Privacy Policy
Community Development and Integration Center (CDIC)
Brossard, Quebec, Canada
1. Privacy Policy and Protection of Personal Information
1.1 Purpose
The Community Development and Integration Center (“CDIC,” “we,” “us,” or “our”) recognizes the importance of protecting personal information entrusted to it.
CDIC is committed to collecting, using, communicating, retaining, protecting, and disposing of personal information responsibly, transparently, and confidentially, in accordance with applicable privacy legislation, including, where applicable, Quebec’s Act respecting the protection of personal information in the private sector and other applicable laws and regulations.
This Privacy Policy describes CDIC’s general practices concerning personal information collected or otherwise handled in connection with its website, electronic communications, programs, services, activities, registration processes, volunteer activities, employment-related activities, and other organizational activities.
This Policy is intended to be read together with CDIC’s internal privacy and information-security procedures.
1.2 Person Responsible for the Protection of Personal Information
CDIC has designated a person responsible for the protection of personal information in accordance with applicable law.
The title and contact information of the person responsible are made available through CDIC’s website or other appropriate means, as required by law.
For privacy-related questions, requests for access or rectification, privacy complaints, or other matters concerning personal information, individuals may contact:
Email: [email protected]
For security and confidentiality reasons, CDIC does not publish personal residential addresses, private telephone numbers, or other private contact information of directors, employees, volunteers, or representatives unless disclosure is required or authorized by law.
1.3 Personal Information Collected
CDIC collects only personal information that is necessary for identified and legitimate purposes, subject to applicable legal requirements.
Depending on the nature of an individual’s relationship or interaction with CDIC, information collected may include:
name and contact information;
email address and telephone number;
information provided through registration, intake, application, or participation forms;
program and service participation information;
volunteer information;
employment-related information;
communications and correspondence with CDIC;
information reasonably required to provide or administer services;
information required for funding, reporting, accountability, contractual, or legal purposes;
accessibility or accommodation information where reasonably necessary to provide or administer services;
photographs, video, audio recordings, or other media where collection and use are authorized or otherwise permitted by law; and
other information voluntarily provided by an individual.
CDIC does not intentionally collect personal information that is unnecessary for the purpose for which it is collected.
Where CDIC collects personal information directly from an individual, CDIC will provide the information required by applicable law concerning the purposes of collection, the means of collection, and other applicable rights and notices.
1.4 Purposes for Collection and Use
CDIC may collect and use personal information for purposes such as:
providing community development, integration, settlement, support, or other services;
administering programs, projects, activities, and events;
registering and communicating with participants;
responding to inquiries, requests, applications, and complaints;
managing volunteers and organizational activities;
managing employment and human-resources matters;
meeting applicable legal, regulatory, contractual, funding, reporting, and accountability requirements;
protecting the safety and security of participants, staff, volunteers, and other persons;
evaluating, administering, and improving programs and services;
preventing misuse, fraud, unauthorized activity, or other unlawful conduct; and
other purposes identified to the individual at or before collection, or otherwise permitted or required by applicable law.
CDIC will not use personal information for a new purpose unless permitted or required by law or, where required, with the individual’s consent.
1.5 Collection Methods
CDIC may collect personal information directly from individuals through:
email;
website forms;
registration and intake forms;
applications;
telephone or other communications;
in-person interactions;
program, service, or event participation;
volunteer or employment processes; and
other lawful means appropriate to CDIC’s activities.
Except where otherwise permitted by law, CDIC generally collects personal information directly from the individual concerned.
Where applicable law requires information to be provided at the time of collection, CDIC will provide the required notice in clear and simple language.
1.6 Consent
Where consent is required by law, CDIC will obtain consent in a manner that satisfies applicable legal requirements.
Where required, consent will be meaningful, specific to the relevant purpose or purposes, informed, and expressed in clear and simple language.
Where applicable law requires express consent for sensitive personal information, CDIC will obtain express consent.
An individual may withdraw consent where withdrawal is permitted by law. Withdrawal of consent does not affect the lawfulness of any collection, use, or communication that occurred before the withdrawal.
Withdrawal of consent may affect CDIC’s ability to provide a service or continue an activity where the information is necessary for that purpose or where another lawful basis for handling the information does not apply.
1.7 Use and Communication of Personal Information
CDIC uses personal information only for identified and legitimate purposes and only to the extent permitted and reasonably necessary for those purposes.
Access to personal information within CDIC is limited to persons who require the information to perform authorized responsibilities.
CDIC may communicate personal information to third parties where authorized or required by law, or where otherwise permitted under applicable privacy legislation. Depending on the circumstances, recipients may include:
service providers acting on behalf of CDIC;
professional advisers;
government authorities;
funding organizations;
partner organizations involved in delivering or administering services;
persons or organizations where disclosure is required or authorized by law; and
other recipients where the individual has provided the consent required by law.
Where CDIC engages a service provider to handle personal information on its behalf, CDIC will take reasonable measures to ensure that the information is handled in accordance with applicable privacy and security requirements.
CDIC does not sell personal information.
1.8 Service Providers and Third-Party Systems
CDIC may use third-party service providers and technology systems to support its activities, including providers of:
website hosting;
email and communications;
registration and scheduling;
information storage;
cloud services;
payment processing;
accounting;
information technology;
security;
analytics; and
other administrative or operational services.
Where personal information is handled by a service provider on behalf of CDIC, CDIC will take measures required by applicable law and appropriate to the circumstances to protect the information and limit its use to authorized purposes.
CDIC will consider privacy and security requirements when selecting and managing service providers.
1.9 Information Outside Quebec
Where applicable law requires a privacy-impact assessment before personal information is communicated outside Quebec or entrusted to a person or organization outside Quebec for collection, use, communication, or storage, CDIC will conduct the required assessment before proceeding.
The assessment will consider factors required by applicable law, including the sensitivity of the information, the purposes for which it will be used, applicable protection measures, including contractual measures, and the legal framework applicable in the jurisdiction concerned.
Where required by law, the transfer or outsourcing arrangement will be documented through an appropriate written agreement containing applicable privacy and security safeguards.
CDIC may use service providers whose systems or infrastructure are located outside Quebec, including cloud and technology providers. Individuals may contact CDIC at [email protected] for information concerning applicable processing arrangements, subject to legitimate confidentiality, security, and legal considerations.
1.10 Sensitive Personal Information
Personal information may be considered sensitive because of its nature or because of the context in which it is collected, used, or communicated.
Examples may include certain health, financial, biometric, identity, family, social, or other information for which individuals may have a heightened expectation of privacy.
CDIC applies safeguards appropriate to the sensitivity of personal information and limits access, use, communication, and retention to what is permitted and reasonably necessary.
1.11 Security Safeguards
CDIC takes reasonable security measures appropriate to the sensitivity, quantity, format, and intended use of personal information.
Depending on the circumstances, safeguards may include:
access controls;
confidentiality obligations;
authentication and account protections;
secure storage practices;
access restrictions based on roles and responsibilities;
secure transmission methods where appropriate;
backup and recovery measures;
secure disposal practices;
privacy and security training or awareness measures; and
other administrative, technical, and organizational safeguards appropriate to CDIC’s activities.
No electronic communication or information-storage system can be guaranteed to be completely secure. CDIC nevertheless takes reasonable measures to protect personal information against unauthorized access, use, communication, loss, alteration, destruction, or other compromise.
1.12 Privacy and Confidentiality Incidents
A confidentiality incident may include unauthorized access to, use of, communication of, or loss of personal information, or another breach of the protection of personal information.
If CDIC has reason to believe that a confidentiality incident has occurred, CDIC will take reasonable measures required by applicable law, which may include:
assessing and containing the incident;
reducing the risk of harm;
taking measures to protect affected individuals;
determining whether notification is legally required;
notifying the Commission d’accès à l’information and affected individuals where required by law;
preventing or reducing the likelihood of recurrence; and
documenting and managing the incident in accordance with applicable legal requirements.
Where applicable law requires notification because an incident presents a risk of serious harm, CDIC will provide the required notifications without undue delay.
CDIC maintains a register of confidentiality incidents as required by applicable law.
1.13 Privacy by Design and Privacy Impact Assessments
Where required by applicable law, CDIC will conduct a privacy-impact assessment before undertaking a project involving the acquisition, development, or redesign of an information system or electronic service that involves the collection, use, communication, retention, or destruction of personal information.
CDIC may also conduct privacy-impact assessments in other circumstances where appropriate to identify and reduce privacy risks.
1.14 Access and Rectification
Subject to applicable legal exceptions, individuals may request access to personal information concerning them that is held by CDIC.
Individuals may also request rectification of personal information that is inaccurate, incomplete, or no longer current.
Requests should be submitted to:
Email: [email protected]
CDIC will process requests in accordance with applicable law.
Where the Quebec private-sector privacy legislation applies, the person responsible for the protection of personal information must respond in writing to an access or rectification request promptly and no later than 30 days after receipt of the request. LLégis Québec
Where access or rectification is refused, CDIC will provide the reasons for the refusal and the information concerning applicable recourse required by law.
1.15 Privacy Complaints
Individuals who have concerns about CDIC’s handling of personal information may submit a privacy complaint to:
Email: [email protected]
CDIC will review privacy complaints fairly, confidentially, and in accordance with applicable law and its internal complaint procedures.
CDIC will take reasonable steps to investigate and respond to privacy complaints.
Where an individual remains dissatisfied with the handling of a privacy matter, the individual may have the right to submit a complaint or exercise another remedy before the Commission d’accès à l’information, subject to applicable law and procedural requirements.
CDIC will not retaliate against an individual for making a good-faith privacy complaint or cooperating with a lawful privacy investigation.
1.16 Retention, Destruction, and Anonymization
CDIC retains personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected or to meet applicable legal, contractual, funding, accounting, reporting, or other legitimate requirements.
CDIC maintains retention and disposal practices appropriate to the nature of the information and its legal and operational requirements.
When personal information is no longer required, CDIC will take reasonable measures to securely destroy, delete, or, where appropriate and permitted by law, anonymize the information.
Information that is subject to a legal hold, an access or rectification request, an investigation, or another legal requirement will be retained for the period required by applicable law.
1.17 Website and Electronic Communications
When individuals communicate with CDIC by email, website forms, or other electronic means, information they provide may be retained and used to respond to their inquiry, administer a program, provide a service, or otherwise fulfill the identified purpose for which it was collected.
CDIC may collect limited technical information associated with website use where reasonably necessary for security, functionality, maintenance, accessibility, or statistical purposes.
Where CDIC uses cookies, analytics, tracking, identification, location, profiling, or similar technologies that trigger additional legal notice, consent, or control requirements, CDIC will provide the notices and controls required by applicable law.
Where a technological means used by CDIC includes functions allowing an individual to be identified, located, or profiled, CDIC will provide the information and controls required by applicable law before using those functions.
1.18 Children and Youth
Where CDIC provides programs or activities involving children or youth, CDIC will apply privacy, safety, confidentiality, consent, and safeguarding measures appropriate to the circumstances and required by law.
Where consent from a parent, guardian, or other authorized person is legally required, CDIC will obtain the required consent before collecting, using, or communicating personal information.
CDIC will take reasonable measures to protect the privacy and safety of children and youth participating in its programs and activities.
1.19 Employees, Volunteers, Directors, Officers, and Representatives
Employees, volunteers, directors, officers, and representatives who have access to personal or confidential information are expected to:
maintain confidentiality;
access information only when authorized and necessary;
use information only for legitimate organizational purposes;
protect information against unauthorized access, use, communication, loss, or misuse;
comply with CDIC’s privacy and security procedures;
comply with applicable legal and contractual obligations; and
promptly report suspected privacy or security incidents.
Failure to comply with these requirements may result in appropriate corrective or disciplinary measures, subject to applicable law and CDIC procedures.
1.20 Privacy Governance
CDIC maintains policies, procedures, and practices designed to protect personal information throughout its lifecycle.
Depending on the nature and scale of CDIC’s activities, these may include:
rules governing collection, use, communication, retention, and destruction;
assignment of privacy responsibilities;
confidentiality and access controls;
privacy and security awareness measures;
procedures for responding to access and rectification requests;
privacy complaint procedures;
confidentiality-incident procedures;
service-provider and third-party privacy requirements;
privacy-impact assessment procedures; and
periodic review of privacy and security practices.
CDIC’s privacy governance measures will be proportionate to the nature and importance of its activities.
1.21 Policy Changes
CDIC may amend this Privacy Policy from time to time to reflect changes in its activities, technology, legal requirements, service providers, or privacy practices.
Where required by law, CDIC will provide notice of material changes through appropriate means.
The current version of this Privacy Policy will be made available through CDIC’s website or other appropriate communication channels.
2. Accessibility and Inclusion Policy
2.1 Purpose
CDIC is committed to promoting accessibility, dignity, respect, inclusion, and equitable participation for individuals accessing its services, programs, activities, employment opportunities, and community resources.
2.2 Commitment
CDIC strives to:
provide welcoming and inclusive services;
identify and reduce barriers to participation;
respect diversity and individual circumstances;
promote equitable access to community resources;
treat individuals with dignity and respect; and
consider reasonable accommodation requests in accordance with applicable law.
2.3 Accommodation Requests
Individuals requiring an accommodation are encouraged to contact CDIC through its official communication channels and, where possible, describe the accommodation required.
CDIC will consider accommodation requests reasonably and in accordance with applicable legal requirements, the circumstances of the request, safety considerations, operational requirements, and available resources.
CDIC will seek to identify reasonable measures that facilitate participation without creating an undue hardship or violating applicable law.
3. Code of Ethics and Professional Conduct
3.1 Purpose
This Policy establishes general standards of ethical and professional conduct for CDIC directors, officers, employees, volunteers, members, and representatives.
3.2 Principles
Individuals associated with CDIC are expected to demonstrate:
respect and dignity;
integrity and honesty;
non-discrimination;
confidentiality;
professional responsibility;
accountability;
appropriate use of organizational resources; and
compliance with applicable laws and CDIC policies.
3.3 Prohibited Conduct
Individuals representing or participating with CDIC must not engage in conduct that violates applicable law or CDIC policy, including:
harassment or discrimination;
abuse, exploitation, or inappropriate conduct;
abuse of authority;
undisclosed conflicts of interest;
misuse of confidential information;
fraudulent or dishonest conduct;
unauthorized use of organizational resources; or
other serious misconduct.
Concerns regarding misconduct should be reported through CDIC’s official communication channels or, where appropriate, to the relevant authority.
4. Complaints and Feedback Policy
CDIC values feedback from participants, community members, volunteers, employees, partners, and other stakeholders.
Individuals may submit concerns or complaints through:
Email: [email protected]
CDIC will review complaints fairly, respectfully, and confidentially to the extent reasonably possible and permitted by law.
CDIC will take reasonable steps to acknowledge, investigate, and respond to complaints appropriately.
Privacy-related complaints will be handled in accordance with this Privacy Policy and applicable privacy legislation.
Submitting a complaint does not guarantee a particular outcome, compensation, or remedy. CDIC will nevertheless make reasonable efforts to address legitimate concerns in accordance with applicable policies and laws.
Nothing in this Policy limits a person’s right to contact a government, regulatory, law-enforcement, or other competent authority where permitted or required by law.
5. Volunteer Policy
5.1 Purpose
CDIC recognizes volunteers as important contributors to community development and integration.
5.2 Volunteer Responsibilities
Volunteers are expected to:
respect CDIC’s values and policies;
maintain confidentiality;
protect personal information;
follow reasonable instructions and safety requirements;
treat community members respectfully;
maintain appropriate professional boundaries;
represent CDIC responsibly; and
report concerns, incidents, or suspected misconduct through appropriate channels.
5.3 Volunteer Status
Unless otherwise agreed in writing, volunteers participate on a voluntary basis and are not employees of CDIC solely by reason of their volunteer status.
Volunteers do not have authority to legally bind CDIC unless such authority has been expressly granted by an authorized representative of CDIC.
6. Conflict of Interest Policy
CDIC is committed to transparent, ethical, and responsible decision-making.
Directors, officers, employees, volunteers, and representatives should disclose actual, potential, or reasonably perceived conflicts of interest when they arise.
A person who has a conflict should not participate in a decision where the person’s personal, financial, professional, family, or other interests could improperly influence the decision, except where participation is permitted or required by applicable law or CDIC procedures.
Conflicts should be managed in a manner that protects CDIC’s integrity, accountability, and the interests of the communities it serves.
7. Safeguarding and Protection Policy
CDIC is committed to maintaining a respectful and safe environment for participants, newcomers, youth, seniors, families, volunteers, employees, and community members.
CDIC promotes:
respectful interactions;
prevention of harassment, abuse, exploitation, and discrimination;
appropriate professional boundaries;
protection of vulnerable individuals;
safe program environments;
responsible reporting of concerns; and
appropriate responses to safety or safeguarding issues.
Concerns involving abuse, harassment, exploitation, threats, violence, or other serious misconduct should be reported promptly through CDIC’s official communication channels and, where appropriate, to emergency services, regulatory authorities, child-protection authorities, law enforcement, or another competent authority.
Nothing in this Policy prevents or discourages a person from contacting an appropriate authority where reporting is required or permitted by law.
8. Document Management and Retention Policy
CDIC maintains organizational records responsibly to support governance, accountability, operational continuity, legal compliance, funding requirements, and service delivery.
CDIC’s document-management practices may address:
record creation;
classification;
secure storage;
access control;
confidential documentation;
retention periods;
backup and continuity;
secure disposal; and
protection of personal and confidential information.
Personal information is retained only for as long as reasonably necessary for its identified purposes or as required by applicable law or legitimate organizational obligations.
9. Responsible Use of Organizational Resources
CDIC’s resources, systems, equipment, records, accounts, funds, technology, and information are intended primarily to support legitimate organizational activities.
Individuals authorized to use CDIC resources are expected to:
use resources responsibly;
protect organizational and personal information;
maintain confidentiality;
prevent unauthorized access;
follow applicable security procedures;
avoid misuse or unauthorized personal use; and
report suspected loss, misuse, fraud, or security incidents.
CDIC may take appropriate corrective or disciplinary measures in response to misuse, subject to applicable law and CDIC procedures.
10. Policy Administration and Updates
CDIC may review these policies periodically to reflect organizational developments, changes in legislation, technology, funding requirements, operational needs, and recognized best practices.
Where required by law, CDIC will provide notice of material policy changes.
The current versions of these policies will be made available through CDIC’s official website or other appropriate communication channels.
Contact Information
Community Development and Integration Center (CDIC)
Brossard, Quebec, Canada
General and Privacy Contact:
[email protected]
For privacy questions, access or rectification requests, privacy complaints, or other matters concerning the protection of personal information, please use the email address above.