Personal Information Governance

Introduction

Telma is operated by Développement Ubi2 inc. (Quebec enterprise number 1178746476). This page explains how we govern the personal information we hold, in accordance with Quebec's Act respecting the protection of personal information in the private sector. It supplements our privacy policy.

Person in Charge of the Protection of Personal Information

Telma's President and Chief Executive Officer is in charge of the protection of personal information. This officer ensures compliance with the law and with this policy, and approves important decisions about personal information.

Contact: privacy@telma.ca.

Two Different Roles

• For our customers and their users (accounts, billing, support), Telma is responsible for the information.
• For people who communicate with our customers (calls, texts, voicemail, recordings), Telma acts as a service provider to the customer business. That business decides what it collects and answers its contacts' requests; we help it do so.

Roles and Responsibilities

• The person in charge of the protection of personal information approves this policy, privacy impact assessments and incident management.
• Team members only access personal information when their duties require it; every access to a customer's data is logged.
• Our providers commit in writing to protect the information and to use it only for the service provided.

Retention and Destruction

• Information is kept as long as the service requires, then securely destroyed.
• Call recordings, their transcripts and summaries follow the retention period chosen by the customer business (30 days by default), then are deleted automatically.
• A deleted account is kept for 10 days, in case of a mistake, then erased.
• Information required by law, such as billing records, is kept for the period the law requires.

Privacy Impact Assessments

We assess the risks before any new information system project involving personal information, and before any disclosure of information outside Quebec. For example, transcription of recorded calls, an optional feature, is performed by OVHcloud in France; it was assessed, and we provide the assessment to any customer business that turns the feature on.

Confidentiality Incidents

We have a procedure to respond to any unauthorized access, use, disclosure or loss of personal information:

• we act without delay to reduce the risk;
• we assess the risk of serious injury;
• if that risk exists, we notify the Commission d'accès à l'information and the people concerned; if the information belongs to a customer business, we notify it without delay so it can do so;
• we record every incident in a register.

Complaints and Requests

To exercise your rights (access, correction, deletion, withdrawal of consent) or to complain about how we handle your information:

1. Write to privacy@telma.ca describing your request. We may ask you to confirm your identity.
2. We acknowledge receipt and answer in writing within 30 days.
3. If your request concerns a customer business's communications (a call or text exchanged with it), we refer you to that business and help it answer you.
4. If you are not satisfied with our answer, you may contact the Commission d'accès à l'information du Québec.

Training and Awareness

Team members who have access to personal information are informed of this policy and of their confidentiality obligations.

Review

This policy is reviewed at least once a year, or when something important changes: a new provider, a new feature or a new processing location.