Cinema Politica : privacy statement under Law 25 in Quebec
Foreword
This policy deals with the management and protection of information deemed confidential within Cinema Politica (CP) in accordance with Quebec privacy legislation (in French), notably the Act respecting the protection of personal information in the private sector (Law 25).
Cinema Politica is committed to respecting and protecting your privacy. We take the security and confidentiality of your personal information very seriously. The purpose of this policy is to provide you with clear and transparent information on how we handle your personal data and to explain your rights in this respect.
The policy applies to relations between all persons: directors, donors, staff members, volunteers and clientele, partners as well as all other persons working or present on the various premises of Cinema Politica.
The policy has the following objectives:
- to ensure respect for the privacy of individuals and the security of personal information held by Cinema Politica;
- to establish guidelines for the exchange of information both inside and outside the organization’s premises;
- to outline Cinema Politica’s practices regarding the collection, use and retention of personal information.
If you have any questions or concerns about this policy or the way in which we manage your personal information, please contact us using the contact information provided at the end of this policy.
Organizational Mission & Values
Cinema Politica is a non-profit media arts organization dedicated to supporting the work of independent, political filmmakers in Canada and beyond. CP is made up of an alternative exhibition network, dedicated distribution arm, and a Video on Demand platform for cutting edge, socially-engaged cinema.
Cinema Politica’s main office is located on the unceded lands of Kanien’kehá:ka Nation in Tiohtiá:ke, or Montreal. The CP team believes it is not enough to acknowledge the title-holders of the lands, rather we urge everyone who attends our screenings and streams our films to become involved in anti-colonial and Indigenous-led struggles and resistance everywhere.
Cinema Politica is funded through arts council grants, membership fees, distribution revenues and audience donations. We have been free of corporate sponsorship since our inception in 2003.
Obligations of Confidentiality
Cinema Politica collects both Personal Information and Non-Personal Information. Personal Information is the focus of this policy.
CP does not sell, trade, rent or otherwise share for marketing purposes your Personal Information with third parties without your consent. We do share Personal Information with banks, third party payroll services or financial processing systems who are performing services for CP for purposes of processing payments and honorariums.
In general, we use Non-Personal Information to help us improve our services and to improve our work. If our information practices change at any time in the future, we will post the policy changes to our website. We suggest that you check periodically if you are concerned about how your information is used.
Cinema Politica agrees to:
- Ensure the security and confidentiality of any personal information obtained;
- Implement measures to protect confidential information;
- Ensure that complaints about confidentiality are addressed;
- Ensure the confidential treatment of complaints;
- Collect only information that is useful or necessary;
- Apply the confidentiality policy with respect to the values of CP;
- Act with respect and transparency when applying this policy, and act in compliance of the applicable laws.
All persons within CP (employees or contractors) who obtain confidential information in the course of their duties are required to respect the confidentiality of such information. An exception is made in certain cases, where it is essential for those involved to be able to exchange certain information for the betterment of our work. In such cases, the persons concerned must also maintain the confidentiality of the information exchanged. This obligation continues even after their relationship with CP has formally concluded.
Obligations of Discretion
Any person who, within CP, has exchanges that are not related to the performance of their duties must act with discretion in regards to the sharing of any confidential information.
Accordingly, they must:
- Respect the privacy of others;
- Not divulge confidential information obtained within the organization;
- Guard the sensitive information of those who confide in them;
- Act in accordance with the organization’s values.
Collection and use of Personal Information
Cinema Politica collects and uses Personal Information in compliance with Law 25 in the province of Quebec, Canada. Personal information is collected only for specific, legitimate and clearly identified purposes, and is not subsequently processed in a manner incompatible with these purposes.
In general, the Personal Information you provide to us is used to help us communicate with you, employ you or process financial forms. For example, we use Personal Information to contact users in response to questions, send relevant information regarding your submission of this information, process payments or communicate about your role if employed by the Organization.
We may share Personal Information with outside parties if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably necessary to meet any applicable legal process or enforceable governmental request; to enforce applicable Terms of Service, including investigation of potential violations; address fraud, security or technical concerns; or to protect against harm to the rights, property, or safety of our members or the public as required or permitted by law.
Types of Personal Information Collected
When you interact with CP, whether as an employee, board member, local organizer, programmer, client, or any other user of our website, we may collect various types of personal information in line with our organizational needs.
This information may include, but is not limited to:
- Contact information: full name, mailing address, email address, phone number;
- Identifying information: Date of birth, social insurance number (for payroll);
- Financial information: credit card number and other information linked to those transactions (for donations);
- Information on your interactions with CP: general inquiries, film submissions, inquiries about starting a local, messages received by email or via the website, and website visits;
- Any other information you choose to share with CP.
Objectives of the collection and usage of personal information
Google Analytics
CP uses Google Analytics to collect anonymized data on our website usage. This data is anonymous, meaning that online behavior cannot be traced back to the individual. Google Analytics uses cookies to collect non-personal data about your activity on our site as well as the path you took to get there.
We use this information for statistical purposes and to better understand the needs and interests of our website visitors.
This information is collected and stored by Google in the United States. Click here to view Google’s privacy policy.
It may be possible for you to prevent this information from being collected from you by Google Analytics (and, in turn, by Cinema Politica) by using an add-on such as Google Analytics Opt-out or other software. Although Cinema Politica does not discourage you from doing so, Cinema Politica takes no responsibility for your use of any such software.
Cookies
CP’s website, like most websites, uses cookies.
Data stored in a cookie that is created by the server upon your connection. This data is labeled with an ID unique to your computer. It can be thought of as an internet user’s identification card, which indicates to a website that a user has returned to the site.
Each web browser gives users control over their cookies. Please consult aboutcookies.org, section How to manage and delete cookies in the most common browsers which details the process for each browser.
Cookies allow certain features of our website to function and allow CP to collect non-personal data and statistics about the usage of our website. This enables us to better understand the reach of our work.
We also use cookies on the site to keep track of your consent to our Privacy Policy. This cookie is created when you accept the privacy notice pop-up and will be deleted if/when you clear cookies on your browser.
Hosting
CP’s website, server and infrastructure is hosted by Koumbit, a Quebec-based non-profit company whose encrypted servers are located in Montreal (Tio’tia:ke – Mooniyang), Quebec, Canada. Click here to read Koumbit’s privacy policy.
We also collect your IP address and the URLs of pages you visit, in order to be able to serve you the web pages you request. This information is collected by our web hosting service.
Notwithstanding the above, CP’s website might use third-party components, plugins, payment services and other add-ons that store their information in the United States or other countries that are not subject to Canadian and Quebec privacy laws.
Video On Demand Services and Third-Party Websites
CP uses third-party platforms such as Vimeo and Vimeo OTT (VHX) for the sale, rental (pay-per-view) and streaming of films and the management of subscriptions to video-on-demand services.
In order to use these services, our clientele might be required to create an account and process transactions on these external platforms. Click here to view the Vimeo privacy policy and click here to view the Vimeo OTT (VHX) privacy policy.
CP’s website may contain links to other such websites that are outside the realm of our operations. By clicking on an external link on our website, you will be redirected there and no longer covered by CP’s privacy policy. We advise that you review the Privacy Policy of the new website in question.
CP does not assume any responsibility for the privacy policies, practices or content on any third-party website.
Newsletter Subscription
CP uses Mailchimp to collect and store data for the purpose of sending emails. When you sign up to receive email from us, we collect some or all of the following information:
- First and last names
- Email address
- IP address
- Email preferences
With the exception of your IP address, this information is provided by you through the Mailchimp sign-up form. This data will be stored on Mailchimp’s servers in the United States and is also subject to Mailchimp’s privacy policies.
Financial Transactions
CP uses Paypal and Paysafe to process payments and regular donations. Click here to view the PayPal privacy policy and click here for the Paysafe privacy policy. CP does not store the payment card details you provide to make a payment.
Other Tools and Platforms
CP uses the following platforms to conduct our operations; Google Workspace, Zoom Pro, Slack and CiviCRM. These platforms are protected by passwords. It is important to note that these are U.S. platforms, and thus follow U.S. laws on privacy protection. Though we do our best to maintain rigorous privacy measures for technology, there is always a risk that Personal Information could be compromised. CP may integrate new software as required to perform our duties in a regular course of operations.
Management of Personal Information
The person occupying the role with the highest authority within Cinema Politica, is designated as the person responsible for ensuring the protection of personal information. This person may delegate this responsibility in writing by designating them in the role of Privacy Officer. The way to contact the Privacy Officer is available in this policy, as well as on CP website. The Privacy Officer is responsible for maintaining a registry of privacy incidents.
The person holding the highest authority at CP is authorized to access the personal information held by the organization as necessary in the usual course of duty, with the exception of cases of conflict of interest. All other employees are authorized to access any personal information to the extent that it is necessary for the completion of their tasks.
In accordance with Quebec’s Law 25, a privacy incident includes any unauthorized access, use or disclosure of personal information, as well as any loss or breach of personal information.
The procedure to seek recourse for any breach of personal information is outlined in this policy.
Conservation of Personal Information
Cinema Politica implements security measures designed to protect your information from unauthorized access. Your data is protected by implementing security measures including passwords and multi-factor authentication for accessing data. However, these measures do not guarantee that your information will not be accessed, disclosed, altered or destroyed by breach of such security measures. By submitting your data, you acknowledge that you understand and agree to assume these risks. We will do our best to minimize any chance of this happening.
Cinema Politica is committed to keeping our security practices up-to-date to safeguard the confidentiality of your personal information. Some of the practices that we have in place to ensure this are: limiting access to sensitive data to a need-to-know basis, password protection on documents with sensitive data, and limiting downloads of personal information to local computers as much as possible. We are putting in place staff training on cybersecurity and on personal information best practices.
Exchanges of information outside Cinema Politica
- The Board of Directors, management and employees must not discuss files, persons or decisions specific to CP, with outsiders or persons not concerned. In an exceptional situation, they must limit exchanges of information to the strict minimum.
Exchanges of information within Cinema Politica
- Limit exchanges of information between employees to team meetings or in a secure area (e.g. office with closed door);
- Avoid discussing issues pertaining to confidential information outside of these times. If this is not possible, make sure not to use identifying information, and discuss in a location that ensures confidentiality;
- Ensure that telephone conversations dealing with confidential information are not overheard by others.
Security measures to limit access to information
CP stores some personal information in physical hard drives or as paper copies at our office in filing cabinets. Some personal information is stored virtually in private emails secured by CP, on password-protected personal computers or on network or cloud storage with restricted access.
- All personal information stored virtually will be protected by a password or have restricted access to specific user accounts;
- All personal information stored physically will be in locked drawers and cabinets, the keys being held strictly by senior personnel that need to access the information;
- A secure NAS drive is used to back up confidential files.
Office
CP primarily works in a physical office, and occasionally uses a virtual office. The following applies to both circumstances.
CP employees must:
- Lock computer screens at lunchtime or when absent from the office;
- Change passwords (server, computer, voice mail or other) every 3 months;
- Close office doors at lunchtime, at the end of the day, or in case of absence;
- Lock the main office door when stepping out of the office.
- Turn on the alarm system upon leaving at the end of the day.
Job Applicants, Employees and Board Members
Cinema Politica uses email for job applications, which means that the following information might be stored if you apply for a job with us:
- First and last name;
- Email address, phone number;
- The answers that you provide to the job related questions;
- Any information that you choose to provide us relating to employment equity;
- Your CV.
Sensitive employee and board member data, such as financial information, social insurance numbers, ID cards, banking information and any other HR-related sensitive documents are stored in a remote repository that includes two-factor authentication. This information is only accessible to the Executive Director, Board Member(s) responsible for HR, and accountants. This service is run by a United States-based company and the information is stored outside of Quebec and Canada.
Other staff information, such as employment contracts and salary information, is stored in Cinema Politica’s Google Workspace and is only accessible to the Executive Director and one board member responsible for HR. This is in accordance with Cinema Politica’s values and practices regarding transparency and collective management.
Some information, such as training materials, the signed project contract and any other written material relevant to a contract, might also be stored in our Google Workspace. These files are shared only with relevant staff members and the Cinema Politica external affiliates who are working on the project.
Please note that these external services store your data outside of Quebec and Canada.
Limits of confidentiality
CP will not disclose any personal information to any outside party or to any of its affiliated entities without the person’s knowledge and consent, except to the following persons:
- an auditor related to an audit of Cinema Politica;
- an organization or individual providing services to CP, if the personal information is reasonably necessary for the provision of said services. In such a case, the organization or individual must act in accordance with this Policy, and use such personal information only for the purposes of providing services to CP;
- a lawyer representing CP in a matter involving personal information;
- anyone submitting a subpoena, warrant or court order obligation;
- a government institution requesting such information, which submits its request authorization, in connection with the administration of any applicable law;
- in any other circumstance where disclosure is explicitly permitted under applicable privacy laws.
Destruction or anonymization of personal information
CP ensures the destruction or anonymization of personal information in accordance with the requirements of Law 25 in the province of Quebec, Canada, once the data is no longer required for the purposes for which it was collected.
Communicating personal information collected with the concerned person
An individual has the right to request access to their personal information retained by CP. Once this information has been requested in writing, CP will communicate this information within 30 days in accordance with the provisions of Law 25.
Accessing your personal information:
- An individual can request a copy of their personal information to consult the information.
- An individual has the right to make corrections to the information when it is inaccurate and/or incomplete.
In some circumstances, the organization can legitimately refuse to give the individual access to certain parts of their personal information file if it could compromise the mission and values of the organization.
Breach of Confidentiality
A breach of confidentiality has occurred when a member of CP, meaning a staff member, director, or contractor, carries out one of the following actions:
- If a member of CP discusses personal information with external parties;
- If a member of CP gives personal information to non-authorised parties;
- If a member of CP leaves personal information in a location where non-authorised parties could access it;
- If a member of CP accesses personal information for their individual personal gain or interest.
Failure to comply with the obligations of this policy
Any breach of the obligations set out in this Privacy Policy will be dealt with appropriately in accordance with the remedies and sanctions provided by Law 25.
Recourse
In the event that it is determined that an individual’s personal information has been used in a manner that is inconsistent with this policy or the law, that individual has the right to recourse.
The individual has the right to file a complaint here with the Privacy Officer. Should the complaint pertain to the Privacy Officer, the complaint will be sent to the Executive Director, or to the Board of Directors of Cinema Politica, if the complaint concerns the general management. These complaints will be saved for a period of five years.
The Privacy Officer will consult with the management and/or the board of directors where appropriate to determine if the incident presents a “risk of serious prejudice”, as outlined in article 3.5 of Law 25. Subsequently, they will define measures to reduce the risk of similar future incidents.
Any breaches of privacy that have been determined as presenting a “risk of serious prejudice” are recorded in the register of privacy incidents. The Privacy Officer will assess, based on the degree of risk of prejudice, whether to advise the Commission d’accès à l’information and any others potentially impacted by this breach.
Terms of application
The management of CP is responsible for the implementation and application of the privacy policy. As soon as this policy comes into effect, directors, management, employees and volunteers must commit to complying with the policy. In the event of non-compliance with the confidentiality policy by management, the Board of Directors must intervene. If a director, employee or volunteer has disclosed confidential information, the competent authority will impose a sanction in accordance with CP’s policies, regulations and by-laws. The sanction may range from reprimand to termination.
Contacting us
If you have any questions, concerns or comments regarding this Privacy Policy or our data collection practices, please contact our Privacy Officer, Svetla Turnin, at the following address: privacy [at] cinemapolitica [dot] org
Our Privacy Officer will answer any questions you may about our Privacy Policy within 10 business days.
The privacy officer’s name and contact details will also be published on the CP website for public access.
Adoption of the Policy
This policy was adopted on September 1, 2024 following its adoption by the Board of Directors. It can be modified at the opportune time after an effective analysis. Any modification must respect the values and rules of Cinema Politica.