Privacy Policy

Policy objectives Carmichael Engineering Ltd. values the privacy of its employees, customers or any other collaborator and is committed to protecting the confidentiality of their personal information whether it is kept by the company or a third party. This document is intended to inform you of Carmichael Engineering Ltd.'s practices regarding personal information and to explain our policies and procedures on the collection, use and disclosure of personal information. The policy applies to all personal information collected by Carmichael Engineering Ltd. The collection, use, disclosure and retention of your personal information is subject to the Act respecting the protection of personal information in the private sector (RLRQ, c. P-39.1).

Definition: Personal information is any information that relates to an individual and that makes it possible to identify that person, whether directly or indirectly.

1. Responsibility:

Senior management’s support is critical to the success of the Privacy Program and to fostering a culture that values privacy. Carmichael Engineering Ltd.’s senior management promotes the privacy program and ensures that the company's operations comply with the outlined policies and procedures. At Carmichael Engineering Ltd., the Privacy Officer is officially in charge of managing the privacy program on a day-to-day basis. He or she is responsible for implementing Carmichael Engineering Ltd.'s commitment to maintaining customers and other stakeholders’ trust regarding its handling of personal information. The Privacy Officer must also structure, design and manage the program, including all procedures, training, monitoring/auditing, documentation, assessments and follow-ups. The Human Resources Manager is responsible for protecting personal information at Carmichael Engineering Ltd. and ensures compliance with applicable laws. You may contact him or her at: [email protected] 514-735-4361

2. Reasons for collecting personal information.

Carmichael Engineering Ltd. ensures it has a legitimate reason for collecting personal information in every situation.

We collect your personal information for the following reasons:

• Managing our employees’ jobs and salaries.
• Managing our employees’ benefits.
• Creating and maintaining a responsible commercial relationship with customers and providing continuous service. For example, managing and developing our business and our operations, including troubleshooting technical problems, improving serviceability and maintaining and improving the security of our customers’ data.
• Complying with laws, regulations and contractual provisions. Investigating and resolving customer and end-user incidents, complaints or disputes.
• Providing products and services on behalf of the customer (in accordance with contractual obligations), including for billing purposes. For these purposes, we may collect the following personal information: (when provided voluntarily) name, email address, gender, employer's telephone number and mailing address, employer's name, employee’s job title.
• Collecting the geolocation data of website users. Personal information may also be collected automatically when you access our website (IP address, device type, operating system, browsing behaviour, others to be determined).
• Policy regarding cookies, etc. (Google Analytics).

Please note that only the data required for the purposes set out in this privacy policy will be collected. We will not collect any other information without advising you first. Google Analytics is the service provider for cookies used on our website. You can find Google Analytics’ Privacy Policy at the following address: Privacy & Terms.

3. Consent:

Except where permitted or required by law, Carmichael Engineering Ltd. will only collect your personal information for the purposes for which we have first obtained your consent. Consent will be obtained prior to collecting personal information. Depending on the nature and sensitivity of the information collected and the purposes for which it will be used, your consent may be explicit or implied. Carmichael Engineering Ltd. will usually seek your explicit consent at the time of collection. Consent may be obtained verbally, electronically or in writing. In some cases, implied consent may be reasonably inferred from an individual's action or inaction, for example, by providing a name and address to receive a publication or a name and telephone number to obtain an answer to a question. If we want to use your personal information for a new purpose, we will explain the intended purpose to you and ask for your consent again. You may withdraw your consent to the collection, disclosure and retention of your personal information at any time. You may also request that your information be dereferenced. Carmichael Engineering Ltd. may then stop sharing your information or may dereference a hyperlink to your information. Please note that if you choose to withdraw your consent or have your information dereferenced, Carmichael Engineering Ltd. may not be able to provide you with certain products or services in the future. To withdraw consent or have your information dereferenced, a written request must be submitted to the Privacy Officer. Carmichael Engineering Ltd. will cease using your personal information within three business days.

4. Limited collection:

Personal information will only be collected to establish, manage and maintain our employment or business relationship with you and for the purposes outlined above. Carmichael Engineering Ltd. is not responsible for the safekeeping of personal information voluntarily provided when using our services, which may include (but not limited to): accessing our website or communicating with us by telephone or email.

5. Limited use, disclosure and retention:

Carmichael Engineering Ltd. is committed to using personal information strictly for the purposes for which it was collected. Unless otherwise permitted by law, Carmichael Engineering Ltd. will obtain your consent to use information for a purpose other than that for which the original consent was obtained. Carmichael Engineering Ltd. will not disclose personal information to third parties without the consent of the individuals to whom the information pertains, or if applicable laws provide that it may be disclosed without consent. The personal information we collect is generally used and kept in Quebec. However, some of our service providers (group insurance, software or other) may keep it outside the province for the purposes of the services they provide. Where applicable, Carmichael Engineering Ltd. will ensure, by way of a written agreement, that information is subject to controls that protect its confidentiality and that it is used and retained only for the purposes described in this policy. Carmichael Engineering Ltd. has a policy in place regarding the life cycle of personal information. In this regard, Carmichael Engineering Ltd. will retain your personal information for the amount of time necessary to fulfill the purposes for which it was collected, to comply with legal requirements and to protect our legitimate business interests. After this period, Carmichael Engineering Ltd. will ensure that your personal information is destroyed in order to maintain its confidentiality and to comply with its obligations under applicable laws.

6. Accuracy:

Carmichael Engineering Ltd. is committed to taking all reasonable measures to ensure the accuracy of the personal information retained by the company. If you notice any errors in your information or if you need to update it, please notify us by contacting the Privacy Officer. Carmichael Engineering will make the necessary changes within three business days.

7. Safety measures:

Carmichael Engineering Ltd. uses all reasonable safety measures to protect the personal information retained by the company. We are committed to implementing and periodically reviewing safeguards through appropriate technical, administrative and organizational means in order to protect against unauthorized access to personal information or its loss, theft, use, disclosure, alteration or destruction. The level of protection afforded depends on the following:

• The degree to which the personal information is of a sensitive nature.
• The quantity of information, its dissemination et format.
• The way the information is kept and its retention period.

Whenever possible, Carmichael Engineering Ltd. implements, maintains and monitors the following measures to better protect the integrity, availability and confidentiality of the personal information entrusted to us:

• Limiting access to personal information to only those employees who need the information to perform their duties, on a need-to-know basis and according to the principle of least privilege.
• Providing employee training on confidentiality and the protection of personal information.
• Providing privileged access to information only to those who need to know.
• Implementing technological security measures, such as password policies, multi-factor authentication, data encryption, firewalls, intrusion detection and prevention tools and malware protection tools.
• Implementing physical security measures, such as restricting access to our offices and data centres and locking filing cabinets.

Managing confidentiality incidents:

Carmichael Engineering Ltd. has a Personal Data Incident Preparedness and Response Manual, which is tested and reviewed an ongoing basis. This manual ensures that any incident that threatens privacy is detected quickly, then managed and resolved in a coordinated manner. The manual clearly sets out everyone's roles and responsibilities, as well as the criteria for reporting, escalation and decision-making. Incidents are recorded in a logbook for future reference.

8. Transparency:

Carmichael Engineering Ltd. is committed to making readily available specific information about our policies and practices relating to the management, collection, use and disclosure of your personal information. Any person affected by this policy may request a copy at any time from the person responsible for its application, i. e. the Human Resources Manager.

9. Access to personal information:

You may ask Carmichael Engineering Ltd.'s Privacy Officer to access your personal information at any time. To do so, please send a written request to the following address: 3822 Courtrai, Montreal, Qc, H3S 1C1 or by email to [email protected]. The requested information will be sent to you within 3 business days after receiving your request. In the event that we deny your request, we will inform you of the reasons for our refusal, subject to legal restrictions, and of the recourse available to you.

10. Filing a non-compliance complaint:

Questions or complaints regarding the way in which Carmichael Engineering Ltd.'s Privacy Officer handles personal information may be directed to the Vice-President of the company, Mr. Raymond Carmichael, at [email protected], who will investigate any complaint regarding compliance with this Privacy Policy.