Legal

• Person in charge of the protection of personal information: oversees compliance, approves this policy, handles access and rectification requests, complaints and incidents. Delegated in writing by the company's highest authority.
• Staff and moderators: access personal information only as needed for their role (admin, moderator, support, finance), through role-based permissions and database Row-Level Security; access is removed when a role ends.
• Service providers: process information only on our instructions under written agreements (confidentiality, security, deletion at end of contract, incident notification). The list is in the Privacy Policy.

Information is destroyed or anonymized at the end of its retention period by automated daily jobs. Anonymization must be irreversible, following generally accepted best practices.

A privacy impact assessment (PIA) is carried out, proportionate to the sensitivity of the information, before any new project to acquire, develop or overhaul an information system or service involving personal information, and before communicating personal information outside Québec (s. 17). It reviews purpose, necessity, minimization, safeguards and, for transfers, the legal framework of the destination. PIAs are kept on file and reviewed when the processing changes. Privacy by default: the most privacy-protective settings apply without any action from you (e.g. advertising cookies off until you accept).

1. Any staff member who suspects an incident reports it to the privacy officer immediately.
2. We take reasonable measures to reduce the risk of injury and prevent recurrence.
3. We assess the risk of serious injury (sensitivity, likely consequences, probability of misuse).
4. If the risk is serious, we promptly notify the Commission d'accès à l'information and the persons concerned, and may notify others who can reduce the risk.
5. Every incident, serious or not, is recorded in the incident register, kept at least 5 years.

Send requests (access, rectification, withdrawal, de-indexation, portability) or complaints to the privacy officer by email or mail. We acknowledge receipt, verify your identity, and answer in writing within 30 days. A refusal states the reasons, the legal provision and your right to apply to the CAI. Complaints about how we handle personal information are investigated and answered in writing within 30 days; if you are not satisfied you may contact the Commission d'accès à l'information. These services are free.

Reports with the child-safety reason are handled first. Evidence is kept privately, excluded from automatic deletion, and preserved for at least 21 days and until resolved. Child sexual abuse material is reported to Cybertip.ca and, where required, to police, in accordance with Canada's mandatory reporting law.

Staff and moderators receive privacy and confidentiality training when they get access, and a refresher every year, covering this policy, incident reporting and child-safety procedures.

This policy, the retention schedule and the provider list are reviewed at least once a year and whenever a major change occurs.