Privacy Governance Policy

1. What these practices cover

These practices cover every piece of personal information the partner network handles: information about the people who represent member firms, information about the people involved in a client transaction, and the records the portal creates as it operates. They apply to Vantage personnel, to anyone acting on our behalf, and to the service providers we engage.

2. Who is responsible for what

Vantage is a small enterprise, and saying so is part of being clear. Three roles exist:

• Person responsible. Eric White is the person responsible for the protection of personal information and holds final authority over these practices. Every access request, rectification request, withdrawal of consent and complaint is answered by this person, at info@vantageventures.ca. Where the portal is changed in a way that touches personal information, the person responsible is consulted before the change ships, not after.
• Vantage personnel. Vantage administrators may see the whole network, because routing an opportunity requires comparing firms. Their actions are written to an audit log they cannot edit. Access is granted by role rather than by person, and it is removed when it is no longer needed for the work.
• Member firm users. A member firm's users see their own firm and nothing else. This is enforced by the server on every request and refuses by default, so a partner account cannot reach another firm's information even if a link to it is guessed or shared.
• Service providers. Service providers process personal information only on our instructions, for the single purpose they were engaged for, under confidentiality and security obligations. The current categories, what each is for and where each operates are listed in the Privacy Policy. Engaging a new provider requires that list to be updated before the provider goes live.

3. How long information is kept, and how it is destroyed

Personal information is kept for 7 years after the end of our relationship with a member firm, and longer only where the law requires it. Tax, accounting and transaction records are the usual reason for a longer period. Two categories run shorter by design: sign in and invitation links expire in hours and are purged automatically, and the assistant keeps no record of conversations at all.

When a retention period ends, information is either securely deleted or irreversibly anonymized. Anonymized means it can no longer identify anyone, directly or indirectly, and cannot be reversed. Aggregate statistics that identify nobody may be kept for network analytics after the underlying records are gone.

4. The life cycle of a record

Information is collected directly from member firms, from use of the portal, and from the parties to a transaction. It is used only for the purposes published in the Privacy Policy. It is communicated only inside the referral process, to service providers, or where the law requires. It is kept as described above. It is destroyed as described above. At each of those five stages the controlling rule is the same: the smallest amount of information, seen by the fewest people, for the shortest time the purpose allows.

5. Confidentiality incidents

We keep a register of confidentiality incidents, as the law requires, and record every incident in it whether or not it turns out to be serious. When an incident involving personal information presents a risk of serious injury, we notify the person affected and the Commission d'accès à l'information promptly, take reasonable measures to reduce the risk, and act to prevent a recurrence. Injury is assessed on the sensitivity of the information, the likely consequences and the likelihood the information will be misused.

6. Information communicated outside Québec

The portal's primary data store is in Canada. Some processing is performed by providers in the United States, listed by category in the Privacy Policy. Before personal information is communicated outside Québec we assess the sensitivity of the information, the purposes it will be used for, the protection measures that will apply to it and the legal framework where it is going, and we proceed only where the assessment establishes that it would receive adequate protection. That assessment is kept in writing and may be requested from the person responsible.

7. Identification, location and profiling technology

The portal uses no technology that identifies, locates or profiles an individual. Cookies are strictly necessary ones that keep you signed in and protect your session; there are no advertising cookies, no third party analytics and no social media pixels. The mandate fit score compares an opportunity against a firm's own stated mandate, so it describes a firm rather than a person, it shows its reasoning, and a person at Vantage makes the routing decision. No decision producing a legal or similarly significant effect about an individual is made by automated means alone.

8. How to complain

Write to info@vantageventures.ca and say what you think went wrong. You do not need a particular form of words. We acknowledge a complaint on receipt, answer it within 30 days, and tell you in writing what we found and what we did about it. If we were wrong we say so and fix it. Complaining costs a member firm nothing and has no bearing on how opportunities are routed to it.

If our answer does not satisfy you, you may complain to the Commission d'accès à l'information du Québec, or to the Office of the Privacy Commissioner of Canada. You may do that at any time; you are not obliged to come to us first.

9. Keeping these practices current

These practices are reviewed at least once a year, and again whenever the portal changes in a way that affects personal information, whenever a new service provider is engaged, and after any confidentiality incident. The date above reflects the current version.

10. Contact

Vantage Ventures Inc. · Montréal, Québec, Canada · info@vantageventures.ca