Avera Audiovisual (“Avera”, “We”, “Our”, or “Us”) is committed to managing personal information responsibly throughout its lifecycle including its collection, use, disclosure, retention and secure destruction. This Data Retention and Governance Policy (“Policy”) establishes the framework for managing personal information in accordance with applicable privacy legislation.

This policy works closely in conjunction with our Privacy Policy, which explains how we collect, use, disclose, and protect personal information. In addition, it provides detailed information regarding individuals’ privacy rights. For more information about how personal information is defined and our privacy practices, please review our Privacy Policy.

This policy outlines:

• Our internal practices regarding the retention and secure destruction of personal information from users;
• The roles and responsibilities of our employees and authorized personnel throughout the lifecycle of personal information;
• The process for handling questions and complaints related to the management of personal information.

Scope

This policy applies to:

• Our employees, contractors and authorized personnel
• All personal information collected, used and or managed by Avera
• All systems, tools and business processes that involve user personal information.

Collection Of Personal Information

Personal information is collected in accordance with our Privacy Policy and only where necessary for business and operational purposes and for its intended purpose.

Information may be collected by third parties to use certain services or engage in business with us. If this information is not collected directly from the user concerned, the latter may request the source of the information.

Use of Personal Information

We use personal information only for the purposes generally identified in this Policy or for any other purpose identified at the time of collection. Where necessary, we will obtain the user’s consent.

We take reasonable steps to ensure the personal information we hold is accurate, complete and up-to-date when it is used to make decisions.

Our Purposes in Collecting, Using and Retaining Personal Information

We use personal information only for approved business purposes and in accordance with applicable privacy laws.

Providing Services

We process personal information to provide and deliver our services, including:

• Verifying a person’s identity;
• Taking, verifying or updating customer instructions;
• Managing accounts, responding to requests and questions.

Business Operations

We process personal information to manage our operations, for example:

• Processing employment applications;
• To meet our contractual, legal and regulatory obligations;
• Protect ourselves and third parties against error and fraud.

Marketing

Where users have provided consent, we may use personal information to send marketing communications.

Users may withdraw their consent at any time using the unsubscribe instructions provided in our communications, or by contacting us as set out in the “Handling Procedure for Requests and Complaints” section below.

We may continue to send non-marketing communications where necessary (e.g. service-related communications).

Research and Analysis

We may use personal information to:

• Understand our customers’ interests and priorities and adapt our offer;
• Develop new or improve services;
• Evaluate the effectiveness of our services, events, activities and marketing;
• Improve website functionality and performance;

We may use personal information for additional purposes where consent has been obtained.

Disclosure of Personal Information

Personal information is disclosed only as permitted or required by law or as necessary for business and operational purposes. Where third-party service providers process information on our behalf, appropriate contractual safeguards are in place to protect personal information.

Third-Party Websites, Cookies and Other Tracking Technologies

As referenced in our Privacy Policy, we may include links or plug-ins on our website to third-party sites or services that we do not control (e.g. Facebook, LinkedIn, Instagram or YouTube). These third-party organizations follow their own practices, and we encourage users to consult their documentation in this regard.

We may access information about the use of these links and plug-ins. We may also obtain and use analytical and statistical information from third parties to help us measure the performance and effectiveness of the content we display.

Please see our Privacy Policy for information on our use of cookies and other tracking technologies.

Retention of Personal Information

Personal information is stored in physical and electronic systems managed by Avera. Electronic records are kept on servers and storage devices located in Canada and the United States.

Some of our service providers may access, use or store personal information outside your province or country of residence, including outside Canada.

For additional information, users may contact us using the details indicated in the “Handling Procedure for Requests and Complaints” section of this policy.

Protection of Personal Information

We implement physical, technical, and organizational safeguards to protect personal information against loss, theft, and unauthorized access, use or disclosure. These safeguards are appropriate to the sensitivity, volume, purpose and format of the information.

Security Measures

Our measures may include:

• Physical measures such as secure storage and controlled access to facilities
• Technical measures such as encryption, firewalls, passwords, multi-factor authentication, anti-virus software and Secure Sockets Layer (SSL) technology
• Administrative safeguards such as policies, procedures and employee training in privacy, confidentiality and information security.

Internal Access to Personal Information

Access to personal information is restricted to employees and authorized personnel who require it to perform their duties. Access is only granted based on role and business needs, and all individuals with access to personal information are required to maintain its confidentiality.  Supervisors have the additional responsibility of enforcing privacy and confidentiality measures.

As a condition of employment, all employees must comply with this policy and related privacy and confidentiality practices as established by employment agreements, confidentiality clauses and other related policies. Employees must comply with this policy and related privacy practices. Failure to comply may result in disciplinary, legal or other appropriate action.

Retention and Destruction of Personal Information

Personal information remains protected for as long as necessary to fulfil the purposes for which it was collected to meet legal requirements. Personal information remains protected through its life cycle. Once no longer required, it is securely and permanently destroyed.

Rights Concerning Personal Information

Subject to certain legal and contractual restrictions, users have the right to:

• Access their personal information;
• Request correction of inaccurate information;
• Withdraw their consent;
• Request the deletion of their personal information;
• Remove their e-mail address from marketing communications;

Users may also request information about:

• The personal information collected, including from third parties;
• Who has access to their personal information within our Company;
• How long their personal information is retained;

Additional rights, such as data portability, may apply where required by law.

Exercising Rights

To exercise their rights, users may contact us at the e-mail address indicated in the “Handling Procedure for Requests and Complaints” section. Users are responsible for providing accurate, correct and complete information.

A user may also contact our Privacy Officer with any questions regarding this policy and to file a complaint about it, as well as about our privacy practices in general.

Handling Procedure for Requests and Complaints

Any requests, inquiries, and/or complaints regarding this policy or its application, must be submitted in writing to our Privacy Officer at the following e-mail address: privacy@averaav.ca, vieprivee@averaav.ca

Users should provide sufficient detail to allow us to assess the request, including:

• Name
• Contact information: telephone number, e-mail (if applicable)
• Description of the request or complaint

If the request or complaint is not sufficiently precise, we may request additional information deemed necessary to assess the complaint.

Processing Requests and Complaints

We treat all requests and complaints confidentially and aim to respond within 30 days of receipt. If additional information is required to assess a request or complaint, we will request it from the user.

A record of each request of complaint is maintained, including the details of the request, the analysis conducted and the response provided. Responses will be issued in writing by email or, where appropriate, via an alternative accessible format. Where a request is refused, or cannot be fully satisfied, we will provide an explanation.

We maintain a separate file for each request or complaint received. Each file includes the request, supporting documentation and the final response.

Users may file a complaint with the Commission d’accès à l’information du Québec or any other applicable privacy regulator. We encourage users to contact our Privacy Officer first to allow us an opportunity to address the concern.

Approval and Contact

This policy is approved by Avera Audiovisual Privacy Officer:

E-mail: privacy@averaav.ca, vieprivee@averaav.ca