Personal Information Governance Policy
Last updated: October 22, 2026
This policy describes how Sauvetage Assuré inc. governs the protection of personal information throughout its life cycle, from collection to destruction. It complements our Privacy Policy.
The French version of this policy is the official version. This English version is a translation.
1. Roles and responsibilities
- Sauvetage Assuré's management is responsible for the protection of the personal information the company holds and approves this policy.
- The person in charge of the protection of personal information, designated by written delegation from the President, ensures this policy is applied, handles requests and complaints, keeps the incident register, takes part in privacy impact assessments and trains staff. E-mail: admin@sauvetageassure.com.
- Administrators grant access on a need-to-know basis and remove it as soon as a person leaves their role.
- Every staff member is bound by a confidentiality commitment in their contract, uses information only for their work and reports any incident immediately.
- Our providers act under a written contract that sets out the protection measures, forbids any other use of the information and requires its destruction at the end of the contract.
2. Information life cycle
- Collection: only the information needed, with clear information at the time of collection; information about a child under 14 is obtained from the parent or guardian.
- Use: only for the stated purposes, unless consent is given or the law provides an exception.
- Communication: only to authorized people and to providers bound by contract; a privacy impact assessment precedes any communication outside Québec.
- Retention: according to the schedule below, in protected systems.
- Destruction: secure erasure of computer data and shredding of paper documents, or anonymization under the rules set by law.
3. Retention schedule
| Information | Retention period |
|---|---|
| Family account and participants | As long as the account is used. An account with no login for 3 years, and no registration or payment that must be kept, is deleted. |
| Registrations and attendance | 3 years after the end of the session. |
| Payments, refunds and cancellations | 6 years after the end of the year concerned. |
| Incident reports and people involved | 7 years after the incident or, if a minor is involved, until they turn 21 if that is later. |
| Employment file (certifications, rates, warnings, employment details) | End of employment, then 3 years. |
| Staff medical conditions, allergies and emergency contacts | Until employment ends. |
| Schedules, time clock and shift history | 6 years after the end of the year concerned. |
| Staff chat (including hidden messages) | 2 years. |
| Portal messages (notices) | 2 years. |
| Company client requests and access requests | 3 years. |
| Change log | 3 years. |
| Website inquiries | 2 years after the last exchange. |
| Unsuccessful job applications | 12 months. |
| Confidentiality incident register | At least 5 years after the date the company became aware of the incident. |
In the portal, these deletions happen automatically every day and are recorded. A longer period may apply where a law requires it or where the information is needed for an ongoing claim, investigation or dispute.
4. Privacy impact assessments
We carry out a privacy impact assessment before any information system or electronic service delivery project involving personal information, and before communicating information outside Québec. The assessment considers the sensitivity of the information, the purpose, the protection measures and, outside Québec, the applicable legal framework. It is proportionate to the size of the project.
5. Confidentiality incidents
- Anyone who suspects unauthorized access, use, communication or loss reports it immediately to the person in charge.
- We promptly take reasonable measures to reduce the risk of injury and prevent a similar incident.
- If the incident presents a risk of serious injury, we promptly notify the Commission d'accès à l'information and the people concerned.
- Every incident, even without a serious risk, is entered in the incident register.
6. Requests and complaints
- A request for access, correction, portability or withdrawal of consent, or a complaint, is sent in writing to the person in charge: admin@sauvetageassure.com.
- We acknowledge receipt, verify the person's identity and answer within 30 days. A refusal gives reasons and states the available recourse.
- A complaint is reviewed by the person in charge, who answers in writing with the measures taken.
- A person who is not satisfied may contact the Commission d'accès à l'information du Québec (https://www.cai.gouv.qc.ca).
7. Training and review
Staff with access to personal information are trained when hired and reminded every year. This policy is reviewed at least once a year and whenever an important change affects our systems or providers.