Data protection policies
Privacy Policy for Individuals Working for the Producer
Effective Date: September 23, 2023
1. Purpose and Scope
Productions Eurêka! and its subsidiaries (hereinafter, the “Producer”) are committed to handling the personal information of individuals working for them in accordance with the Private Sector Privacy Protection Act. This Privacy Policy for Individuals Working for the Producer (hereinafter, the “Policy”) informs individuals working for the Producer of its practices regarding the collection, use, and disclosure of their personal information, as well as their rights concerning their personal information.
This Policy applies to all individuals working for the Producer (hereinafter, the “Designated Persons”).
2. Definition of “Personal Information”
In this Policy, the term “personal information” refers to any information that relates to a natural person and directly or indirectly identifies them.
3. Collection of Personal Information
The Producer collects personal information about Designated Persons as necessary for managing their work relationships. The Producer may collect the following personal information:
- Identifiers and contact details, such as name, email and postal addresses, phone number, government-issued IDs (e.g., social insurance number, visa and passport information), and work/residence permits.
- Demographic information, such as date of birth, gender, citizenship, or medical information. In some cases, demographic data related to equity, diversity, and inclusion programs may be collected on a voluntary basis (e.g., ethnic origin, sexual orientation).
- Professional or employment-related information, such as job title and salary history, work schedule, professional status, work experience, education, permits, and certifications, benefits and leave information, details of any issues or disputes, performance reports and evaluations, psychometric test results, disciplinary records, employment end date, and reasons for termination.
- Financial information, such as details provided by individuals for payroll management (bank account details) and information required for issuing tax forms.
- Information regarding internet, network, devices, and premises use, such as IP address (if it identifies the employee) and device ID (e.g., when connecting to the Producer’s Wi-Fi network). The Producer may collect information on the use of work email accounts, internet, computers, phones, and other devices provided by the Producer or personal devices used for work purposes. The Producer may also collect video images and photos via closed-circuit cameras.
- Other information, such as details provided through the payroll management system.
4. Retention and Destruction of Personal Information
The Producer implements appropriate measures and controls to protect the personal information of Designated Persons. These measures include restricting physical access to the Producer’s offices and records, preventing unauthorized access, disclosure, use, or misuse of personal information, storing archival documents with trusted third parties in secure locations, using firewalls, passwords, and file encryption for online activities.
The Producer aims to prevent unauthorized access, loss, misuse, sharing, or alteration of personal information in its possession. These protections are also applied when deleting or destroying the personal information of Designated Persons.
The Producer seeks to store its personal information in Quebec or, when not possible, in Canada. However, information stored on the servers of the Producer’s service providers may be located outside of Canada and may be subject to the laws of that country, including any law allowing government authorities to access the information. Subject to these foreign laws, the Producer will use its best efforts to include contractual protections to ensure the personal information receives at least the same level of protection as in Quebec.
The Producer retains personal information of Designated Persons only for the period reasonably necessary to fulfill the purposes for which it was collected or as permitted or required by the Private Sector Privacy Protection Act. Once no longer needed, personal information is securely destroyed or anonymized, in accordance with the Private Sector Privacy Protection Act.
The following retention periods are considered reasonably necessary for retaining the personal information of Designated Persons:
- Permanently for documents containing usage rights, copyrights, neighboring rights, or any other rights necessary for exploiting a work (e.g., author, director, performer contracts).
- Seven (7) years after the end of the project for which the person worked for the Producer for tax-related documents.
- Three (3) years after the end of the project for which the person worked for the Producer for all other personal information.
5. Use of Personal Information
The Producer uses the personal information of Designated Persons for managing its work relationships and other legitimate purposes as outlined in this Policy, as well as for other purposes permitted by the Private Sector Privacy Protection Act.
For example, the Producer may use the personal information of Designated Persons for:
- Administering personnel, including verifying the identity of individuals working for the Producer, managing taxes and social security, planning schedules, tracking attendance and hours worked, setting up emergency contact details, and processing work-related requests.
- Managing benefits, including determining eligibility for benefits for Designated Persons, their dependents, and beneficiaries.
- Administering payroll, sick leave, and other types of leave.
- Evaluating performance, including making decisions regarding assignments, training, pay, and promotions.
- Taking necessary steps to protect the health and physical and mental well-being of Designated Persons.
- Managing internal business activities, such as implementing disaster recovery plans, conducting internal audits and investigations, and generating statistics and analytical tools for legitimate business purposes (e.g., improving business processes and managing the Producer’s personnel).
- Preparing and managing work visa applications.
- Complying with legal and regulatory obligations, addressing security needs, and managing fraud, including conducting internal investigations and monitoring the use of the Producer’s information technology systems.
In addition to the purposes described above, the Producer may also collect personal information from Designated Persons for any other purpose, with their consent, when required by the Private Sector Privacy Protection Act.
7. Accuracy, Access and Rectification Individuals working for the Producer must provide the Producer with accurate and complete personal information, and must update their personal information held by the Producer promptly after any change to that information. Designated individuals may request information about their personal information held by the Producer, as well as access to that information, and may request that their personal information be amended if it is inaccurate or incomplete, subject to various exceptions provided for in the Act respecting the protection of personal information in the private sector (in particular when access must be refused to protect other individuals and to protect the Producer’s privileged or confidential information). Designated individuals may also request more information about the processing of their personal information by the Producer, in particular with respect to the categories of individuals who have access to their personal information within the Producer as well as the retention period applicable to their information. Designated individuals may address their requests for access or requests for rectification of personal information in writing to their manager or supervisor. Designated individuals who are not satisfied with the outcome of their request addressed to their manager or supervisor may submit a formal request for access directly to the Privacy Officer. 8. Roles and Responsibilities of Staff Members Throughout the Personal Information Lifecycle All designated individuals who obtain personal information in the course of their work are responsible for maintaining the confidentiality of such information to the extent provided for in this Policy. In particular, France Choquette, President and Producer, serves as the Privacy Officer for the Producer and is responsible for ensuring compliance with the Act respecting the protection of personal information in the private sector. 9. Complaints and Questions Designated individuals who believe that their personal information has been processed in violation of this Policy may raise the issue with their manager or supervisor. Designated individuals who are not satisfied with the outcome of their complaint and question contact the Privacy Officer. Any privacy incident involving personal information must be immediately reported to the Privacy Officer. A privacy incident includes the following situations:- Access to personal information that is not authorized by law;
- Unauthorized use of personal information by law;
- Unauthorized disclosure of personal information by law;
- Loss of personal information or any other breach of the protection of such information.
