Personal Data Privacy Policy

This policy establishes the general practices and standards followed by PSC when processing Personal Data. This policy is applicable when PSC acts as Data Controller or Data Processor for all Personal Data, regardless of its nature or category and the media on which it is stored. This policy does not apply to third party websites that are accessible by clicking on links found on our website, and we are not responsible for third party websites.

1.1. Who does this policy apply to?

Our policy applies to any person who communicates with us, to any person whose Personal Data may be collected as part of our services, and to any person wishing to learn about our practices regarding the use, retention, collection and disclosure of Personal Data.

For the purposes of this policy, the following definitions apply:

• “Application” refers to the PSC website accessible to Clients and Users: https://Clients.nethris.com/ or https://evo.nethris.com;
• “Mobile Application” refers to the version of the Application accessible via phones and tablets;
• “Candidate” means, as the context requires, any person who applies for employment with the Client or at PSC;
• “Client” refers to entities that have entered into an agreement with PSC to use our Services;
• “Prospect” refers to any entity that demonstrates an interest in the Services and contacts PSC to inquire about them, but has not yet entered into an agreement to that effect;
• “Employee” refers to employees of the Client whose records are managed through the Services;
• “CGI Legal Entities” refers to all legal entities controlled directly or indirectly by CGI Inc. and that handle personal data, excluding any legal entities that are within the operational scope of CGI Federal. PSC is a wholly owned subsidiary of CGI;
• “Local Legislation” refers to local regulations, laws, including data protection laws, ordinances, and mandatory standards;
• “Member” refers to the employees, consultants, agents, directors and managers of PSC who operate the Services on our behalf;
• “Data Subject” refers to an identified or identifiable natural person whose Personal Data is processed. These may be visitors, Candidates or Employees, or end users of a Client in a business context;
• “Personal Data” refers to any information relating to a natural person that allows that person to be identified directly or indirectly. Personal Data includes sensitive data;
• “Data Controller” refers to any entity (i.e., natural or legal person, public authority, agency or other body) that, alone or jointly with other Data Controllers, determines the purposes and means of the Processing of Personal Data;
• “Data Processor” refers to any entity (i.e., natural or legal person, public authority, agency or other body) acting on behalf of and under instructions from a Data Controller or another Data Processor to Process Personal Data;
• “Services” refers to PSC’s electronic services available via the Application and the Mobile Application;
• “Public Site” refers to the website accessible to Visitors: https://nethris.com/;
• “Cookie” refers to any identifier transmitted to your device through your browser when you visit a website. Cookies may be temporary and disappear after the browsing session or they may be permanent, remaining even after the device used for browsing is closed;
• “Process”, “Processing” or “Processed” refers to any operation or set of operations performed on Personal Data, whether or not by automated means, such as collecting, recording, organizing, structuring, storing, adapting, altering, retrieving, consulting (including remote access), using, disclosing by transmitting, disseminating or otherwise making available, aligning or combining, restricting, erasing, or destroying;
• “User” refers to any person designated (administrators, directors, employees, consultants, and other representatives) by the Client to access and use the Services;
• “Visitor” refers to any person browsing the PSC website, with or without the use of cookies.

As part of its operations, PSC shall collect and Process Personal Data relating to:

• PSC job candidates;
• PSC Employees and former PSC Employees;
• Clients and prospects;
• Employees and candidates of Clients;
• Visitors to the PSC website;
• Service providers, professional advisors, suppliers, contractors and subcontractors;
• Any other third parties.

Subject to Applicable Data Protection Legislation, some or all of the following Personal Data categories may be processed by the Data Controller or by PSC as a Data Processor on behalf of the Client or for its own purposes as Data Controller:

Client Candidates

Application file: Résumé, background check.

Employees and former Employees of the Client

On behalf of the Client, PSC may process Personal Data (including sensitive data, where applicable and subject to this Policy and Applicable Data Protection Legislation) relating to the Client’s Employees and former Employees, as well as their dependents and next of kin (if applicable), for purposes related to their employment with the Client. This may include recruitment, general management, payroll management, performance management, career development, health and safety compliance, provision of health insurance, life insurance, diversity and inclusion management, disciplinary procedures, security checks (if and where required), background checks, visa applications and other immigration requirements, IT system administration and management, payment of taxes, expense processing and Employee benefits.

Clients, Prospects and visitors of PSC

The names of contact persons as well as their titles and contact details (phone, email).

Personal Data is collected in the following ways:

• Directly from you when you apply for a position at PSC;
• Directly from you when you request information about our services;
• When browsing the website if cookies are enabled;
• By the employer (Client of PSC) when an Employee or Candidate file is created. The employer is responsible for obtaining the consent of the Employee or Candidate when collecting Personal Data.

PSC will process Personal Data only when strictly necessary and apply different principles on the basis of whether PSC acts as Data Controller or Data Processor.

Data Processing may be performed only if at least one of the conditions set out below applies:

• It is necessary for the execution of a contract, e.g., a service agreement with a Client;
• It is necessary to comply with a legal obligation applicable to PSC, e.g., reporting data to tax authorities;
• It is necessary for the legitimate interest of PSC, it being understood that this legitimate interest of PSC must be assessed against the interests of the Data Subjects.

If none of the above legal bases apply, PSC will seek and retain the Data Subjects’ prior consent before processing their Personal Data, it being understood that the consent of the Data Subjects is valid when (i) it is manifestly and freely given by a clear affirmative act, and (ii) it represents a specific, informed and unambiguous indication of the Data Subjects’ agreement to the processing of their Personal Data.

PSC implements appropriate technical and organizational measures to guard against unlawful access and/or Processing of Personal Data, including the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of Personal Data transmitted, stored, or otherwise Processed. In particular, PSC grants access to Personal Data only when it is necessary to accomplish assigned tasks consistent with the purpose for which the Personal Data is processed. Where PSC uses a third party to undertake Processing on its behalf, PSC ensures that equivalent measures are put in place by that third party through contractual agreements. In the event of unlawful access and/or Processing, PSC will comply with its Information Security Policy and related procedures. Among other measures, PSC holds and is committed to maintaining ISO 27001 and 27701 certifications.

8.1. Incident Management

PSC has a mature, standards-based security incident response and management process designed to handle all phases of a security incident. Employees’ responsibilities are clearly defined at all levels. Incident assessment and prioritization standards are followed to ensure appropriate engagement levels and timely resolution. Incident records are maintained and reported to senior management as required. High-priority incidents are managed through PSC’s 24x7 Global Security Operations Centre (SOC), where highly trained, full-time incident response professionals coordinate response efforts. The internal organization responsible for the protection of Personal Data is immediately engaged in the incident management process wherever Personal Data is suspected to have been involved.

8.2. Notification of Personal Data Breach

Whether acting as a Data Controller or as a Data Processor, if PSC reasonably believes that a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data transmitted, stored or otherwise Processed has occurred, PSC will provide security incident notification and status updates to the relevant Data Protection Authority, to Data Subjects and/or to the Data Controller, in accordance with Applicable Data Protection Legislation or any other local applicable laws. Similarly, and for the sake of clarity, in the event a Personal Data breach is identified by a third party engaged by PSC, the third party will have to inform PSC as agreed upon in the relevant agreement.

9.1. PSC as a Data Controller

PSC will ensure that it does not keep your Personal Data for a longer period than strictly necessary to achieve the purpose for which your Personal Data is collected. Consequently, PSC will determine before the performance of the Processing an appropriate retention period. In doing so, PSC will consider the time during which the Personal Data is necessary to achieve the purpose of the Processing while taking into account the following factors:

• Period after which maintenance of such Personal Data may have an impact on Data Subjects’ rights to be forgotten; and
• Any legal obligations imposing a minimum data retention period, as may be defined in the CGI Records Retention Policy and Records Retention Schedule or otherwise.

PSC may retain Personal Data after the specific purposes for which it was collected have been fulfilled if this is necessary (i) to comply with applicable laws, (ii) to prevent any breach, or (iii) to resolve any dispute.

9.2. PSC as a Data Controller

PSC is the Data Controller and as such remains responsible for retaining data within the applicable timeframes in order to comply with the legal requirements applicable to its business. Retention periods must also take into account applicable limitation periods and possible recourse. It is therefore possible that your Personal Data will be retained after the end of your relationship with the Client, if it is your employer.

Upon termination of the relevant Data Processing agreement, PSC and any third party engaged by PSC will either destroy or return all Personal Data to the client according to its instructions and Applicable Data Protection Legislation

For the avoidance of doubt, nothing in this Policy limits PSC’s right to keep Personal Data for the purpose of existing litigation or to bring or defend future claims, in accordance with applicable legal statutes of limitation applicable to PSC.

This website may contain links to third-party websites and applications that are not affiliated with PSC. PSC does not endorse or make any representations about these third-party websites and applications in any way. PSC is therefore not responsible for the privacy practices or the content of these third-party websites and applications, which are subject to their own privacy policies. If you choose to access these links, we encourage you to review the privacy policies of all third-party sites before submitting your data.

As part of PSC operations, we may collect your Personal Data and disclose them to:

• CGI Legal Entities, if it is possible for the Data Subject to benefit from our full range of solutions and services as part of our global delivery model;
• Third parties engaged by PSC and providing goods to PSC or performing services on our behalf (e.g., suppliers, subcontractors);
• Certain regulated professionals (e.g., banks, lawyers, notaries and auditors);
• Partners of the Client and other third parties at the express request of the Client.

PSC will disclose your Personal Data if the disclosure is reasonably necessary to protect PSC’s rights and pursue available remedies, enforce PSC’s terms and conditions, investigate fraud, or protect CGI’s operations or users.

PSC may also disclose your Personal Data to administrative, judicial or governmental authorities, state agencies or public bodies, strictly in accordance with Applicable Data Protection Legislation and Local Legislation and, after careful review, the legality of any order to disclose data. PSC will challenge the order if there are grounds under law to do so and will notify the Data Subject of a potential order in accordance with the law of the country of destination.

PSC does not sell Personal Data.

As part of its operations, PSC keeps Personal Data in Quebec and does not transfer it to other jurisdictions.

Under the Applicable Privacy Legislation, Data Subjects have several rights, including withdrawal of consent. In particular, they may request access to their Personal Data held by PSC and/or request to obtain information on how PSC processes their Personal Data. If you have any queries regarding the processing of your Personal Information, please send a formal request to confidentialite@cgi.com or complete the online form.

When acting as a Data Processor, upon request, PSC will provide its clients with relevant information enabling such clients to comply with their own obligations toward Data Subjects. Unless otherwise indicated in any contractual agreement, PSC shall not be required to inform Data Subjects directly thereof, as this remains the responsibility of the Data Controller.

14.1 Compliance by Employees

Employees acknowledge the requirements and confirm acceptance of this Policy on an annual basis. In addition to this Policy, Members must also comply with other applicable confidentiality and privacy obligations, including those set out in any Applicable Data Protection Legislation, their employment agreements and PSC policies, processes and standards, or client’s instructions.

Employees are required to complete all of PSC’s privacy training and awareness programs. These programs include mandatory online training on data privacy, information security, anti-corruption, and records management, communication campaigns, and specific training adapted to the different roles within the organization.

These trainings and awareness programs are regularly updated to reflect changes to the Applicable Data Protection Legislation.

14.2 Compliance by any third party

In the event that any third party Processes Personal Data on behalf of PSC, such third party is governed by a contractual agreement and shall:

• Comply with this Policy and PSC’s security policies and standards, in addition to any other security controls included within contractual agreements between PSC and its Clients and/or partners;
• Process Personal Data in accordance with PSC’s documented instructions and for no other purpose than the one expressly defined in writing by PSC, unless it has a legal obligation to do so. In such case, the third party shall inform PSC immediately of this legal obligation prior to Processing;
• Notify PSC, to the extent permitted by law, of any request for disclosure of PSC Personal Data from a third party, public authority or court, as well as of any action and/or measure regarding the processing of Personal Data related to PSC that is under investigation by the authorities;
• Notify PSC immediately of any changes that may affect the Processing of PSC Personal Data;
• Notify PSC immediately of any confidentiality incident involving the Processing of PSC Personal Data;
• Actively cooperate with PSC to assess and document the compliance of PSC’s Personal Data Processing, including providing PSC with any information that PSC may need or require to comply with Applicable Data Protection Legislation (including any information required for the Transfer Impact Assessment [TIA]);
• Immediately inform PSC in writing if, in its opinion, any instruction from PSC regarding the Processing of PSC’s Personal Data constitutes a violation of the Applicable Data Protection Legislation.

This Policy may be amended from time to time by PSC. PSC must ensure that Data Subjects are promptly notified of any material changes to the policy, by means of an “update” published on nethris.com The latest updates take effect on the date indicated in the Policy.

16.1. Questions

If you have any questions regarding the interpretation or application of this policy, please send an email to confidentialite@cgi.com or contact us by phone at 1-514-841-3200 or in writing at:

CGI Payroll Services Centre Inc.
Attention: Legal Department
1350 René-Lévesque Boulevard West, 25th floor
Montréal, Quebec H3G 1T4

16.2. Privacy authorities

If you believe that your rights have not been respected by us or your employer, please contact us or your employer, depending on the nature of the complaint.

If you wish, you may also contact the appropriate provincial or federal privacy authority using the list below:

• Quebec
• Alberta
• British Columbia
• Canada (other provinces and territories)