Privacy Policy

This policy aims to ensure the protection of personal information and to govern how DECON-TRACK collects, uses, communicates, retains, destroys, or otherwise manages such information. It also aims to inform any interested party about how DECON-TRACK processes their personal information.

This policy applies to DECON-TRACK, which includes, notably, its officers, employees, consultants, volunteers, as well as any person who otherwise provides services on behalf of DECON-TRACK. It also applies to DECON-TRACK's website, as well as all websites controlled and maintained by DECON-TRACK.

It covers all types of personal information managed by DECON-TRACK, whether it concerns prospective or current clients, consultants, employees, members, or any other individuals (such as website visitors).

For the purposes of this policy, personal information is any information that relates to a natural person and allows them to be identified, directly or indirectly. For example, this could include a person’s name, address, email address, telephone number, gender, banking details, health information, ethnic origin, language, and similar information.

Sensitive personal information is information for which there is a high degree of reasonable expectation of privacy, for example health information, banking details, biometric data, sexual orientation, ethnic origin, political opinions, or religious or philosophical beliefs. Occupational exposure and decontamination records held in the platform are treated as sensitive because they relate to health and safety, even though the platform does not collect medical diagnoses.

A person’s professional or business contact information is personal information — for example, a person’s work name, title, address, email address, or work phone number. Under Quebec's Act respecting the protection of personal information in the private sector, only Divisions II and III of that Act do not apply to personal information concerning a person's exercise of a function within an enterprise, such as their name, title, and position, as well as the address, email address, and phone number of their workplace.

These same provisions also do not apply to personal information that is public under the law, as of the coming into force of this policy.

In the course of its activities, DECON-TRACK may collect different types of information for various purposes. The types of information that DECON-TRACK may collect, their intended use, and the means by which information is collected are set out in Schedule A of this policy.

DECON-TRACK will also inform the individuals concerned, at the time personal information is collected, of any other information collected, the purposes for which it is collected, and the means of collection, in addition to any other information required by law.

DECON-TRACK applies the following general principles regarding the collection, use, and disclosure of personal information.

Generally, DECON-TRACK collects personal information directly from the individual concerned and with their consent, unless an exception is provided by law. Consent may be implied in certain situations, for example when an individual chooses to provide personal information after being informed by this policy of its use and disclosure for the purposes indicated here (see Schedule A). This policy can be consulted at the time of collection.

Normally, DECON-TRACK must also obtain the consent of the individual concerned before collecting their personal information from third parties, before disclosing it to third parties, or for any secondary use of that information. DECON-TRACK may act without consent in certain cases provided for by law and under the conditions specified there. The main situations are described in the relevant sections of this policy.

In all cases, DECON-TRACK only collects information if it has a valid reason to do so. Collection is limited to the information required to fulfill the intended purpose.

DECON-TRACK's services and programs are not intended for minors. More generally, DECON-TRACK does not intentionally collect personal information concerning minors. If that occurs, the information cannot be collected without the consent of a parent or guardian.

DECON-TRACK may collect personal information from third parties. Unless an exception is provided by law, DECON-TRACK will request the consent of the individual concerned before collecting personal information about them from a third party. Where information is collected from another organization rather than from the individual, the individual may ask DECON-TRACK for the source of the information.

In certain situations, DECON-TRACK may also collect personal information from third parties without the consent of the individual, if it has a serious and legitimate interest and:

• a) the collection is in the interest of the individual and it is not possible to collect it from them in a timely manner; or
• b) the collection is necessary to ensure that the information is accurate.

Collection through third parties may be necessary to access certain services or programs, or to otherwise conduct business with DECON-TRACK. When required, DECON-TRACK collects the individual’s consent at the appropriate time. In the platform, the client fire department enters its personnel records, and DECON-TRACK processes them to provide the service that department requested.

DECON-TRACK ensures that the information it holds is up to date and accurate at the time it is used to make a decision about the person concerned.

DECON-TRACK may only use an individual's personal information for the reasons indicated in this policy or for any other reasons provided at the time of collection. As soon as DECON-TRACK wishes to use this information for another reason, new consent must be obtained, and that consent must be express if sensitive personal information is involved. In certain cases provided by law, DECON-TRACK may use information for secondary purposes without consent, such as:

• when the use is clearly for the benefit of the individual;
• when necessary to prevent or detect fraud;
• when necessary to evaluate or improve protection and security measures.

DECON-TRACK must limit access to personal information to employees and other people in its organization who are qualified to know it and for whom access is necessary in the performance of their duties. DECON-TRACK will request the individual's consent before granting access to any other person.

Generally, and unless an exception is indicated in this policy or otherwise provided by law, DECON-TRACK will obtain the consent of the individual concerned before disclosing their personal information to a third party. When consent is required and sensitive personal information is involved, DECON-TRACK must obtain explicit consent before communicating the information.

Disclosing personal information to third parties is sometimes necessary. Personal information may be disclosed without the individual's consent in certain cases, including:

• Public bodies: DECON-TRACK may disclose personal information without consent to a public body (such as a government authority) that collects it through a representative in the exercise of its duties or the implementation of a program under its management.
• Service providers: personal information may be transmitted without individual consent to service providers to whom disclosure is necessary. These may include event organizers, subcontractors designated by DECON-TRACK for mandates under programs it administers, and cloud service providers (hosting for the website and the platform, the database, email delivery, and the inquiry register). In these cases, DECON-TRACK must enter into written contracts that set out the measures the providers must take to protect the confidentiality of the personal information, state that the information may be used only to perform the contract, and prohibit them from retaining it after the contract ends. These contracts must also require providers to notify DECON-TRACK’s Privacy Officer of any breach or attempted breach of confidentiality obligations and allow the officer to conduct audits regarding confidentiality.
• Commercial transactions: if necessary to conclude a commercial transaction, DECON-TRACK may disclose personal information, without consent, to the other party, subject to the conditions provided by law.

Personal information held by DECON-TRACK may be communicated outside Quebec — for example when DECON-TRACK uses cloud service providers whose servers are located outside Quebec, or when it does business with subcontractors located outside the province. This includes hosting of the marketing website and the operational platform, the database, email delivery, and the spreadsheet used as the inquiry register, where those providers process the information outside Quebec.

Use of cookies. Cookies are data files sent to a visitor's browser when visiting a website. They can serve several purposes.

Websites controlled by DECON-TRACK use cookies, or similar technology such as browser local storage, to:

• remember visitor settings and preferences (for example language selection) and enable session tracking;
• operate and secure the website.

Websites controlled by DECON-TRACK may use the following types of cookies:

• Session cookies: temporary cookies stored in memory for the duration of the website visit only.
• Persistent cookies: stored on the user's computer until they expire and retrieved on later visits. On decon-track.com, the language choice is stored in the browser's local storage under the key "decon-track-locale", not in an advertising cookie.

Certain cookies may be disabled by default. Visitors can choose to enable or disable these features when browsing DECON-TRACK's websites. Cookies and local storage can also be managed in the browser settings.

Use of Google Analytics. DECON-TRACK does not use Google Analytics, or other third-party advertising or analytics cookies, on decon-track.com or on the operational platform. If that changes, this policy will be updated before that use begins.

Other technological means. DECON-TRACK also collects personal information through technological tools such as web forms on controlled websites (for example contact forms or newsletter sign-ups), online questionnaires on platforms and applications, and other form tools, including the privacy inquiry form.

If DECON-TRACK collects personal information by offering a technological product or service that includes privacy settings, DECON-TRACK must ensure these settings provide the highest level of privacy by default (cookies are excluded from this specific rule).

Unless a minimum retention period is required by applicable law or regulation, DECON-TRACK will only retain personal information for as long as necessary to fulfill the purposes for which it was collected.

Personal information used by DECON-TRACK to make a decision about an individual must be retained for at least one (1) year following the decision, or up to seven (7) years following the end of the fiscal year in which the decision was made if it carries tax implications (for example, termination of employment).

Privacy inquiry files are retained for up to seven (7) years after the file is closed, or longer if required by law, to document how the inquiry was handled.

At the end of the retention period, or when personal information is no longer needed, DECON-TRACK will ensure it is either:

1. destroyed; or
2. anonymized (meaning it can no longer irreversibly identify the individual, and no link can be established between the person and the data) for serious and legitimate purposes.

Destruction must be conducted securely.

This section may be supplemented by any policy or procedure DECON-TRACK adopts on retention and destruction. Contact DECON-TRACK’s Privacy Officer for further information.

DECON-TRACK is responsible for protecting the personal information it holds.

The Privacy Officer is generally responsible for ensuring compliance with applicable privacy legislation. The officer must approve policies and practices governing personal information protection. This person implements this policy and ensures it is known, understood, and applied. If the Privacy Officer is absent or unable to act, Derek Doyle, President of DECON-TRACK, assumes those responsibilities.

Staff members who have access to personal information or are involved in its management must protect it and comply with this policy. Roles across the lifecycle of personal information may be specified in other organizational policies.

DECON-TRACK implements reasonable security measures to protect the personal information it manages. Those measures correspond to the purpose, quantity, distribution, storage medium, and sensitivity of the information. Information treated as sensitive (see Application and definitions) requires heightened security measures.

In line with limited access, DECON-TRACK restricts system access so that only people who need it to perform their duties are authorized. In the platform, access is limited to the client fire department and to the roles required inside that department.

To exercise a right of access, rectification, or withdrawal of consent, submit a written request to DECON-TRACK's Privacy Officer, Artur Tereshchenko, at artur@decon-track.com.

Subject to legal restrictions, individuals may request access to personal information DECON-TRACK holds about them and request corrections if it is inaccurate, incomplete, or ambiguous. They may also require DECON-TRACK to cease disseminating personal information, or to de-index hyperlinks attached to their name that allow access by technological means, when dissemination violates the law or a court order. They may make the same request, or require that such a hyperlink be re-indexed, where dissemination causes them serious injury in relation to their right to the respect of their reputation or privacy and the other conditions set out in the Act are met.

The Privacy Officer must respond in writing within 30 days of receipt. Any refusal must state reasons and cite the applicable legal provisions, and must outline available remedies and time limits.

Subject to legal and contractual limitations, individuals may withdraw consent to the communication or use of collected information. They may also ask what personal information was collected, which categories of personnel have access to it, and how long it is retained.

Receipt. A complaint about this policy or about DECON-TRACK's privacy practices must be made in writing to the Privacy Officer, Artur Tereshchenko, at artur@decon-track.com, or through the online form at /complaint. The complaint must include the complainant's name, contact details (including a phone number), and enough detail to explain the grounds.

Processing. DECON-TRACK treats every complaint confidentially.

Within 30 days of receiving the complaint (or of receiving any additional information required), the Privacy Officer will evaluate it and provide a written, reasoned response by email. The online form also acknowledges receipt within five (5) business days and assigns a tracking number. If the complaint cannot be processed within 30 days, the complainant will be told why the time is extended, the status of the file, and the estimated completion time.

DECON-TRACK keeps a separate file for each complaint, containing the complaint, the analysis, supporting documents, and the final response. A complainant may also file a complaint with the Commission d'accès à l'information du Québec or another competent supervisory authority. DECON-TRACK encourages individuals to contact its Privacy Officer first.

This policy is approved by Derek Doyle, President of DECON-TRACK. Requests are handled by the Privacy Officer:

• Privacy Officer: Artur Tereshchenko
• Address: 6 rue Jubilee, Gatineau, QC, J9H 4S8
• Email: artur@decon-track.com

For requests, questions, or comments about this policy, contact the Privacy Officer by email.

This policy is published on the DECON-TRACK website and on all websites it controls. Changes will be published and brought to the attention of affected individuals.

The following non-exhaustive list sets out the types of information DECON-TRACK may collect, why it is used, and how it is collected. It reflects DECON-TRACK's current activities: the marketing website, the privacy inquiry form, and the decontamination and exposure-tracking platform used by client fire departments.