Privacy policy

The protection of your privacy is a priority for the Château Ramezay.

Objective of the policy

At the Château Ramezay, we are committed to protecting the privacy of your personal information and being transparent about the information we hold about you.

The purpose of this policy is to clearly set out how we collect and process your personal information, including the information you may provide when making a donation or when asking for a tax receipt, for example.

We use the information we collect in compliance with:

• The Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada
• Québec’s Law 25 governing the protection of personal information in Québec

This policy explains:

1. The information we collect about you and why
2. How we collect your data
3. Limitation on disclosure of your data to third parties
4. The security of your personal information
5. Data retention
6. Your legal rights
7. Notification of changes to our Privacy Policy
8. Contact details and additional information

If you have questions about this policy, please contact the person responsible for the protection of personal information at the Château Ramezay. The contact information is provided in point 8 below.

1. The information we collect about you and why

We only collect the personal information we need to offer you our products and services. We may collect the following information:

Biographical information including full name, email address, postal address, telephone number, professional experience and employment profile.

We may collect this information for the following purposes:

• Provide the services and information you request
• Register you as a donor or friend of the Museum
• Respond to your comments and questions
• Communicate with you
• Review your application for employment

Usage data including your Internet Protocol (IP), login data, browser type and version, time-zone setting and location, browser plug-in type and version, operating system and platform.

We may collect this information for the following purposes:

• Operate, maintain and improve the features of our website
• Understand and analyze your user trends and preferences
• Create new products and services

Transactional data including the details of your payment card, your billing and delivery address and details regarding the donations you have made and the services you have received from us.

We may collect information for the following purposes:

• Finalize your purchase of products and services
• Process your donation and issue a tax receipt
• Process information about your credit card or bank account with the assistance of a thirdparty provider

We may also sometimes use your personal information to:

• Respect our legal obligations
• Prevent cyberthreats and fraud
• Respond to requests, warrants and orders from a court or other organization
• Protect your rights and interests as well as ours
• Cooperate with legal proceedings or investigations

2. How we collect your data

We may collect your personal information when you:

• Visit our website
• Enter information on our website
• Communicate with us by phone, email or social media
• Make a donation
• Purchase a product or service
• Subscribe to a newsletter
• Post content on our social media accounts
• Apply for a job

We occasionally receive information about you from third parties, including:

• Analytics providers such as Google Analytics
• Advertising networks such as Facebook
• Search information providers such as Google
• Publicly available information about you

3. Limitation on disclosure of your data to third parties

There are specific situations in which we may communicate your personal information to third parties. These circumstance are as follows:

• To our service providers and our partners with whom we collaborate and who process data on our behalf and according to our instructions. We require all third parties to respect the privacy of your personal information and to process it in accordance with the laws in effect. We do not authorize our thirdparty service providers to use your personal information for their own purposes and we only authorize them to process it for specific purposes and in accordance with our instructions.
• When we are required to disclose your personal information in order to comply with any legal obligation (for example, to government agencies and law enforcement agencies).

4. The security of your personal information

Measures

We have in place physical, administrative and technical measures to protect the privacy and security of the personal information we hold. Our servers are also managed by a specialized third party.

We have an incident management policy in the event of an incident involving personal information. It requires us to inform the authorities and the people concerned should an incident occur that could present a risk of serious harm and to implement measures to limit the negative consequences.

Limitation of Access

Only authorized and qualified staff who need to consult your personal information in the performance of their duties have access to it.

Complaints Procedure

If you have reason to believe that the security of the personal information you provided us is compromised or if you wish to express your dissatisfaction, please contact us immediately. Our contact information is provided in point 8 of this policy.

Following the filing of a complaint:

• A notice of receipt will be sent to you within five business days following receipt of the complaint.
• The person responsible for your file will review it and conduct an investigation.
• A detailed response to your complaint will be sent to you as soon as possible, and no later than 15 business days following the date of receipt of the complaint. This response will include a summary of the complaint, the outcome of the investigation and the final decision accompanied by an explanation.
• If you are not satisfied with the final decision, you can file an official complaint with the Commission d’accès à l’information du Québec.

5. Data retention

We only keep your personal data for the period required to attain the objectives for which we collected it, including to satisfy all legal, accounting or reporting requirements.

To determine the appropriate retention period for your personal information, we take into account several factors, including the quantity, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or unauthorized disclosure of your personal data, our purposes for using your personal information and whether we can achieve those purposes through other means, as well as certain legal requirements that may apply.

6. Your legal rights

You have certain rights under data protection laws regarding your personal information. To exercise these rights, contact the person responsible for the protection of personal information at the Château Ramezay. The contact information is provided in point 8 of this policy. We may ask for a piece of identification to confirm it is you.

a) Access to your personal information

You have the right to request a copy of the personal information we hold about you.

b) Correction of your personal information

You have the right to request that we correct the personal information we hold about you, although we may need to verify the accuracy of the new information you provide.

c) Erasure of your personal information

You have the right to ask us to erase or remove personal information where there is no good reason for us to continue to process it. Note that in certain cases, special legal requirements may prevent us from complying with your request, and we will be able to provide you with explanations on request.

d) Objection to processing of your personal information

You have the right to object to the processing of your personal data despite our legitimate interest if, because of your particular situation, you believe that it has an impact on your fundamental rights and freedoms. In certain situations, we may be able to demonstrate that we have legitimate grounds to process your information that override your rights and freedoms.

e) Restriction of processing your personal information

You have the right to request that we suspend the processing of your personal data in the following scenarios:

• If you want us to establish the data’s accuracy
• If our use of the data is unlawful but you do not want us to erase it
• If you need us to hold your data even if we no longer require it as you need it to establish, exercise or defend legal claims
• If you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it

f) Withdrawal of consent

In circumstances where we are relying on your consent to process your personal data, you have the right to withdraw your consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

7. Notification of changes made to our Privacy Policy