is not specific enough or when requested by an individual, the Privacy Officer shall assist in identifying the Personal Information sought.
The foregoing shall not be construed as restricting the disclosure to a person of Personal Information concerning him or her or its rectification resulting from the rendering of a service to him or her.
The Privacy Officer will reply in writing to the request for access or rectification, with due diligence and no later than 30 days from the date of receipt of the request.
If no reply is received within 30 days of receipt of the request, the Privacy Officer is deemed to have refused to grant the request.
When Paco Spiralift holds Personal Information that is the subject of a request for access or rectification and does not grant the request, it retains the information for the time required to allow the person concerned to exhaust the remedies provided by law.
The Privacy Officer shall give reasons for any refusal to grant a request, and indicate the provision of the law upon which the refusal is based, the remedies available to the applicant under the Loi sur la protection des renseignements personnels dans le secteur privé, and the time within which they may be exercised. He also assists the applicant, at his or her request, in understanding the refusal.
A request for withdrawal under this Policy follows the same procedure as for a request for access or correction, with the necessary adaptations. If the request is granted, the Privacy Officer certifies, in its written response, that the disclosure of the Personal Information or the de-indexing or reindexation of the hyperlink has ceased.
Access to Personal Information at Paco Spiralift is free of charge. However, Paco Spiralift may charge a reasonable fee for the transcription, reproduction or transmission of such Personal Information.
When Paco Spiralift intends to charge a fee under this Policy, it shall inform the applicant of the approximate amount payable before proceeding with the transcription, reproduction or transmission of such Personal Information.
Paco Spiralift takes the protection of Personal Information very seriously. If Paco Spiralift has reason to believe that a Privacy Incident involving Personal Information held by Paco Spiralift has occurred, Paco Spiralift will take reasonable measures to minimize the risk of harm and to prevent similar Privacy Incidents from occurring in the future.
For the purposes of this Policy, a “Privacy Incident” is defined as the unauthorized access, use or disclosure of Personal Information, the loss of Personal Information or any other breach of its protection.
If the Privacy Incident presents a risk of serious harm, Paco Spiralift undertakes to diligently notify the Commission d’accès à l’information du Québec. Paco Spiralift also undertakes to notify any person whose Personal Information is affected by the Privacy Incident, if applicable, as well as any person or organization likely to reduce this risk, by communicating only the Personal Information necessary for this purpose without the consent of the person concerned. In the latter case, the Manager will record the communication.
Notwithstanding the foregoing, a person whose Personal Information is affected by the Privacy Incident will not be notified if this is likely to impede an investigation by a person or organization which, under the law, is responsible for preventing, detecting or suppressing crime or breaches of the law.
When Paco Spiralift assesses jointly with the Privacy Officer the risk of harm being caused to a person whose Personal Information is affected by a Privacy Incident, it considers in particular the sensitivity of the Personal Information concerned, the apprehended consequences of its use and the likelihood that it will be used for harmful purposes.
Moreover, Paco Spiralift maintains a register of Privacy Incidents.
For any complaint relating to the interpretation or application of this Policy, or concerning your Personal Information in connection with Paco Spiralift, we invite you to proceed by means of a written request addressed to the Privacy Officer. Your complaint will be processed as soon as possible, and Paco Spiralift will take reasonable measures to address the situation.
On the other hand, any interested person may submit to the Commission d’accès à l’information du Québec a request for examination of a disagreement relating to the application of a legislative provision relating to access to or rectification of Personal Information, or relating to the application of section 28.1. of the Loi sur la protection des renseignements personnels dans le secteur privé.
Paco Spiralift, when it holds Personal Information about others, may ask the Commission d’accès à l’information du Québec to authorize it to disregard requests that are manifestly abusive due to their number, repetitive or systematic nature or requests that, in the opinion of the Commission d’accès à l’information du Québec, are not consistent with the purpose of the Loi sur la protection des renseignements personnels dans le secteur privé. Paco Spiralift may also ask the Commission d’accès à l’information du Québec to circumscribe the requester’s request or to extend the deadline within which Paco Spiralift must respond.
Paco Spiralift will forward any such request to the Commission d’accès à l’information du Québec no later than 30 days from the date of receipt of the applicant’s last request.
Paco Spiralift cooperates with the Commission d’accès à l’information du Québec, and provides it with the information it requires under the law in a timely manner.