Management of Personal and Confidential Information

This Policy sets out the measures and practices that CAE Memphremagog has implemented to govern its management of personal information and to protect personal information.

The main objective of this Policy is to inform you of:

• The means used to collect personal information
• The nature of the personal information collected and the purposes for which it is collected
• How CAE Memphremagog may use personal information and which third parties to whom it may communicate such information, when applicable
• The various security measures put in place to protect the confidentiality of your information
• The rights you have regarding personal information collected by CAE Memphremagog,
• including to access your personal information or request the correction of inaccurate information, if applicable.

By transmitting one or more pieces of personal information to CAE Memphremagog through direct or indirect contact with an authorized representative or through your use of the Website, you expressly consent to CAE Memphremagog collecting, using, communicating, and retaining such personal information in accordance with the terms and conditions set out in this Policy.

Information is collected by various means:

• Automatically when you connect to the Website
• Automatically through the use of cookies or pixels on the Website
• By email
• By telephone
• By disclosing personal information by mail
• In person
• By completing a hardcopy form during a meeting
• By completing a form on the CAE Memphremagog website

Or by any other means necessary for secure data collection.

The following personal information may be collected:

• First and last name
• Physical or email address
• Personal phone number
• Credit card number
• Social insurance number
• Name of banking institution
• Personal balance sheet
• Credit file
• Curriculum vitae
• Insurance policy
• Date of birth

Or any other personal information necessary for the analysis of a support or financing application

Personal information is collected to fulfill the following purposes:

• Communicating with our potential clients and ensuring that communications are personalized
• Conducting advertising with clients or potential clients
• Fulfilling requests from clients or Website visitors
• Evaluating client needs and interests
• Ensuring that a visitor can connect to the Website
• Ensuring the Website functions properly
• Improving Website performance and its effectiveness in retaining visitors
• Identifying the legislative framework applicable to the personal information of Website visitors
• Carry out advertising aimed at customers, visitors, or potential customers.
• Ensuring compliance with a law, court order, or judicial proceeding
• Ensuring the legal protection of the Organisation
• Evaluating and improving protection and security measures
• Preventing or detecting fraud
• Addressing complaints and requests for access, rectification, or withdrawal of consent

Or any other purpose necessary for proper file management within constraints of the law

In accordance with our procedures for the secure retention and destruction of personal information, we retain your personal information only for as long as is necessary to fulfill the purposes listed in the preceding section of this Policy or for as long as required to comply with our statutory obligations, whichever is later.

Personal information collected is destroyed upon fulfillment of the purposes for which it was collected, unless a law or regulation requires CAE Memphremagog to retain it or imposes a specific retention period.

CAE Memphrémagog communicates personal information:

• To its employees only when they need access to this information to perform their duties
• To any other person or entity, when communication is required or permitted by applicable legislation with or without the consent of the person concerned
• To business partners, when the business, organisation, or entrepreneur has given their approval by signing the required documents
• To external consultants with whom CAE Memphremagog has entered into a contractual agreement whereby the external consultant may not use the personal information for any purpose other than providing said service and must destroy the personal information disclosed no later than the end of the contractual agreement

CAE Memphremagog does not sell personal information to third parties and does not allow third parties to access personal information unless such access is necessary to fulfill one of the aforementioned purposes and the access or communication without the consent of the persons concerned is authorized or required by a law or regulation.

If you continue to use CAE Memphremagog’s Website, transmit personal information to an authorized representative of CAE Memphremagog, or communicate personal information by completing a form provided by CAE Memphremagog, you consent to the purposes and communications of personal information described herein.

CAE Memphremagog takes adequate physical, technological, contractual, and administrative protective measures to protect your personal information and reduce the risks of unauthorized access, use, communication, and destruction.

Without limiting the generality of the foregoing, the Website has certain security mechanisms to protect your personal information, namely:

• Personal information collected on the Website is encrypted at rest
• All transfers of personal information between the various components of the Website are encrypted
• CAE Memphremagog’s IT service providers are contractually required to comply with various security obligations, including periodic validation of security practices and processes and continuous monitoring of the Website’s software components and their updates

All privacy settings applicable to your use of the Website offer, by default, the highest level of confidentiality, without any action on your part.

In addition to these measures, CAE Memphremagog also provides for, among other things:

• An internal access management policy for its employees.
• Under this policy, only employees who need to access personal information to perform their duties may do so
• An internal policy for the protection of information to which employees are subject, to ensure the integrity, availability, and confidentiality of personal information
• A privacy incident registry, which helps to inventory incidents, whether minor or major, that affect your personal information, to ensure that these incidents do not recur and to identify the required corrective measures
• A personal information retention schedule, to ensure that personal information is destroyed when it is no longer needed for the aforementioned purposes and the law no longer requires its retention
• A privacy incident response plan, which enables an effective and rapid response to breaches of your personal information
• Logging of access to your personal information
• Annual staff members training

Despite these various measures, it remains impossible for CAE Memphremagog to guarantee the security of the personal information entrusted to it.

If you suspect that your personal information held by CAE Memphrémagog has been compromised, please contact our Privacy Officer at: info@caememphremagog.ca

CAE Memphremagog maintains a privacy incident registry in accordance with applicable legislation. In the event of a breach of your personal information that presents a risk of serious harm to you, CAE Memphremagog will take the necessary steps to notify you, in accordance with applicable legislation.

It will also implement measures to limit the harm that may result from the breach and to reduce the likelihood of recurrence.

You or a person authorized under the Act respecting the protection of personal information in the private sector may submit a request for access to your personal information by contacting our Privacy Officer directly by completing the access request form and sending it to: info@caememphremagog.ca

The Privacy Officer will grant this access, unless:

• The law prevents CAE Memphremagog from granting access
• CAE Memphremagog has a serious and legitimate interest in refusing access
• Granting access would seriously harm you or a third party

In principle, exercising the right of access is free of charge. However, reasonable fees may be charged to cover the costs of transcription, reproduction, or transmission of personal information. In such cases, the applicant will be notified of the fee amount prior to processing their request.

We ask that you inform us of any change that may affect the authenticity or accuracy of your personal information.

You or a person authorized under the Act respecting the protection of personal information in the private sector may also submit a request to rectify your personal information.

Such a request will allow you to correct personal information in our possession if:

• The personal information is inaccurate
• The personal information is outdated
• The personal information is ambiguous
• The personal information is incomplete
• The personal information was collected unjustifiably

Alternatively, you may submit a written rectification request asking our Privacy Officer to destroy outdated or unjustifiably collected or retained personal information by completing the rectification form and sending it to: info@caememphremagog.ca

Any request for deletion or correction must be submitted in writing to our Privacy Officer by completing the correction request form and sending it to the following email address: info@caememphremagog.ca.

Subject to your contractual commitments with CAE Memphrémagog and applicable legislation, the Act respecting the protection of personal information in the private sector (if applicable to you) allows you to withdraw your consent to certain uses or communications of personal information.

Please note that exercising this right may affect CAE Memphremagog’s services to you. In this case, if you submit this request, we will identify and advise you of the consequences of the withdrawal of consent on services.

Any request for access or rectification must be submitted in writing to our Privacy Officer by completing the consent withdrawal form and sending it to: info@caememphremagog.ca

The request must be sufficiently detailed to allow the Privacy Officer to evaluate and locate the personal information covered by the request. The applicant must ensure that the Privacy Officer can reach them to provide assistance in clarifying the request, to facilitate the identification of the personal information covered, and, above all, to communicate the acceptance or refusal of the request.

The Privacy Officer has a duty to process these requests within 30 days. If the request is not processed within that time, it is deemed to have been refused.

You may submit a complaint regarding our personal information protection or governance methods, practices, and policies by contacting our Privacy Officer directly by completing the complaint form and sending it to: info@caememphremagog.ca

The Privacy Officer will respond to the complaint within 30 days of receipt.

If the complaint is accepted, a brief summary of the changes made to our personal information protection or governance methods, practices, and policies will be provided to you.

For any questions about your rights, to ask questions of CAE Memphremagog, or for any comments, please contact the Privacy Officer at: info@caememphremagog.ca