Privacy Incident Management

Trésor’s Commitment

Agence de placement Trésor inc., Emploi Trésor International Inc. and their affiliated entities are committed to protecting personal information entrusted by workers, candidates, clients, partners and users.

In accordance with Quebec Law 25, Trésor has implemented procedures to prevent, detect, assess and manage any confidentiality incident that may compromise the security or confidentiality of personal information.

What Is a Confidentiality Incident?

A confidentiality incident may include:

• Unauthorized access to personal information
• Unauthorized use of personal information
• Unauthorized disclosure of personal information
• Loss of personal information
• Theft of documents or data
• Consultation of information by an unauthorized person
• Any other breach of personal information protection

Types of Information Concerned

Trésor may process identification information, professional information, immigration-related information, administrative and financial information and sensitive information where required in certain files.

Examples of Information Concerned

• Name, address, phone number, email and date of birth
• Resume, employment history, references, qualifications and certifications
• Passports, work permits, study permits and immigration documents
• Payroll data, contractual information, billing data and tax information
• Medical information, CNESST files, health-related information and information protected by specific legal obligations when required

Incident Detection

Any person who observes or suspects a confidentiality incident must report it immediately to the person responsible for protecting personal information.

Each report is assessed to determine the nature of the incident, the information involved, affected persons, level of risk and corrective measures to implement.

Risk Assessment

When an incident is detected, Trésor analyzes the sensitivity of the information involved, the likelihood of malicious use, the potential consequences for affected persons and financial, professional or reputational risks.

Corrective Measures

Depending on the situation, Trésor may restrict access to the data concerned, suspend user access, correct security weaknesses, recover disclosed information where possible, strengthen security measures or update internal procedures.

Notice to Affected Persons

When required by law or when the risk of injury is considered serious, Trésor will inform affected persons as soon as possible. The notice may include the nature of the incident, the information affected, measures taken, recommendations to limit risks and contact information for the person responsible for the file.

Notice to the Commission d’accès à l’information

When required by Law 25, Trésor will submit the necessary declarations to the Commission d’accès à l’information du Québec (CAI).

Incident Register

In accordance with Law 25, Trésor maintains a register of confidentiality incidents. This register may include the date of the incident, description of facts, information involved, measures taken, notices sent and corrective actions completed.

Prevention

To reduce incident risks, Trésor implements security measures such as access controls, password management, access limitation according to job functions, staff training, secure backups, system monitoring and internal compliance procedures.

Responsibility

Responsibility for protecting personal information is assumed in accordance with Law 25 by the person designated by Trésor. Questions about this policy or a confidentiality incident may be directed to:

• Privacy Officer
• Agence de placement Trésor inc.
• 134, boul. des Laurentides, Laval (Québec) H7G 2T3
• 450-933-7090
• confidentialite@emploitresor.com

Policy Review

This policy may be modified at any time to reflect changes in laws, technologies, security practices or Trésor’s activities. The most recent version is the version published on the company’s official website.