Protection of personal information

In the normal course of its activities and within the scope of its business and service provision, the company collects certain personal information necessary for these purposes or for any other compatible purpose if the criteria of the Private Sector Privacy Law (LPRPSP) and other applicable laws and regulations regarding the protection of personal information are respected (collectively referred to as “the Law”). Personal information may also be collected by the company in the context of employment, customer relations, debt collection, consultation, and business relationships.

The personal information collected by the company may include details pertaining to identity, contact information, or recruitment, depending on the nature of the relationship between them and the company. Identity documents containing personal information may also be collected by the company.

The company ensures that individuals affected by the collection of this personal information are informed of its collection and understand the purposes of this collection.

It is possible that the company collects personal information using technology that includes functions to identify or locate an individual or to profile them. In such cases, consent in accordance with the law will be requested from the individual concerned. Information about the use of the company’s website and other technical information or visitor interaction with the website may be collected.

In cases where the personal information collected by the company is provided by a third party, i.e., a person other than the one concerned by this information, the individual making the communication must ensure that they have obtained the consent of the person concerned and have informed them of this communication beforehand.

The personal information collected by the company is used within the scope of providing services and, in some cases, to meet legal obligations arising from the law. The personal information collected by the company may also be required to enable it to fulfill its contractual obligations to its clients and other third parties.

It may happen that the company discloses personal information it holds to third parties, particularly to companies acting as subcontractors or service providers. These third parties may, in some cases, be located outside the province of Quebec, so the personal information collected and held by the company may be located in a jurisdiction with a legal regime different from that of Quebec.

The contracts that the company enters into with third parties require them to preserve the confidentiality of personal information and specifically stipulate their obligation to comply with the legal framework applicable to the company regarding the protection of personal information and privacy.

Subject to an exception provided for by the law, consent will be requested from individuals concerned by the personal information if the company were to disclose personal information to third parties that is not related to its regular operations and activities, or that is not compatible with the purpose for which it was collected.

It is also possible for the company to disclose certain personal information it holds as part of a commercial transaction or in other cases provided for by the law. In the event that the circumstances of the disclosure mean that the company is not required to obtain the consent of the individuals concerned by the personal information, it will comply with the requirements of the law for such disclosure.

Also, the Company may be required to disclose certain personal information it holds to government authorities or agencies responsible for enforcing laws.

The Company implements policies and practices governing its governance and the protection of personal information.

Personal information held by the Company is stored in secure locations according to generally recognized practices, and access to this information is limited to employees who need access to it for their job duties.

Employees of the Company are educated on the importance of protecting personal information and the measures to be taken to ensure the confidentiality of this information. As part of their duties, employees follow procedures that protect the confidentiality of personal information and promote best practices in this regard.

The Company ensures the protection of personal information from the moment of its collection and implements security measures aimed at protecting it against unauthorized use, in compliance with current legislation, and to prevent accidental loss, alteration, disclosure, unauthorized access, misuse, or any illegal form of use. However, the Company cannot guarantee that the personal information it collects is completely protected against any breach.

The personal information of the Company may be held or transferred outside the province of Quebec, including to countries other than Canada, whose rules regarding the protection of personal information differ from those of Quebec and Canada. When information is located outside Quebec or Canada, it is subject to the laws of the country where it is located, and its collection, disclosure, use, and destruction may be carried out differently from Canadian provincial or federal requirements.

Unless authorized or required by applicable laws, the Company only retains personal information for as long as necessary to fulfill the purposes for which it was collected, including meeting ethical, legal, tax, accounting, or notice requirements to appropriate government agencies. At the end of the retention period, personal information is destroyed, deleted, or anonymized. Anonymized information no longer allows the irreversible identification of the individual concerned.

In the event of a privacy incident involving personal information, the Company follows the provisions of the relevant Law and takes reasonable measures to mitigate the risks of harm to individuals affected by the personal information involved in the incident.

Any individual who believes that their own personal information or that of another person has been:

• Accessed unlawfully under the Law;
• Used unlawfully under the Law;
• Disclosed unlawfully under the Law;
• Lost or otherwise compromised in violation of the protections provided by the Law;

is invited to submit their complaint in writing to the person responsible for personal information protection identified below.

The complaint should include relevant details, such as the specific personal information involved, the context, any potential or actual harm suffered or likely to be suffered by the affected individual, and relevant dates. The details of the reported incident should be described as precisely as possible to enable prompt intervention.

Any employee who receives a complaint is obligated to promptly forward it to the person responsible for personal information protection.

Upon receiving a complaint, the Company adheres to its Internal Complaint Handling Procedure to address the complaint fairly.

For any questions or comments regarding how the Company handles personal information throughout its lifecycle within the Company, or if you wish to exercise your rights under the Law regarding the protection of personal information, you can contact the person responsible for personal information protection at the Company:

Ms. Audrey Marois
Fournier Industries Group Inc.
3787 Boulevard Frontenac West
Thetford Mines, QC G6H 2B5

prp@fournierindustries.com