Politique de confidentialité
Policy on the Protection of Personal Information of Individuals Working for Les Productions Sovimage inc.
Effective: April 24, 2025
1. Purpose and Scope
Les Productions Sovimage inc. (hereinafter the “Producer”) undertakes to handle the personal information of individuals working for it in compliance with the Act respecting the protection of personal information in the private sector. This Employee Personal Information Protection Policy (the “Policy”) informs individuals working for the Producer of its practices regarding the collection, use and disclosure of their personal information, as well as their rights relating to that information.
This Policy applies to all individuals working for the Producer (the “Designated Persons”).
2. Definition of “personal information”
For the purposes of this Policy, “personal information” means any information concerning a natural person that directly or indirectly identifies that person.
3. Collection of Personal Information
The Producer collects personal information about Designated Persons only to the extent necessary for managing its employment relationships with them. The Producer may collect the following personal information about Designated Persons:
· Identifiers and contact details – name, email and mailing addresses, telephone number, government‑issued ID (e.g., social insurance number, visa and passport details), work/residence permit.
· Demographic information – date of birth, gender, citizenship or medical information. In some cases, demographic data may be collected voluntarily for an equity, diversity and inclusion program (e.g., ethnic origin, sexual orientation, etc.).
· Employment‑related information – job title and compensation history, work schedule and employment status, professional experience, education, licences and other credentials, benefit and leave information, details of any issues or disputes, performance evaluations and reports, psychometric test results, disciplinary records, termination date and reason (voluntary or involuntary, with details).
· Financial information – data provided by Designated Persons for payroll management (financial institution and bank account number) and information required to issue tax forms.
· Emergency contact information – names, contact details and nature of the relationship to the Designated Person.
· Information on the use of IT resources and premises – IP address (if it identifies the employee) and device identifier (e.g., when connecting to the Producer’s Wi‑Fi), usage data for work email, internet, computers, phones and other Producer devices, as well as personal devices used for work; video images and photos from CCTV.
· Other information – details provided through the payroll management system.
4. Retention and Destruction of Personal Information
The Producer implements appropriate safeguards and control mechanisms to protect Designated Persons’ personal information. Measures include restricting physical access to offices and files, preventing unauthorized access, disclosure, use or mishandling of information under its custody, storing archives with trusted third parties in secure premises, and using firewalls, passwords and file encryption for online activities.
The Producer’s goal is to prevent any unauthorized access, loss, misuse, sharing or alteration of personal information in its possession. The Producer applies these safeguards when deleting, destroying or anonymizing personal information as well.
The Producer strives to keep personal information in Québec or, when not possible, elsewhere in Canada. However, data stored on service‑provider servers may be located outside Canada and thus be subject to that jurisdiction’s laws, including any that allow government access. Subject to such foreign laws, the Producer uses contractual measures to maintain protections at least equivalent to those applicable in Québec.
Personal information is retained only as long as reasonably necessary for the purposes for which it was collected, or as permitted or required by the Act respecting the protection of personal information in the private sector. Once no longer necessary, personal information is securely destroyed or anonymized.
Retention periods deemed reasonably necessary:
· In perpetuity – documents containing exploitation rights, copyrights, neighbouring rights or other rights required to exploit a work (e.g., agreements with authors, directors, performers).
· Seven (7) years after the end of the project for which the person worked for the Producer – tax documents.
· Three (3) years after the end of the project for which the person worked for the Producer – all other personal information.
5. Use of Personal Information
The Producer uses personal information for managing employment relationships and other legitimate purposes detailed in this Policy, as well as for any other purposes permitted by the Act respecting the protection of personal information in the private sector. For example:
· Personnel administration – verifying identity, managing taxes and social security, scheduling, attendance control, establishing emergency contacts and processing employee requests.
· Benefit administration – determining eligibility of employees, dependents and beneficiaries.
· Payroll, sick pay and leave management.
· Performance evaluation – decisions on assignments, training, compensation and promotions.
· Health and safety – measures to protect the physical and psychological integrity of Designated Persons.
· Internal business operations – disaster recovery and business‑continuity plans, internal reviews, audits and investigations, statistics and analytics for legitimate business purposes (e.g., process improvement, workforce management).
· Work‑visa applications – preparation and management.
· Legal and regulatory compliance; fraud management – including internal investigations, failure to perform duties and breach of employment contract, notably through monitoring of IT‑system use.
In addition to the purposes above, the Producer may collect personal information for any other purpose with the Designated Person’s consent, where required.
Personal information of other Designated Persons is made available to employees only as necessary to perform their work. Individuals with such access must protect it appropriately and may not share, copy or use it for any other purpose.
6. Disclosure of Personal Information
The Producer may disclose personal information to third parties for the purposes set out in this Policy and in other Producer policies and notices, or as required or permitted by law.
Examples of third‑party disclosures:
· Government bodies – where access is required (e.g., employment‑insurance requests, grant or program applications).
· Service providers – audit services, IT services, payroll administration, HR administration, benefit administration, and professional services (e.g., law firms, accounting firms). Some providers may be outside Québec; written contracts will include required safeguards.
· Reference or background checks or where contractually required by a client.
· Business transactions – contemplated or completed (e.g., purchase/sale, merger, financing) where personal information is necessary; the Producer will comply with applicable legal requirements.
· Production or exploitation of a work – only to the extent reasonably necessary.
The Producer will also cooperate with law‑enforcement agencies and comply with any court order or law requiring disclosure without additional notice or consent.
7. Accuracy, Access and Rectification
Designated Persons must provide accurate, complete personal information and promptly inform the Producer of any updates.
Designated Persons may request information about, access to, or correction of their personal information, subject to exceptions under the Act respecting the protection of personal information in the private sector (e.g., to protect others or the Producer’s privileged or confidential data).
They may also request further details on how their information is processed, including categories of internal recipients and applicable retention periods.
Requests should be submitted in writing to the Designated Person’s manager or supervisor. If unsatisfied, a formal request may be made directly to the Privacy Officer.
8. Roles and Responsibilities Throughout the Information Life Cycle
All Designated Persons who access personal information while performing their duties must maintain its confidentiality as provided in this Policy.
The Producer’s controller (productions@sovimage.qc.ca) acts as Privacy Officer and oversees compliance with the Act respecting the protection of personal information in the private sector.
9. Complaints and Questions
Designated Persons who believe their personal information has been processed in violation of this Policy should raise the matter with their manager or supervisor. If unsatisfied, they may contact the Privacy Officer.
Any privacy incident involving personal information must be reported immediately to the Privacy Officer. A privacy incident includes:
· Unauthorized access to personal information.
· Unauthorized use of personal information.
· Unauthorized disclosure of personal information.
· Loss of personal information or any other breach of its protection.
10. Changes to this Policy
The Producer regularly reviews its policies and procedures and may revise this Policy from time to time. The current version can be consulted at https://qa.sovimage.com/fr/politique-de-confidentialite.
The Producer will also provide Designated Persons with training on personal‑information protection and information security as needed.