Privacy Policy – CECFQ
1. Introduction
The Centre d’Enseignement et de Certification du Français du Québec (CECFQ) places great importance on protecting personal information collected through its website, educational services, and forms. This policy outlines our practices in accordance with the requirements of Quebec’s Law 25, fully in effect since September 2024.
2. Person Responsible for Data Protection
In accordance with Law 25, CECFQ appoints a person responsible for the protection of personal information. If this function is not delegated, the President assumes responsibility by default. The name, position, and contact details of this person are available on our website.
3. Consent
We collect personal information only with free, informed, and specific consent given for identified purposes. Consent is obtained separately from other information and is explicitly confirmed, especially for sensitive data.
4. Transparency and Data Collection Technologies
We clearly inform individuals when data is collected, including through profiling technologies (cookies, analytics tools, etc.), and provide information on how to disable such technologies.
5. Privacy Impact Assessments (PIA)
Before collecting or disclosing sensitive data, or transferring it outside Quebec, we conduct a PIA to assess privacy risks and implement appropriate protection measures.
6. Retention, Destruction, and Anonymization
Personal information is kept only for as long as necessary for the purposes stated, then securely destroyed or anonymized. We maintain a data inventory and a retention schedule.
7. Privacy by Design and by Default
Our services and interfaces are designed to provide the highest level of privacy by default, without requiring any action from the user.
8. Rights of Individuals
Every individual has the following rights:
- Right of access to their personal information
- Right of rectification
- Right to erasure (“right to be forgotten”)
- Right to withdraw consent
- Right to restrict processing
- Right to data portability
Requests are processed promptly in accordance with legal deadlines.
9. Incident Notification
In the event of a data breach that poses a risk of serious harm, we promptly notify the Commission d’accès à l’information du Québec as well as the affected individuals. A register of all incidents is kept for five years.
10. Governance and Training
We have established internal data governance policies and complaint-handling procedures. Staff receive regular training on personal information protection and data security.
11. International Data Transfers
Any transfer of personal data outside Quebec is subject to a PIA and is carried out only if adequate safeguards are in place.
12. Policy Updates
This policy is reviewed regularly to reflect legislative changes and best practices. Significant changes are clearly communicated to users.
13. Contact
For any questions or to exercise your rights, you may contact our Privacy Officer at: presidence@cecfq.ca
14. Legal Basis
This policy is based on the Act Respecting the Protection of Personal Information in the Private Sector of Quebec (Law 25), fully applicable since September 2024.