Privacy and Personal Data Protection Policy

1. Person in Charge of the Protection of Personal Information

In accordance with Law 25, the responsibility for the protection of personal information lies with the person holding the highest authority within the organization.

2. Collection of Personal Information and Purposes

We only collect personal information that is strictly necessary for the management and publication of the Directory. The information collected and its purposes are as follows:

Additional Data Sources: During the process of identifying and registering businesses, we may have obtained publicly available information (trade name, address, phone, contact email) from public websites, social media, or public business registries. This information is used solely for directory publication purposes, in accordance with the public nature of business contact information.

Means of Collection: Information is collected directly through the registration form on our website, by email, or by phone, with the explicit consent of the business representative, or through the public sources mentioned above.

3. Consent

Registering a business in the directory constitutes the express, free, and informed consent of the business representative for the collection, use, and communication of their personal information according to this Policy.

• Withdrawal of Consent: The representative has the right to withdraw their consent at any time by sending a written request to the Person in Charge. Withdrawing consent will result in the deletion of the business information from our directory.

4. Use, Communication (Disclosure), and Retention of Data

• Use: Personal information will be used only for the purposes for which it was collected.
• Disclosure to Third Parties: The Directory does not sell, rent, or exchange the personal information of business representatives. Business data (public contacts) is disclosed on the website with explicit consent given at the time of registration.
• Data Retention: Personal information is kept for the time necessary to provide the directory service and for an additional period of one (1) year after deactivation to comply with legal obligations. Thereafter, the data will be completely deleted from the database.
• Legal Exceptions: Personal information may only be communicated to third parties without consent in cases strictly provided for by Law 25 (e.g., compliance with a court order).

5. Exclusion of Critical and Financial Data Collection

Latinos Québec is not designed to collect, process, or store critical or sensitive personal information from our users.

Specifically, Latinos Québec does not request or store any of the following categories of information:

• Financial Information: We do not store credit or debit card numbers, bank account information, or any type of financial security data. (All payment transactions are processed through certified and secure third-party platforms).
• Critical or Sensitive Data: We do not require or collect Social Insurance Numbers (SIN), personal identification numbers (ID), health information, ethnic origin, or biometric data.
• External Account Passwords: User account passwords are stored in encrypted form (hash); we do not have access to the original password.

6. Rights of the Business Representative

You may exercise the following rights with the Person in Charge of Data Protection, in writing:

• Right of Access: To know if the Directory holds your personal information and to consult it.
• Right of Rectification: To request the correction of incomplete or inaccurate data.
• Right to Withdraw Consent: To withdraw your consent (see Section 3).
• Right to Portability: To obtain your data in a structured and commonly used format.

7. Confidentiality Incidents

In the event of a confidentiality incident (e.g., unauthorized access or loss of data), the following protocol will be applied:

• Notification: If the incident presents a risk of serious injury (according to Law 25), we will promptly notify the Commission d’accès à l’information (CAI) of Quebec and the affected individuals.
• Record-keeping: We will maintain a register of all confidentiality incidents.