Policy Scope
ANNUAL REPORT CONCERNING THE LAW ON FORCED LABOUR AND CHILD LABOUR IN THE SUPPLY CHAIN
1 INTRODUCTION
1.1 Purpose
This Data Governance Policy (“Policy”) defines and outlines the rules under which La Ronde ("La Ronde”), a member of the Six Flags Entertainment Corporation group (“Six Flags”) handles personal information. This Policy is designed to help La Ronde comply with legal and regulatory requirements regarding the protection of privacy and data, and it outlines Staff Members' responsibilities when handling personal information for or on behalf of La Ronde.
All employees, contractors, consultants, directors, and executives of La Ronde (collectively, “Staff Members”) must understand and follow this Policy. Failure to comply with this Policy may result in disciplinary action, up to and including termination of employment and contract or legal action for contractors and consultants.
1.2 Scope
This Policy extends to all business units, departments, and operating units of La Ronde and includes all activities that involve the handling of Personal Information. It covers both digital and physical data , as well as all Personal Information processed by La Ronde, regardless of the individual's location. This includes Personal Information of customers, job applicants, and Staff Members.
1.3 Associated Policies
This Policy refers to the following Six Flags policies and procedures and should be read in conjunction with them:
- Six Flags Information Services Department Security Policies, including but not limited to:
- Six Flags Data Retention Policy and Data Disposal Procedures
- Six Flags Security Awareness and Acceptable Use Policy
- Six Flags Business Continuity and Disaster Recovery Plan
- Six Flags Incident Response Plan
- Six Flags Vendor Risk Management Policy
- Six Flags Records Retention Schedule
1.4 Definitions
Throughout this Policy, capitalized terms shall have the meanings set forth below:
- "Privacy Regulatory Authority" refers to any government or regulatory body responsible for overseeing and enforcing compliance with applicable law under its jurisdiction. In Canada, this includes the Office of the Privacy Commissioner of Canada and other competent federal and provincial regulatory authorities, including, but not limited to, the Commission d'accès à l'information du Québec.
- “Applicable Law” means all existing or enacted international, national, federal, state, provincial, and local laws, rules, regulations, directives, governmental and regulatory requirements, and guidelines that relate in any way to privacy, data protection, confidentiality, information security, or privacy breach reporting and that apply to La Ronde, including, but not limited to, the federal Personal Information Protection and Electronic Documents Act, and similar provincial laws including, but not limited to, Quebec's Act Respecting the Protection of Personal Information in the Private Sector.
- “Privacy Impact Assessment” or “PIA” refers to a formal process used to identify, assess and mitigate potential privacy risks associated with a specific project or initiative that involves handling personal information.
- "Security Breach" refers to any event that compromises the confidentiality, integrity, or availability of Personal Information or otherwise jeopardizes information privacy or security, such as loss or unauthorized disclosure, access, or use of Personal Information, or any other breach of information security.
- "Individual" refers to any person (natural person) to whom the Personal Information pertains.
- “Personal Information” refers to any information, whether stored in digital or physical form, that relates to an identified or identifiable individual. This includes, but is not limited to, information such as the name, address, telephone number, date of birth, email address, nationality, and age.
- "Handling" refers to any action or series of actions taken, automatically or otherwise, with respect to Personal Information or sets of Personal Information, such as collecting, recording, organizing, structuring, storing, altering, retrieving, accessing, using, communicating, disseminating or otherwise providing, aligning or combining, restricting, deleting or destroying.
1.5 Roles and Responsibilities
1.5.1 Privacy Officer
La Ronde has appointed a Privacy Officer to oversee compliance with this Policy and applicable law at La Ronde. The Privacy Officer's roles and responsibilities include:
- Ensure that La Ronde's handling of personal information complies with internal policies and applicable law;
- Advise on how to conduct Privacy Impact Assessments, including identifying potential privacy risks and recommending risk mitigation strategies;
- Oversee the security breach management process, including providing guidance on required notices and ensuring that all actions taken are documented in accordance with internal policies and applicable law;
- Respond to requests and complaints from individuals related to their privacy rights in accordance with applicable law;
- Regularly review and, where necessary, update this Policy and associated policies or practices to reflect changes in legal and industry standards;
- Develop and implement privacy training for Staff Members to promote a privacy-friendly culture and highlight La Ronde's efforts to comply with privacy requirements; and
- Any other role or responsibility set out in this Policy.
The Privacy Officer may delegate these roles and responsibilities to qualified personnel within the organization, as necessary. Any such delegation will be formally documented.
The position and contact details of the Privacy Officer will be made public and published on the La Ronde website. This information will be updated accordingly should the Privacy Officer's roles and responsibilities change.
2 KEY PRINCIPLES FOR HANDLING PERSONAL INFORMATION
The following principles apply to any Handling of Personal Information:
2.1 Accountability. La Ronde is accountable for Personal Information (including Personal Information stored by a third party on behalf of La Ronde, in accordance with the Six Flags Vendor Risk Management Policy). La Ronde has implemented policies and procedures to ensure the protection of this information.
2.2 Organization and Access Control. La Ronde must ensure the appropriate Handling of Personal Information and properly categorize the level of risk/confidentiality. Access to Personal Information is restricted to Staff Members on a need to know basis, in accordance with the Six Flags Information Services Department Security Policies.
2.3 Security Measures. La Ronde must take appropriate administrative, technical, and physical security measures to protect Personal Information throughout the retention period. These measures must be reasonable with respect to the nature, purpose, volume, distribution, and storage medium of the information. These measures are set out in the Six Flags Information Services Department Security Policies, the Six Flags Incident Response Policy, the Six Flags Data Retention Policy and Disposal Procedures, the Records Retention Schedule, and in section 8 of this Policy.
2.4 Defining the purpose of collection. La Ronde identifies the purposes for which it must collect Personal Information prior to collection.
2.5 Consent. La Ronde will notify and seek consent from the individuals in question, including customers and Staff Members, regarding the collection and handling of their Personal Information, unless they choose to opt out under applicable law.
2.6 Collection Restrictions. La Ronde only collects Personal Information necessary for the purposes identified above. Personal Information must always be obtained by fair and lawful means.
2.7 Handling and Retention Restrictions. La Ronde limits the Handling of Personal Information to the purposes for which the individual has consented or similar purposes, unless otherwise permitted by law. They retain Personal Information only for as long as necessary to fulfill the identified purposes, as set out in Section 8 of this Policy, the Six Flags Data Retention Policy and Disposal Procedures and the Records Retention Schedule.
2.8 Accuracy. La Ronde ensures, to the best of its ability, that the Personal Information in its possession is up to date, accurate, and complete for the entire duration of the Handling.
2.9 Transparency. La Ronde makes its policies and procedures concerning the management of Personal Information available to Staff Members. They also make publicly available their practices with regard to Personal Information, as well as a Privacy Policy published on their website.
2.10 Access to Personal Information. La Ronde informs any individual who requests it of the existence and use of their personal information and whether it has been disclosed to third parties. It allows any Individual to access their Personal Information or obtain a copy of it and rectify it if necessary, subject to the exceptions permitted by applicable laws, as outlined in Section 6 of this Policy. La Ronde must promptly respond to any request of this nature.
2.11 Filing a complaint. Any Individual may file a complaint with respect to the protection of their Personal Information by La Ronde, as outlined in Section 6 of this Policy. La Ronde will respond promptly to these complaints.
3 VENDOR RISK MANAGEMENT
La Ronde may send Personal Information to a vendor, supplier, consultant, subcontractor, or service provider (collectively, “Vendor”) for processing on its behalf, provided that La Ronde and the Vendor have an established data processing/protection agreement that complies with applicable law. As a minimum, this agreement must include contractual guarantees that (i) establish the safeguards that the Vendor will implement to ensure the confidentiality of Personal Information, (ii) ensure that Personal Information is used solely for the purpose of providing the services set out in the agreement, (iii) stipulate that the Vendor will not retain the information after expiry of the agreement, (iv) stipulate that the Vendor will not disclose Personal Information outside Quebec without La Ronde's written consent, (v) stipulate that the Vendor shall provide La Ronde with reasonable means of monitoring and verifying its security measures and compliance with its data privacy obligations, and (vi) stipulate that, in the event of a Security Breach, the Vendor will promptly notify Six Flags of the details of the incident, recovery, and remediation.
La Ronde is subject to the Six Flags Vendor Risk Management Policy, which establishes the framework and guidelines for managing risks associated with suppliers, including conducting due diligence reviews of third parties and ensuring compliance with La Ronde's information security requirements and applicable law. Staff Members participating in the selection, management, and oversight of Vendors on behalf of La Ronde are required to comply with both this Section 3 and the Six Flags Vendor Risk Management Policy and related procedures.
4 CROSS-BORDER DATA TRANSFERS
4.1 Cross-border Data Transfers General Conditions
If Personal Information is accessed, stored, or transferred outside of Quebec, La Ronde will inform the Individuals involved and will ensure the adequate protection of Personal Information when handled in other jurisdictions.
4.2 Cross-Border Data Transfers Impact Assessment
La Ronde will conduct a Transfer Impact Assessment before disclosing any Personal Information outside of Quebec. The purpose of the Transfer Impact Assessment is to determine whether the information will be adequately protected in another jurisdiction, with regard to certain criteria, including, as a minimum: (i) sensitivity of the information; (ii) intended use; (iii) security measures (contractual or otherwise) to be implemented; and (iv) the country, province, state, or region's legal framework, including privacy rights and safeguards available to individuals under local laws and regulations.
Unless information must be disclosed to a third party as a result of an emergency threatening the life, health, or safety of the Individual, La Ronde may only disclose information if the following conditions are met:
- The assessment concludes that Personal Information will be adequately protected, particularly in light of generally accepted data protection principles; and
- The parties sign a written agreement incorporating the results of the assessment and the agreed-upon remediation measures.
The Privacy Officer is responsible for establishing and managing procedures for conducting a transfer impact assessment under this Policy. Staff Members responsible for managing relationships with Vendors or third parties must promptly inform the Privacy Officer of any disclosure of personal information and must follow the Privacy Officer's instructions on how to proceed.
5 PRIVACY IMPACT ASSESSMENT
5.1 General Conditions
La Ronde must conduct a PIA when it acquires, develops, or updates an information system or an electronic service delivery system that involves the processing of personal information. Any PIPEDA must take into account all relevant factors related to the project, including, but not limited to: (i) the sensitivity of the Personal Information; (ii) the volume of Personal Information processed; (iii) the categories of Individuals involved; (iv) the intended use of the information; and (v) the means used to process the information.
5.2 Conducting a Privacy Impact Assessment
The PIA process must include, as a minimum, the following steps:
- Description of the nature, scope, objectives, and context of the project and related handling measures;
- Assessment of the necessity, effectiveness, proportionality and minimum level of intrusion of the Processing Measures with respect to the objectives;
- Assessment of risks of infringement of Individuals' rights or interests; and
- Description of actions intended to manage risks.
5.3 Accountability and Oversight
The Privacy Officer, together with the relevant departments at La Ronde or Six Flags, is responsible for overseeing the PIA process. The Privacy Officer ensures that PIAs are maintained in compliance with this Policy and applicable law, and advises and supports throughout the process, including identifying privacy risks and recommending risk mitigation strategies.
6 HUMAN RIGHTS CLAIM PROCESSING
6.1 Types of human rights claims
Individuals residing in Quebec have the right to exercise some or all of the following rights with respect to their Personal Information:
- Confirmation of Processing: This right allows an Individual to request and receive confirmation as to whether La Ronde collects, retains, or discloses their Personal Information or otherwise processes it.
- Access to Personal Information: This right allows an Individual to request and receive a copy of their Personal Information held by La Ronde.
- Correction of incomplete or inaccurate data: This right allows an Individual to request the correction of their Personal Information if it is deemed inaccurate or incomplete.
- Withdrawal or withholding of consent: To the extent that consent is required for the processing of an Individual's Personal Information, this right allows an Individual to withdraw or withhold consent and to be informed of the consequences of doing so.
- Data Portability: An Individual has the right to obtain a copy of their Personal Information in a structured and commonly used technological format or, upon request, to request that La Ronde disclose the information in such a format to a third party authorized by law to collect Personal Information. Note: This right applies only to computerized Personal Information collected from the Individual and excludes any information created or inferred from Personal Information, and will come into effect only in September 2024.
- Information Management Practices Complaints: Individuals have the right to file a complaint with La Ronde regarding its information management practices and compliance with applicable law.
6.2 Processing a Claim
If a Staff Member receives a Human Rights Claim directly from an Individual, they shall process the claim accordingly with the Customer Relations team or promptly escalate the claim to the Privacy Officer and, other than acknowledging receipt, shall not respond to the claim unless otherwise instructed by the Privacy Officer. The Customer Relations team is responsible for responding to these requests within 30 days and must do so in a manner and format that complies with internal policies and procedures and applicable law.
If a Staff Member wishes to exercise their rights regarding their Personal Information collected during their employment, they must contact their supervisor or the Human Resources department. If the Staff Member is not satisfied with the answer, they must submit a written request to the Privacy Officer, who will process the request according to the established internal policies and procedures and applicable law.
7 HANDLING REQUESTS FROM LAW ENFORCEMENT, COURTS, AND GOVERNMENT
Staff Members must promptly notify the Privacy Officer if La Ronde receives requests from law enforcement, courts, or government authorities regarding Personal Information in its possession or control, or inquiries from Privacy Regulators about La Ronde's information management practices. Staff Members must not respond directly to such requests or questions unless expressly asked to do so by the Privacy Officer or senior management.
Upon receiving the notice in question, the Privacy Officer must promptly notify and work with Six Flags' Legal Department to determine the appropriate course of action. The response may include providing the requested information, seeking clarification, acquiring legal advice, or disputing the request if it is deemed too broad or conflicts with legal or regulatory requirements.
8 RETENTION AND DISPOSAL OF PERSONAL INFORMATION
La Ronde will retain Personal Information only for the duration necessary for the purposes for which it was initially collected or lawfully used, unless a longer retention period is allowed or required by law, such as to comply with legal or regulatory requirements or for legitimate business purposes. Once personal information is no longer required for the purposes for which it was collected and there is no legal requirement to retain it, it will be securely destroyed, erased, or depersonalized ( meaning that it can no longer be used to identify the individual in question, either alone or in combination with other information) in accordance with La Ronde's internal policies and applicable law.
La Ronde has implemented a Data Retention Policy and Data Disposal Procedures and a Records Retention Schedule that detail specific retention periods for various categories of records and describe procedures for their secure disposal. Staff Members must understand these documents and follow the retention periods and disposal procedures outlined therein.
9 INFORMATION PRIVACY AND SECURITY
La Ronde is committed to maintaining the confidentiality, integrity, and availability of Personal Information in its possession or control and implements appropriate physical, technical, and organizational measures to protect Personal Information from loss or theft and unauthorized access, disclosure, duplication, use, or alteration.
Six Flags has established various policies, standards, and controls that fulfill its information security requirements and outline how Staff Members should handle Personal Information and engage with the systems, networks, and facilities of Six Flags and La Ronde that contain such information. The main policies are outlined in Article 1.3 of this Policy.
10 SECURITY INCIDENT RESPONSE
La Ronde must conduct a documented investigation into any known or suspected security incident in accordance with the Six Flags Incident Response Plan and any other relevant internal policies or procedures.
The Privacy Officer must be consulted in evaluating the scope, impact, and extent of a Security Breach, including determining when such an incident should be reported to external authorities, such as law enforcement or Privacy Regulatory Authorities, or to the Individuals involved. The Privacy Officer is also responsible for maintaining adequate records related to the Security Incident in accordance with La Ronde's internal policies and procedures and applicable law.
11 TRAINING AND AWARENESS
La Ronde will develop and implement a privacy protection and training program to promote compliance with this Policy and foster a culture of data protection and security awareness within the company. As part of this program, training will be offered to all Staff Members who have access to Personal Information regarding this Policy and related privacy and security obligations.
12 POLICY OVERSIGHT AND COMPLIANCE VERIFICATION
La Ronde will develop and implement an oversight and compliance verification program to ensure adherence to this Policy and related policies, procedures, and standards. This program will include audits of operational procedures and processes that involve the Handling of Personal Information and, should an audit reveal a violation of this Policy, the development and implementation of an adequate and timely corrective action plan. The Privacy Officer will oversee the verification process and request assistance from other departments within La Ronde as needed.
13 PERIODIC REVIEW AND POLICY CHANGES
This Privacy Policy will be reviewed and updated periodically to ensure its continued relevance and effectiveness in light of changes in the legal, technological, and business environment. The Privacy Officer, with the assistance of other relevant departments within La Ronde, will be responsible for carrying out these revisions.
