Terms and Conditions

Terms and Conditions

PRIVACY INCIDENT MANAGEMENT PROCEDURE

Entry into force: 05/05/2025

1 - Confidentiality incident

The provisions contained in sections 63.8 to 63.11 of the Access Act define the concept of breach of confidentiality and set out the procedures to which MAP HYDRATION INC. complies. These sections list the criteria that the relevant public entity must consider when assessing the risks of harm to an individual whose personal data is affected by a breach of confidentiality.

2 - Communication of notifications to the Commission for Access to Information and to the affected parties

In the event of an incident that poses a significant risk of harm to the individuals involved, MAP HYDRATION INC is required to immediately notify the Commission d'accès à l'information (CAI). In addition, it must inform the parties affected by the incident, unless doing so could hinder an investigation conducted by a person or entity authorized by law to prevent, detect, or suppress criminal activities or violations of the law. As soon as the information is no longer likely to hinder such an investigation, the public entity must promptly inform the individuals concerned.

3 - Assessment of damage

In the event of a breach of confidentiality, the public entity is required to assess whether this poses a potential risk of harm to an individual whose personal data is at stake. To this end, it must take into account various elements, including:

  1. The sensitivity of personal information, such as financial data or identifying information;
  2. The anticipated consequences of using this data, including the risk of identity theft, financial fraud or serious breaches of privacy;
  3. The likelihood that this information could be used for harmful purposes.

Serious harm refers to an act or event that may cause significant damage to the person concerned or their property, with a significant impact on their interests. This may result, for example:

  • Degradation of reputation;
  • A financial loss;
  • Humiliation;
  • Identity theft;
  • Negative repercussions on the credit file;
  • A job loss.

4 - Maintaining a register of confidentiality incidents

MAP HYDRATION INC maintains a comprehensive record of all privacy incidents it has encountered, including those that do not pose a substantial risk of harm to the individuals involved.

The Commission for Access to Information (CAI) has the right to consult the data collected in this register, and a copy of it must be provided to it upon request.

5 - Powers of order of the Access to Information Commission

MAP HYDRATION INC takes into account that the Commission d'accès à l'information (CAI) holds several powers of order in relation to confidentiality incidents. In particular, it has the power to order:

  • To a public body which has been the victim of an incident resulting in a serious risk of harm and which has failed to inform the individuals whose personal data is affected by this incident, to inform them immediately.
  • It is up to each party to put in place the necessary measures to protect the rights of affected persons.
  • The return of personal information involved in the confidentiality incident to the public body that held it, as well as its destruction.

The government has implemented the Confidentiality Incident Regulations, which primarily aim to clarify the details surrounding the notifications to be sent to the Access to Information Commission and to affected individuals when a confidentiality incident causes serious harm. It also specifies the required content for the register to be maintained by public entities.

6 - Management of confidentiality incidents

A. Assessment of the situation:
When MAP HYDRATION INC suspects that a privacy incident involving personal information has occurred, the company takes the following steps:

  • Examine the circumstances surrounding the incident;
  • Identify the personal data concerned;
  • Identify affected individuals;
  • Diagnose the nature of the problem, whether it is an error, a security breach, or something else. This assessment should continue until all relevant elements are identified.

B. Risk Reduction:
MAP HYDRATION INC must respond promptly by taking reasonable steps to mitigate risks, whether serious or not, and to prevent similar incidents in the future. This may include actions such as:

  • Stop any unauthorized practice;
  • Recover or require the destruction of affected personal data;
  • Fix computer vulnerabilities.

C. Determination of the nature of the damage:
The aim is to determine whether notification to the Commission for Access to Information (CAI) and the persons concerned is necessary, as well as to define the measures to be taken to reduce risks. For example:

  • Include a note in files associated with identity theft risks;
  • Require further verification.

D. Registration in the registry:
MAP HYDRATION INC records the event in the incident log, whether it is classified as serious or not in terms of potential harm.

E. In the event of a risk of serious harm:
— Notification to the CAI: MAP HYDRATION INC immediately informs the CAI, even if all the information relating to the incident is not yet available. MAP HYDRATION INC can then report the incident to the CAI and complete the declaration later, including the precise number of people affected.
— Notification of affected individuals: MAP HYDRATION INC notifies all individuals whose personal information is affected by the incident, unless such notification may jeopardize an ongoing investigation. A delay may apply between discovery of the incident and notification in order to gather critical information, identify affected individuals, resolve the security breach, or not to impede an ongoing investigation. These notifications are mandatory.

F. In the event of a risk of serious harm:
MAP HYDRATION INC may also inform any person or organization that may be able to mitigate this risk. For this purpose, the company may share only the personal information necessary for this purpose, without requiring the prior consent of the individual concerned. However, the Person Responsible for Personal Data Protection must document this communication by recording the following details:

  • The recipients of the information;
  • The circumstances surrounding the communication;
  • The specific information transmitted;
  • The objectives of this approach.

Last updated: 05/05/2025

PERSONAL INFORMATION PROTECTION POLICY

Entry into force: 05/05/2025
Approved by: Board of Directors
Responsible management: Presidency and General Management

Table of Contents

 1. Statement of Principles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2 
2. Objectives . ...
 3. Fields of application. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2
 4. Frame of reference . ...
 5. Definitions . ...
 6. Roles and responsibilities . ...
 6.1 Board of Directors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4
 6.2 Presidency-General Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
 6.3 Person responsible for personal information . . . . . . . . . . . . . . . . .4
 6.4 Member of the Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5
 6.5 Staff member . ...
 6.6 Contractor and subcontractor . . . . . . . . . . . . . . . . . . . . . . . . . . . .6 
7. Politics . ...
 7.1 Confidentiality of personal information . . . . . . . . . . . . . 6
 7.2 Public nature of certain personal information . . . . . . . . . . . . . 6
 7.3 Terms of protection of personal information
 throughout the life cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6
 7.3.1 Management of access to personal information . . . . . . . . . . . .7
 7.3.2 Collection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7
 7.3.3 Preservation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8
 7.3.4 Destruction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8
 7.3.5 Communication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
 (1) To a natural or legal person . . . . . . . . . . . . . . . . . . . . . . . 8
 (2) To an organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8 
(3) To a public body . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
 7.3.6 Communications Register . . . . . . . . . . . . . . . . . . . . . . . . . . .9
 7.4 Accessibility to personal information held by MAP HYDRATION INC. 10
 7.5 Privacy Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
 7.6 Processing of the declaration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
 7.7 Confidentiality Incident Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
 7.8 Rights of the person concerned by personal information . . . . . . . . . . .10
 7.8.1 11.1 Access . ...
 7.8.2 11.2 Rectification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
 8. Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
 8.1 Approval. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 
8.2 Application Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
 8.3 Distribution. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
 8.4 Effective Date . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
 8.5 Revision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11

1. Statement of principle

As part of its activities and mission, the company, named "MAP HYDRATION INC", processes personal information. The objective of this Personal Information Protection Policy (hereinafter referred to as the "Policy") is to ensure the safeguarding of this information by establishing appropriate governance rules. Accordingly, this Policy governs the collection, use, protection, communication, retention and destruction of personal information relating to MAP HYDRATION INC staff, members of the board of directors, candidates, contractors and subcontractors, whether from documents of any nature, regardless of their origin, and in accordance with the Act on the Protection of Personal Information in the Private Sector (hereinafter referred to as the "Act") and its regulations.

It is important to note that personal information is considered confidential, except for information defined as public information under the Act. Accordingly, MAP HYDRATION INC assumes responsibility for maintaining its confidentiality and complying with the obligations imposed by the Act, including obtaining consent from staff members before disclosing personal information to third parties.

2. Objectives

The main objective of this Policy is to:

  1. State the principles governing the protection of personal information throughout its life cycle.
  2. Define the roles and responsibilities of staff members and the various stakeholders involved in the protection of personal information.
  3. Provide staff members and site users with the right to access information about themselves.

3. Scope of application

This Policy applies to any person who, in the performance of their duties, is involved in the collection, consultation, use, communication, holding, conservation or destruction of personal information held by MAP HYDRATION INC, whether obtained in the course of their duties or otherwise.

The recipients of this Policy include MAP HYDRATION INC staff members, board members, contractors and subcontractors, as well as users of its website.

If in doubt regarding the processing of personal information, staff members are required to consult the person responsible for the protection of personal information.

4. Frame of reference

This Policy is part of the following legislative and regulatory context:

Charter of Human Rights and Freedoms (LRLQ c. C-12);
Civil Code of Quebec (RLRQ c. CCQ-1991);
Act respecting the protection of personal information in the private sector (LRLQ c. P-39.1);
Act respecting the legal framework for information technology (LRLQ c. C-1.1);
Canada Not-for-profit Corporations Act (SC 2009 c. 23);
any other regulatory document of MAP HYDRATION INC governing the processing of personal information covered by this Policy.

5. Definitions

In this Policy, unless the context indicates a different meaning, terms are defined as follows:

  1. Consent :
    Consent is a form of authorization that implies voluntary and informed agreement. It must be manifest, that is, clearly expressed and indisputable. It must also be given freely, without coercion. Consent must be informed, which means that it must be precise, rigorous, and specific. The person giving consent must be sufficiently informed of the communications that will be made to be able to make an informed decision about the scope of consent. Furthermore, it must be given for specific purposes and for the duration necessary to achieve the objectives for which it was requested.
  2. Contractual:
    A natural person whose situation is governed by a contract which defines their rights and obligations.
  3. Personal Information Life Cycle:
    All steps involved in the processing of personal information, from collection to retention and destruction, in accordance with the Retention Schedule of the Classification Plan and/or the Integrated Document Management Directive.
  4. Privacy Incident:
    Any access, use or disclosure of personal information not authorized by law, as well as any loss or other breach of the protection of such information.
  5. Personal information:
    Any information about a natural person that allows them to be identified, whether directly through a single piece of information or indirectly through cross-referencing with other information. The name of a natural person is not considered personal information unless it is mentioned in conjunction with other information about them or if its mere mention would reveal personal information about that person. The mere presence of a signature at the bottom of a document does not make the information contained therein personal.
  6. Privacy Officer (PPO):
    A person appointed to this position by the board of directors. The general secretary independently exercises the functions of the Privacy Officer in accordance with the Act.
  7. Staff member:
    All employees working for MAP HYDRATION INC, including unionized staff, non-unionized staff and management staff.
  8. Member of the management:
    Any person hired to fill a management position in accordance with the organizational structure of MAP HYDRATION INC.
  9. Person concerned:
    Any natural person to whom the personal information relates.

Subcontractor
Natural or legal person who undertakes, vis-à-vis MAP HYDRATION INC and according to its instructions, to carry out in whole or in part the production of a good or the provision of a service.

Immediate superior
Refers to the hierarchical manager who represents the first level of authority above the staff member; he exercises direct control over this member.

User
Refers to any visitor and user of the company's website.

6. Roles and responsibilities

The management of personal information is a shared responsibility between MAP HYDRATION INC and its staff: its respect is based on the commitment of all staff members.

6.1 Board of Directors

The Board of Directors is responsible for:

  • adopt this Policy and its updates;
  • designate the President and CEO or a member of the management of MAP HYDRATION INC and delegate to them, in writing, in whole or in part, the functions of Person responsible for the protection of personal information;
  • inform itself of any major incident or risk of a major incident in connection with this Policy;

6.2 Presidency and General Management

As the person responsible for this Policy, the President and CEO assumes the following responsibilities and exercises the following roles:

  • ensure the implementation of this Policy;
  • provide the resources necessary for the application of this Policy;
  • ensure that roles and responsibilities are correctly assigned to the various stakeholders;
  • communicate this Policy to the Board of Directors.

6.3 Person responsible for personal information

This function is assigned to the Secretary General. For the sole purpose of exercising their responsibilities with respect to the application of the Act, this person may have access to any file containing personal information. This person's opinions are prescriptive; they have the power to verify and inspect any process or file related to the application of the Act or this Policy and any document resulting therefrom. It is their responsibility to:

The responsibilities of the holder of this position include:

  1. Submit this Policy to the Executive Committee and make recommendations to the President and CEO for approval by the Board of Directors.
  2. Coordinate all activities related to the application and review of the Policy in question.
  3. Ensure that the Policy is updated, communicated and complied with at all times.
  4. Conduct a privacy impact assessment for any project to acquire, develop or redesign information systems or electronic service delivery involving the collection, disclosure, retention or destruction of personal information.
  5. Provide recommendations regarding personal information protection measures to be implemented during projects.
  6. Collaborate with all departments to ensure the implementation of required and appropriate measures, particularly technological ones, related to the protection of personal information held by MAP HYDRATION INC.
  7. Plan and supervise the implementation of training and awareness activities on the protection of personal information.
  8. Take reasonable steps to reduce risks in the event of a privacy incident, including when harm involving personal information occurs, in order to prevent the recurrence of similar incidents.
  9. Promptly and diligently inform the Access to Information Commission in the event of an incident presenting a serious risk to confidentiality.
  10. Notify any person affected by a confidentiality incident in accordance with applicable law.
  11. Maintain a register of confidentiality incidents as well as the inventory of personal information required by law.
  12. Handle incidents related to the protection of personal information in accordance with applicable law.
  13. Respond to requests for access, communication and rectification that MAP HYDRATION INC may receive.
  14. Represent MAP HYDRATION INC before the Access to Information Commission when necessary.

6.4 Member of the management

These individuals are designated as Privacy Officers and have the following duties:

  1. Raise awareness among those under their authority about this Policy and related documents, in order to promote good practices in the protection of personal information.
  2. Promptly report to the Person Responsible for the Protection of Personal Information at MAP HYDRATION INC any difficulty, problem, report or question related to the protection of personal information.

6.5 Staff Member

Each individual is expected to:

  1. To read this Policy and your personal responsibilities.
  2. To scrupulously respect the rules of governance regarding the protection of personal information, as well as the obligations stipulated in this Policy and the documents resulting from it.
  3. To act with caution and discernment when handling personal information held by MAP HYDRATION INC, in order to preserve it.
  4. To promptly report any confidentiality incident or any situation likely to jeopardize the confidentiality of personal information, whether to the Person responsible for the protection of personal information or to a person designated for this purpose.
  5. To cooperate fully in the handling of privacy complaints or in investigations related to potential privacy breach incidents.
  6. To actively participate in training and awareness activities provided in relation to the protection of personal information.

6.6 Contractor and subcontractor

agree in writing to comply with this Policy and related documents of MAP HYDRATION INC and applicable laws regarding the protection of personal information

7. Policy

7.1 Confidentiality of personal information

Except in the situations provided for in Article 7.2, the personal information held by MAP HYDRATION INC is confidential in nature and is subject to the protection provisions provided by the Act. It may only be consulted by the persons to whom it relates, and within MAP HYDRATION INC, only by individuals authorized to receive it in the exercise of their functions when this personal information proves necessary.

In accordance with the preceding paragraph, if the person concerned by personal information has expressly given his consent to its disclosure, said personal information ceases to be considered confidential. It is essential that this consent be granted freely, informed, specific, and limited to the purposes previously defined.

7.2 Public nature of certain personal information

Personal information considered public under the Act includes:

  1. The name, title, position, classification, address and telephone number of the place of employment of a member of the management staff or of its board of directors.
  2. The name, title, position, classification, and salary scale (excluding salary), address and telephone number of the workplace of MAP HYDRATION INC. personnel.
  3. Unless it may be subject to access restrictions provided for by law, any information relating to an individual as a party to a service contract entered into with MAP HYDRATION INC, as well as the conditions of this contract.

7.3 Terms of protection of personal information throughout the life cycle

When the company wishes to collect personal information, it must implement the necessary security measures to ensure the protection of this data. It is imperative to inform staff members and users of the terms and conditions relating to the collection, use, communication, retention, and destruction of this personal information within MAP HYDRATION INC, taking into account factors such as its degree of sensitivity, the purpose of its use, its distribution, and its medium.

MAP HYDRATION INC implements appropriate and reasonable security measures, whether physical, organizational, contractual or technological, in order to protect the personal information in its possession against loss, theft, unauthorized access, communication, disclosure, copying, use or modification, in accordance with the legal requirements in force.

7.3.1 Management of access to personal information

MAP HYDRATION INC implements measures to ensure that only staff members who have a compelling need to access the personal information in question as part of their duties are authorized to do so. Access rights management is aligned with the principle of "least privilege", thus ensuring appropriate restriction of authorizations.

In addition, contractors or subcontractors who have access to personal information for which MAP HYDRATION INC is responsible or under its control are informed of this Privacy Policy and other relevant documents. This communication is intended to ensure the security and protection of personal information in accordance with applicable requirements.

7.3.2 Collection

Any collection of personal information must meet two (2) criteria:

  • the collection must be necessary: ​​that is, the collection is essential for the development and activities of MAP HYDRATION INC. The latter takes measures to ensure that the personal information it collects is adequate, relevant, not excessive and used for limited purposes.
  • the staff or user must have expressly consented to provide their personal information for a specific purpose.

Information communicated during the collection of personal information:
When collecting personal information, MAP HYDRATION INC ensures that the person concerned is informed, at the latest at the time of collection.

The Data Subject must be informed of the following when providing personal information:

  • The name of the organization for which the collection is carried out.
  • The purposes for which this information is collected.
  • The methods used to collect this information.
  • The distinction between information requested on a mandatory or optional basis.
  • The consequences of refusing to respond or give consent to the request.
  • The rights of access and rectification as provided by law.
  • Where applicable, the possibility that personal information may be communicated outside Quebec.

Upon request, the Data Subject must also be informed of the following aspects:

  • The personal information that has been collected from her.
  • The categories of people within MAP HYDRATION INC who have access to this information.
  • The length of time this information will be retained.
  • The contact details of the Person responsible for the protection of personal information.

Use
MAP HYDRATION INC uses the personal information it holds only for the purposes for which it was collected, except in the following situations:

  • When it has previously obtained the explicit consent of the person concerned by the personal information.
  • When use is necessary to comply with a law, whether a provincial or federal law applicable in Quebec.

MAP HYDRATION INC staff members who use personal information in the performance of their duties are required to:

  • Limit their use of personal information to the specific purposes of their job. To determine whether the collection is justified, one should ask: “What is the purpose of the collection?” For example, the purpose may include paying staff members’ salaries, conducting statistics or user surveys for marketing purposes, etc. When it is determined that the information is necessary, it should also be defined how long the collected personal information will be retained, ensuring that it is destroyed as soon as the need ceases.
  • Maintain the confidentiality of personal information at all times.
  • Immediately inform their line manager and/or the person responsible for the protection of personal information in the event of a situation where the confidentiality of personal information may have been compromised.
  • At the end of their employment with MAP HYDRATION INC, not to retain any personal information that they have become aware of in the course of their duties, while continuing to maintain its confidentiality.
7.3.3 Conservation

MAP HYDRATION INC communicates the methods and period of retention of personal information, while detailing the protective measures in force within the organization.

7.3.4 Destruction

MAP HYDRATION INC securely destroys personal information once the purposes for which it was collected have been fulfilled, in accordance with applicable laws regarding its retention.

7.3.5 Communication

MAP HYDRATION INC publishes its Policy so that staff members and users can understand the conditions under which their personal information may be disclosed to third parties.

MAP HYDRATION INC cannot share confidential personal information with third parties without the explicit consent of the individual concerned, except in the following situations:

(1) To a natural or legal person

  1. authorized by the Commission for Access to Information for the purposes of studies, research or statistics;
  2. to whom it is necessary to do so in order to collect personal information already collected by it, by first informing the Commission for Access to Information.

(2) To an organization
If the communication of certain personal information is necessary for:

  1. the application of a law in Quebec, whether or not such communication is provided for by law;
  2. comply with a court order, legal process, official government and regulatory request;
  3. prevent, detect or suppress crime or breaches of laws;
  4. the application of a collective agreement, decree, order, directive or regulation which establishes working conditions;

(3) To a public body
When it is necessary to communicate this information to public bodies, this is done in compliance with the Law, by establishing and submitting to the Commission d'accès à l'information a written agreement in advance in accordance with the law:

  1. for the exercise of its powers by the receiving body;
  2. is clearly for the benefit of the person concerned;
  3. in the context of the provision of a service to be rendered to the person concerned by a public body;
  4. when exceptional circumstances justify it.

MAP HYDRATION INC is required to disclose certain personal information in a timely manner in the following situations:

To any person who may provide assistance to a person facing an emergency or imminent danger of death or serious injury, including in cases of threat of violence, including suicide. This disclosure may only take place if there are reasonable grounds to believe that such danger exists and the disclosure of personal information is necessary to prevent that danger. In this case, only personal information essential to providing assistance should be shared.

To the police authorities when there are valid reasons to believe that a person has a weapon on the grounds or premises of MAP HYDRATION INC, that a weapon is located on the premises, or that a person is engaging in behavior likely to compromise their own safety or that of others by using a weapon on the premises of MAP HYDRATION INC. In this situation, MAP HYDRATION INC only discloses to the police authorities the personal information strictly necessary to facilitate the intervention of law enforcement.

7.3.6 Communications Register

MAP HYDRATION INC maintains a record of all personal information it discloses in accordance with the law, without the consent of the individuals concerned. Any employee who discloses such information must notify the person responsible for the personal data in writing. This notification must include the following:

  • The nature or category of information disclosed.
  • The identity of the person or organization receiving this information.
  • The objective of this communication.
  • The justification for the need for this disclosure.

Any person who requests it may access the register kept by MAP HYDRATION INC, within the limits and under the conditions provided for by the Law.

7.4 Accessibility to personal information held by MAP HYDRATION INC

The staff member or user can access his or her personal information or object to its collection by contacting the person responsible for the personal information; his or her contact details are:

Name of the person responsible or the department responsible
Email: info@maphydration.com
Phone: 514-576-1502

7.5 Privacy Statement

MAP HYDRATION INC is required to manage any privacy incidents involving personal information that may arise. Staff members are therefore required to report any privacy incidents of which they become aware to:

2379 CH CHAMBLY OFFICE 208 CARIGNAN QC CA J3L 4N4

Under the terms of this Policy, a Privacy Incident includes the following:

  1. Unauthorized access by law to personal information.
  2. Use of personal information that is not authorized by law.
  3. Unauthorized disclosure of personal information.
  4. Loss of personal information.
  5. Any other breach of the protection of such information.

It is important to note that the intention of the person responsible for the incident is not taken into account. Whether the incident is accidental, due to an error, a vulnerability, or the result of an intentional act of which a staff member has knowledge, it must be immediately reported to the person responsible for personal information.

7.6 Processing of the declaration

When MAP HYDRATION INC has reason to believe that a privacy incident involving personal information it holds has occurred, it must:

  • As soon as possible, take reasonable steps to reduce the risk of harm and prevent similar incidents from occurring again.
  • Implement the Privacy Incident Management Procedure. When assessing whether harm may be caused to an individual whose personal information is affected by the privacy incident, consideration should be given to the sensitivity of the information in question, the foreseeable consequences of its use, and the likelihood that it will be used for harmful purposes.
  • If the confidentiality incident presents a serious risk of causing significant harm, the Person responsible for the protection of personal information must:
    1. Promptly inform the Access to Information Commission in a diligent manner.
    2. As soon as possible, inform the person concerned by the incident, unless doing so may interfere with an investigation conducted by a person or body charged, under the law, with preventing, detecting or suppressing crimes or violations of the law.

7.7 Privacy Incident Log

In accordance with applicable law, MAP HYDRATION INC maintains a register of confidentiality incidents, which must be communicated to the Commission d'accès à l'information upon request.

7.8 Rights of the person concerned by personal information

7.8.1 11.1 Access

The person whose personal information is held by MAP HYDRATION INC has the right to be informed of the existence of this information and has the right to obtain a copy upon request, in accordance with the provisions of the law and under the conditions provided for therein.

7.8.2 11.2 Rectification

A person whose personal information is inaccurate, incomplete, ambiguous, or whose collection, communication or storage violates the law, has the right to request in writing the correction of the file, in accordance with the provisions of the law and under the conditions provided therein.

8. Implementation

8.1 Approval

This Policy is approved by the Board of Directors.

8.2 Application Manager

The CEO or the person responsible for personal information is responsible for disseminating this Policy. They must ensure that it is implemented.

8.3 Distribution

This Policy is distributed to all staff and is available for consultation on the MAP HYDRATION INC. website.

8.4 Effective Date

This Policy comes into effect upon adoption by the Board of Directors.

8.5 Revision

This Policy is updated as needed, at least every 3 years after its first adoption.

Version 1.0
Approval date: 05/05/2025