Protection of Personal Information and Information Security
​
Callosum assigns great importance to confidentiality and the protection of personal information. Personal information is provided by the people who participate in our studies and the companies that use our services. We are committed to protecting the confidentiality of the personal information entrusted to us.
For participants in our studies
Personal information is collected from participants who have agreed to participate in our studies (surveys, focus groups, individual interviews, online communities, etc). The reports we produce do not allow the individual responses of participants to be identified. The information is always anonymized and the results are presented in an aggregated manner.
For our clients
Personal information obtained on behalf of our clients is used only within the framework of the mandate entrusted to us. All data collected is kept strictly confidential.
For further information, you are invited to contact our personal data protection manager, Nathalie Martel, who can be reached at the following address: info@callosum.ca
​
Personal information protection policy
Callosum's policy has been prepared according to the principles set out in the National Standard of Canada entitled Model Code for the Protection of Personal Information, CAN/CSA-Q830-96.
https://laws-lois.justice.gc.ca/eng/lois/p-8.6/page-7.html
​
1. Responsibility
Nathalie Martel, Partner, has been designated by Callosum as the person responsible for ensuring that the organization complies with the principles of its policy, although other members of the organization may be responsible for daily collection and processing personal information.
The policy can be reached via the following channel:
By email: info@callosum.ca
By mail: 7245 rue Alexandra, bureau 301, Montréal, Québec H2R 2Y9
The person designated by Callosum is responsible for:
a) Implementation of procedures to protect the personal information that Callosum obtains from people who have agreed to participate in its studies and from companies that use its services;
b) Establishment of procedures to receive and respond to complaints and requests for information;
c) Staff training and transmission to staff of information relating to the organization's policies and practices;
d) Drafting explanatory documents concerning their policies and procedures.
2. Determining the purposes of collecting information
Callosum has created a registry to document the projects on which personal information is collected and how its information will be used.
When personal information is collected from participants in our studies, we tell them in advance what purposes their information will be used for:
a) To contact them to send them an invitation to participate in a study (online survey or participation in a focus group, individual interview or online community).
b) To send them the promised incentive to thank them for their participation (focus groups, individual interviews or online communities).
c) Regarding the recordings of the focus groups and individual interviews: so that the internal team at Callosum can remember the content of the discussions, that clients who were not able to see the sessions in real time can oberve it, and include anonymized video clips in the reports.
d) To be able to see how survey results (which are always aggregated) vary based on different profile variables (like gender, age, region, etc.).
Before using personal information for purposes not previously specified, if applicable, the new purposes are specified before use. We ensure that we obtain the consent of the person concerned before using the information for this new purpose.
When planning the project and writing the research tools, we make sure to only collect the information necessary for the purposes mentioned.
3. Consent
Participation in Callosum studies is always voluntary.
People who participate in our studies are informed of any collection, use or communication of personal information that concerns them and must consent to it.
We collect personal information from minors only after obtaining permission from a parent or legal guardian.
When a client wishes to use our services to carry out a study from a contact list that belongs to them, they must obtain the consent of the people concerned before sharing this list containing personal information.
Consent takes the following forms:
• Via a consent form. By signing it or checking a box, the person gives consent to the collection of information and the specified uses;
• Consent can be given orally when information is collected by telephone.
During the study, participants have the right to refuse to answer specific questions or terminate their participation at any time.
A person may withdraw consent at any time, subject to restrictions provided by law or contract and reasonable notice.
4. Limitation of collection
Personal information is used solely for the purposes of research that is conducted by our clients. They are never used to carry out other studies or sold to a third party.
We limit the amount and nature of the information collected to what is necessary to carry out our studies.
​
5. Limitation of use, disclosure and retention
Only employees of Callosum and its partners approved by the client have access to participants' personal information.
Callosum retains personal information only as long as necessary to achieve the specified purposes. One month after the project is completed (report submitted), this information is destroyed/deleted from all media where it was saved:
• Contact lists provided by customers
• Grids presenting the profile of participants in discussion groups or individual interviews
• Recording of qualitative sessions
For recordings that are shared with clients (and for which consent has been requested in advance from the participant), we specify that use must be limited to the people involved in the study, that the content must not be disseminated in any way and the file must be destroyed after use.
6. Accuracy
Through various validation mechanisms, we ensure that the personal information we collect from participants in our studies is accurate.
With a few exceptions, Callosum does not update personal information because the mandates entrusted to us are one-off.
7. Security measures
All employees must comply with the provisions of Callosum's information security policy.
A document including all the clauses concerning them is provided to all new employees when they are hired. This document is available on the server for access at any time.
Future employees must also sign an employment contract which includes clauses relating to confidentiality and non-disclosure of information.
The policy is explained/reminded to employees throughout the year. In addition, company managers offer support to employees as needed and can answer their questions at any time.
We ask our partners to commit to data protection and security standards that are at least as strict as ours. All subcontractors are bound by confidentiality agreements.
8. Transparency
On our website we present a summary of our commitment to the protection of personal information and the contact details of the person responsible.
In this summary, a clickable link provides access to all the details on our policies and practices regarding the management of personal information.
9. Access to personal information
If a person requests it, Callosum informs them whether or not it has personal information about them. We also specify the source of the information and the third parties to whom it was communicated (if applicable).
The data subject can consult the personal information that Callosum has in its possession (after verification of their identity).
If this person brings to our attention that personal information is inaccurate or incomplete, we make the necessary changes to this information. Depending on the nature of the information that is the subject of the dispute, we correct, delete or add information.
If the information comes from a list provided by our client, we ask the person to contact the client directly to make the necessary changes.
10. Possibility of filing a complaint regarding non-compliance with the principles
Any person can complain about non-compliance with the principles set out in our policy by contacting the person responsible for the protection of personal information at Callosum.
This person will read the complaint, analyze the situation and if the complaint is deemed justified, they will propose a solution so that the problem raised does not repeat itself.
Callosum will inform the person who filed the complaint of its analysis of the situation and the corrections that will be made, if necessary.
Callosum documents complaints and their handling in a register.