Personal Information Governance Policy

1. Purpose

This governance policy is established pursuant to section 3.2 of Quebec's Law 25 (Act to modernize legislative provisions as regards the protection of personal information).

It describes the rules Syspark Inc. has put in place to protect the personal information it holds, in accordance with the applicable legal requirements.

2. Scope

This policy applies to all:

Employees, officers and agents of Syspark Inc.
Subcontractors acting on behalf of Syspark
Personal information held by Syspark, whether it concerns clients, prospects, site visitors, job applicants, partners or employees

3. Person in charge of the protection of personal information

In accordance with section 3.1 of Law 25, Syspark has designated a person in charge of the protection of personal information:

Chief Information Officer (CIO) of Syspark Inc.
Email: [email protected]

Roles and responsibilities of the person in charge

Ensure that Law 25 and other applicable laws are applied and complied with
Approve personal information management policies and practices
Oversee privacy impact assessments (PIAs)
Handle requests for access, rectification and withdrawal of consent
Coordinate the response to confidentiality incidents
Train staff and raise their awareness
Serve as the point of contact with the Commission d'accès à l'information (CAI)

4. Internal roles and responsibilities

4.1 Syspark management

Ensure that the necessary resources are allocated to the protection of personal information
Approve policies and procedures
Receive the annual governance reports

4.2 Technical team

Implement technical security measures (encryption, firewalls, logging)
Keep systems up to date (patches, updates)
Monitor access and potential incidents
Manage backups and business continuity

4.3 Sales and operations team

Collect only the information that is necessary
Obtain appropriate consent
Respect retention periods
Report any incident to the person in charge

4.4 Subcontractors

Comply with contractual data protection clauses
Implement equivalent security measures
Notify Syspark of any incident

5. Personal information handling process

5.1 Collection

Syspark collects only the personal information necessary for the stated purpose
Consent is obtained explicitly where required
Individuals are informed of the collection, the purposes, the recipients and their rights

5.2 Use

Information is used only for the purposes for which it was collected
No secondary use without additional consent
No automated profiling or automated decision-making with legal effects

5.3 Communication to third parties

Subcontractors are bound by written contractual agreements
No sale or transfer of personal information for commercial purposes
Transfers outside Quebec are documented by a privacy impact assessment (PIA)

5.4 Retention and destruction

Retention periods defined by type of data (see the privacy policy)
Secure destruction of information at the end of the retention period
Destruction of paper documents by shredding, and of digital files by irreversible deletion

6. Security measures

6.1 Technical measures

TLS 1.2+ encryption for all web communications
Encryption at rest for sensitive backups
Access control through strong authentication for internal systems
Logging of access to sensitive data
Firewalls and anti-DDoS protection (Cloudflare + Syspark infrastructure)
Regular updates of systems and software
Network segmentation between environments

6.2 Organizational measures

Access to personal information on a need-to-know basis
Confidentiality undertaking signed by employees
Annual training on the protection of personal information
Security awareness sessions
Regular internal audit of practices

6.3 Physical measures

Hosting in ISO/IEC 27001 certified data centres (Vantage QC1 in Montréal, Equinix PA3 in France)
Physical access controls at Syspark's premises in Montréal
Secure physical destruction of decommissioned media

7. Privacy impact assessment (PIA)

In accordance with sections 3.3 and 3.4 of Law 25, Syspark carries out a PIA:

Before any project to acquire, develop or overhaul an information system involving personal information
Before any transfer of personal information outside Quebec
Before any communication of personal information for study, research or statistical purposes

PIAs are documented, retained and updated as processing evolves.

8. Handling requests from the persons concerned

8.1 Rights covered

Syspark handles the following requests in accordance with Law 25 and the GDPR:

Access to one's personal information
Rectification of inaccurate data
Withdrawal of consent
Data portability (in force since September 2024)
Erasure (GDPR)
Objection to processing (GDPR)

8.2 Handling procedure

Receipt: by email at [email protected]
Identity verification: request for supporting documents where there is doubt
Analysis of the request by the person in charge of protection
Reasoned reply within a maximum of 30 days
Reasoned refusal where applicable, with an indication of the available recourses
Logging of the request and the reply

9. Managing confidentiality incidents

9.1 Definition

A confidentiality incident means:

Unauthorized access to personal information
Unauthorized use of personal information
Unauthorized communication of personal information
Loss of personal information or any other breach of its protection

9.2 Procedure

Detection and reporting to the person in charge of protection without delay
Immediate containment (measures to stop the incident)
Assessment of the risk of serious injury to the persons concerned
If the risk is serious: notification to the CAI and information of the persons concerned
Corrective measures to prevent recurrence
Documentation in the incident register
Post-incident analysis and update of procedures if necessary

9.3 Incident register

Syspark keeps an internal register of confidentiality incidents up to date, including the date, nature, information concerned, number of persons affected, measures taken and notifications made.

10. Training and awareness

Mandatory training of all new employees on the protection of personal information
Annual refresher and update session
Ongoing awareness (internal communications, security alerts)
Specific training for employees who frequently handle personal information

11. Review of the policy

This policy is reviewed:

At least once a year
Whenever relevant legislation changes
After any major confidentiality incident
When there is a significant change in Syspark's activities

12. Publication

In accordance with section 3.2 of Law 25, this policy is:

Published on Syspark's website in simple and clear terms
Accessible in French and English from the footer
Communicated to Syspark's staff
Provided on request to any person who asks for it

13. Contact

For any question about this policy:

Person in charge of the protection of personal information
Syspark Inc.
Email: [email protected] (or [email protected])