Our Commitment To Privacy

360HRIS is committed to protecting and safeguarding the privacy of individuals in all aspects of our business operations. Keeping personal information in strict confidence is a cornerstone of our business. 360HRIS has implemented a Privacy Policy to comply with the Personal Information Protection & Electronic Documents Act (PIPEDA) that came into effect on January 1, 2004, as well as other applicable legislation that may apply in other provinces. The Privacy Policy sets out the principles and guidelines that 360HRIS has adopted for the management of personal information of its customers (corporations, organizations and individuals purchasing services from 360HRIS), clients (individuals utilizing career transition or recruiting services from 360HRIS) and employees of 360HRIS. The Privacy Policy is based on the principles of the Canadian Standards Association Model Code for the Protection of Personal Information (the “Privacy Principles”).

Personal information is defined as information about an identifiable individual. The personal information that 360HRIS may utilize includes:

For customers – personal information may include information about their current employees (position, compensation, performance rating, length of service, employment history, career plans, assessment results or training), their former employees (use of our services), purchase orders, invoices or any records of dealings with us. This information is used to manage the business relationship with the customer and to allow 360HRIS to complete assignments on behalf of the customer.

For clients – this may include contact information, services provided, records of consultant meetings, resume information, employment preferences, job search plans, references or assessment results. For career transition clients, this information is used to help the client to plan and execute an effective job search. For recruitment clients, this information is used to connect the client with job opportunities.

For employees of 360HRIS – this may include contact information, performance evaluations, employment history, employment arrangements, benefit plan participation, career plans and assessment results.
Personal information does not include information that is publicly available, such as an individual´s name, address, telephone number and electronic address, when listed in a directory or made available through directory assistance or other similar sources or that is the name, title or business address or telephone number of an employee of an organization.

1. Accountability

360HRIS is responsible for all customer, client and employee personal information in its possession and under its control. 360HRIS has designated a Privacy Officer to oversee the organization’s compliance with its Privacy Policy and applicable privacy legislation. There are other individuals within 360HRIS who are designated with the responsibility for day-to-day collection and management of customer, client and employee personal information.

360HRIS has established policies and procedures to implement and comply with its Privacy Policy, including internal guidelines and procedures relating to the collection, handling, storage and destruction of personal information. 360HRIS staff has been provided the education and training to protect personal information and how to deal with complaints on privacy issues.

360HRIS is responsible for any personal information transferred to third parties for service or processing on its behalf. 360HRIS uses contractual means to provide an appropriate level of protection for such transferred information. Parties entering into a business relationship with 360HRIS may be required to sign a non-disclosure agreement to protect the confidentiality of information disclosed to such parties during the term and after the termination or expiry of such agreement. 360HRIS may examine the policies and procedures of any third party practices with respect to personal information to safeguard the personal information while it is being handled by a third party.

2. Identifying the purposes for collection of personal information

The purposes for which personal information is collected will be identified by 360HRIS at or before the time the information is collected, unless such purposes are obvious.

360HRIS will ensure that the purposes for which personal information is collected and the way in which the information may be used are clear to the individual. In some cases, the purpose will be clear from the context of the interaction, in other circumstances, a written or verbal explanation may be required.

Generally, 360HRIS collects personal information only for the following purposes:

• to establish and maintain responsible commercial relations with customers and to provide ongoing service and offers;

• to understand customer and client needs;

• to develop, enhance, market or provide products and services;

• to manage and develop 360HRIS business and operations, including personnel and employment matters; and

• to meet legal and regulatory requirements including requirements or requests of government agencies or pursuant to a subpoena or other legal proceeding.

The Privacy Policy places no limits on the collection, use or disclosure of information that is publicly available, such as an individual’s name, address, telephone number and electronic address, when listed in a directory or made available through directory assistance or other similar source or that is the name, title or business address or telephone number of an employee of an organization.

360HRIS’s customers may obtain and, in some cases may require, personal information pertaining to a 360HRIS employee. Such information may be obtained and/or used for the purposes of business and employment communications, facility and equipment management, video monitoring, accommodation management, travel or transportation management, health, safety and security management, social communications and expense and invoice payment processing.

In the event that customer, client or employee personal information is required to be used or disclosed for a purpose that is not listed above and in respect of which the customer, client or employee has not previously granted his or her consent, the personal information will not be used or disclosed without first identifying the new purpose and obtaining consent.

3. Obtaining consent

360HRIS will not collect, use or disclose the personal information of a person without the individual’s knowledge and consent, except in certain limited circumstances permitted by law, such as where immediate health of a person is at risk, or in connection with the breach of an agreement or a law.

The knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where noted below.

The consent may be expressed, implied, or given through an authorized representative. In determining the appropriate form of consent, the sensitivity of the information and reasonable expectations of the individual is taken into account. Implied consent is generally appropriate when the information is less sensitive. Any consent, including any implied consent, will apply to information already in the possession of 360HRIS as of the date of the consent.

360HRIS makes reasonable efforts to inform its customers, clients and employees how any personal information collected will be used and disclosed. To achieve this aim, the purposes for which the information will be used, if not obvious, will be explained in such a manner that the individual can reasonably understand how the information will be used or disclosed.

Generally, consent to use and disclose personal information is sought at the same time it is collected. In certain circumstances, however, 360HRIS may identify a new purpose and seek consent to use and disclose the personal information after it has been collected.

An individual can withdraw consent to use personal information at any time, subject to any legal or contractual restrictions and reasonable notice. 360HRIS will inform individuals of the implications, if any, of withdrawing consent and how to do so.

Exceptions for collection, use and disclosure without consent

Personal information may be collected without the knowledge or consent of the individual if:

• the collection is clearly in the interests of the individual and consent cannot be obtained in a timely way;

• it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province; or

• the information is publicly available and is specified by the regulations.

Personal Information may be used without the knowledge or consent of the individual if:

• in the course of its activities, 360HRIS becomes aware of information that it has reasonable grounds to believe could be useful in the investigation of a contravention of the laws of Canada, a province or a foreign jurisdiction that has been, is being or is about to be committed, and the information is used for the purpose of investigating that contravention;

• it is used for the purpose of acting in respect of an emergency that threatens the life, health or security of an individual;

• it is used for statistical, or scholarly study of research purposes that cannot be achieved without using the information, the information is used in a manner that will ensure its confidentiality, it is impracticable to obtain consent and 360HRIS informs the Privacy Commissioner of the use before the information is used;

• it is publicly available and is specified by the regulations; or

• it was collected under paragraph (a)(i) or (ii) above.

Personal information may be disclosed without the knowledge or consent of the individual if the disclosure is:

• made to, in the Province of Quebec, an advocate or notary or, in any other province, a barrister or solicitor who is representing the organization;

• for the purpose of collecting a debt owed by the individual to 360HRIS;

• required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records;

• made to a government institution or part of a government institution or an investigative body that has made a request for the information and identified its lawful authority to obtain the information.

• made to a person who needs the information because of an emergency that threatens the life, health or security of an individual and, if the individual whom the information is about is alive, the organization informs that individual in writing without delay of the disclosure;

• of information that is publicly available and is specified by the regulations;

• made by an investigative body and the disclosure is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province; or

• required by law.

4. Limiting collection of personal information

360HRIS will collect only the amount and type of personal information needed for the purposes it has identified. Personal information is collected by fair and lawful means.

Although 360HRIS will collect personal information primarily from customers, clients and employees, it may also collect personal information from other sources such as credit bureaus, or other third parties who represent that they have the right to disclose the information.

5. Limiting use, disclosure and retention of personal information

The personal information that 360HRIS collects is used or disclosed only for the purposes specified above or for which it was collected, unless the individual gives consent or as required by law. 360HRIS may disclose personal information without consent when it is required to do so by law, e.g. subpoenas, search warrants, other court and government orders, or demands from other parties who have a legal right to personal information, or to protect the security and integrity of its network or system. In such circumstances, the interests of the individual is protected by ensuring that:
orders or demands appear to comply with the laws under which they were issued; and
360HRIS discloses only the personal information that is legally required, and nothing more.

The customer, client or employee may be notified that an order requiring disclosure has been received, if the law allows it.

360HRIS may disclose Information to:

• any person who, in its reasonable judgment, is seeking the Information as the agent of the customer, client or employee concerned;

• a person involved directly or indirectly in supplying the product or service to a customer, client or employee, including, without limitation, our sales and marketing agents, our administration team for invoice printing and mailing, our employee benefits and pension providers, and provided that such person is required to keep the Information confidential;

• a person retained by 360HRIS to collect amounts which are owed to it or to enforce 360HRIS’s rights under its terms and conditions, if the Information is required for, and is to be used only for that purpose and that person is required to keep such Information confidential.

360HRIS may share Information with potential business partners of, or potential investors in, 360HRIS
360HRIS may provide Information, including customer information, as security for an investment in 360HRIS. 360HRIS may provide information, including customer information, to third parties who purchase assets from 360HRIS where such information is relevant to the assets so sold.

Only employees with a business need-to-know, or whose duties so require, are granted access to customer, client and employee personal information.

360HRIS will retain personal information only as long as necessary to fulfill the identified purposes. Depending on the circumstances, personal information used to make a decision about a customer, client or employee is kept long enough to allow the customer or employee access to the information after the decision has been made.
360HRIS has established reasonable guidelines and procedures for information and records retention, and any personal information no longer needed for its identified purposes or for legal requirements will be destroyed, erased or made anonymous within a reasonable period of time.

6. Ensuring accuracy of personal information

360HRIS will make reasonable efforts to ensure that personal information of individuals is as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.

Personal information will not be updated without the consent of the individual and it will only be updated if it is necessary for the continued use of the personal information.

360HRIS will make reasonable efforts to obtain information from individuals in order to update information on hand if required to fulfill the purposes for which the information was collected. Once informed by a person that personal information held by 360HRIS about them is inaccurate, 360HRIS will update the information as soon as possible.

7. Safeguarding personal information

360HRIS will protect personal information with safeguards appropriate to the sensitivity of the information. 360HRIS has implemented appropriate safeguards to protect personal information against such risks as loss or theft, unauthorized access, disclosure, copying, use, modification or destruction.

360HRIS´s employees are made aware of the need to maintain the confidentiality of all personal information.

The methods of protection used by 360HRIS will include:

• physical measures, for example, locked filing cabinets and restricted access to offices;

• organizational measures, for example, limiting access on a “need-to-know” basis; and

• technological measures, for example, the use of passwords and encryption.

7.3 360HRIS will ensure that its employees who are in contact with personal information are trained in the appropriate protection of personal information and that they are aware of the importance of maintaining the confidentiality of personal information. Employees are required to abide by this Privacy Policy.

8. Making information about policies and procedures available to customers, clients and employees

360HRIS’s policies and practices for the protection of personal information are made available to customers, clients, employees and general public. 360HRIS’s Privacy Policy is posted on the 360HRIS website and informs individuals about the type of personal information it collects, what it is used for and to whom the information is disclosed.

9. Providing access to personal information

When customers, clients or employees request it, 360HRIS will disclose to them what personal information 360HRIS has about the customer, client or employee, what it is being used for, and to whom it has been disclosed, and will give them reasonable access to their information. 360HRIS will provide a list of the third parties to which it may have disclosed the personal information when it is not possible to provide an actual list. Wrong or incomplete information will be amended and the amended information transmitted to third parties where appropriate. Any dispute over amending a file will be recorded and details of disputed data provided to third parties where appropriate.

In certain situations, however, 360HRIS may not be able to give customers or employees access to all personal information it holds about the customer, client or employee. This may, for example, be the case when the information is unreasonably costly to provide, the information contains references to other individuals, the information cannot be disclosed for legal, security or commercial proprietary reasons or the information is subject to solicitor-client or litigation privilege. 360HRIS will explain the reasons for denying access in writing, and the recourse available to the customer, client or employee.

360HRIS will make reasonable efforts to respond to an individual’s request for access to his or her personal information no later than 30 days after receipt of the written request, and at minimal or no cost. The individual will be informed of any extensions to the time limit and his or her right to complain to the Privacy Commissioner.

360HRIS may not provide access to personal information to an individual if doing so would likely reveal personal information about a third party, unless:

• the information about the third party can be severed from the record containing the information about the individual, in which case it will be severed prior to providing the access;

• the third party consents to the access; or

• the individual needs the information because an individual’s life, health or security is threatened.

Access to personal information will not be given if:

• • the information is protected by solicitor-client privilege;

  • to do so would reveal confidential commercial information;

• to do so could reasonably be expected to threaten the life or security of another individual; or

• the information was generated in the course of a formal dispute resolution process.

• A customer or client can obtain information or seek access to his or her personal information by contacting a 360HRIS representative at the 360HRIS office.

• An employee can obtain information or seek access to his or her individual personal file by contacting the 360HRIS Privacy Officer.

10. Handling complaints and questions

Customers, clients or employees may challenge 360HRIS compliance with its Privacy Policy. 360HRIS has implemented an internal escalation policy to deal with the receipt, investigation and responses to complaints and questions regarding privacy issues.

All complaints and questions will be responded to in a timely manner under the circumstances. All complaints will be investigated and appropriate measures taken to correct deficient policies and practices. Customers, clients or employees have the right to contact the Privacy Commissioner in the event of any dispute.

Any complaints or concerns regarding personal information and this Privacy Policy may be addressed to 360HRIS.