INTRODUCTION

The present privacy policy outlines the commitments implemented by Alter Solutions Canada in the processing of personal information transmitted or collected in accordance with applicable laws on personal information protection, adopted in September 2021 (Law 25, hereinafter referred to as the "Regulation").

Through this policy, Alter Solutions Canada aims to clearly inform how personal information is collected and used.

DEFINITIONS

Data Controller: The natural person or legal entity, who, alone or jointly with others, determines the purposes and means of processing personal data. When the purposes and means of processing are determined by legislative or regulatory provisions, the data controller must be indicated in the law of organization and functioning or in the statute of the entity legally or statutorily competent to process the personal data concerned.

Data Subject: An individual who can be identified by the data used in the processing of personal data.

Processing of Personal Information: Any operation or set of operations, whether or not performed using automated processes, applied to Personal Information, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, transmission by communication, dissemination, or any other form of provision, alignment or interconnection, as well as locking, erasure, or destruction.

Personal Information: Information (including sensitive personal information) that allows the direct or indirect identification of an individual.

Processor: The natural or legal person, public authority, agency, or any other body that processes personal data on behalf of the Data Controller.

Sensitive Personal Information: Information sensitive by its medical, biometric, or otherwise intimate nature, or due to the context of its use or communication, which raises a high degree of reasonable expectation of privacy.

WHO ARE WE?

Alter Solutions is a technology consulting group that provides services and expertise to support our clients in implementing their software engineering and cybersecurity projects. Our ambition is guided by three strategic development axes:

• Enhancing our position in the market as technical experts.
• Expanding our activity internationally.
• Developing our employer brand to attract the best collaborators.

SCOPE

Data subjects

This privacy policy concerns individuals for whom we collect Personal Information during our activities. It applies to:

• Professionals, partners
• Employees
• Individual and corporate clients
• Internet users browsing the website www.alter-solutions.ca
• All information technology and telecommunications resources (regardless of their material or immaterial form) necessary for the creation, processing, exchange, and storage of personal data.

Nature of Data

In accordance with the principle of minimization, only strictly necessary Personal Information is collected and processed. The information that may be collected includes:

Data Subject civil status for human resources and client management purposes:

• Last name / Maiden name
• First names
• Nationality
• Civil status data (gender, spouse's first name and last name, family composition, etc.)
• Address, postal code, and city of residence
• Personal and/or professional phone number(s)
• Personal and/or professional email(s)

Data Subject professional life for human resources tracking and management:

• Job title, grade, salary
• Time clock records
• Photos, videos
• Addresses, location plans, and technical data of buildings or facilities (subject to intellectual property and contractual rights).

Data subject login and browsing information:

• IP address of the terminal or equipment connected to the Internet
• Information specific to the technical devices used to access services provided by group companies (PC, smartphone, web browser, etc.)
• Personal information collected directly from databases and/or social networks.
• Browsing history and cookies.

PROCESSING PURPOSES

Personal information is collected for specific, explicit, and legitimate purposes. All processing is justified based on at least one of the following grounds:

• Processing of personal data is based on consent from the Data Subject;
• Processing is necessary for the performance of a contract to which the Data Subject is a party;
• Processing is necessary to comply with a legal obligation to which we are subject;
• Processing is necessary for the legitimate interests pursued by Alter Solutions Canada and does not infringe upon the rights of the Data Subjects.

DATA RETENTION PERIOD

Personal Information is kept in a form that allows the identification of Data Subjects for a duration not exceeding that necessary for the purposes for which they are processed or for any obligations arising from the Regulation. Your consent is valid for the duration necessary to achieve these purposes.

The retention period is defined appropriately, precisely, and proportionally to the purpose of each processing, according to the applicable Regulation and our retention schedule.

If we need to disclose or use your Personal Information for purposes other than those previously defined, we will collect your consent again, unless permitted by law.

STAKEHOLDER ACCOUNTABILITY

Data controllers collect and process only the Personal Information that is voluntarily provided to them or provided by various software or hardware (ERP, Timekeeping systems, Internet routers, etc.)

Alter Solutions Canada establishes an organization that relies on the skills and accountability of individuals involved in operations related to Personal Information. We raise awareness and implement dedicated training on data protection to enhance vigilance and knowledge for all.

LIMITATION OF TRANSFERS / EXCHANGES OF DATA TO A THIRD COUNTRY

Alter Solutions Canada does not transmit the collected Personal Information, nor do we sell, rent, or exchange it with any organization or entity unless the Data Subjects have been informed in advance and have explicitly consented, unless required by law, for example, in the context of a judicial procedure.

We strive to keep Personal Information in Quebec. However, it is possible that the information we collect when you use our platforms or services may be transferred to other countries. This is the case, for example, if some of our service providers are located outside Quebec or Canada. Before any transfer, we conduct a privacy impact assessment to assess privacy implications and organize the transfer securely.

In the event of such a transfer, we ensure that it will be made:

• To a country providing an adequate level of protection, meaning a level of protection equivalent to that required by the Regulation.
• Under contracts including contractual clauses governing the transfer (including security measures and Personal Information protection).
• Under the company's internal rules.

RESPONSABILISATION DES DIFFERENTS ACTEURS

Les responsables de traitement collectent et traitent uniquement les données à caractère personnel qui lui sont transmises volontairement, ou fournies par les différents logiciels ou matériels (ERP, Pointage, Routeurs internet, etc.).

Le Alter Solutions Canada met en place une organisation qui s’appuie sur les compétences et la responsabilisation des personnes impliquées dans des opérations liées aux données à caractère personnel. Nous sensibilisons et mettons-en œuvre des formations dédiées à la protection des données afin de renforcer la vigilance et la connaissance de tous.

DATA SECURITY

Alter Solutions Canada is committed to protecting the Personal Information we collect or process against loss, destruction, alteration, unauthorized access, or disclosure. We have implemented a set of security measures proportionate to the risks associated with data loss, data disclosure, and unauthorized access to Personal Information. These measures ensure the confidentiality, integrity, and availability of the information processed by Alter Solutions Canada.

We ensure that subcontractors provide sufficient guarantees regarding the protection of Personal Information, particularly through the implementation of appropriate technical and organizational measures to ensure the protection of Personal Information and the rights of the Data Subject.

We oversee the relationship with subcontractors through contractual clauses related to the responsibility for protecting Personal Information, and we ensure the proper execution of the contract terms.

DATA SUBJECT RIGHTS

Alter Solutions Canada ensures that Data Subjects have the power to exercise their rights over their personal data:

Right of access: This right ensures the possibility of accessing all Personal Information and processing activities concerning you held by Alter Solutions Canada or verifying their accuracy.

Right to rectification: This right allows you to request the rectification and/or updating of inaccurate, incomplete, and/or obsolete information concerning you.

Right to withdraw consent: The right to withdraw consent at any time when the processing for which your Personal Information was collected is based on consent.

Right to withdraw consent: The right to withdraw consent at any time when the processing for which your Personal Information was collected is based on consent.

These rights can be exercised at any time by contacting our Data Protection Officer, Inès Chenouf:

• By sending an email to the following address: asca.privacy@alter-solutions.com
• By writing at: Alter Solutions Canada – Data Protection Officer - 1275 Avenue des Canadiens-de-Montréal, Montreal, QC H3C 0G4.

You also have the right to file a complaint with the Quebec Data Protection Authority, accessible at the following address: English (gouv.qc.ca)

Effective date of this policy and last updated on May 13, 2024.