Personal Information Governance Policy
Effective date: October 10, 2026 · Labontech inc. (RestoManager)
1. Purpose and scope
This policy describes how Labontech inc. protects personal information throughout its life cycle, from collection to destruction. It meets section 3.2 of Québec's Act respecting the protection of personal information in the private sector.
It applies to:
- all personal information Labontech holds, including information processed in RestoManager on behalf of its customers;
- everyone who works for Labontech, including contractors;
- service providers that process information for us, through their contracts.
It complements our Privacy Policy, which explains to users what information we collect and what their rights are.
2. Person in charge of the protection of personal information
As the law provides, the person with the highest authority at Labontech acts as the person in charge of the protection of personal information. They have delegated part of this function in writing to two team members, who assist them and act in their absence.
The person in charge:
- approves the personal information governance policies and practices;
- receives and handles access requests, correction requests and complaints;
- leads the response to confidentiality incidents and keeps the incident register;
- approves privacy impact assessments;
- makes sure the team is trained.
To contact the person in charge: confidentialite@restomanager.ca
3. Roles and responsibilities
Everyone who handles personal information has a defined role, from collection to destruction.
| Who | Responsibilities |
|---|---|
| Person in charge | Approves policies, decides on notices after an incident, keeps the incident register, approves privacy impact assessments. |
| Designated members | Handle requests and complaints day to day, coordinate the response to incidents, act for the person in charge in their absence. |
| Whole team | Accesses only the information needed for their work, reports any suspected incident without delay, completes training, honours their confidentiality commitment. |
| Development team | Builds protection in by design, sets privacy settings to the highest level by default, applies retention periods in the software. |
| Service providers | Process information only on our instructions and under their contract, protect it, notify us of any incident. |
| Employer customers | Decide what information they collect about their employees, tell them they use RestoManager, answer their requests with our help. |
4. Collection, use and disclosure
We collect only the information needed for the stated purposes, and we do not sell it.
- Collection. We inform people at the time of collection: purposes, means, rights and how to contact the person in charge. The app's privacy settings are off by default.
- Consent. We ask for consent that is manifest, free and informed, and given for specific purposes. For sensitive information, consent is express. We keep a record of consents.
- Use. We use information only for the purposes it was collected for, unless the person consents or the law provides an exception.
- Automated decisions. When a decision is based exclusively on automated processing, we tell the person, who may ask for a person to review it.
- Service providers. Every provider that processes information for us is bound by a written contract. The contract sets the protection measures, limits use to the mandate, requires destruction when the contract ends and requires notice of any incident.
- Disclosure outside Québec. Before disclosing information outside Québec, we carry out a privacy impact assessment (section 7) and govern the disclosure with a written agreement.
5. Retention and destruction
We keep information for as long as its purposes or the law require, then destroy or anonymize it. The exact periods are in section 10 of our Privacy Policy.
- Automatic enforcement. The software applies retention periods itself: a scheduled job erases or anonymizes information that has reached its end date.
- Decisions. Information used to make a decision about a person is kept for at least one year after that decision.
- Destruction. Data is securely erased. Backups are overwritten automatically within 35 days. Media taken out of service are securely wiped or destroyed.
- Anonymization. We anonymize information only according to generally accepted best practices and the criteria set by regulation, so that it irreversibly no longer allows the person to be identified.
- End of subscription. A customer that ends its subscription has 90 days to export its data. We then delete it, except what the law requires us to keep.
6. Security and access management
Access to personal information is limited to people who need it for their work, and it is logged.
- Least privilege. Each team member gets only the access their tasks require. Access to production data is restricted to a few designated people.
- Authentication. All internal accounts use multi-factor authentication.
- Access reviews. We review access every quarter. We remove a person's access on the day they leave.
- Encryption. Information is encrypted in transit and at rest. SINs and banking details are additionally encrypted and masked on screen.
- Confidentiality. Every team member signs a confidentiality commitment before getting access.
- Logging. Access to sensitive information is logged and can be audited.
7. Privacy impact assessments
We assess privacy risks before starting a project or a disclosure that involves personal information.
When. We carry out an assessment:
- before any project to acquire, develop or overhaul an information system or electronic service that involves personal information;
- before disclosing personal information outside Québec, including to a new service provider.
How. The assessment is proportionate to the sensitivity of the information, its purpose, quantity, distribution and medium. It looks at whether the information is needed, the risks and the measures to reduce them. For a disclosure outside Québec, it also considers the legal framework of the destination and the contractual safeguards.
Who. The project team drafts the assessment at the start. The person in charge approves it and may require measures. We keep it and update it when the project changes.
8. Confidentiality incidents
A confidentiality incident is unauthorized access to, use of or disclosure of personal information, or its loss. We handle it in five steps.
- Report. Any team member who suspects an incident reports it immediately to the person in charge.
- Contain. We promptly take reasonable measures to reduce the risk of harm and prevent a similar incident.
- Assess. We assess whether there is a risk of serious harm, based on the sensitivity of the information, the possible consequences of its use and the likelihood it will be used for harmful purposes.
- Notify. If there is a risk of serious harm, we promptly notify the Commission d'accès à l'information and the people concerned in writing. When the incident involves a customer's information, we notify the customer without delay, and no later than 72 hours after becoming aware of it, and help them make their own notices.
- Record. We record every incident in the incident register, even without a risk of serious harm. We keep the register up to date and keep each entry for at least 5 years after we became aware of the incident.
9. Complaints and requests
Anyone may exercise their rights or make a complaint by writing to confidentialite@restomanager.ca, or by leaving a message at +1 581-706-5568. The service is free, in French or English.
| Request | Acknowledgement | Written response |
|---|---|---|
| Access, correction or other right | On receipt | Within 30 days |
| Complaint about how information is handled | Within 5 business days | Within 30 days |
- Identity. We may verify the person's identity before responding.
- Employment records. A request about a record we process for an employer is forwarded to that employer without delay. We help them respond.
- Handling a complaint. A designated member reviews the facts and proposes a solution, and the person in charge approves the response. We record every complaint and how it was resolved.
- Recourse. If the person is not satisfied with the response, they may contact the Commission d'accès à l'information. An application to review a refusal of access or correction must be made within 30 days of the refusal.
10. Training and awareness
Every team member is trained before getting access to personal information, then every year.
Training covers:
- this policy and the privacy policy;
- how to recognize and report a confidentiality incident;
- good security practices (passwords, phishing, devices);
- how to handle a request from a person concerned.
We also give a refresher after an incident or a significant change in our practices.
11. Review and contact
We review this policy every year and after any significant change: a new law, a new service provider, a new feature or an incident. The person in charge approves each version, and the effective date is shown at the top of the page.
For any question about this policy:
- Email: confidentialite@restomanager.ca
- Phone: +1 581-706-5568 (voicemail)