(Last updated: September 22, 2024)
Policy approved by the Privacy Officer.

1. OBJECTIVE

This policy presents the measures implemented regarding the protection of personal information.

It aims to raise awareness among company employees about the application of a process for managing and protecting personal information to avoid data loss by limiting the dissemination of information to people who need it in the course of their duties.

2. TERMINOLOGY

(a) Candidate: Any person who submits an application as part of a recruitment process for a new employee;

b) Customer: any natural person who contacts (or is contacted) by the Grocer, by telephone, by email, or via the contact form available on the website, in order to obtain information on the home grocery service and/or to sign a contract;

(c) Employee: generally includes any person who has an employment relationship with the Grocer including, for the purposes hereof, vendors, service providers, shareholders and directors;

d) The Grocer: Alimentation L'Épicier Inc.;

e) Responsible for the protection of personal information: Didier Henssen, Executive Vice President;

3. DEFINITION OF PERSONAL INFORMATION

This is information that allows a natural person to be identified , directly or indirectly.

Personal information is confidential. Its confidentiality stems from the right to privacy, allowing everyone to exercise control over the use and circulation of their information.

However, a person's position and professional contact details within a company do not constitute personal information.

4. COLLECTION OF PERSONAL INFORMATION

 

4.1 REQUIRED Information:

It is essential to ensure that only personal information that is NECESSARY to perform our services is collected.


a) Regarding Customers:

For Customers, this is the information necessary for opening their account, analyzing their credit file (to obtain financing), invoicing, payment and delivery of the products ordered and also for sending advertising and promotional offers, i.e.:

Identification information: first and last name, telephone number, postal address, email address.


Financial information: date of birth, social security number, marital status, current and previous employment, income, debts (loans, lines of credit, credit cards) and check specimen.

This also includes information contained on media other than paper, including audio recordings.

b) Concerning Employees or Candidates:

For Employees, this is information necessary for human resources management and the granting of social benefits, i.e.:

In addition to the identification information previously described, this also includes banking information, CV, cover letter, and reference letter, and emergency contact details.

4.2 Duty to provide information before collecting information:

The person who collects personal information from a Customer, Employee or Candidate must inform them of the purposes for which the information is collected, the use that will be made of it, the categories of people who will have access to it within L'Épicier, the place where it will be held, and their rights of access and rectification.

Generally, L'Épicier must collect personal information directly from the person concerned, after having informed them in accordance with the preceding paragraph.

4.2.1 Reading the “script” during the first telephone communications:

When the Grocer contacts a Customer for the first time, whether at the latter's request or following the Grocer's initiative, the Customer must be informed of the measures in place to protect their personal information and of their rights in this regard.

To do this, the "Script - Protection of Personal Information" must be read to the Customer clearly and audibly and asked whether or not they consent. The Grocer keeps the audio recording of the consent given by the Customer and its date.

The Grocer also keeps in its file the version of the "Script- protection of personal information" in effect at the time of consent to demonstrate that the Customer gave informed consent.


4.2.2 Signing the consent form when signing the contract:

At the time of signing the contract, L'Épicier provides the Client with the "Information and Consent Notice" to inform them of the measures put in place to protect their personal information and their rights in this regard.

The Grocer makes himself available, if necessary, to help the Customer understand this notice before signing it.

The Grocer keeps a copy of this signed consent form.

4.3 Sensitive personal information:

Among the information collected by the Grocer, some is considered sensitive and requires special attention, namely the social insurance number and financial information.

4.4 Methods of collecting personal information:

The Grocer collects personal information in several ways, more specifically:

– With Customers: during communications with L'Épicier by telephone or email, via the contact form available on the website or through its mobile application. Subsequently, during a visit by a representative to the Customer at the time of opening the account.

– With Employees: by human resources during interviews and subsequently in the context of their work;

5. USE OF PERSONAL INFORMATION

The personal information collected may only be used for the purposes for which it was collected , namely:

– For Customers: to respond to their request for information, to open their account, to analyze their credit file to obtain financing, for invoicing and payment, as well as for the delivery of products and also for sending promotional offers.

– For Employees: for human resources management and the granting of social benefits.

6. LIST OF PERSONS WHO MAY HAVE ACCESS TO PERSONAL INFORMATION

The personal information collected by L'Épicier is accessible only to those who have the authority to receive and review it, and who consult it only when NECESSARY in the performance of their duties.

6.1 Regarding Customers:

The following may have access to this personal information:

– Regarding identification information: all Grocer Employees;

– Regarding financial information: all Employees of the Accounting and Credit Department and all members and Employees of the Grocer's management.

6.2 Information concerning Employees and Candidates:

The following may have access to this personal information:

– Employees of the human resources department and management;

– External professionals;

7. COMMUNICATION OF PERSONAL INFORMATION

 

The Grocer must not communicate to third parties the personal information collected without the consent of the person concerned.

The only cases in which L'Épicier may communicate them to a third party without obtaining the consent of the person concerned are the following:


7.1 When it is NECESSARY for the performance of a service or business contract

The Grocer may communicate personal information, without the consent of the person concerned, to the following service providers:

– Companies offering credit investigation services;

– Companies offering financing;

– IT service and data analysis providers;

– Compensation processing platforms;

– External advisors (lawyers, accountants, etc.);

7.2 When necessary for the conclusion of a commercial transaction

This is the case of the sale or merger of L'Épicier, or of obtaining new financing.

In all cases, L'Épicier must enter into a written agreement with the other party to ensure that it takes appropriate measures to ensure the protection of personal information.


7.3 Other situations:

– Communication to a person to whom this communication must be made due to an emergency situation endangering the life, safety or health of the person concerned;

– Communication to a body responsible under the law for preventing, detecting or repressing crime or offences against the laws, which requires it in the exercise of its functions, if the information is necessary for the prosecution of an offence against a law applicable in Quebec;

– Communication to public government authorities when required by law or necessary for the exercise of L'Épicier's functions;

8. RETENTION OF PERSONAL INFORMATION

 

8.1 Regarding Customers:

All information, in paper form, is kept in a restricted access room, in order to preserve its confidentiality.

Information on digital media is stored on the servers used by L'Épicier in a secure and password-protected manner to maintain confidentiality.

The Grocer keeps the information, on paper and digital media, for a period of seven (7) years from the last payment made by the Customer.

Once the retention period has expired, the documents must be destroyed by a mechanical process that ensures their confidentiality.


8.2 Regarding Employees and Candidates:

All information, in paper form, is kept in a restricted access room, in order to preserve its confidentiality.

Information on digital media is stored on the servers used by L'Épicier in a secure and password-protected manner to maintain confidentiality.

The Grocer keeps the information, on paper and digital media, for the entire duration during which the Employee is employed by The Grocer and for a period of seven (7) years from the end of that period.

Regarding Candidates who are not hired, L'Épicier retains the information, in paper and digital format, for a period of 1 year from the end of the interview process.

Once the retention period has expired, the documents must be destroyed by a mechanical process that ensures their confidentiality.

9. REQUEST FOR ACCESS AND RECTIFICATION OF PERSONAL INFORMATION

Any Customer, Employee or Candidate of L'Épicier may request, within the limits of the applicable law and regulations, to consult the file containing their personal information and request its rectification, if necessary.

9.1 Method of the request:

Any request for information must be addressed to the Privacy Officer, in writing, detailing sufficiently and precisely the information to which access is requested.

9.2 Response to the request:

The Privacy Officer must, within 30 days of receiving the request, respond to the requester of information, indicating the acceptance or refusal of the request and, in the event of a refusal, must justify his decision.


9.3 Updating information:

Any Customer, Employee or Candidate of L'Épicier may request that their own personal information recorded in L'Épicier's files be updated by providing the relevant information.

10. INTERNAL DO NOT CALL LIST

If a Customer requests that L'Épicier no longer be contacted, L'Épicier adds their first and last name and telephone number to the internal Do Not Call List within 14 days of receiving the Customer's request.

The Grocer keeps the name, first name and telephone number of this Customer on the internal Do Not Call List for three (3) years.

The Grocer does not use or communicate the name, first name and telephone number of this Customer except for the purpose of ensuring that this Customer is not contacted again.

11. MANAGEMENT OF CONFIDENTIALITY INCIDENTS

11.1 Definition of Confidentiality Incident:

There is a confidentiality incident in the event of:

– Unauthorized access by law to personal information;

– Use of personal information not authorized by law;

– Communication of personal information not authorized by law;

– Loss of personal information or any other breach of the protection of such information;

The confidentiality incident may result from a voluntary or involuntary act committed by a person internally (e.g., an employee of L'Épicier) or externally (subcontractor, service provider, supplier, hacker, etc.).

Examples of incidents: intrusion into the computer system, malware, virus or computer breach, unauthorized data extraction by an employee or other of L'Épicier, electronic sending containing personal information to an incorrect email address, loss of mail, loss or theft of a laptop or physical file.


11.2 Procedure to follow in the event of a confidentiality incident:

a) Obligation of the Grocer: Any Employee, regardless of their status, must immediately report any confidentiality incident to the Personal Information Protection Officer;

(b) Identification of the cause of the incident: The Privacy Officer conducts an investigation to determine the information that was leaked and to identify the individuals involved. He may take all necessary measures to conduct his investigation;

(c) Disclosure to the Board of Directors: The Privacy Officer must promptly inform the Board of Directors of any potential or actual incident;

d) Reduce the consequences: If the Privacy Officer has reason to believe that a confidentiality incident involving personal information held by L'Épicier has occurred, he or she must take reasonable measures to reduce the risk of harm being caused and prevent new incidents of the same nature from occurring after informing L'Épicier's board of directors of the risks and obtaining its approval to implement the proposed measures;

(e) Informing the affected individuals: The Privacy Officer must inform the affected individuals of the actual incident and the measures taken to mitigate the consequences. However, an individual whose personal information is affected by the incident does not have to be notified as long as this would be likely to hinder an investigation by a person or body that, under the law, is responsible for preventing, detecting or suppressing crime or violations of laws;

(f) Record the incident in the register: The Privacy Officer must keep a register of confidentiality incidents involving personal information and record any confidentiality incident in it;

Report the incident to the CAI: The Privacy Officer must report the incident to the Commission d’accès à l’information, all on the prescribed form;