Last updated: September 2026

PRIVACY POLICY

  1. Introduction 

Elmwood Cemetery (“EC”) is subject to the Act respecting the protection of personal information in the private sector (Law 25). EC is committed to protecting the confidentiality and security of your personal information in accordance with the principles applicable to the protection of personal information.

This privacy policy describes how EC collects, uses, stores, and communicates personal information during its business activities. The policy is intended to evolve over time to reflect any changes made in the administration of personal information, to comply with applicable laws and to demonstrate transparency.

  1. Consent 

EC only collects and uses personal information with the consent of the individual.

By providing EC with personal information, you accept the terms and conditions of this policy.

If you are not a resident of Quebec, please note that by providing your personal information, you are deemed to consent to: (i) the collection, use and disclosure of your personal information in Quebec; (ii) the collection, use and disclosure of your personal information in accordance with the laws of the province of Quebec (which may differ from the privacy laws of the jurisdiction of your residence) and this policy.

An individual can withdraw their consent by contacting EC at [email protected].

  1. Definition of personal information 

By personal information, we mean any information that concerns an individual and which, taken alone or in combination with other information, allows them to be identified. 

  1. Responsibility 

EC is responsible for the personal information it collects, including personal information communicated to third parties for administrative purposes, processing, or maintenance.

The Chairperson of the EC Board of Directors ensures compliance with this policy to meet the following requirements:

  • To designate a person responsible for the protection of personal information (Privacy Officer).
  • To establish governance policies and practices in relation to personal information.
  • To report privacy incidents involving personal information that would present a serious risk of harm and record them in the Confidentiality Incident Register.
  • To ensure transparency in the collection and use of personal information.
  • To ensure clear, free, and informed consent in the use and processing of personal information.
  • To conduct privacy impact assessments where required under Law 25, including before communicating personal information outside Quebec or before acquiring, developing, or overhauling an information system or electronic service delivery project involving personal information.
  1. Purposes of collection and use 

The collection, use and communication by EC is limited to what is necessary for the operations of EC. We may use your personal information to conduct data analysis and research to guide our operations. EC collects personal information for various reasons, including:

  • Follow up on requests from members, volunteers, and donors.
  • Soliciting donations.
  • Processing and accounting of donations made and the production of charitable receipts.
  • Application for membership and volunteering.
  • Management of contracts and service agreements.
  • Ensuring the operation and maintenance of full functionality of the website and social media accounts (i.e. Facebook), including fulfillment of service and information requests of members, volunteers, and donors; response to comments and questions; and provision of support for users of the website and social media accounts.
  • For statistical purposes understanding and analysis of usage trends and preferences of our members, volunteers, and donors, improvement of the website and social media accounts, and development of new products, programs, services, news features, and functionality.
  • For administrative or marketing purposes in accordance with applicable laws relating to commercial electronic messages.

EC does not use automated decision-making systems (e.g. algorithms or artificial intelligence) to render decisions about individuals based exclusively on automated processing of personal information. Should this change, EC will inform affected individuals at or before the time of collection, and will explain the factors and logic used, and their right to have such a decision reviewed by a person.

  1. Limits on collection and use 

The collection of personal information by EC is limited to what is necessary for the purposes indicated or clearly implied at the time of collection. It is possible that EC may collect and use information concerning an individual which comes from a third party when the law authorizes it and with the consent of the person concerned in all other cases.

For example, EC, in the context of fundraising is likely to request and collect the following information when creating a file or processing a service:

  • First and last name
  • Civic address
  • Email address
  • Phone number

If a donor uses a credit card to donate through the LQ website, no information related to this credit card is collected by LQ on its servers. Payment for donations is processed and administered by the banking procedures of a third-party provider, directly on their website.

At no time will EC share any information with third parties, or otherwise disseminate it without the consent of the person concerned, except in cases authorized or required by the law.

  1. How information is collected 

EC may collect personal information in various ways, including, but not limited to: 

  • By completing an application (for service; to volunteer; for membership) 
  • By telephone 
  • Via EC’s website and its related software 
  • By responding to a postal request 
  • By email 
  1. Preservation of personal information 

EC retains personal information for as long as is reasonably necessary for the purposes for which it was collected or as required by law. Once these purposes are fulfilled, EC will destroy or anonymize the information, subject to applicable legal retention requirements (e.g. tax and charitable receipt records).

  1. Security of personal information 

EC applies and ensures that it and its sub-contractors apply appropriate physical, technological, and administrative security measures to maintain the confidential nature of personal information to protect it against theft, loss, disclosure, or unauthorized access.

  1. Destruction of personal information 

EC will undertake appropriate security means to destroy personal information when the destruction of information is required and legal. 

  1. Cross-Border Transfers of Personal Information

Some of EC’s service providers (for example, Meta/Facebook) may store or process personal information outside Quebec, including in the United States. Before communicating personal information outside Quebec, EC conducts a privacy impact assessment to evaluate whether the information would receive protection equivalent to that afforded under Quebec law, taking into account the sensitivity of the information, the purposes of use, applicable safeguards (including contractual protections), and the legal framework of the destination jurisdiction. Personal information will only be transferred outside Quebec where this assessment confirms adequate protection.

  1. Communication of personal information 

Access to information is limited to EC Staff and Board Members assigned for this purpose, and only in the exercise of their work.

Under no circumstances will EC sell, share, or rent this information.

EC does not, under any circumstances, communicate personal information for purposes other than those for which these were collected, except with the consent of the person concerned or as the law requires or permits.

Every member of the EC Staff or Board of Directors is committed to respecting personal information collected by EC. These people undertake to preserve the confidentiality of information specific to the activities of EC and not to disclose its content, make any personal use of it, or use it for the benefit of others. This commitment exists from the time members of EC Staff and Board of Directors begin work for EC and continues indefinitely. EC Staff and Board Members will sign an agreement to maintain such confidentiality.

EC undertakes to require confidentiality commitments from these third parties at least as demanding as those provided for in this policy, including controls and measures aimed at protecting the confidentiality, security, and integrity of the information they hold on behalf of EC, and to avoid theft, loss, disclosure, or unauthorized access to personal information.

Despite the above, no method of transmitting or storing personal information by electronic means offers infallible security. EC cannot therefore guarantee that the confidentiality and integrity of personal information cannot be infringed.

  1. Reporting and recording privacy incidents (breach of data) 

If, despite efforts to protect personal information, an incident involving this information occurs, EC will undertake the following actions as soon as the breach is identified:

  • Collect the information concerning the breach, which will be recorded in the Confidentiality Incident Register. This will include the personal information concerned, the circumstances, the period (or date) of the breach, the date the breach was noted, and the number of people targeted.
  • Assess the situation to determine if there is resultant harm and of what kind.
  • If the breach presents a risk of serious injury, notice will be sent to the person(s) affected by the breach, including a description of the measures taken by EC, without delay.
  • Notify the Commission d’accès à l’information du Québec (CAI) without delay where the breach presents a risk of serious injury.
  • Implement the measures described for those affected by the breach.
  • A report is made by the Privacy Officer to the Chairperson of the EC Board of Directors, the CAI, and other required authorities.

If you believe your personal information has been affected by a breach, you may submit a Breach of Personal Data Complaint Form.

  1. Access to Personal Information

Subject to relevant laws and upon receipt of a written request from an individual and after verifying their identity, EC will inform the individual whether it has personal information on that individual and will communicate what personal information it has on them, within 30 days of receiving the request.

EC may refuse a person access to their information in accordance with the relevant laws, in which case it will give reasons for its refusal in writing.

To request access to your personal information, please submit a .

  1. Correction, Deletion, and Portability of Personal Information

EC will make reasonable efforts to ensure that the personal information it holds is accurate and complete as required for the purposes for which it is used. An individual can request a correction or update by contacting EC.

An individual may also request that EC cease disseminating their personal information, or that it be de-indexed from any search engine results, where the dissemination contravenes the law or a court order. An individual may further request the deletion of their personal information where it is no longer necessary for the purposes for which it was collected, subject to EC’s legal retention obligations.

An individual may request that EC provides the computerized personal information it holds about them, in a structured, commonly used technical format, and that EC transmits that information to a third party at the individual’s request, where technically feasible.

EC will respond to correction, deletion, and portability requests within 30 days.

Correction, deletion, and portability requests can also be submitted using the same Data Access Request Form.

  1. Complaints

Anyone about whom EC holds personal information may complain about non-compliance with this policy in writing. EC will process any complaints.

If an individual is dissatisfied with EC’s response to a complaint, or with the policy and practices regarding the processing of personal information, they may file a complaint with the Commission d’accès à l’information du Québec on the Commissioner’s website at www.cai.gouv.qc.ca.

  1. Responsible for the protection of personal data 

Hélène Gagné
Office Manager
Elmwood Cemetery
P.O. Box 751 STN Place de la Cité
Sherbrooke, QC J1H 5K7
819-562-4555
[email protected]

  1. Amendment Process

The Office Manager prepares a draft amendment indicating the elements to be modified and sends it to the Chair of the Board in advance. 

  • The Office Manager prepares a draft amendment indicating the elements to be modified and sends it to the Chair of the Board in advance.
  • The amendment is included on the agenda of a meeting of the Board of Directors.
  • The document is discussed during the meeting and is ratified by a resolution.
  • The Office Manager makes the changes on the policy.
  • A copy of the resolution is filed with the original policy kept in the official minute book of EC.
  • The amendments are listed below in Updates.
  1. Updates 

September 2026: Privacy policy created to align with 2024 amendments under Law 25.