Privacy and confidentiality policy

Privacy and confidentiality policy

Background

• The Société de transport de Montréal, hereinafter the STM, is a public organization subject to the Act respecting Access to documents held by public bodies and the Protection of personal information.
• The STM fully recognizes the importance of privacy and is committed to taking the necessary measures to properly safeguard the confidentiality of all personal information entrusted to it. As such, it is also committed to being transparent and complying with all applicable regulations concerning access to and the protection of personal information.
• To allow people to access and use certain services, or to comply with its legal obligations, the STM must collect, use and retain certain personal information and/or share it with its authorized partners.
• Personal information is information about a natural person that directly or indirectly allows that person to be identified.
• The STM invites all those concerned to familiarize themselves with this policy, as it presents the information on which they should base the decision to consent to the collection, use and sharing of their personal information by the STM and its authorized partners.

Why have we adopted this policy and who does it apply to?

• This policy applies to anyone the STM collects personal information from or about in the course of its operations.
• The policy defines how the STM protects the personal information entrusted to it and specifies the rules and procedures for the collection, use, sharing, retention and correction of said information, as well as the right of access to it. It covers all personal information that is collected, particularly via forms and technological means by which services are offered to users (e.g., the STM’s websites and applications).
• The policy is based on the following four (4) main principles:
  • Your consent to the collection, use and sharing of your personal information
  • Our commitment to collecting only the information we need
  • Our duty to protect the confidentiality of your personal information
  • Compliance and transparency regarding our obligations, rules, policies, guidelines and practices
• The policy provides information on current practices concerning the processing and protection of personal information.

When and why do we have to obtain your consent?

• By consenting to the collection, use and sharing of your personal information by the STM, you agree to the terms and conditions described in this policy.
• Where applicable, your consent may be required based on the information provided in this policy.
• Should you decline to consent to the collection of certain personal information, the STM may be unable to provide you with the service(s) requiring said information.

What types of personal information do we collect, and how do we use and share it?

• The STM collects only the personal information needed to fulfill its mission and offer you the services you wish to access.
• Depending on the service you wish to access, the STM may need to collect and retain certain personal information such as your last name, first name, mailing address, e-mail addresses, phone number(s), date of birth, or photos, as well as information regarding your mobility or any comments or complaints sent by e-mail, phone or other means.
• The STM collects personal information directly from the individuals concerned or through authorized partners by various means, including forms and various technological means (e.g., websites, applications, social media, phone conversations, surveys and questionnaires).
• Access to your information is regulated and limited to employees of the STM (or its representatives) who require said access to perform their duties. The STM only shares your information with third parties when required by law or for the execution of mandates given to them by the STM and under its supervision.
• No collection of personal information is required for you to view content on the STM website. The STM collects and uses only the personal information that it needs in order to provide you with specific services or to comply with its legal obligations. This includes information required to:
  • Communicate with you
  • Process your application for job opportunities with the STM
  • Confirm and authenticate your identity when required
  • Determine the specific parameters for the services you wish to access
  • Confirm your eligibility for specific services
  • Issue certain transit fares to you
  • Track and process your requests and comments
  • Generate statistics and satisfaction indicators
  • Improve the quality of our services
  • Comply with all applicable regulations and legal obligations
• Please note that when you contact us by phone, some conversations may be recorded for quality assurance purposes. You will be notified in advance if this is the case.
• Please also note that when you access our online services or visit the STM website, certain technical information is recorded on your computer in the form of cookies or similar files. This may include IP addresses, pages visited, date and time of connection or type of internet browser used. The purpose of this is to optimize content quality and provide user-friendly navigation options.
• The STM keeps your personal information only for as long as is reasonably necessary, or longer if required by law. When the information we hold about you is no longer required, our procedures stipulate that it must be destroyed or anonymized in accordance with the applicable laws so that it can no longer be used to identify you.

How do we protect your personal information?

• The STM is keenly aware of the sensitivity and confidentiality of personal information and naturally understands the importance of ensuring its security. We are rigorous in our application of measures to protect personal information based on broadly recognized best practices in the field.
• We store the personal information that we collect in an environment where the proper technological, physical and administrative safeguards are in place.
• We have a number of privacy rules and guidelines and are steadily deploying initiatives to raise staff awareness on the importance of protecting privacy when handling personal information.
• We use many tools and procedures to control access to your personal information and to ensure that it can be accessed only by those who need to do so in the course of their duties.
• The STM also has several teams specializing in risk management, security, cybersecurity and information management who continuously monitor the risk of privacy incidents and ensure that we are constantly improving and periodically adapting our measures to counter this risk.
• Please note that external requests for access to personal information are processed carefully and in strict compliance with the applicable legal provisions to preserve the confidentiality of all personal information.
• In addition, the STM has created a special executive-level committee to direct and oversee company‑wide practices regarding the management and protection of personal information.

What is our level of commitment to privacy protection?

• The STM fully subscribes to the principles of privacy protection as well as to the legal provisions governing access to and the protection of personal information. All internal rules, policies, guidelines, measures, procedures and practices are defined and aligned with our goals of compliance, efficiency, rigour and transparency. This policy reflects that commitment by clearly outlining the STM’s orientations and practices in privacy protection.
• In accordance with the applicable laws, the STM sets and implements a retention schedule for the personal information in its possession. It also processes all requests to remove, correct or destroy said information in accordance with the applicable provisions and endeavors to manage and report any privacy incidents in accordance with the applicable regulations.

How can you contact us for questions, comments, complaints or requests for correction?

• In accordance with the law, the STM has designated its Corporate Secretary as the person responsible for sound governance regarding access to and the protection of personal information. The STM has also created a management committee to direct and oversee practices regarding the management and protection of personal information.
• If you believe that we hold inaccurate or incomplete personal information about you or that we have collected, used, shared or retained such information in breach of the Act respecting Access to documents held by public bodies and the Protection of personal information, you have the right to request that such information be corrected or that we cease the collection, use, sharing or retention that you believe to be against the law.
• If you have any questions, comments or complaints regarding this policy and/or the handling of your personal information, please contact the STM Corporate Secretary :

Email : SecretaireCorporatif@stm.info
Mail :
Corporate secretariat 
Société de transport de Montréal
800, De la Gauchetière Street West, suite 1170
Montréal, Quebec H5A 1J6

• To submit a request to access your personal information or have it corrected, please contact the Legal Affairs team, which is responsible for access to information requests :

Email : Acces.Information@stm.info
Mail :
Legal Affairs
Société de transport de Montréal
800, De la Gauchetière Street West, suite 1170
Montréal, Quebec H5A 1J6