Personal Information Governance
Version 1.0 · In effect on October 17, 2026
The French version of this document was written first. In case of a difference, the French version prevails.
This page sets out, in plain terms, the internal rules RM Digital Solutions LTD. follows to protect personal information: who is responsible, how long we keep information, how we destroy it and how we handle a complaint. It complements the Privacy Policy.
1. Roles and responsibilities
- Person in charge of the protection of personal information [responsable de la protection des renseignements personnels]: the person who holds the title of Privacy Officer, reachable at [email protected]. They see that the law is followed, approve these rules, keep the incident register and answer requests and complaints.
- People with access to the data: only those who need it for their work (support, billing, technical administration). Administrative access is personal to each person and logged.
- Providers: they process information only on our instructions, under a written agreement. The list is in the privacy policy.
2. Information life cycle
- Collection: only what is needed, with a notice at the time of collection (sign-up, forms).
- Use: only for the stated purposes. Any new purpose requires new consent, unless the law provides otherwise.
- Sharing: only with the listed providers, or when the law requires it.
- Retention: according to the schedule below.
- Destruction: permanent deletion of the database rows linked to the person. We keep only overall statistics with no link to a person.
3. Retention and destruction schedule
| Information | Period | Destruction |
|---|---|---|
| Account deleted at the person’s request | 30 days after the request | Automatic daily deletion |
| IP address and browser in the security log | 365 days | Automatic daily erasure |
| Sent emails (technical copy) | 90 days | Automatic daily deletion |
| Expired sessions and verification tokens | Until they expire | Automatic daily deletion |
| Access, correction or deletion requests | 3 years after the response | Manual review |
| Confidentiality incident register | At least 5 years | Manual review |
| Inactive accounts | As long as the account exists | Deletion from Settings or on request, erased 30 days after the request |
4. Privacy impact assessments
Before we acquire, develop or overhaul a system that processes personal information, and before we share information outside Québec, we carry out a privacy impact assessment. New systems are designed from the start to export the information in a structured format.
5. Confidentiality incidents
Any incident (unauthorized access, use or disclosure, or loss) is reported right away to the person in charge. We take steps to reduce the risk of injury, record it in the register and, if it presents a risk of serious injury, notify the Commission d’accès à l’information and the people concerned.
6. Complaint handling
- Write to [email protected] describing your complaint. No particular form is required.
- We acknowledge it and answer you in writing within 30 days.
- If the answer does not satisfy you, you may contact the Commission d’accès à l’information du Québec.
7. Training and review
The people who have access to personal information are informed of these rules. We review these rules at least once a year and whenever a system or a provider changes.