Privacy Policy

This policy applies to the website: https://produitsboreal.com/

Last update date: March 14, 2024

At Produit Boréal, we cherish the trust you place in us and are firmly committed to preserving the confidentiality of your personal information. The purpose of this policy is to clarify how we handle the data you entrust to us. By interacting with our services, you signify your agreement to this privacy policy.

How your personal information is collected and processed. Personal information refers to any information that can identify you. This includes your first and last name, your age, your mailing address, your email address, your location, or even your IP address.
What your rights are regarding this information.
Who is responsible for the processing of personal information collected and processed.
To whom this information is transmitted.
Possibly, the site’s policy on cookies.

Information Collection

1.1. Personal Information Collected

When you request our services or purchase one of our products, we may collect data such as:

Your identity (first name, last name).
Contact means (email, telephone number).
Transactional information, including payment details.
Information related to your construction project, such as dimensions, material preferences, and specific requests.
Feedback and interactions related to our services.

1.2. Automatically Collected Information

Each time you browse our website, certain information is automatically collected:

IP address.
Internet browser used.
Operating system.
Navigation history (pages viewed, duration of visit).
Information on the device and software used.

2. Forms and Collection Methods

Your personal information is collected through the following methods:

Website registration form
Order form
Opinion survey
Contest

We use the collected information for the following purposes:

Order tracking
Information/Promotional offers
Statistics
Contact
Website management

3. Interactivity

Your personal information is also collected through the interactivity that can be established between you and our website. This information is collected by the following means:

Discussion form
Comments
Correspondence
Information for promotional offers

We use the collected information for the following purposes:

Statistics
Contact
Website management

4. Log Files and Cookies

We collect certain information through log files (“log files”) and cookies (“cookies”). These files allow us to process statistics and traffic information, facilitate navigation, and improve the service for your comfort.

a) Description of cookies used by the site

This mainly involves the following information:

IP address
Operating system
Visited pages and requests
Time and day of connection

Using such files allows us to achieve the following objectives:

Improvement of the service and personalized welcome
Creation of personalized consumption profiles
Order tracking
Statistical studies

When browsing the site, third-party cookies may be recorded. These particularly include the following third parties:

Moreover, the site integrates social network buttons allowing you to share your activity on the site. Consequently, cookies from these social networks may therefore be stored on your computer when you use these features. These sites have their own privacy policies and general terms of use possibly different from our site. We invite you to consult the privacy policies and the general terms of use of these sites.

b) Opposition to the use of cookies by the site

You can oppose the recording of these cookies by configuring your browser software. In case you decide to disable cookies, you can then continue your navigation on the site. However, any dysfunction of the site caused by this manipulation cannot be considered as being our fault.

5. Use of Information

We use your data for:

Processing your orders and responding to your requests.
Offering a personalized experience and tailored to your needs.
Informing you about new products, promotions, and special offers.
Continuously improving our products and services.
Providing quality customer support.
Complying with our legal obligations.

6. Disclosure of Information

Unlike many, at Produit Boréal, we do not exploit your data for commercial purposes. However, exceptions exist:

Third-party providers: Your data may be shared with external collaborators (for example, companies managing financial transactions) for the finalization of your purchases.
Judicial authorities: Your information could be disclosed if the law requires us or if we deem it imperative to defend our rights or those of other people.
Affiliated entities: As part of our provision, certain information can be exchanged with our strategic partners.

7. Information Protection

We employ a range of measures to guarantee the security of your information, preventing any undesired access, disclosure, or unauthorized modification.

7.1 Conservation of Personal Information

Responsible management of the information you entrust to us is paramount. This includes the collection, use, retention, and secure destruction of data, according to the highest industry standards.

The personal information processing manager will keep in the site’s computer systems and under reasonable security conditions all the personal information collected for a duration of: 1 year.

8. Right to Use Photos

When you share photos with us, whether directly, through social networks, through our representatives, or during contests, you grant us the right to use these photos. These images may be displayed on our website in the “Achievements” section, used in our promotional campaigns, or for any other digital use.

9. Right to Oppose and Withdraw

You have the right to oppose the processing of your personal information by the site (“right to oppose”). You also have the right to request that your personal information no longer appear, for example, in a mailing list (“right to withdraw”). To formulate an opposition to the processing of your personal information or request the withdrawal of your personal information, you must follow the following procedure: The user must make a request to limit the processing of their personal information to the processing manager, by sending an email to the address provided above.

10. Right of Access, Rectification, and Deletion

You can be acquainted, update, modify, or request the deletion of information about you, by respecting the procedure set forth below: The user must send an email to the personal information processing manager, specifying the subject of their request and using the contact email address of the personal information manager provided on this page. If you own one, you have the right to request the deletion of your personal space by following the following procedure: The user must send an email to the data processing manager, specifying their personal space number. The request for data deletion will be processed within a 10 working days delay.

11. Security

The personal information we collect is kept in a secure environment. People working for us are required to respect the confidentiality of your information. To ensure the security of your personal information, we use the following measures:

SSL Protocol (Secure Sockets Layer)
SET Protocol (Secure Electronic Transaction)
Access Management – authorized person
Access Management – concerned person
Network monitoring software
Automatic backup
Development of a digital certificate
ID/password
Firewalls

We are committed to maintaining a high degree of confidentiality by integrating the latest technological innovations to ensure the confidentiality of your transactions. However, since no mechanism offers maximum security, a part of the risk is always present when the Internet is used to transmit personal information.

13. Label

Our commitments in terms of protection of personal information meet the requirements of the following program(s):

TRUSTe: http://truste.org
VeriSign: http://www.verisign.com

14. Conditions for Modifying the Privacy Policy

This privacy policy can be viewed at any time at the address indicated below: cyberquebec.org/confidentiality We reserve the right to modify it to ensure compliance with the prevailing law.

15. Responsibilities of the Personal Information Processing Manager

For any questions or concerns regarding this policy, please do not hesitate to contact our data protection officer, Mario Lapointe, who is the IT Director. He can be reached by email at [email protected] or by phone at 418-669-2020, extension 1205.

The personal information processing manager commits to protecting the collected personal information, not to transmit it to third parties without having informed you, and to respect the purposes for which this information was collected. Moreover, the personal information processing manager commits to notify you in case of rectification or deletion of personal information, unless this entails disproportionate formalities, costs, or steps for him. In case the integrity, confidentiality, or security of your personal information is compromised, the processing manager commits to inform you by any means.

15. Acceptance of the Privacy Policy

By browsing the site, you attest to having read and understood this privacy policy and accept its conditions, particularly concerning the collection and processing of your personal information, as well as the use of cookies.

16. Legislation

We commit to respect the legislative provisions set out in:

Act respecting the protection of personal information in the private sector, RLRQ c P-39.1; and/or
Personal Information Protection and Electronic Documents Act, SC 2000, c 5.

Produit Boréal values the trust you place in us and commits to guaranteeing the confidentiality of your information. We are honored to contribute to your construction projects.

For ease of reading, in this document “Groupe Boréal” refers to each of the following companies of the Boréal group:

Produits Boréal Inc
Construction et Développement Boréal Inc.
Fenêtres AGM Inc.
Boréal Rive Nord Inc
Ontario Boreal Product Distributor Inc
Inspection Mectal Inc
9261-5251 QC INC
9432-0611 QC INC
9432-0587 QC INC
9470-0242 QC INC

1.1 Context

This policy aims to ensure the protection of personal information and to frame the way in which Groupe Boréal collects, uses, discloses, retains, and destroys or otherwise manages it. Moreover, it aims to inform all interested parties about how Groupe Boréal processes their personal information.

1.2 Application and Definitions

This policy applies to Groupe Boréal, which includes its directors, employees, consultants, volunteers, as well as any other person who, otherwise, provides services on behalf of Groupe Boréal. It also applies to all Groupe Boréal’s websites.

It covers all types of personal information managed by Groupe Boréal, whether it be information about its clients, potential or current, its consultants, employees, members, or any other individuals (such as visitors to its websites or others).

For the purposes of this policy, personal information is information about an individual that allows them to be identified, directly or indirectly. For example, this could be a person’s name, address, email address, telephone number, gender, or banking information, information about their health, ethnic origin, language, etc.

Sensitive personal information is information towards which there is a high reasonable expectation of privacy, e.g., health information, banking information, biometric information, sexual orientation, ethnic origin, political opinions, religious or philosophical beliefs, etc.

Generally, an individual’s professional or business contact information does not constitute personal information, for example, a person’s name, title, address, email address, or phone number at work. More specifically, for the sake of precision, in the sense of the Quebec Private Sector Privacy Act, as of September 22, 2023, sections 3 (collection, use, disclosure), 4 (retention and destruction), and 6 (data security) do not apply to information about a person related to the exercise of a function within a company, such as their name, title, function, as well as the address, email address, and telephone number of their workplace.

1.3 Collection, Use, and Disclosure

In the course of its activities, Groupe Boréal may collect various types of information for different purposes. The types of information that Groupe Boréal might collect, their use (or the intended purpose), and the means by which the information is collected are indicated in Appendix A of this policy.

Groupe Boréal will also inform individuals, at the time of collecting personal information, of any other information collected, the purposes for which they are collected, and the means of collection, in addition to other information to be provided as required by law.

Groupe Boréal applies the following general principles with respect to the collection, use, and disclosure of personal information:

1.3.1 Consent:

Generally, Groupe Boréal collects personal information directly from the concerned individual and with their consent, unless an exception is provided by law. Consent can be obtained implicitly in certain situations, for example, when a person decides to provide their personal information after being informed by this policy about the use and disclosure for the purposes indicated herein (see Appendix A for more details). Thus, this policy and the information it contains will be available for the concerned individual at the time of the collection of personal information.
Normally, Groupe Boréal must also obtain the consent of the concerned individual before collecting their personal information from third parties, before disclosing it to third parties, or for any secondary use of it. However, Groupe Boréal can act without consent in certain cases provided by law and under the conditions provided by it. The main situations where Groupe Boréal can act without consent are indicated in the relevant sections of this policy.

1.3.2 Collection:

In all cases, Groupe Boréal only collects information if it has a valid reason to do so. Moreover, the collection will be limited only to the information necessary to fulfill the intended purpose.
Please note that the services and programs of Groupe Boréal are not intended for minors, and more generally, Groupe Boréal does not intentionally obtain personal information about minors (in these cases, the information cannot be collected from them without the consent of a parent or guardian).

Collection from third parties. Groupe Boréal may collect personal information from third parties. Unless an exception is provided by law, Groupe Boréal will ask for the consent of the concerned individual before collecting personal information about them from a third party. In cases where such information is not collected directly from the individual but from another organization, the concerned individual may ask Groupe Boréal for the source of the collected information.

In certain situations, Groupe Boréal may also collect personal information from third parties, without the consent of the concerned individual, if it has a serious and legitimate interest in doing so and a) if the collection is in the interest of the individual and it is not possible to do so from them in a timely manner, or b) if this collection is necessary to ensure the accuracy of the information.

This collection through third parties may be necessary to access certain services or programs, or to otherwise do business with Groupe Boréal. When required, Groupe Boréal will collect the consent of the individual at the appropriate time.

1.3.3 Retention and Use:

Groupe Boréal ensures that the information it holds is up to date and accurate at the time of its use to make a decision about the concerned individual.

Groupe Boréal can only use an individual’s personal information for the reasons indicated herein or for any other reasons provided at the time of collection. As soon as Groupe Boréal wants to use this information for another reason or purpose, new consent must be obtained from the concerned individual, which must be obtained explicitly if it is sensitive personal information. However, in certain cases provided by law, Groupe Boréal can use the information for secondary purposes without the consent of the individual, for example:

when this use is clearly for the benefit of this individual;
when it is necessary to prevent or detect fraud;
when it is necessary to evaluate or improve protection and security measures.

Limited access. Groupe Boréal must implement measures to limit access to personal information only to employees and people within its organization who have the quality to be aware of it and for whom this information is necessary in the performance of their duties. Groupe Boréal will ask for the consent of the individual before granting access to any other person.

1.3.4 Disclosure:

Generally, and unless an exception indicated in this policy or otherwise provided by law, Groupe Boréal will obtain the consent of the concerned individual before disclosing their personal information to a third party. Moreover, when consent is necessary and when it involves sensitive personal information, Groupe Boréal must obtain explicit consent from the individual before disclosing the information.

However, the disclosure of personal information to third parties is sometimes necessary. Thus, personal information can be disclosed to third parties without the consent of the concerned individual in certain cases, including, but not limited to, the following:

Groupe Boréal may disclose personal information, without the consent of the concerned individual, to a public body (such as the government) which, through one of its representatives, collects it in the exercise of its functions or the implementation of a program it manages.
Personal information may be transmitted to its service providers to whom it is necessary to communicate the information, and this, without the consent of the individual. For example, these service providers can be event organizers, subcontractors of Groupe Boréal designated for the execution of mandates in the programs administered by Groupe Boréal, and cloud service providers. In these cases, Groupe Boréal must have written contracts with these providers that indicate the measures they must take to ensure the confidentiality of the disclosed personal information, that the use of this information is only made within the framework of the execution of the contract, and that they cannot retain this information after its expiration. Moreover, these contracts must provide that the providers must notify the personal information protection officer of Groupe Boréal (indicated in this policy) of any breach or attempt to breach the confidentiality obligations regarding the disclosed personal information and must allow this officer to carry out any verification related to this confidentiality.
If necessary for the conclusion of a commercial transaction, Groupe Boréal could also disclose personal information, without the consent of the concerned individual, to the other party of the transaction and subject to the conditions provided by law.

Communication outside Quebec: It is possible that the personal information held by Groupe Boréal is disclosed outside Quebec, for example, when Groupe Boréal uses cloud service providers whose servers are located outside Quebec or when Groupe Boréal does business with subcontractors located outside the province.

1.3.5 Additional Information on Used Technologies:

Use of cookies

Login cookies are data files transmitted to a website visitor’s computer by their web browser when visiting the site and can have several purposes.

Websites controlled by Groupe Boréal use cookies notably:

To remember visitors’ settings and preferences, for example, for language choice and to allow the tracking of the current session.
For statistical purposes to know the behavior of visitors, the content viewed, and to allow the improvement of the website.

Websites controlled by Groupe Boréal use the following types of cookies:

Session cookies: These are temporary cookies that are kept in memory for the duration of the website visit only.
Persistent cookies: They are kept on the computer until they expire and will be retrieved on the next visit to the site.

Some login cookies may be disabled by default, and visitors can choose to activate these features or not, when consulting the websites of Groupe Boréal.

It is also possible to activate and deactivate the use of cookies by changing the preferences in the settings of the browser used.

Use of Google Analytics

Certain sites of Groupe Boréal use Google Analytics to allow its continuous improvement. Google Analytics allows in particular to analyze how a visitor interacts with a Groupe Boréal website. Google Analytics uses cookies to generate statistical reports on the behavior of visitors to these websites and the content viewed.

The information from Google Analytics will never be shared by Groupe Boréal with third parties.

It is possible to install a browser add-on to disable Google Analytics.

Other technological means used

Groupe Boréal also collects personal information through technological means like web forms integrated into a website controlled by Groupe Boréal (for example, its contact form and its form to subscribe to the newsletter), online questionnaires accessible on its platforms and applications, as well as other platforms or form tools.

If Groupe Boréal collects personal information by offering a technological product or service that has privacy settings, Groupe Boréal must ensure that these settings offer the highest level of privacy by default (cookies are not covered).

1.4 Retention and Destruction of Personal Information

Unless a minimum retention period is required by applicable law or regulation, Groupe Boréal will only retain personal information for the duration necessary for the realization of the purposes for which they were collected.

Personal information used by Groupe Boréal to make a decision about an individual must be kept for a period of at least one year following the decision in question or even seven years after the end of the fiscal year in which the decision was made if it has tax implications, for example, the circumstances of an employment termination.

At the end of the retention period or when the personal information is no longer necessary, Groupe Boréal will ensure:

to destroy them; or
to anonymize them (i.e., they no longer allow, irreversibly, to identify the person, and it is no longer possible to establish a link between the person and the personal information) for use for serious and legitimate purposes.

The destruction of information by Groupe Boréal must be done securely, to ensure the protection of this information.

This section may be supplemented by any policy or procedure adopted by Groupe Boréal concerning the retention and destruction of personal information, as applicable. Please contact the personal information protection officer of Groupe Boréal (indicated in this policy) for more information.

1.5 Responsibilities of Groupe Boréal

Generally, Groupe Boréal is responsible for the protection of the personal information it holds.

The personal information protection officer of Groupe Boréal must, in general, ensure compliance with applicable legislation regarding the protection of personal information. The officer must approve the policies and practices governing the governance of personal information. More specifically, this person is responsible for implementing this policy and ensuring it is known, understood, and applied. In the absence or inability to act of this officer, the general manager of Groupe Boréal will assume the functions of the personal information protection officer.

Groupe Boréal staff members who have access to personal information or are otherwise involved in the management of it must ensure their protection and comply with this policy.

The roles and responsibilities of Groupe Boréal employees throughout the lifecycle of personal information can be specified by any other Groupe Boréal policy in this regard, as applicable.

1.6 Data Security

Groupe Boréal commits to implementing reasonable security measures to ensure the protection of the personal information it manages. The security measures in place correspond, among others, to the purpose, quantity, distribution, support, and sensitivity of the information. Thus, this means that information that can be qualified as sensitive (see the definition provided in section 2) will be subject to more important security measures and will be better protected. Notably, and in accordance with what was previously mentioned concerning limited access to personal information, Groupe Boréal must implement the necessary measures to impose constraints on the rights of use of its information systems so that only employees who must have access are authorized to do so.

1.7 Rights of Access, Rectification, and Withdrawal of Consent

To exercise their rights of access, rectification, or withdrawal of consent, the concerned individual must submit a written request to this effect to the personal information protection officer of Groupe Boréal, at the email address indicated in the following section.

Subject to certain legal restrictions, concerned individuals can request access to their personal information held by Groupe Boréal and request its correction if it is inaccurate, incomplete, or equivocal. They can also require the cessation of the dissemination of personal information about them or that any hyperlink attached to their name allowing access to this information through a technological means be de-indexed, when the dissemination of this information contravenes the law or a judicial order. They can do the same, or also require that the hyperlink allowing access to this information be re-indexed, when certain conditions provided by law are met.

The personal information protection officer of Groupe Boréal must respond in writing to these requests within 30 days from the date of receipt of the request. Any refusal must be justified and accompanied by the legal provision justifying the refusal. In these cases, the response must indicate the remedies under the law and the deadline to exercise them. The officer must assist the requester in understanding the refusal if needed.

Subject to applicable legal and contractual restrictions, concerned individuals can withdraw their consent to the communication or use of the collected information.

They can also ask Groupe Boréal what personal information is collected from them, the categories of people within Groupe Boréal who have access to it, and their duration of retention.

1.8 Complaint Processing Procedure

Reception

Any person wishing to file a complaint regarding the application of this policy or, more generally, the protection of their personal information by Groupe Boréal, must do so in writing by addressing the personal information protection officer of Groupe Boréal, at the email address indicated in the following section.

The complainant must indicate their name, contact details to reach them, including a telephone number, as well as the object and reasons for their complaint, providing enough details so that it can be evaluated by Groupe Boréal. If the formulated complaint is not sufficiently precise, the personal information protection officer may require any additional information deemed necessary to evaluate the complaint.

Processing

Groupe Boréal commits to treating any received complaint confidentially.

Within 30 days following the receipt of the complaint or following the receipt of all additional information deemed necessary and required by the personal information protection officer of Groupe Boréal to process it, the officer must evaluate it and formulate a motivated written response by email, to the complainant. This evaluation will aim to determine if the processing of personal information by Groupe Boréal complies with this policy, any other policy and practice in place within the organization, and applicable legislation or regulation.

If the complaint cannot be processed within this timeframe, the complainant must be informed of the reasons justifying the extension of the timeframe, the progress of the processing of their complaint, and the reasonable timeframe necessary to provide a definitive response.

Groupe Boréal must create a separate file for each of the complaints addressed to it. Each file contains the complaint, the analysis and the supporting documentation of its evaluation, as well as the response sent to the person originating the complaint.

It is also possible to file a complaint with the Commission d’accès à l’information du Québec or any other supervisory body for the protection of personal information responsible for the application of the law concerned by the object of the complaint.

However, Groupe Boréal invites all interested individuals to first address its personal information protection officer and to wait for the end of the processing by Groupe Boréal.

1.9 Approval

The personal information processing officer commits to protecting the collected personal information, not to transmit it to third parties without having informed you, and to respect the purposes for which this information was collected. Moreover, the personal information processing officer commits to notify you in case of rectification or deletion of personal information, unless this entails disproportionate formalities, costs, or steps for him. In case the integrity, confidentiality, or security of your personal information is compromised, the processing officer commits to inform you by any means.

1.10 Publication and Modifications

This policy is published on Groupe Boréal’s websites, as well as on all websites controlled and maintained by Groupe Boréal, to which this policy applies, regarding the personal information collected therein. This policy is also disseminated by any means proper to reach the concerned individuals.

Groupe Boréal must also do the same for any modifications to this policy, which must also be the subject of a notice to inform the concerned individuals.

*Notes: Please note that the use of the masculine gender is intended to lighten this policy and facilitate its reading.

Appendix A

Here is a non-exhaustive list of the types of information Groupe Boréal might collect, their use, or intended purpose, as well as the means by which the information is collected. Thus, this includes, without limitation, the following elements.

Category of Individual	Types of Personal Information	Purpose of Collection / Use	Method of Collection
Employees	Payroll Data	7 years	Payroll System
Clients	Name and email	1 year	Websites
Suppliers	None