Confidentiality and the Protection of Personal Information Policy

Last Updated December 10th, 2025

1. Context

1.1. Foundations

To modernize the regulations protecting personal information in Quebec, the Commission of Access to Information proposes legislative provisions in the matter of the protection of personal information, also called Law 25. Mont Cascades must comply with this law to ensure the protection of personal information within the organization as part of its activities, in all aspects.

1.2. Goals

Mont Cascades is a private Ski Center and Water Park, which processes personal information as part of its activities. The purpose of this policy is to ensure the protection of personal information that Mont Cascades obtains. In this sense, it aims to:

Supervise how the company manages sensitive data, more specifically how it collects data, uses it, communicates with it, stores and destroys data.
Empowers all staff in a responsible matter to access and protect personal information.
Inform all interested people of the way in which Mont Cascades treats their personal information.

1.3. Method of application

This policy applies to Mont Cascades, which includes its managers, its employees, its consultants, as well as any person who otherwise provides services on behalf of Mont Cascades. It also applies to the website and social networks managed by the company. This policy includes all types of personal information managed by Mont Cascades, the information of its customers, collaborators, employees, or any other people (such as volunteers). By providing us with personal information through our website or by communicating with us, you agree that it will be processed in accordance with what is outlined in this Policy, and you authorize Mont Cascades, its third parties and its service suppliers to process your personal information for the purposes set out below. If you do not consent to Mont Cascades to collect, use and/or communicate your personal information in accordance with this Policy, please refrain from sharing it with us. However, it is possible that we cannot offer you all our services without the necessary personal information. Any other personal information you provide to us will be treated in accordance with this Policy. If you provide us with personal information about other people, you must notify them and obtain their consent.

2. Definitions

Personal information

Personal information is information which concerns a physical person, and which allows, directly or indirectly, to identify them, for example: name, address, email address, telephone number, gender, banking information, language, etc.

Sensitive personal information

Sensitive personal information is information for which there is a high degree of reasonable expectation of privacy, for example: health information, banking information, biometric information, sexual orientation, ethnic origin, political opinions, religious beliefs or philosophical, etc. Certain provisions of the Act do not apply to personal information, which is of a public nature, nor to personal information which concerns a person’s place within a company, such as name, title, and position, as well as their workplace address, email, and telephone number.

3. Principles and Commitments of Directors

3.1. Responsibilities

In general, Mont Cascades is responsible for the protection of the personal information it possesses. Mont Cascades staff members having access to personal information or otherwise involved in its management must ensure its protection and respect this policy. The roles and responsibilities of Mont Cascades employees throughout the life cycle of personal information are as follows:

The responsibility of the protection of personal information (RPRP) and guarantee following this policy.
All employees, subcontractors and suppliers of Mont Cascades must comply with this policy.
The managers are responsible for the collection of personal information, including sensitive data, communication to designated agents and the destruction of sensitive data following communications.
The Human Resources Director, supported by the financial controller, is responsible for processing payroll data, in accordance with Mont Cascades policies, and must not keep any copies of this data on their workstation.

3.1.1. Security of the data

Mont Cascades is committed to implementing security measures to ensure the protection of the personal information it manages. The security measures in place are reasonable considering the purpose, quantity, distribution, medium and sensitivity of the information. This means that sensitive personal information will have to be subject to greater security measures and will have to be better protected. Mont Cascades must put in place the necessary measures to impose constraints on access rights to its information systems so that only employees who must have access to it to carry out their functions are authorized to access it.

3.2. Policy Statement

To ensure the protection of personal information that Mont Cascades does use, the company commits that it has only collected the personal information necessary to achieve the specified purposes. Unless a minimum retention period is required by applicable law or regulation, Mont Cascades will only retain personal information for the period necessary to achieve the purposes for which it was collected. At the end of the retention period or when the personal information is no longer necessary, Mont Cascades will ensure:

Safe destruction of them.
Anonymize them, i.e. it is no longer possible, in an irreversible way, to identify the person directly or indirectly.
The destruction of information by Mont Cascades will be done in a safe way, to ensure the protection of this information.

This policy may be supplemented by any policy or procedure adopted by Mountain Cascades concerning the retention and destruction of personal information, as applicable.

3.3. Guidelines

3.3.1. Collection, use and communication.

As part of its activities, Mont Cascades may collect different types of information for different purposes. The types of information that Mont Cascades may collect, for their use (or the intended purpose) as well as the means by which the information is collected are indicated in Appendix A of this policy. Mont Cascades also applies the following general principles with respect to collection, use and disclosure of personal information:

Consent

Generally, Mont Cascades collects personal information directly from the person concerned and with their consent, unless an exception is provided for by law.
Consent may be obtained implicitly in certain situations, for example, when the person decides to provide their personal information after having been informed of this policy and of the elements required by the Law (ends and means of the collection, right to access and right of withdrawal of consent) consents to the use and disclosure for the purposes indicated therein (see Appendix A for further details).
Mont Cascades also aims to obtain the consent of the person concerned before collecting their personal information from third parties, before communicating it to third parties or for any secondary use thereof.
However, Mont Cascades may act without consent in certain cases provided for by the Law and under the conditions provided for therein. The main situations where Mont Cascades can act without consent are indicated in the “communication”.

Collection:

In all cases, Mont Cascades only collects information if it has a specific reason to do so. In addition, the collection is limited to the information that is necessary for the targeted objective. (See the Annex HAS For more details). Mont Cascades ensures that it complies with the provisions of the law governing the hiring of a minor. Also, the company ensures that only the necessary information for the intended purpose will be collected, following the consent of the legal guardian for any person under the age of 14.

Retention and Use:

Mont Cascades ensures that the information it holds is up to date and accurate when it is used to make a decision regarding the person concerned. Mont Cascades can only use an individual’s personal information for the reasons stated herein or for any other reasons provided at the time of collection. As soon as Mont Cascades wants to use this information for another reason or another purpose, new consent must be obtained from the person concerned, which must be obtained expressly if it concerns sensitive personal information. However, in certain cases provided for by law, Mont Cascades may use the information it has for the secondary purposes without the consent of the person, For example:

When this use is clearly the benefit of that person.
When it is necessary to prevent or detect fraud.
When necessary to evaluate or improve protection and security measures.

Communication:

Generally, and unless there is an exception provided for by law, Mont Cascades obtains the consent of the person concerned before communicating their personal information to a third party.
In addition, when consent is necessary and when it concerns sensitive personal information, Mount Cascades must get the explicit consent of the person before communicating the information.
Communication outside Quebec: It is possible that the personal information held by Mont Cascades are communicated outside Quebec, as elsewhere in Canada or outside the country. For example, when Mont Cascades uses cloud service providers whose server(s) are located outside Quebec or when Mont Mise à jour 6 novembre 2024 Cascades does business with subcontractors or partners located outside the province.

3.3.2. Additional information on the technologies used:

Cookies:

Cookies are data files transmitted to a website visitor’s computer by their Web browser when they visit that site and can serve several purposes.

The internet site controlled by Mont Cascades uses the following types of cookies:

Session cookies: These are temporary cookies that are kept in memory for the duration of website visit only.
Witnesses persistent: These are kept on the computer until they expire, and they are retrieved the next time the site is visited.

The internet site controlled by Mont Cascades uses cookies including:

Functional cookies: to enable the integration of certain features, such as sharing content on social media and our contact forms.
Marketing and analytics cookies to learn about visitor behavior, content viewed, and user interactions with our website.
Statistical cookies to evaluate the performance of the website and enable its improvement.

Some cookies may be disabled by default and visitors will be able to choose to activate or deactivate these functions when consulting Mont Cascades’ websites. It is also possible to enable and disable the use of cookies by changing preferences in in the settings of the browser used. It is also possible to install a browser add-on to disable Google Analytics. Others means technological used: Mont Cascades also collects personal information through technological means such as web forms integrated into a website controlled by Mont Cascades (newsletter registration form, contact request, online purchases) questionnaires accessible online on its platforms and applications, as well as other platforms or form tools (Google Forms).

4. Principles intervention

4.1. Revision of the rights to access and the withdrawal of consent

To assert the right to access, rectification or withdraw consent, the person concerned must submit a written request to this effect to the information protection manager personal of Mont Cascade at the e-mail address indicated in section 4.2. Subject to applicable legal restrictions, the concerned persons may withdraw their consent to communicate or use the information collected. However, we may not be able to offer all of our services without the necessary personal information.

4.2 Treatment of the complaints

Any person who wishes to make a complaint relating to the application of this policy or, more generally, to the protection of their personal information by Mont Cascades must do so in writing by contacting the person responsible for the protection of personal information of Mont Cascades, at the email address indicated below

4.2.1 Treatment

Mont Cascades commits to treating all complaints received as confidential. This policy is approved by the personal information protection manager of Mont Cascades, whose business contact details are as follows: For any requests, questions, or comments regarding this policy, please contact the person in charge by email. Mont Cascades always reserves the right to modify the present policy and will review this policy on an annual basis.

Annex “A”

Relationship with Mont Cascades	Type of information staff	End of collection / Use	Way of collecting information (means)
	One or the other of this information, when it is required	Used for:	Can be collected
Employees	Name, first and last Postal address Phone number Date of birth E-mail SIN Specimen cheque Work Permit Curriculum Vitae/resume Criminal record Driver’s License Driving file from SAAQ or other province	Administration of our business and to carry out our services Management of the communications with the employee Ensure the functioning of the payroll system Ensure financial and tax transmission Any other secondary purpose To meet our legal and regulatory obligations	By e-mail By phone By hand writing By Electronic means
Clients	Name, first and last Postal Address Phone number E-mail Photo Date of birth Gender	Management of seasonal passes and daily tickets Snow school program management	By e-mail By phone By hand writing By Electronic means
Candidates	Name, first and last Postal Address Phone number E-mail Curriculum Vitae/resume	Management of communication with the candidates Management of seasonal business	By Electronic means
Volunteers	Name, first and last Date of birth Phone number E-mail Level of education	Monitoring seasonal activities (ensure security, enforce codes, first aid in the event of an accident)	By handwriting By e-mail By phone