PRIVACY POLICY

Kastello provides its internet users with a secure online environment. Kastello operates in accordance with the Private Sector Personal Information Protection Act (R.S.Q., c. P-39.1) (herein after referred to as the "Act"). In this context, Kastello is committed to maintaining high standards of confidentiality regarding personal information provided by its clients, suppliers, and other businesses in the course of its real estate brokerage activities, including via its website (https://www.kastello.ca) its social media, its advertisements, as well as for the needs of its Customer Relationship Management (CRM) systems and Electronic Document Management (EDM) systems, in accordance with the obligations arising from the Act.

‍What is meant by "personal information"?
‍
Personal information" refers to information related to an individual that allows their identification, directly or indirectly. This information can be in written form, images, videos, or sound recordings. In the course of its professional activities, Kastello may collect personal information such as name, address, date of birth, identity data, social insurance number, financial information, marital status, etc. The following principles of protection apply to the collection, use, and transmission of personal information that internet users may provide when using the Website.

‍1. Responsibility

‍Kastello takes responsibility for safeguarding the personal information it holds in the course of its real estate brokerage activities. To this end, Kastello has established a privacy policy, as well as policies and practices governing the management of personal information. These guidelines are designed to regulate the collection, use, disclosure, retention, and disposal of this information.

‍2. Collection of Personal Information

‍Kastello collects only the personal information necessary for the conduct of its real estate brokerage activities. For example, this may include information required to complete a real estate transaction, maintain records, monitor professional practice in accordance with the standards of the Organisme d'autoréglementation du courtage immobilier du Québec (OACIQ), or for other specific purposes disclosed and made known to the person giving their consent. Kastello staff are encouraged to clearly and simply explain the reasons for collecting personal information to the individuals concerned. Kastello also encourages its staff to use standardized forms developed by the OACIQ for the collection of personal information. Personal information may also be collected verbally during correspondence or through documents submitted in the course of a real estate transaction (identity documents, financial documents, powers of attorney, etc.).

‍3. Use and Disclosure of Personal Information
‍
‍Personal information is used and disclosed for the purposes for which it was collected, with the consent of the individual concerned. In certain cases provided for by law, it may be used for other purposes, such as fraud prevention or the provision of services to the individual. Kastello may be required to disclose personal information to third parties, such as suppliers, co-contractors, subcontractors, agents, insurers (such as the Fonds d'assurance responsabilité professionnelle du courtage immobilier du Québec [FARCIQ], the Fonds d'indemnisation du courtage immobilier du Québec [FICI]), the Autorité des Marchés Financiers (AMF), professionals, financial institutions, or credit verification agencies, as well as electronic document management system (EDM) providers and other regulatory bodies, both within and outside the province of Quebec. Kastello may, without the consent of the individual concerned, share personal information with a third party when it is necessary for the execution of a mandate or a service or business contract. In such cases, Kastello establishes a specific written mandate or contract outlining the measures the third party must take to protect the personal information entrusted to them, committing to use it only within the scope of the mandate or contract and to destroy it after use. The co-contractor must also cooperate with Kastello in the event of a breach of the confidentiality of personal information. Before transmitting personal information outside of Quebec, Kastello assesses its sensitivity, the purpose of its use, and the protection measures provided outside the province. Personal information is only disclosed outside of Quebec if this analysis demonstrates that it will receive adequate protection in the location of its transmission.

‍4. Retention and Disposal of Personal Information
‍Once the purposes for which personal information has been collected or used have been achieved, Kastello destroys them, unless the law specifies a specific retention period. In accordance with its professional obligations, Kastello must retain its records for at least six (6) years after their final closure.

‍5. Data Security

‍During the collection, use, retention, and deletion of personal information, Kastello implements adequate security measures to preserve the confidentiality of this data. The personal data collected will be stored on servers and in electronic data management systems that adhere to recognized protection mechanisms and standards. This is to ensure the security of personal information provided by its clients, suppliers, and other businesses in the course of its real estate brokerage activities. These activities include, among others, the use of the Website, social media, advertisements, as well as the use of Customer Relationship Management (CRM) systems and Electronic Document Management (EDM)systems. All of this is in compliance with the legal obligations imposed by the Private Sector Personal Information Protection Act.

‍Privacy Incident
A privacy incident refers to unauthorized access, use, or disclosure of personal information in violation of the Act, loss of personal information, or any other breach of data protection. SIX Agency has established a protocol for managing privacy incidents. This protocol identifies individuals assisting the Privacy Officer and outlines specific measures to be taken in the event of an incident. It also defines responsibilities at each stage of incident management, including measures to ensure data security.

‍6. Roles and Responsibilities‍

‍A. SIX Agency, its Staff, Team Members, or Administrative Assistants, as applicable:
‍Ensure the confidentiality of personal information by adopting best practices in information management. This includes providing guidelines, training, and instructions to staff members regarding the appropriate collection, use, storage, modification, consultation, communication, and proper destruction of personal information. Implement necessary protective measures to mitigate the risks of privacy incidents. This may include computer security practices, updating policies related to personal information, staff training, and other actions. Use standardized classification methods for documents containing personal information. Apply standardized methods for the retention of documents containing personal information, including scanning procedures. Manage physical and digital access to personal information based on its sensitivity. Supervise the secure destruction of personal information, providing staff members with guidelines or instructions on the appropriate method of destruction, destruction timelines, etc.

‍B. Personal Information Protection Officer:
‍In accordance with the law, Kastello has appointed a Personal Information Protection Officer. The Personal Information Protection Officer ensures compliance with existing policies and applicable regulations. They are responsible for managing privacy incidents and take actions as prescribed by the law in this context. They handle requests for access and correction of personal information, as well as complaints related to the processing of personal information by Kastello. They are consulted during the assessment of privacy factors for any project involving the acquisition, development, or redesign of information systems or electronic service delivery involving the collection, use, disclosure, retention, or disposal of personal information. They may suggest measures to protect personal information within the scope of such projects.

‍C. Staff Members, Team, or Administrative Assistants:
‍Staff members, team members, or administrative assistants of Kastello have access to personal information only to the extent necessary to perform their duties or mandate. They ensure the integrity and confidentiality of personal information held by Kastello. They comply with all policies and directives of Kastello regarding access, collection, use, disclosure, and destruction of personal information, as well as information security, and follow the provided instructions. They adhere to the security measures in place in their workplaces and on any equipment containing personal information. They exclusively use equipment and software authorized by Kastello. They ensure the timely and secure destruction of personal information, following received guidelines, and promptly report to their supervisor any act that could constitute an actual or suspected breach of security rules related to personal information.

7. Access, Withdrawal, and Correction

‍Rights Any individual (or their authorized representative) has the right to request access to their personal information held by Kastello. An individual can also withdraw their consent at any time regarding the collection, use, and disclosure of their personal information. This withdrawal must be recorded inwriting. Furthermore, an individual has the right to request the correction of personal information they believe to be inaccurate, incomplete, or ambiguous in their record. Upon request, it is also possible to electronically transfer the personal data that Kastello holds about an individual to a third party. Kastello reserves the right to refuse a request for access or correction in cases provided for by the Law (htps://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1).

‍8. Complaints

‍Any individual who believes they have suffered harm related to the processing of their personal information by Kastello can file a complaint. This complaint will be processed promptly, and a written response will be provided within a maximum of 30 days by the Personal Information Protection Officer. To submit a request for access, correction of your personal information, or any other request to which you are entitled, or to file a complaint regarding the processing of your personal information, please contact:

Laurent Cardinal
Responsable de la protection des renseignements personnel
L’Agence immobilière SIX
200 Av. Laurier O suite 400, Montréal, QC H2T 2N8
(514) 548-3448
laurent@sixcommunications.ca