PRIVACY POLICY
SURFING IN THERRIEN-CPA.COM
Therrien-cpa.com contains links to external sites. The organization is not responsible for the content of those sites, nor for their privacy-related practices.
​
1. CONTEXT
Therrien, Therrien CPA is a provincially incorporated for-profit organization that processes personal information in the course of its activities.
​
The purpose of this policy is to ensure the protection of personal information and to govern the manner in which Therrien, Therrien CPA collects, uses, communicates, retains and destroys it or otherwise manages it. In addition, it aims to inform all interested parties on how Therrien, Therrien CPA handles their personal information. It also covers the treatment of personal information collected by Therrien, Therrien CPA by technological means.
​
2. APPLICATION AND DEFINITIONS
This policy applies to Therrien, Therrien CPA, which includes, but is not limited to, its officers, employees, consultants, volunteers, and any person who otherwise provides services on behalf of Therrien, Therrien CPA. It also applies with respect to the Therrien, Therrien CPA website, as well as all websites controlled and maintained by Therrien, Therrien CPA.
​
It applies to all types of personal information managed by Therrien, Therrien CPA, whether it be information about its clients, potential or actual clients, consultants, employees, members or any other person (such as visitors to its websites or others).
​
For the purposes of this Policy, personal Information is information about an individual that directly or indirectly identifies the individual. For example, it could be an individual’s name, address, e-mail address, telephone number, gender, banking information, health information, ethnic origin, language, etc.
​
Sensitive personal information is information for which there is a high reasonable expectation of privacy, e.g., health information, banking information, biometric information, sexual orientation, ethnic origin, political opinions, religious or philosophical beliefs, etc.
​
Generally speaking, an individual’s business or professional contact information is not personal information, for example, an individual’s name, title, address, e-mail address or business telephone number. More specifically, and for greater certainty, under the Québec Act Respecting the Protection of Personal Information in the Private Sector, and as of September 22, 2023, sections 3 (collection, use, disclosure), 4 (retention and destruction) and 6 (data security) do not apply to information of an individual relating to the performance of a function in an enterprise, such as the name, title, position, address, e-mail address and telephone number of the individual’s workplace.
​
These same paragraphs also do not apply to personal information that is public information by law upon the coming into force of this policy.
​
3. COLLECTION, USE AND COMMUNICATION
Therrien, Therrien CPA may collect different types of information for different purposes in the course of its activities. The types of information that Therrien, Therrien CPA may collect, its use (or purpose) and the means by which the information is collected are set out in Appendix A of this policy.
​
Therrien, Therrien CPA will also inform individuals, at the time of collection of personal information, of any other information collected, the purposes for which it is collected and the means of collection, in addition to other information required by law.
​
Therrien, Therrien CPA applies the following general principles to the collection, use and disclosure of personal information:
​
CONSENT
-
Generally, Therrien, Therrien CPA collects personal information directly from the individual with consent, unless an exception is provided by law. Consent may be implied in certain situations, for example, when an individual chooses to provide his or her personal information after being informed by this policy of the use and disclosure for the purposes identified in this policy (see Appendix A for more details). Thus, this Policy and the information it contains will be available to the individual at the time of collection of personal information.
-
Normally, Therrien, Therrien CPA must also obtain the consent of the individual concerned before collecting his or her personal information from third parties, before disclosing it to third parties or for any secondary use of it. However, Therrien, Therrien CPA may act without consent in certain circumstances and under the conditions set out in the law. The main situations where Therrien, Therrien CPA may act without consent are indicated in the relevant sections of this policy.
​​
COLLECTION
-
In all cases, Therrien, Therrien CPA collects information only when it has a valid reason to do so. In addition, the collection will be limited to that which is necessary to fulfill the purpose for which it is collected.
-
Please note that Therrien, Therrien CPA’s services may be intended for minors, and Therrien, Therrien CPA only obtains personal information about minors with the consent of a parent or guardian.
-
Collection from third parties. Therrien, Therrien CPA may collect personal information from third parties. Unless an exception is provided by law, Therrien, Therrien CPA will seek the consent of the individual before collecting personal information about him or her from a third party. In the event that such information is not collected directly from the individual, but from another organization, the individual may request the source of the information collected from Therrien, Therrien CPA.
​​
In some situations, Therrien, Therrien CPA may also collect personal information from third parties, without the consent of the individual, if it has a substantial and legitimate interest in doing so and (a) the collection is in the individual’s best interests and it is not possible to collect it from the individual in a timely manner, or (b) if such collection is necessary to ensure the accuracy of the information.
​
HOLDING AND USE
-
Therrien, Therrien CPA ensures that the information it holds is current and accurate at the time it is used to make a decision about the individual.
-
Therrien, Therrien CPA may only use an individual’s personal information for the purposes identified herein or for any other purposes provided at the time of collection. If Therrien, Therrien CPA wants to use the information for another reason or another purpose, a new consent will have to be obtained from the person concerned, which will have to be expressly obtained if it is sensitive personal information. However, in certain circumstances provided for by law, Therrien, Therrien CPA may use the information for secondary purposes without the consent of the individual, e.g:
-
when such use is clearly for the benefit of that person;
-
when necessary to prevent or detect fraud;
-
when necessary to evaluate or improve protection and security measures.
-
-
Limiting access. Therrien, Therrien CPA shall implement measures to limit access to personal information to those employees and individuals within its organization who have a right to know the information and for whom the information is necessary to perform their duties. Therrien, Therrien CPA will seek the consent of the individual before granting access to any other person.
COMMUNICATION
-
Generally, and unless otherwise specified in this Policy or as required by law, Therrien, Therrien CPA will obtain the consent of the individual before disclosing personal information to a third party. In addition, where consent is required and where sensitive personal information is involved, Therrien, Therrien CPA will obtain the individual’s express consent before disclosing the information.
-
However, there are times when disclosure of personal information to third parties is necessary. For example, personal information may be disclosed to third parties without the consent of the individual in certain circumstances, including, but not limited to, the following:
-
Therrien, Therrien CPA may disclose personal information, without consent, to a public body (such as a government) that collects it through an agent of that public body in the course of carrying out its functions or implementing a program under its control.
-
Personal information may be shared with its service providers to whom it is necessary to disclose the information without the individual’s consent. For example, these service providers may include subcontractors of Therrien, Therrien CPA designated to carry out mandates in programs administered by Therrien, Therrien CPA and cloud service providers. In these cases, Therrien, Therrien CPA must have written contracts with these suppliers that indicate the measures they must take to ensure the confidentiality of the personal information disclosed, that the use of this information is only for the purpose of performing the contract and that they may not retain this information after the contract has expired. In addition, these contracts must provide that suppliers must notify Therrien, Therrien CPA’s Privacy Officer (identified in this policy) of any breach or attempted breach of confidentiality obligations regarding the personal information disclosed and must allow the Privacy Officer to conduct any audit related to such confidentiality.
-
If necessary for the purpose of concluding a commercial transaction, Therrien, Therrien CPA may also disclose personal information, without the consent of the individual, to the other party to the transaction and subject to the conditions provided by law.
-
-
Disclosure outside Québec: Personal information held by Therrien, Therrien CPA may be disclosed outside Québec, for example, when Therrien, Therrien CPA uses cloud service providers whose server(s) are located outside Québec or when Therrien, Therrien CPA deals with subcontractors located outside the province.
ADDITIONAL INFORMATION ON THE TECHNOLOGIES USED
Use of cookies
Cookies are data files that are sent to a website visitor’s computer by their web browser when they visit a website and can serve several purposes.
​
The websites controlled by Therrien, Therrien CPA use cookies, in particular:
-
To remember the settings and preferences of visitors, for example, for the choice of language and to allow tracking of the current session.
-
For statistical purposes to know the behaviour of visitors, the content consulted and to allow the improvement of the website.
The websites controlled by Therrien, Therrien CPA use the following types of cookies:
-
Session cookies: these are temporary cookies that are kept in memory for the duration of the visit to the website only.
-
Persistent cookies: these are kept on the computer until they expire and will be retrieved the next time you visit the site.
Some cookies may be disabled by default and visitors may choose to enable or disable these features when visiting Therrien, Therrien CPA websites.
It is also possible to enable and disable the use of cookies by changing the preferences in your browser settings.
​
Use of Google Analytics
Therrien, Therrien CPA’s website uses Google Analytics to enable its continuous improvement. Google Analytics is used to analyze how a visitor interacts with Therrien, Therrien CPA’s website. Google Analytics uses cookies to generate statistical reports about the behaviour of visitors to these websites and the content they view.
​
Information from Google Analytics will never be shared by Therrien, Therrien CPA with third parties.
​
It is possible to install a browser add-on to disable Google Analytics.
​
Other technological means used
Therrien, Therrien CPA also collects personal information through technological means such as web forms embedded in a website controlled by Therrien, Therrien CPA (e.g., its contact form, newsletter and seminar registration form), questionnaires available online on its platforms and applications, and other platforms or form tools (e.g., Microsoft Forms).
​
If Therrien, Therrien CPA collects personal information by offering a technology product or service that has privacy settings, Therrien, Therrien CPA shall ensure that those settings provide the highest level of privacy by default (cookies are not covered).
​
4. RETENTION AND DESTRUCTION OF PERSONAL INFORMATION
Unless a minimum retention period is required by applicable law or regulation, Therrien, Therrien CPA shall retain personal information only as long as necessary for the fulfillment of the purposes for which it was collected.
​
Personal information used by Therrien, Therrien CPA to make a decision about an individual must be retained for a period of at least one year after the decision is made, or up to seven years after the end of the fiscal year in which the decision was made if the decision has tax implications, for example, the circumstances of a termination of employment.
​
At the end of the retention period or when the personal information is no longer needed, Therrien, Therrien CPA will ensure
-
to destroy them; or
-
anonymize it (i.e., it is no longer irreversibly identifiable with the individual and cannot be linked to the personal information) for a meaningful and legitimate purpose.
The destruction of information by Therrien, Therrien CPA must be done in a secure manner to ensure the protection of this information.
​
This section may be supplemented by any policy or procedure adopted by Therrien, Therrien CPA regarding the retention and destruction of personal information, if any. Please contact Therrien, Therrien CPA’s Privacy Officer (identified in this policy) for further information.
​
5. THERRIEN, THERRIEN CPA’S RESPONSIBILITIES
Therrien, Therrien CPA is generally responsible for the protection of the personal information it holds.
​
Therrien, Therrien CPA’s Privacy Officer is the Director of Operations of the organization. The Privacy Officer is generally responsible for ensuring compliance with applicable privacy legislation. The Privacy Officer is responsible for approving policies and practices governing the governance of personal information. In particular, this individual is responsible for implementing this policy and ensuring that it is known, understood and followed. In the event that the Privacy Officer is absent or unable to act, the designated person at Therrien, Therrien CPA will assume the duties of the Privacy Officer.
​
Therrien, Therrien CPA staff members who have access to personal information or are otherwise involved in the management of personal information must ensure its protection and respect this policy.
​
The roles and responsibilities of Therrien, Therrien CPA employees throughout the life cycle of personal information may be specified by any other Therrien, Therrien CPA policy in this regard, if any.
​
6. DATA SECURITY
Therrien, Therrien CPA is committed to implementing reasonable security measures to protect the personal information under its control. The safeguards in place are appropriate to the purpose, amount, distribution, medium and sensitivity of the information. This means that information that may be considered sensitive (as defined in section 2) will require enhanced security safeguards and protection. In particular, and in accordance with what was mentioned above regarding limited access to personal information, Therrien, Therrien CPA must put in place the necessary measures to impose constraints on the rights of use of its information systems so that only employees who need to have access to it are authorized to access it.
​
7. RIGHTS OF ACCESS, RECTIFICATION AND WITHDRAWAL OF CONSENT
To exercise his or her rights of access, rectification or withdrawal of consent, the person concerned must submit a written request to this effect to the Privacy Officer of Therrien, Therrien CPA, at the e-mail address indicated in section 9.
​
Subject to certain legal restrictions, individuals may request access to and correction of their personal information held by Therrien, Therrien CPA if it is inaccurate, incomplete or misleading. They may also request that the dissemination of their personal information be stopped or that any hyperlink attached to their name allowing access to this information by a technological means be de-indexed, when the dissemination of this information contravenes the law or a court order. They may do the same, or require that the hyperlink to the information be re-indexed, where certain statutory conditions are met.
​
Therrien, Therrien CPA’s Privacy Officer shall respond in writing to such requests within 30 days of receipt of the request. Reasons must be given for any refusal and the legal provision justifying the refusal. In these cases, the response must indicate the remedies available under the law and the time limit for exercising them. The official shall assist the applicant in understanding the denial if necessary.
​
Subject to applicable legal and contractual restrictions, individuals may withdraw their consent to the disclosure or use of the information collected.
​
They may also ask Therrien, Therrien CPA what personal information is collected from them, what categories of people at Therrien, Therrien CPA have access to it, and how long it is kept.
​
8. COMPLAINT HANDLING PROCESS
Reception
Any person who wishes to make a complaint regarding the application of this policy or, more generally, regarding the protection of his or her personal information by Therrien, Therrien CPA, must do so in writing to the person responsible for the protection of personal information at Therrien, Therrien CPA, at the email address indicated in the following section.
​
The individual will be asked to provide his or her name, contact information, including a telephone number, and the subject matter and reasons for the complaint in sufficient detail to allow Therrien, Therrien CPA to assess the complaint. If the complaint is not specific enough, the Privacy Officer may request any additional information that he or she deems necessary to assess the complaint.
​
Treatment
Therrien, Therrien CPA is committed to treating all complaints received in a confidential manner.
​
Within 30 days of receipt of the complaint or receipt of any additional information deemed necessary and required by Therrien, Therrien CPA’s Privacy Officer to process the complaint, the Privacy Officer shall assess the complaint and provide a written response, with reasons, to the complainant by e-mail. The purpose of this assessment will be to determine whether Therrien, Therrien CPA’s handling of personal information is in compliance with this policy, any other policies and practices in place within the organization, and applicable legislation or regulations.
​
If the complaint cannot be processed within this time frame, the complainant shall be informed of the reasons for the extension, the status of the complaint and the reasonable time required to provide a final response.
​
Therrien, Therrien CPA is required to maintain a separate file for each complaint received. Each file contains the complaint, the analysis and documentation supporting its assessment, and the response sent to the person who filed the complaint.
​
You may also file a complaint with the Commission d’accès à l’information du Québec or any other privacy oversight body responsible for the application of the law concerned by the subject of the complaint.
​
However, Therrien, Therrien CPA invites any interested person to first contact its Privacy Officer and wait for the end of the treatment process by Therrien, Therrien CPA.
​
9. APPROVAL
This policy is approved by Therrien, Therrien CPA’s Privacy Officer, whose business contact information is as follows.
​
Privacy Officer:
Christophe Therrien
810-1470 Peel Street
Montréal (Québec) H3A 1T1
confidentialite@therrien-cpa.com
​
If you have any requests, questions or comments regarding this policy, please contact the person in charge by email.
​
10. PUBLICATION AND MODIFICATIONS
This policy is published on Therrien, Therrien CPA’s website to which this policy applies, with respect to the personal information collected therein. This policy is also disseminated by any means appropriate to reach the persons concerned.
​
Therrien, Therrien CPA reserves the right to modify this Privacy Policy from time to time. Any changes related to it will be posted on its website.
​
*Notes : Please note that the use of the masculine gender is intended to lighten this policy and make it easier to read.
​
Table of versions and changes:
Version: 1.0
Effective date: August 9, 2023
Changes since the last version: First version
​
ANNEXE A
The following is a non-exhaustive list of the types of information that Therrien, Therrien CPA may collect, its use, or purpose, and the means by which it is collected. The categories of personal information we collect depend on the product or service you have with Therrien, Therrien CPA, and your use of Therrien, Therrien CPA’s websites and services. This includes, but is not limited to, the following.
​
Identifiers
-
Name, address, telephone numbers, title, email address, date of birth, social insurance number, account numbers, credit card numbers, debit card number, knowledge-based information (e.g. username, password and account information), information pertaining to business clients will include your business name, address, phone number, email address, industry type, financial status and detail(s) on the owner(s), operator(s) and director(s).
Transaction and financial information
-
Receipts and invoices for products and services purchased, obtained or considered, from other activities;
-
Bank statements and transaction history;
-
Information you provide on an application for our products and services, such as your annual income, investments, account balance, financial liabilities, transaction history.
Internet or other similar network activity
-
Browsing history, search history, information regarding your interaction with an Internet Web site, application, or advertisement
Professional or employment-related information
-
Occupation, education, place of employment, employment history, titles or positions with government entities, employers, or companies you own, salary or self-employment income.
Other
-
Information you provide during communication with us which may include family details, health information, life events, goals and your opinions and issues you may have encountered;
-
Additional information may be requested to help us determine your eligibility for products and services that we offer.
​
Reminder
An individual’s business or professional contact information is not personal information, for example, an individual’s name, title, address, e-mail address or business telephone number. See section 2 for more details.