Personal Information Protection Policy

Last updated: November 3, 2026

1. Purpose

This Policy establishes the principles and practices applied by Les Entreprises Marc Dubé regarding the collection, use, access, disclosure, retention, security, and destruction of personal information.

It is intended to ensure responsible management of personal information throughout its life cycle.

2. Scope

This Policy applies to personal information held by Les Entreprises Marc Dubé, regardless of format, including electronic and paper records.

• clients and users of our services;
• users of our parking facilities;
• tenants and occupants, where applicable;
• employees and employment candidates;
• suppliers and partners;
• business representatives;
• individuals communicating with Les Entreprises Marc Dubé;
• other individuals whose personal information is collected in the course of our activities.

3. Protection Principles

• identify the purposes of collection;
• limit collection to necessary information;
• inform individuals and obtain required consent;
• use information only for authorized purposes;
• limit access to individuals who require it;
• govern disclosure to third parties;
• maintain appropriate security safeguards;
• retain information only for the necessary or legally required period;
• destroy or anonymize information when it is no longer required;
• allow individuals to exercise rights provided by law;
• properly manage confidentiality incidents.

4. Person in Charge of the Protection of Personal Information

The person in charge oversees application of this Policy, handles access and correction requests, receives complaints, participates in incident management, oversees the incident register, and contributes to privacy impact assessments where required.

5. Types of Information Collected

• identification and contact information;
• contractual, administrative, and billing information;
• licence plate number, parking location, zone, period, and transaction information;
• employment-related information where required;
• IP address, device, browser, and other technological data where collected.

For parking services, a licence plate number may be used to associate payment with the vehicle concerned.

6. Identification of Purposes

Purposes may include service delivery, client relationship management, parking management, contract administration, communications, billing, transaction processing, recruitment, employee management, security, and compliance with legal obligations.

7. Consent

Where consent is required, Les Entreprises Marc Dubé takes appropriate steps to ensure that the individual can understand the nature of the collection and the purposes for which the information is requested.

8. Limitation of Access

Access is limited, to the extent reasonably possible, to authorized employees, officers, representatives, professionals, and service providers who require the information in the performance of their duties. Anyone with access to personal information must preserve its confidentiality.

9. Service Providers

Les Entreprises Marc Dubé may use providers of information technology, payment platforms, parking systems, hosting, accounting, and professional services.

Where information must be disclosed, reasonable measures are taken to ensure it is used for the intended purposes and protected in accordance with applicable requirements.

10. Web Forms and Technological Means

Web forms may be used to receive an information or service request, obtain information required to communicate with an individual, and administer certain services.

Payment platforms may process information required for a transaction. When a third-party platform is used, certain information may be collected directly by that provider.

11. Security Measures

• access controls and passwords;
• multi-factor authentication where available and appropriate;
• limitation of access rights;
• protection of devices and information systems;
• security of physical records;
• removal or modification of access that is no longer required;
• secure destruction methods;
• internal confidentiality practices and staff awareness.

12. Retention

Information is retained based on operational needs and applicable obligations. Retention periods may vary according to the type of information, purposes of collection, contractual relationship, tax or accounting obligations, and applicable limitation periods.

13. Destruction and Anonymization

Once the purposes have been fulfilled, personal information is securely destroyed, subject to applicable retention periods. Where permitted and appropriate, it may be anonymized in accordance with applicable requirements.

14. Confidentiality Incidents

An incident may include unauthorized access, use, or disclosure, the loss of personal information, or any other breach of its protection.

Les Entreprises Marc Dubé takes reasonable measures to reduce the risk of harm and prevent similar incidents. An incident register is maintained, and required notices are provided where an incident presents a risk of serious injury.

15. Privacy Impact Assessments

Where required by legislation, a privacy impact assessment is conducted before implementing or substantially modifying a project, system, or service involving personal information.

16. Personal Information Outside Quebec

Where personal information must be disclosed or processed outside Quebec, Les Entreprises Marc Dubé applies the measures required by applicable legislation.

17. Access and Correction

Subject to restrictions provided by law, any individual may request access to personal information held about them and correction of inaccurate, incomplete, or ambiguous information. Proof of identity may be required.

18. Withdrawal of Consent

Where use is based on consent and withdrawal is permitted by law, an individual may contact Les Entreprises Marc Dubé. Withdrawal cannot prevent retention, use, or disclosure that is permitted or required by law.

19. Complaints

Any complaint concerning the protection or handling of personal information may be submitted to the person in charge. Complaints are handled confidentially, and appropriate measures are taken where necessary.

20. Training and Awareness

Les Entreprises Marc Dubé raises awareness among individuals who have access to personal information regarding the importance of confidentiality and compliance with applicable security measures.

21. Responsibilities of Employees and Representatives

• use only the information required to perform their duties;
• avoid disclosure to unauthorized persons;
• protect access to systems;
• take reasonable precautions with confidential documents;
• promptly report any incident or risk of compromise.

22. Policy Review

This Policy may be updated following a change in business activities, implementation of new technology, an incident, a legislative change, or the identification of new risks. The version published on the website is the version in force.

← All our policies