CONFIDENTIALITY AND PRIVACY POLICY

INTRODUCTION

The Musée national des beaux-arts du Québec (the “MNBAQ” or the “organization”) recognizes the importance of protecting personal information, i.e., any information concerning an individual that allows the individual to be directly or indirectly identified (“personal information”).

This Confidentiality and Privacy Policy (the “Policy”) describes the measures that the MNBAQ applies to protect the personal information that it collects, uses, discloses, processes, and preserves in the context of operating its website (mnbaq.org) and its day-to-day operational activities.

The policy seeks to comply with the provisions in the Act respecting Access to documents held by public bodies and the Protection of personal information (the “AADHPBPPI” or the “Act respecting Access”) as amended by SQ 2021, c. 25 (“Bill 25”) and the Personal Information Protection and Electronic Documents Act (PIPEDA).

UPDATE AND NOTICE OF ALTERATION

This policy can be amended from time to time to ensure the MNBAQ’s compliance with the Act and consider any change in the personal information collection process.

Any amendment of the policy will be subject to prior notice that specifies:

• the general purpose of the amendments to the confidentiality policy; and
• the date on which such amendments come into force.

Coming into force: September 22, 2023

Last update: September 20, 2023

Approved by:

• The MNBAQ Access to Information and Privacy Committee, September 21, 2023
• The Board of Directors on December 14, 2023 (CA 2023-12-14 9.2)

PERSONAL INFORMATION COLLECTED

The collection by the MNBAQ of personal information solely includes information that is necessary for it to pursue its activities, i.e., information pertaining to your identity, such as your name, street address and email address, telephone numbers, company name, demographic information, and information related to the use of the website.

The MNBAQ collects personal information as indicated below.

Directly from you

You provide most of the personal information collected when you:

• directly purchase from the MNBAQ a product or service such as a ticket or a subscription;
• participate in a survey, a study, or an event that the MNBAQ organizes;
• subscribe to the MNBAQ newsletter or any other personalized communication;
• make any other request concerning the products and services that the MNBAQ offers, e.g., submitting a comment or a complaint;
• visit the MNBAQ, which is equipped with video surveillance cameras to ensure the safety of individuals, property, and infrastructure;
• apply for a position.

Directly through the MNBAQ website

The MNBAQ can also collect information on visitors to its website or through the online services portal, including the identifier of the computer equipment used (IP address). Such information is collected by means of cookies, which enables us to recognize users of our website when they access it and move from page to page. We use the following types of cookies on our website:

• necessary cookies, which facilitate the smooth operation of the website;
• statistical and audience measurement cookies collect information on how visitors use the website by measuring the traffic on the website or its performance by means of statistics;
• cookies related to social networks, which seek to enable users to share pages more readily from the MNBAQ website on social networks by proposing the most widely used social networks in their region;
• personalized advertising cookies, which facilitate the presentation of personalized advertising and the measurement of the efficacy of the advertisements presented.

When required, the MNBAQ will request the user’s consent before collecting the information. 

Indirectly, through third parties with which we do business in the context of our activities

The MNBAQ can also collect information through the partners indicated below.

• The Fondation du Musée: the MNBAQ collects your personal information through the Fondation du Musée in order to propose products and services.
• Other Québec museums: in the context of its activities, the MNBAQ collects your personal information through other Québec museums. An agreement that complies with the requirements of the Act governs such information collection.

CONSENT

The MNBAQ collects, uses, and communicates personal information for specific purposes at the time of collection. Below are some non-limitative examples of the purposes for which the MNBAQ collects your personal information.

When the Act so requires, the MNBAQ will request your consent before using your personal information.

ACCESS TO AND COMMUNICATION OF PERSONAL INFORMATION

Personal information is disclosed and accessible to MNBAQ employees who have reasonable grounds for accessing it to carry out the objectives stipulated in this policy. All the personal information stored on the MNBAQ’s servers is secure and is only accessible to employees who are entitled to access it in the context of their duties. The MNBAQ adheres to the principle of least privilege when granting access to personal information according to the users’ roles and responsibilities.

Third parties such as partners and suppliers, in particular the Fondation du Musée (the “Fondation”) can also access the personal information collected to achieve the objectives stipulated in this policy. They cannot access personal information beyond what is necessary to attain a given objective.

The MNBAQ undertakes to avoid communicating personal information to other third parties except in the follow instances when:

• 1. the Act requires it;
• 2. the communication of personal information to a third party is required in respect of all legal proceedings;
• 3. the communication of personal information to a third party is necessary to prove or protect legal rights;
• 4. the communication of personal information to a third party occurs in the context of an agreement concluded between public bodies.

WHERE IS YOUR PERSONAL INFORMATION STORED?

The servers containing personal information are located in Québec, Canada. However, it is possible that the communication to certain providers of technological solutions of personal information leads to the transfer outside Québec of such information. In such cases, the MNBAQ will:

• analyze the risks related to the necessary protection of personal information;
• validate beforehand the applicable legislation and privacy practices in the jurisdiction in question and ensure adequate protection of your personal information;
• inform you accordingly at the latest when your personal information is collected.

RETENTION PERIOD AND DESTRUCTION OF PERSONAL INFORMATION

The MNBAQ has implemented measures to ensure that it complies with obligations governing the retention and destruction of personal information.

The personal information that the MNBAQ collects is not retained beyond what is necessary to achieve the purposes for which it is collected.

Notwithstanding the foregoing, the MNBAQ retains your personal information when required to do so to comply with the applicable legal obligations aside from those pertaining specifically to privacy.

MEASURES TO PROTECT PERSONAL INFORMATION AND TRAINING AND AWARENESS-RAISING AMONG STAFF

The MNBAQ has adopted physical safety, organizational, contractual, and technological measures that reflect the sensitivity of personal information to properly protect such personal information from theft, loss, unauthorized access, transfer, or copying, or alteration.

Confidentiality agreements bind MNBAQ employees. Training and awareness-raising pertaining to information security and the protection of personal information are offered to MNBAQ employees. Data processing systems comply with industry-recommended frameworks and protocols.

USERS’ RIGHTS

You can assert the following rights given that the MNBAQ has collected or used personal information that concerns you.

The right to access or rectify your personal information: the MNBAQ makes a reasonable effort to ensure that the personal information that it collects is accurate and complete from the standpoint of the purposes for which it is used. You can consult your personal information, verify its accuracy, and modify it, if necessary, subject, however, to the exceptions stipulated by the Act.

This is possible, in particular, through your MNBAQ online account. However, when it is impossible to exercise this right through your online account, you can submit a request. Your request for access or rectification must be submitted in writing to the head of the protection of personal information, whose contact information is indicated in section 10. Your request will subsequently be processed not later than 20 days following the date of receipt of your written request. A 10-day extension may be necessary to process your request, in which case you will be notified accordingly.

The right to withdraw your consent: you can withdraw your consent for the MNBAQ to use your personal information for purposes that are not essential to the management and administration of the products and services offered or the processing of your requests.

It will not be possible to withdraw your consent to use your personal information for a purpose pertaining to the management and administration of products and services without ceasing beforehand to provide you with the service or the product that you requested.

Any request to withdraw consent must be submitted to the head of the protection of personal information, whose contact information is indicated in section 10.

The right to lodge a complaint: questions concerning your personal information or complaints in the wake of non-compliance with the principles stipulated in the policy must be sent to the head of the protection of personal information, whose contact information is indicated in section 10.

[In force as of September 2024] The right to data portability: anyone concerned must be able upon request to obtain a copy of the personal information collected. If the individual’s personal information is computerized, the person can request that it be communicated in the form of a written, comprehensible transcription.

Exceptions: Hyperlinks or redirection to third-party websites or applications

Our websites and applications can contain hyperlinks or offer redirection to other websites of our partners, suppliers, advertisers, and other third-party enterprises. Accordingly, by clicking on such hyperlinks you leave the MNBAQ’s websites.

The MNBAQ adopts reasonable means to ensure that its partners comply with the applicable legal requirements pertaining to the protection of personal information. However, the MNBAQ neither controls the operation of such websites nor the manner in which your personal information is collected, stored, used, or shared or to whom it is disclosed. You must consult the confidentiality policies specific to such third-party websites before opting to provide them with personal information. The MNBAQ cannot be held liable for confidentiality or privacy practices, nor for the contents of other websites other than its own websites.

CONTACT

The head of the protection of personal information is responsible for ensuring the protection of your personal information, i.e., for adopting all the measures necessary to ensure your rights as described in the preceding sections. Below is his contact information:

M^e Marc Lajoie, LL. B., LL. M.
Secretary General and Legal Counsel
Musée national des beaux-arts du Québec
Parc des Champs-de-Bataille
Québec (Québec) G1R 5H3
Canada
secretariat.general@mnbaq.org
Fax: 418 644-1067

Requests will be examined and processed with all due respect.