Confidentiality and Use of Personal Information Policy

1. Introduction

Villa Maria understands and respects the importance of the personal information that it handles concerning its students and their parents or legal tutors, its employees and suppliers. We have developed this Confidentiality and Use of Personal Information Policy (the “Policy”) to explain how we collect, use, keep and communicate information concerning an individual and allowing, directly or indirectly, to identify that person, like you.

This Policy also describes your rights regarding the protection of your personal information and the means by which to exercise them.

2. Who is responsible within Villa Maria for managing the handling of my personal information?

We are responsible for the personal information that we handle. We have appointed a person in charge of the protection of personal information (“PCPPI”) to supervise our conforming to the applicable legislation regarding protection of personal information, and to assist you should you have any questions concerning the same issue.

3. What is the contact information of our PCPPI?

For questions and/or comments about this Policy or the handling of your personal information, please contact the following person:

Martin Loyat
Director – Academic Support Services and Person in charge of the protection of personal information 
Villa Maria
4245 Decarie Boulevard
Montreal, Quebec
Canada H4A 3K4
Email: loyatm@villamaria.qc.ca
Telephone: (514) 484-4950, extension 3221

The following responsibilities rest with the PCPPI:

be an active ex-officio member of the Villa Maria Committee on access to information and the protection of personal information;
cooperate with the school management for the updating of this Policy, any accompanying directives and of any other policy, notice or procedure relative to personal information;
be the point of contact regarding demands addressed to Villa Maria relative to the protection of personal information, and ensure the handling of those demands.

4. What kind of personal information do we process?

Our school may be required to process the following personal information:

identity and contact information: including your name, address, telephone number, date of birth, civil status, passport number, health insurance card number, educational and career pathways, or your tax status;
school record: including the student’s schedule, photo, school email address, periodical report cards, award of diploma, absences and late arrivals and any supporting documents relative thereto, any disciplinary warning, and information relating to extracurricular activities;
employee file: including all pre-hiring information such as your CV, diplomas, reference letters, track record, all information stemming within the context of your employment such as your evaluations, your medical file; and personal information regarding your beneficiaries, and all post employment information;
financial and payment information: including you bank account number and address and other relevant information for the processing of payments and fraud prevention, including credit/debit card numbers, your account statement and other related billing information;
profile and usage information: including passwords to access our website or platforms or password protected services, your communication preferences and information on how you are using our website, including the services that you have consulted or which you have researched, the pages response time, download errors, visit time of particular pages and interaction information (such as scrolling, clicks, rollovers). To know more on our use of cookies or similar technologies, please consult our Cookie Policy which you can access on our website;
technical information: including information collected while visiting our website, IP (internet Protocol) address, login data, browser type and version, device type, time zone adjustment, types and versions of browser plug-ins, and operating systems and platform;
physical access information: with details of your visits on the premises of our establishment;
sensitive personal information: information that, due to its medical, biometric or otherwise intimate nature, or the context of its use or communication, entails a high level of reasonable expectation of privacy, for example the student’s image or voice, information relative to aid and prevention services offered by internal providers (drug addiction, sexuality, anxiety, family problems, conflicts, etc.), adapted path information for students with special needs.

Please note: if you provide us with personal information on a person other than you, you must ensure that the latter understands how their information will be used and that they authorize you to communicate such information to us and allow us and our outsourcing service providers to use it.

5. For what purposes do we process your personal information?

Villa Maria processes the information that you communicate to us to manage our organization and to plan, coordinate and provide educational services for the academic success of our students. We only process the information necessary for that purpose. If we must use your personal information for purposes other than those described herein, we will obtain your consent beforehand, except under the circumstances listed in Section 9 below.

The purposes for which we process your personal information are the following:

to fulfil any obligation arising from a concluded or eventual contract between you and us or to take any measure relative thereto, with you or your organization, including:
1. to enroll you as a student;
2. to hire you as an employee or consultant;
3. to provide and manage our services or other services or solutions, in accordance with your instructions or those of your organization;
4. to run and manage our relationship with you, including accounting;
5. to process payments, invoicing, and collecting;
to the extent necessary to carry on our activities and pursue our legitimate interests, in particular:
1. to provide our services and address any questions or concerns regarding our services;
2. to ensure the monitoring and supervision of students, including particular attention for students with special needs;
3. to offer counselling and risk prevention services through internal providers;
4. as part of the extracurricular activities, school trips and educational outings, and to provide various other activities as part of student life;
5. to ensure the monitoring and supervision of our employees;
6. to analyze and improve our services and communications, including our activities on our website, and to monitor compliance with our policies and norms;
7. to manage the access control to our premises and for security purposes;
8. to ensure the security of our communications and other systems and to prevent and detect security threats, frauds and criminal or malicious activities;
9. for insurance purposes;
10. to collect information on your preferences in order to personalize and improve the quality of our communications with you;
as needed to carry on promotional activities;
as required to comply with our legal obligations or institute proceedings, in particular:
1. to protect our rights and our safety and those of third parties;
2. to comply with legal requirements and court orders;
3. to institute proceedings and submit a defense within the context of court proceedings, arbitration or similar procedure;
4. to communicate this information to consultants assisting us to conform to legal, accounting or safety requirements;
as otherwise authorized by law.

Villa Maria will not use your personal information to take automated decisions.

Villa Maria will not, without your consent, use personal information for purposes other than those for which it was collected, except in the following cases:

legal, medical or security reasons make it impossible to obtain your consent;
Villa Maria is authorized or obliged to do so in accordance with the applicable legislation.

6. How do we collect your personal information?

We collect your personal information when you communicate with us verbally or in writing, or when you use our portal. We can also collect your personal information when you turn on features on your technological devices that allow us to identify, locate or profile you.

7. What happens if I do not provide my personal information?

When we must collect personal information pursuant to the law or in order to process your instructions or execute an eventual agreement or an existing contract with you, and you do not provide that personal information when asked for, we could be unable to execute your instructions or fulfill the contract entered into or which we are trying to conclude with you, in which case we will then inform you of this hindrance.

8. What is the extent of the personal information that we require?

We limit the personal information that we handle to what is necessary to manage our activities and carry out our educational mandate.

9. Do we share your personal information?

Villa Maria could share your personal information in the following circumstances and with the following recipients:

with the members of our professional team who need it to ensure the monitoring and supervision of students, and any other related service;
confidentially with third parties for the purpose of collecting your comments on our service, of assisting us to measure our performance, to improve and promote our services;
with government departments such as the ministère de l’Éducation;
with financial institutions;
with courts of law, law enforcement agencies, regulatory bodies, government representatives, lawyers or other parties, when reasonably necessary to make, substantiate or contest a legal claim, or for a confidential out-of-court dispute resolution process;
with service providers that we retain at the national level or abroad (for example shared services centers), to process on our behalf personal information in any of the above-mentioned circumstances and only in accordance with our instructions.

Please note: it is possible that Villa Maria, its external service providers and other third parties to whom we communicate information, carry on activities outside of Quebec or even Canada.

Personal information that is processed in countries other than Canada may be subject to the laws of those jurisdictions (for example, when an external service provider operates at the international level). Consequently, it is possible that personal information be communicated in response to valid requests of government authorities, courts of law, or law enforcing authorities in foreign countries.

You can obtain additional information concerning the processing of your personal information outside of Canada by reaching our PCPPI whose contact information appears in Section 3 above.

10. How long do we keep your personal information?

Since the duration of the period of time the personal information will be kept varies depending on the nature of the information and our applicable legal obligations, we keep a retention schedule of personal information. We invite you to contact our PCPPI for any question that concerns you.

11. How do we guarantee the exactness of your personal information?

Villa Maria makes reasonable efforts to ensure that your personal information is retained in such a way that it is as exact, complete, and up-to-date as possible. Unless necessary, we do not regularly update your personal information. In order to assist us update your information and ensure its accuracy you must inform us without delay of any change in the information that you provide us.

12. How do we protect your personal information?

Villa Maria is committed to protecting the confidentiality, integrity, and availability of your personal information. We take security measures that are common in the educational sector and adapted to the sensitivity of the information, including physical, organizational, and technological measures. Comprised among these measures are the restricted access to offices, the training of personnel, the restricted access to information on the basis of the need-to-know principle, the use of passwords and our well-defined internal policies and practices.

As regards the information that you can communicate to us via our website or portal, and despite all the measures put in place, the transmission of data via internet always carries a risk. Although we normally have recourse to encryption using Secure Sockets Layer (“SSL”) or Transport Layer Security (“TLS”), it is your responsibility to ensure with your browser that the connection is encrypted, and that the SSL safety certificate is valid and reliable before you transmit information to us.

13. What are your rights?

In addition to what the law provides in this regard, if you have questions or concerns about the way in which we handle your personal information please discuss it with our PCPPI whose contact information appears in Section 3 above. More often than not, your concerns will thus be resolved quickly.

You may also a) submit a request for access to the personal information we process about you, or b) request correction or deletion of your personal information if it is incorrect or no longer relevant.

And you have the right to withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. You will be informed of the implications of such withdrawal.

14. How do we resolve your concerns?

Reports, concerns, complaints, or incidents that come to our attention and call into question a conduct likely to contravene this Policy shall be treated confidentially inasmuch as possible. However, the disclosure of some information may be necessary to adequately respond to the matters thus raised, facilitate the investigation, and implement solutions if required.

15. Process for reporting incidents and hierarchical assistance

We take seriously any potential or real breach of personal information.

You can express your concerns regarding the handling of your personal information directly to our PCPPI whose contact information appears in Section 3 above.

The PCPPI will call upon the appropriate level of management for assistance to solve the problem.

16. Prohibition of reprisals

We will not take reprisals against a person who, in good faith and on reasonable grounds, raises questions or concerns regarding personal information.

17. Monitoring mechanisms/supervision

The Villa Maria Committee on access to information and the protection of personal information conducts periodical reviews of incidents and problems signaled through the process for reporting incidents and hierarchical assistance, this in order to identify and solve systemic problems.

18. Roles and responsibilities

Villa Maria must ensure that its employees fully comply with the law, this Policy and with any accompanying directives.

19. The law prevails

The provisions of the law regarding the collection, keeping, use and communication of personal information take precedence over this Policy.

20. Coming into effect and amendment of this Policy

This Policy comes into effect on October 20, 2023, and replaces all previous versions.

Villa Maria reserves the right to interpret this Policy at its sole discretion.

The protection of personnel information legislation continues to evolve and, consequently, we can amend this Policy occasionally, at our sole discretion, without forewarning you nor engaging our responsibility towards you or any other person. The processing of your personal information shall be governed by the version of this Policy that will be in effect at that time and for which a notice of amendment will then be published on the Villa Maria website.