Policy on The Protection of Personal Information
Effective Date: February 18, 2026
White Glove Heating and Air Conditioning (“the Company”) is committed to ensuring the protection of personal information in accordance with the Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), as amended by Law 25.
This Policy establishes the governance rules applicable to the collection, use, communication, retention, destruction, and protection of personal information under the Company’s custody or control.
This Policy applies to personal information concerning customers, employees, job applicants, suppliers, contractors, and any other identifiable natural person interacting with the Company.
1. Accountability
The Company is responsible for personal information in its possession.
The Person in Charge of the Protection of Personal Information is responsible for ensuring compliance with applicable privacy legislation.
Contact details:
Person in Charge of the Protection of Personal Information
White Glove Heating and Air Conditioning
ap*******@****rs.com
2. Role of the person in charge
The Person in Charge shall:
- Ensure compliance with the Act and applicable regulations
- Approve and implement privacy governance policies and practices
- Conduct or oversee Privacy Impact Assessments (PIAs) where required
- Maintain a register of confidentiality incidents
- Establish procedures for handling complaints and access requests
- Ensure appropriate training and awareness within the organization
- Assess and report confidentiality incidents where there is a risk of serious injury
3. Collection of personal information
The Company collects personal information only where:
- The collection is necessary for identified purposes
- The purposes are legitimate and clearly defined
- Consent is obtained, unless otherwise authorized by law
Personal information is collected directly from the individual concerned, except where authorized by law.
At the time of collection, individuals are informed of:
- The purposes of collection
- The means by which the information is collected
- Their rights of access and rectification
- The possibility that the information may be communicated outside Quebec, if applicable
4. Consent
Consent must be:
- Clear
- Free
- Informed
- Given for specific purposes
Consent requests are presented separately from other information and written in clear and simple language.
Consent may be withdrawn at any time, subject to legal or contractual restrictions.
5. Use and communication of personal information
Personal information is used only for the purposes for which it was collected, unless:
- The individual provides new consent;
- The use is consistent with the original purpose; or
- The law authorizes such use.
Personal information may be communicated to third parties only where necessary for carrying out Company activities and subject to written agreements ensuring confidentiality and security safeguards.
The Company does not sell or commercialize personal information, including telephone numbers or SMS consent data.
6. Confidentiality incidents
A “confidentiality incident” includes:
- Unauthorized access to personal information
- Unauthorized use
- Unauthorized communication
- Loss of personal information
- Any other breach of the protection of personal information
The Company maintains a register of confidentiality incidents.
Where a confidentiality incident presents a risk of serious injury, the Company will:
- Notify the Commission d’accès à l’information du Québec (CAI)
- Notify the affected individual(s)
- Take reasonable measures to reduce the risk of injury and prevent recurrence
7. Security measures
The Company implements reasonable security measures proportionate to the sensitivity of the information, including:
- Role-based access controls
- Two-factor authentication
- Encryption (SSL)
- Secure storage systems
- Locked physical premises
- Secure destruction of paper documents
- Immediate revocation of access upon termination
Access to personal information is limited to persons whose duties require it.
8. Retention, destruction and anonymization
Personal information is retained only for the time necessary to fulfill the purposes for which it was collected, or to comply with legal requirements.
When the purposes have been achieved and retention is no longer required:
- The information is securely destroyed; or
- It is anonymized in accordance with the Act.
Anonymized information may be retained for serious and legitimate purposes.
9. Rights of individuals
Subject to legal limitations, individuals have the right to:
- Access their personal information
- Request rectification of inaccurate or incomplete information
- Withdraw consent
- Request cessation of dissemination or de-indexation (where applicable)
- Request deletion where continued processing is not justified
- Request communication of their computerized personal information in a structured and commonly used technological format (data portability right)
Requests must be submitted in writing to:
The Company will respond within 30 days, unless an extension is permitted by law.
If a request is refused, written reasons will be provided.
10. Privacy impact assessments (pia)
The Company conducts a Privacy Impact Assessment when:
- Acquiring, developing, or redesigning an information system involving personal information
- Communicating personal information outside Quebec
- Undertaking projects involving sensitive personal information
PIAs assess privacy risks and ensure adequate safeguards are implemented.
11. Cross-border communication
Before communicating personal information outside Quebec, the Company conducts an assessment to ensure that the information would receive adequate protection in the receiving jurisdiction.
Such communication occurs only if the assessment demonstrates adequate safeguards.
12. complaints
Any individual who believes that their personal information has been handled in a manner inconsistent with this Policy or applicable law may file a written complaint with:
Person in Charge of the Protection of Personal Information
ap*******@****rs.com
Complaints will be investigated and responded to within 30 days.
Individuals may also submit a complaint to the Commission d’accès à l’information du Québec (CAI).
13. Policy approval and review
This Policy is approved by the Person in Charge of the Protection of Personal Information.
The Policy is reviewed periodically to ensure continued compliance with Quebec privacy legislation.
