Personal information governance

Roles and responsibilities

Caravita is a one-person business. I am the person in charge of the protection of personal information, and the only person with access to it. I review this policy at least once a year.

Collection and use

I collect only what is needed for the purposes described in the privacy policy, and I do not use it for anything else without your consent.

New projects and providers

Before adding a service that handles personal information, or sending any outside Quebec, I carry out a privacy impact assessment and make sure I have a written agreement with the provider.

Retention and destruction

Retention periods are published in the privacy policy. At the end of them, I securely delete the information or make it anonymous.

Confidentiality incidents

I keep an incident register, retained for 5 years. If an incident presents a risk of serious injury, I promptly notify the Commission d’accès à l’information and the people affected, and I take steps to limit the consequences.

How complaints are handled

• Write to me at caravita@elysegiroux.com and describe the problem. No form is needed.
• I confirm I have received your complaint.
• I look into it and answer in writing within 30 days, with the reasons for my decision.
• If you are not satisfied, you can contact the Commission d’accès à l’information: cai.gouv.qc.ca.