Version history

This document will be reviewed regularly and updated based on legislative, technological, and organizational changes.

*Notes: Please note that the use of the masculine gender is intended to simplify this policy and make it easier to read.

1. Context

NVS Studio is a federally regulated for-profit legal entity that handles personal information as part of its activities.

This policy aims to ensure the protection of personal information and to set out how NVS Studio collects, uses, shares, stores, and destroys it, or otherwise manages it. It also aims to inform anyone interested about how NVS Studio handles their personal information. It also covers the processing of personal information collected by NVS Studio through technological means.

2. Application and definitions

This policy applies to NVS Studio, including its leaders, employees, consultants, volunteers, as well as anyone else who provides services on behalf of NVS Studio. It also applies to the NVS Studio website.

It covers all types of personal information handled by NVS Studio, whether it's information about its clients, potential or current, its consultants, employees, members, or any other people (like visitors to its websites or elsewhere).

For the purposes of this document, personal information is information about an individual that allows them to be identified, either directly or indirectly. For example, it could be a person's name, address, email address, phone number, gender, or banking information, as well as information about their health, ethnic origin, language, etc.

Sensitive personal information is information for which there is a high degree of reasonable expectation of privacy, for example, health information, banking information, biometric data, sexual orientation, ethnic origin, political opinions, religious or philosophical beliefs, etc.

As a general rule, an individual's business or professional contact information does not constitute personal information. This includes, for example, a person's name, title, business address, business email address, or business telephone number. More specifically, and for greater clarity, under Québec's Act Respecting the Protection of Personal Information in the Private Sector, effective September 22, 2023, Sections 3 (Collection, Use and Disclosure), 4 (Retention and Destruction), and 6 (Data Security) do not apply to information relating to an individual's role within an enterprise, such as their name, title, position, and the address, email address, and telephone number of their place of work.

These same sections also do not apply to personal information that is public by law, effective as of the date this Policy comes into force.

3. Collection, Use and Disclosure

In the course of its activities, NVS Studio may collect various types of information for different purposes. The types of information that NVS Studio may collect, their intended use (or purpose), and the methods by which the information is collected are set out in Appendix A of this Policy.

At the time personal information is collected, NVS Studio will also inform the individuals concerned of any additional information being collected, the purposes for which it is collected, the methods used to collect it, and any other information required by applicable law.

NVS Studio applies the following general principles regarding the collection, use, and disclosure of personal information:

Consent:

• As a general rule, NVS Studio collects personal information directly from the individual concerned and with their consent, unless an exception is provided by law. In certain circumstances, consent may be implied, for example, when an individual chooses to provide their personal information after having been informed, through this Policy, of the purposes for which it will be used and disclosed (see Appendix A for more details). Accordingly, this Policy and the information it contains will be made available to the individual at the time their personal information is collected.
• As a general rule, NVS Studio must also obtain the consent of the individual concerned before collecting their personal information from third parties, disclosing it to third parties, or using it for any secondary purpose. However, NVS Studio may do so without consent in certain circumstances permitted by law and subject to the conditions set out therein. The principal situations in which NVS Studio may act without consent are described in the relevant sections of this Policy.

Collection:

• In all cases, NVS Studio collects personal information only when it has a legitimate reason to do so. Furthermore, the collection of personal information is limited to what is necessary to achieve the intended purpose.
• Please note that NVS Studio's services and programs are not intended for minors. More generally, NVS Studio does not knowingly collect personal information from minors. In such cases, personal information may not be collected without the consent of a parent or legal guardian.
• Collection from Third Parties: NVS Studio peut collecter des renseignements personnels auprès de tiers. À moins d’une exception prévue par la loi, NVS Studio demandera le consentement de la personne concernée avant de collecter des renseignements personnels qui la concernent auprès d’un tiers. Dans le cas où un tel renseignement n’est pas collecté directement auprès de la personne, mais auprès d’une autre organisation, la personne concernée peut demander la source des renseignements collectés à NVS Studio.

In certain circumstances, NVS Studio may also collect personal information from third parties without the consent of the individual concerned if it has a serious and legitimate interest in doing so and: (a) the collection is in the individual's best interests and it is not possible to collect the information directly from them in a timely manner; or (b) the collection is necessary to ensure the accuracy of the information.

Collecting personal information through third parties may be necessary to provide certain services or programs or otherwise conduct business with NVS Studio. Where required, NVS Studio will obtain the individual's consent at the appropriate time.

Retention and Use:

• NVS Studio takes reasonable steps to ensure that the personal information it holds is accurate and up to date at the time it is used to make a decision concerning the individual.
• NVS Studio may use an individual's personal information only for the purposes set out in this Policy or for any other purposes disclosed at the time of collection. If NVS Studio wishes to use the information for a different purpose, it must obtain new consent from the individual concerned. Such consent must be express where the information involved is sensitive personal information. However, in certain circumstances permitted by law, NVS Studio may use personal information for secondary purposes without the individual's consent, for example:
  • Where such use is clearly for the benefit of the individual;
  • Where it is necessary to prevent or detect fraud;
  • Where it is necessary to assess or improve protective measures and security safeguards.
• Limited Access. NVS Studio implements measures to restrict access to personal information to only those employees and individuals within the organization who are authorized to access it and for whom such information is necessary to perform their duties. NVS Studio will obtain the individual's consent before granting access to any other person, unless otherwise permitted or required by law.
•  

Communication:

• Disclosure. As a general rule, and unless an exception set out in this Policy or otherwise provided by law applies, NVS Studio will obtain the consent of the individual concerned before disclosing their personal information to a third party. Where consent is required and the information involved is sensitive personal information, NVS Studio will obtain the individual's express consent before disclosing such information.
• However, disclosing personal information to third parties may, in some circumstances, be necessary. Accordingly, personal information may be disclosed to third parties without the consent of the individual concerned in certain cases, including, but not limited to, the following:
  • NVS Studio may disclose personal information, without the consent of the individual concerned, to a public body (such as a government authority) where one of its representatives collects the information in the exercise of its official functions or for the administration of a program under its responsibility.
  • Personal information may be disclosed, without the individual's consent, to NVS Studio's service providers where such disclosure is necessary for the delivery of their services. These service providers may include, for example, event organizers, subcontractors engaged by NVS Studio to carry out work related to programs it administers, and cloud service providers. In such cases, NVS Studio enters into written agreements with these service providers requiring them to implement appropriate measures to protect the confidentiality of the personal information disclosed, to use the information solely for the purpose of performing the services under the agreement, and to destroy or return the information upon the expiration or termination of the agreement, as applicable. These agreements must also require service providers to notify NVS Studio's Privacy Officer (identified in this Policy) of any actual or attempted breach of their confidentiality obligations regarding the personal information disclosed and must allow the Privacy Officer to conduct any audit or verification necessary to ensure compliance with those confidentiality obligations.
  • If necessary for the purposes of completing a commercial transaction, NVS Studio may also disclose personal information, without the consent of the individual concerned, to the other party to the transaction, subject to the conditions set out by applicable law.
• Disclosure Outside Québec: Personal information held by NVS Studio may be disclosed outside Québec. For example, this may occur when NVS Studio uses cloud service providers whose servers are located outside Québec or engages subcontractors located outside the province.

Additional Information on the Technologies Used:

Use of Cookies

Cookies are data files that are transmitted to a website visitor's computer by their web browser when they visit a website. Cookies serve a variety of purposes.

NVS Studio's website uses cookies for, among other purposes:

• Functional cookies to ensure the website operates properly and to remember visitors' settings and preferences.
• Analytics cookies used for statistical purposes to understand visitor behavior, identify the content viewed, and help improve the website.

NVS Studio's website uses the following types of cookies:

• Session cookies: These are temporary cookies that are stored in memory only for the duration of the user's visit to the website.
• Persistent cookies: These cookies remain stored on the user's device until they expire or are deleted, and are retrieved each time the user returns to the website.

Certain cookies may be disabled by default, and visitors will be able to choose whether to enable them when visiting NVS Studio's website.

Visitors may also enable or disable the use of cookies by changing the preferences in their web browser settings.

Use of Google Analytics

NVS Studio's website (https://nvsstudio.ca/)NVS Studio's website uses Google Analytics to support its ongoing improvement. Google Analytics helps analyze how visitors interact with NVS Studio's website. It uses cookies to generate statistical reports on visitor behavior and the content viewed on the website. Information collected through Google Analytics will never be shared by NVS Studio with third parties. Visitors may also install a browser add-on to disable Google Analytics.

Other Technologies Used

NVS Studio also collects personal information through technological means, including the contact form available on its website.

NVS Studio uses an invisible CAPTCHA service called Google reCAPTCHA. This service may collect information about you and your device for security purposes. Information collected by Google reCAPTCHA is processed and retained in accordance with Google's Privacy Policy. https://policies.google.com/privacy?hl=en

4. Retention and Destruction of Personal Information

Unless a minimum retention period is required by applicable law or regulation, NVS Studio will retain personal information only for as long as necessary to fulfill the purposes for which it was collected.

Personal information used by NVS Studio to make a decision concerning an individual will be retained for a minimum of one year following that decision. Where the decision has tax implications for example, in the case of the termination of employment the information will be retained for seven years after the end of the fiscal year in which the decision was made.
At the end of the applicable retention period, or once the personal information is no longer required, NVS Studio will ensure that it is:

1. destroyed; or
2. anonymized (meaning they are irreversibly stripped of any identifiers so that the individual can no longer be identified and no link can be established between the individual and the personal information), where they are to be retained for serious and legitimate purposes.

NVS Studio will ensure that personal information is destroyed securely so as to protect its confidentiality throughout the destruction process.

This section may be supplemented by any policies or procedures adopted by NVS Studio regarding the retention and destruction of personal information, where applicable. For more information, please contact NVS Studio's Privacy Officer, whose contact information is provided in this Policy.

5. NVS Studio's Responsibilities

As a general rule, NVS Studio is responsible for protecting the personal information it holds.

NVS Studio's Privacy Officer is the Vice President of NVS Studio. The Privacy Officer is generally responsible for ensuring compliance with applicable personal information protection legislation. The Privacy Officer is also responsible for approving the policies and practices governing the management of personal information. More specifically, the Privacy Officer is responsible for implementing this Policy and ensuring that it is communicated, understood, and applied throughout the organization. In the event of the Privacy Officer's absence or inability to act, the President of NVS Studio will assume the responsibilities of the Privacy Officer.

Employees of NVS Studio who have access to personal information or are otherwise involved in its handling are responsible for protecting that information and complying with this Policy.

The roles and responsibilities of NVS Studio employees throughout the personal information lifecycle may be further defined in other NVS Studio policies, where applicable.

6. Data Security

NVS Studio is committed to implementing reasonable security measures to protect the personal information it manages. These security measures are designed having regard to, among other things, the purpose for which the information is collected, the amount of information involved, its distribution, the medium on which it is stored, and its level of sensitivity. Accordingly, personal information that may be considered sensitive (see the definition in Section 2) is subject to enhanced security measures and a higher level of protection. In particular, and consistent with the limited access principles described above, NVS Studio implements the necessary measures to restrict access rights within its information systems so that only employees who require access to personal information to perform their duties are authorized to access it.

7. Rights of Access, Correction, and Withdrawal of Consent

To exercise their rights of access, correction, or withdrawal of consent, the individual concerned must submit a written request to NVS Studio's Privacy Officer at the email address provided in the following section.

Subject to certain legal restrictions, individuals may request access to the personal information held about them by NVS Studio and request that it be corrected if it is inaccurate, incomplete, or ambiguous. They may also request that NVS Studio cease disseminating personal information concerning them or de-index any hyperlink associated with their name that provides access to such information through technological means where the dissemination of the information violates the law or a court order. They may also request that such a hyperlink be re-indexed where the conditions prescribed by applicable law are met.

NVS Studio's Privacy Officer must respond to such requests in writing within 30 days of receiving the request. Any refusal must be justified and include the legal provision on which the refusal is based. In such cases, the response must also inform the individual of the remedies available under applicable law and the time limits for exercising them. Where necessary, the Privacy Officer must assist the requester in understanding the reasons for the refusal.

Subject to applicable legal and contractual restrictions, individuals may withdraw their consent to the use or disclosure of their personal information.

Individuals may also request information from NVS Studio regarding the personal information collected about them, the categories of persons within NVS Studio who have access to it, and the applicable retention period.

8. Complaint Handling Process

Receipt of Complaints

Any individual who wishes to file a complaint regarding the application of this Policy or, more generally, the protection of their personal information by NVS Studio must do so in writing by contacting NVS Studio's Privacy Officer at the email address provided in the following section. The individual must provide their name, contact information (including a telephone number), and the subject matter and reasons for the complaint, together with sufficient detail to allow NVS Studio to assess it. If the complaint is not sufficiently detailed, the Privacy Officer may request any additional information deemed necessary to properly evaluate the complaint.

Processing of Complaints

NVS Studio is committed to handling all complaints in a confidential manner.

Within 30 days of receiving the complaint or, where applicable, within 30 days of receiving any additional information requested by NVS Studio's Privacy Officer to process it the Privacy Officer will assess the complaint and provide the complainant with a reasoned written response by email. This assessment will determine whether NVS Studio's handling of the personal information complies with this Policy, any other applicable internal policies and practices, and the relevant legislation and regulations.

If the complaint cannot be processed within this timeframe, the complainant will be informed of the reasons for the delay, the status of the complaint's review, and the reasonable additional time required to provide a final response.

NVS Studio will maintain a separate file for each complaint it receives. Each file will include the complaint, the assessment and supporting documentation used in its evaluation, and the response provided to the individual who submitted the complaint.

Individuals may also file a complaint with the Commission d'accès à l'information du Québec or with any other privacy oversight authority responsible for enforcing the legislation applicable to the subject matter of the complaint.

However, NVS Studio encourages any individual wishing to file a complaint to first contact its Privacy Officer and allow NVS Studio's complaint handling process to be completed before referring the matter to an external oversight authority.

9. Approval

This Policy has been approved by NVS Studio's Privacy Officer, whose business contact information is as follows:

Privacy Officer:

Emilie Duquette
5455 avenue de Gaspé, suite 710
Montréal, QC, H2T 3B3
vieprivee@nvsstudio.com

For any requests, questions, or comments regarding this Policy, please contact the person in charge by email.

10. Publication and Amendments

This Policy is published on NVS Studio's website with respect to the personal information collected through the website. If this Policy is amended, a revised version will be published on the website together with a record of the changes made from the previous version.

Appendix A

The following is a non-exhaustive list of the types of information that NVS Studio may collect, the purposes for which it is collected or used, and the methods by which it is collected. This list includes, but is not limited to, the following:

Please note that the majority of the personal information managed by NVS Studio relates to employees, job applicants, and consultants. For the other categories of individuals listed in the table below, the information collected is, in most cases, business or professional contact information (see Section 2 – Business Contact Information). In most cases, NVS Studio also collects the individual's job title or position, the name of the organization, and/or the organization's address (see Section 2 – Business Contact Information).