As a law firm, Gattuso Bouchard Mazzone LLP (“GBM” or “we”) collects, uses, stores, and discloses your Personal Information for the purpose of providing professional services and fulfilling the legal mandates entrusted to us. This Privacy Policy (“Policy”) outlines our practices regarding the collection, use, disclosure, and retention of Personal Information furnished to us.

The Policy outlines the roles and responsibilities of GBM staff members regarding the preservation of the confidentiality of collected personal information. 

In addition to the obligations outlined below concerning Personal Information, we diligently uphold our professional and ethical duties, with a particular emphasis on safeguarding client confidentiality.

If you have any questions regarding your Personal Information held by GBM, you can contact our Privacy Officer, Mtre Nadia Tomassini (hereinafter referred to as the “Privacy Officer”), at the following email address: [email protected]

In this Policy, the term “Personal Information” refers to any information about an identifiable individual, whether directly or indirectly.

CONSENT

BY PROVIDING PERSONAL INFORMATION TO GBM, YOU AUTHORIZE US TO COLLECT, USE, AND DISCLOSE SUCH PERSONAL INFORMATION IN ACCORDANCE WITH THIS PRIVACY POLICY AND AS PERMITTED OR REQUIRED BY LAW. Subject to any legal and contractual requirements, you may refuse or withdraw your consent for certain specified purposes at any time by contacting the Privacy Officer. If you refuse or withdraw your consent, we may be unable to provide, or continue to provide, certain services or information that may be beneficial to you. If you provide GBM with Personal Information about another individual, you represent that you have the necessary authority to do so and/or have obtained all necessary consents from that individual to allow us to collect, use, and disclose such Personal Information for the purposes outlined in this privacy policy.

COLLECTED PERSONAL INFORMATION

GBM collects the following Personal Information from you when you communicate with us through any means (email, phone, website, etc.):

• Your name.
• Your personal or business phone number.
• Your date of birth.
• Your personal address.
• Your email address.
• Your Identification documents.
• Any other Personal Information necessary for the fulfillment of our mandate.

PURPOSES FOR COLLECTING YOUR PERSONAL INFORMATION

GBM processes your Personal Information as part of the mandates entrusted to us for the following purposes:

• To identify you, update your Personal Information, and perform any necessary internal verification.
• To open, update, and close your client file.
• To provide our services.
• To continuously improve our services.
• To comply with our legal and ethical obligations as a law firm.
• To evaluate your application for employment or internship.
• To supply the Barreau with essential information in the event of a complaint and to participate in disciplinary investigations, conciliation, fee arbitration, and hearings.
• To develop and enhance our website and services.
• To send you information about our activities and professional services offerings, while allowing you to withdraw your consent at any time.
• To prevent and detect fraud, and continuously assess and improve our security measures.
• To respond to any request or inquiry from you or a stakeholder in the context of a mandate.
• To send you transactional communications, such as an invoice for services rendered.
• For advertising and business development purposes, including invitations to promotional events.

GBM only uses your Personal Information for the purposes outlined in this Policy and commits to obtaining your consent for any other unforeseen use, except in cases where exceptions are provided by law.

DISCLOSURE OF PERSONAL INFORMATION

 In accordance with its professional and ethical obligations, GBM never discloses Personal Information protected by attorney-client privilege without first obtaining our client’s waiver of this privilege, except in cases where we are legally obligated to do so under applicable law.

GBM shares Personal Information with the following individuals/entities:

• Our service providers;
• Any government authority, in response to a legal obligation;
• Parties involved in a case, including experts, professionals engaged in the mandate, opposing parties, and their legal advisors who require access to Personal Information in the context of a legal proceeding or a business transaction.

When GBM shares Personal Information with a person/entity mentioned above, measures are put in place to ensure the confidentiality and security of this information. Only Personal Information that is reasonably necessary for these third parties to fulfill their functions on behalf of GBM or within the scope of a mandate is disclosed.

GBM is committed to obtaining your consent before disclosing or transmitting your Personal Information to a third party not covered by this Policy, except in cases provided for by law.

DATA SECURITY

The security of your Personal Information is our top priority. We employ all necessary means to establish effective security measures to safeguard the confidentiality of your Personal Information.

We have implemented appropriate and reasonable physical, organizational, and technological security measures to protect your Personal Information against loss, theft, unauthorized access, disclosure, copying, or alteration by third parties.

GBM takes the following measures to ensure the protection of your Personal Information:

• Personal Information collected is stored on a secure server;
• We have protections in place to help prevent and detect attempts of malware, phishing, ransomware, and intrusions that may compromise the confidentiality of our servers;
• Our firewall secures the entire network and minimizes external intrusions;
• Our offices are equipped with security features, including individual access cards for each employee, to ensure the confidentiality of our records and integrity of our physical servers;
• Every employee is provided with an exclusive computer and a unique password for server access as an authentication method for added security.

RETENTION PERIOD

Your Personal Information is retained for as long as it is necessary for the purposes stated in this Policy, subject to any legal retention period requirements.

Once the objectives for which your Personal Information was collected have been achieved and after any applicable legal retention period has expired, GBM will proceed with the destruction or anonymization of this data.

We may retain certain information for purposes of analysis, accounting, maintaining accurate financial records, fraud prevention, fee recovery, compliance with our ethical obligations, enforcement of terms of use, safeguarding the integrity of the website or its users, or for other reasons permitted by law. Furthermore, if any of your Personal Information has been shared with third parties with your consent, their use and retention will be subject to the policies of those third parties, and GBM shall not be held responsible in any way.

RIGHT TO ACCESS AND CORRECTION OF YOUR PERSONAL INFORMATION

Ensuring that the Personal Information we have on record for you is accurate and up to date is crucial. Kindly notify us of any changes.

You have the right to request access to and the correction of your Personal Information.

Upon your request, GBM is committed to verifying the existence of your Personal Information, granting you access to it, and furnishing you a copy in a widely used electronic format.

You may also request the correction or deletion of Personal Information that is inaccurate, incomplete, or unclear, subject to the applicable legislation.

You have the right to request the halt of Personal Information dissemination if it violates the law, a court order, or if specific conditions are met. Please submit your request in writing, accompanied by proof of your identity. The Privacy Officer will respond to this request within 30 days.

Access to your Personal Information is generally free of charge, except in cases where reasonable fees may apply for transcription, reproduction, or transmission.

In the event of a refusal, the Privacy Officer will provide justification for the decision, indicate the legal provision on which it is based, and explain available remedies along with their timelines.

The Privacy Officer will provide, upon request and free of charge, a copy of the modified or added Personal Information, or a statement of its deletion, and will notify individuals who received this information within the six months prior to the request.

The Privacy Officer will retain the Personal Information subject to the request for the time necessary for you to exercise your legal remedies.

CONSENT WITHDRAWAL

 You have the right to withdraw your consent at any time for the communication, retention, or use of your Personal Information by GBM. To do so, please contact our Privacy Officer, whose contact information is provided in this Policy.

However, it is important to note that if the Personal Information is necessary for the execution of the mandate, withdrawing your consent may result in GBM being unable to provide its services, as the case may be.

CONFIDENTIALITY BREACHES

If GBM has reason to believe that an incident involving the held Personal Information has occurred, GBM:

• Will take reasonable measures to reduce the risks of harm and prevent similar incidents from occurring again;
• Will conduct an assessment to determine if the incident poses a risk of serious harm;
• Will promptly inform: (i) the Commission d’accès à l’information du Québec and the individuals whose Personal Information is concerned; and (ii) the individuals who are likely to prevent or reduce the risk of serious harm.
• Will maintain a record of confidentiality incidents and adjust its practices for protecting personal information as needed.

POLICY AMENDMENTS

GBM reserves the right to modify or supplement this Privacy Policy at any time. In the event of a modification, we will publish these changes on our website, and the modified version of the Policy, along with the changes, will be available upon request from the Privacy Officer. However, GBM will obtain the necessary consents in accordance with applicable privacy laws if the firm intends to collect, use, or disclose Personal Information about you for purposes other than those for which you have given your consent, unless the law requires or permits otherwise.