Normex Métal – Last modified on October 22, 2026.
This policy explains how Normex Métal handles personal information obtained through its dealings with clients, suppliers, job applicants and visitors to its website. Personal information is information about an individual that can identify them, directly or indirectly. This policy covers online forms, emails, telephone conversations and documents provided to us.
Steve Legault, Privacy Officer
Email: info@normexmetal.com
Telephone: 819 333-1200
Address: 11, boulevard Industriel, Route 111 Est, La Sarre, Québec
For privacy matters, use “Privacy — Attention: Steve Legault” as your email subject line. Before sending sensitive documents, you may ask for a suitable way to communicate with us. We may verify your identity in a way that is proportionate to your request, without routinely requiring a complete copy of an identity document.
We limit collection to what is necessary. Forms identify required fields. Without necessary information, we may be unable to respond to a request or assess an application. Do not submit a social insurance number, an identity document or health information through an initial contact or job application form unless we have a justified reason to request it and provide a suitable way to submit it.
We explain how information will be used when we collect it. Where your consent is required, it must be freely given, informed, specific and limited to the purposes stated. We request express consent to use or disclose sensitive information where required by law. Exceptions provided by law may allow certain processing without consent.
You may withdraw your consent to a use or disclosure by contacting Steve Legault. We will explain the possible consequences and any obligations that may justify retaining certain information. A quote request or job application does not provide blanket permission for marketing.
Access is limited to staff members who need it to perform their duties: those responsible for quotes and projects, administration, recruitment and the Privacy Officer. Access to sensitive files and privacy complaints is restricted.
We may use service providers for website hosting and maintenance, email, backups, IT support or professional services. We disclose only the information necessary for their work. Arrangements involving access to personal information are documented in writing and include obligations concerning confidentiality, security, limits on use and incident management.
Other disclosures may be made with your consent or where authorized or required by law. Upon request, we can explain the specific information we hold about you, the categories of people authorized to access it and the applicable retention period.
Depending on the services used, information may be hosted, backed up or accessed outside Quebec, including elsewhere in Canada. Before such a disclosure or an arrangement to process information outside Quebec, Normex must conduct a privacy impact assessment, verify that the information will receive adequate protection and enter into a written agreement that takes the assessment into account. You may request information about the processing locations applicable to your file.
Cookies and similar technologies may support website operation or additional features. Where a technology can identify you, locate you or create a profile of you, its functions and how to enable them are explained before they are used. These functions are disabled by default and are enabled only at your initiative, in accordance with applicable requirements.
Cookie settings must identify the categories used and allow you to change your choices. External content, such as a video or map, may disclose information to its provider when it loads. How this content works must be explained, and its activation must be managed according to the information processed. Declining optional functions may limit those functions without preventing the website’s essential functions from working.
Safeguards
Normex applies reasonable safeguards suited to the sensitivity of the information, how it is used and the risks involved. These include access restrictions, account management, staff awareness, document protection and oversight of service providers. No safeguard guarantees absolute security. Incidents are assessed, documented and addressed; authorities and affected individuals are notified where required by law.
Retention and destruction
Information is retained for as long as necessary for the stated purposes, legal obligations and the defence of legal rights. Relevant criteria include the status of the project or application, accounting and contractual obligations, time limits for legal proceedings and the existence of an access request, investigation or dispute. Information used to make a decision about an individual is retained for at least one year after that decision where required by Quebec law.
Once the purposes have been fulfilled and the obligations have ended, information is securely destroyed. Anonymization may replace destruction only for serious and legitimate purposes and in accordance with legal requirements; simply removing a name is not enough. Applications kept for future positions are retained in our candidate pool for 12 months from the date of the applicant’s separate consent, subject to applicable legal retention requirements.
Access and other requests
You may request in writing access to your personal information and the correction of information that is inaccurate, incomplete or ambiguous, or whose collection, disclosure or retention is not authorized by law. In the cases provided for by law, you may also request that computerized information collected from you be provided in a structured, commonly used format. Information created or inferred by the company is excluded from this right to data portability.
We respond in writing to access or correction requests no later than 30 days after receiving them, in accordance with the applicable Quebec requirements. A refusal states the reasons, the relevant legal provision, the available remedies and the time limits for pursuing them. Requests to delete information or stop its dissemination are assessed according to the criteria and exceptions provided by law; there is no automatic right to have every record erased.
Complaints and governance
You may submit a complaint to Steve Legault at info@normexmetal.com. Describe the situation, relevant dates and the outcome you are seeking. Our complaint handling policy explains the steps and target response times. You may also contact the Commission d’accès à l’information du Québec; our internal procedure does not limit your remedies. The Office of the Privacy Commissioner of Canada may have jurisdiction over activities subject to federal law.
Steve Legault approves the information protection rules, oversees requests and incidents, and ensures that practices are kept up to date. Staff must comply with authorized access, retention rules and reporting procedures. Internal rules are reviewed when significant changes are made to activities or tools. Any change to this policy is announced through a notice on our website and through other appropriate means of reaching the individuals concerned, with the date of the update.
Normex Métal – Last modified on October 22, 2026.
This policy explains how to report a concern about our products, our services or the protection of personal information. Normex reviews each complaint carefully and impartially to understand the facts, provide a response and address the situation when necessary.
Steve Legault
Privacy Officer and contact for complaints
info@normexmetal.com | 819 333-1200
11, boulevard Industriel, Route 111 Est, La Sarre, Québec
For a privacy complaint, use the subject line “Privacy — Attention: Steve Legault”. For a commercial complaint, use “Complaint — Product or service”. You may write to us by email or mail. If you need assistance, you may call to have your complaint recorded or to arrange a suitable way to submit it.
You do not need to use legal language to make a complaint. Do not provide more personal information than necessary. Before sending sensitive documents, ask us about a suitable way to send them. An anonymous complaint may be reviewed to the extent that the available information allows, but we may not always be able to provide a response or verify all the facts.
Commercial complaints may concern a product, the quality of work, a delay, an invoice or the service received. Steve directs them to the appropriate person to review the facts and propose a response.
Privacy complaints concern the collection, access, use, disclosure, retention or protection of personal information. Steve oversees their handling, with access limited to those who need it. A request for access or rectification follows its own legal requirements, even when it forms part of a complaint.
Receipt and review
We aim to acknowledge receipt within five business days. The acknowledgement identifies the person responsible for follow-up and any additional information needed. We then review the relevant facts and documents, hear from the people concerned and seek an appropriate solution. If the complaint concerns the person assigned to review it, management appoints another qualified person who is not directly involved.
Response and follow-up
We aim to respond within 30 days of receiving a complaint. Our response explains our findings and, where applicable, the corrective measures and their timeline. If the review requires more time, we will explain why and provide an expected response date. These timeframes are service targets for complaints; they do not replace or extend any applicable legal deadlines.
A written request for access to or rectification of personal information receives a written response no later than 30 days after receipt, in accordance with applicable Quebec law. A confidentiality incident is addressed without waiting for the complaint process to conclude.
Confidentiality of the complaint file
Information in a complaint is used to review it, respond, follow up and meet legal obligations. It is shared only with those who need to know, subject to disclosures authorized or required by law. We cannot promise complete anonymity if certain facts must be checked with the people concerned. Records are retained according to follow-up needs, legal timeframes and Normex’s retention rules, and are then securely destroyed.
If the response does not resolve the issue
You may request a review by explaining any new information or the points you dispute. This internal process is not a prerequisite for seeking an external remedy and does not suspend the deadlines for doing so.
For matters involving the protection of personal information in Quebec, you may contact the Commission d’accès à l’information at www.cai.gouv.qc.ca. A refusal of access or rectification, or the absence of a response within the legal deadline, may be challenged through an application for examination of a disagreement, generally within 30 days of the refusal or the expiry of the response deadline. A complaint about a business practice is a separate process.
If the activity concerned falls under federal law, you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca. For a commercial complaint, your contractual rights and the remedies provided under applicable laws remain available.
Workplace harassment matters must be addressed through a separate policy and process for employees. This policy does not replace those mechanisms. Any changes to this policy are published with the date of the update.