OBJECTIVE OF THE POLICY

955 PRÊT, recognizes the importance of its role in the responsible management of personal information. In this regard, it develops this policy to guide its actions as well as those of its employees and managers, thus ensuring compliance with legal and regulatory requirements regarding the protection of personal information. By establishing such a policy, 955 PRÊT, aims to maintain the trust of its customers, partners, and employees while ensuring compliance with the laws governing these areas. This policy also provides for the implementation of a Privacy Management Program within 955 PRÊT, thereby fostering a culture centered on the protection of privacy and personal information throughout the company. 955 PRÊT, commitment to this is an integral part of its practices, and compliance with these rules is a strict condition of employment.

PROJECT OBJECTIVES

This policy aims to achieve the following objectives:

Confirm 955 PRÊT, commitment and that of all stakeholders to comply with legal and regulatory requirements, as well as promote a culture respectful of privacy and personal information. State the key elements of the Privacy Management Program and how to comply with legal and regulatory requirements regarding the collection, holding, use, disclosure, retention, destruction, or anonymization of personal information. Meet legal and regulatory requirements for the protection of personal information. Define the roles and responsibilities of various stakeholders within the company.

DEFINITIONS

Definitions of certain terms and expressions used in this policy are found in Appendix 1 to facilitate reading. These terms and expressions are identified in the text by the use of uppercase at the beginning of the word.

PRESIDENT AVI ENSAFI 

955PRET (9389-2263 QUÉBEC INC. )

1-866-955-7738

SCOPE

This policy applies to all employees, managers, partners, and independent contractors of 955 PRÊT, as well as any individual or entity duly authorized by 955 PRÊT, to act on its behalf.

GUIDING PRINCIPLES

To fulfill its obligations, 955 PRÊT adopts the following guiding principles:

Protection of personal information and privacy: Ensure the protection of personal information and privacy in accordance with legal and regulatory requirements, including meeting criteria such as necessity, consent, transparency, security, limitation of collection, limitation of use, limitation of disclosure, limitation of retention, accuracy, and the ability for an individual to lodge a complaint or exercise any other right provided in legal and regulatory requirements. Transparency: 955 PRÊT provides its customers with accurate information regarding guiding principles and practices related to the protection of personal information, including information on (i) the use of Third Parties, (ii) the fact that personal information may be stored outside Quebec, (iii) the use of technologies allowing automated decisions, (iv) its practices regarding retention, destruction, and anonymization, and (v) ways to exercise their rights. Consent: Personal information cannot be collected, used, or disclosed without prior notification to the concerned individual and obtaining their consent, unless legal, security, or other legal bases permitted by legal and regulatory requirements justify it. Collection and necessity criterion: The collected personal information must be limited to what is necessary to achieve the intended purposes and must be obtained using fair practices and in compliance with legal and regulatory requirements. Limitation of use, disclosure, and retention: Personal information can only be used, disclosed, or retained for the purpose for which it was collected unless the individual has consented to it or legal or regulatory requirements allow or require it. Accuracy: 955 PRÊT strives with the utmost diligence to ensure that the personal information it collects, possesses, or manages is always accurate and up-to-date. Retention, destruction, or anonymization: Personal information is retained, destroyed, or anonymized in accordance with legal and regulatory requirements and cannot be retained indefinitely unless adequately anonymized. Rights of individuals: Prêt 955 informs its customers of their rights regarding the protection of personal information and how they can exercise them. 955 PRÊT establishes mechanisms to respond to and process these requests within the timeframes specified by legal and regulatory requirements. The same applies to the right to lodge a complaint. Security measures: Prêt 955 implements security measures to protect the personal information it collects, uses, discloses, retains, or destroys, which are reasonable given the sensitivity, purpose of use, distribution, and the support used.

PRIVACY MANAGEMENT PROGRAM

955 PRÊT Privacy Management Program includes the following key elements:

Governance, frameworks, and documentation: This policy sets out 955 PRÊT guidelines regarding the protection of personal information. Other frameworks may accompany this policy to meet specific legal and regulatory requirements or to address needs specific to each department. In addition to this policy, Prêt 955 should establish frameworks to demonstrate its compliance with legislation. At a minimum, 955 PRÊT should provide frameworks for the following aspects:

Management of individual rights, including complaint management and other remedies. Retention, destruction, or anonymization of personal information. Management of Third Parties. Management of incidents involving personal information. Automated decision-making. Use of personal information for research purposes.

Responsible for the protection of personal information: Prêt 955 must designate a person to act as the responsible party for the protection of personal information. Unless specifically appointed by the administration, this responsibility is delegated to the person with the highest authority within 955 PRÊT.

Inventory of personal information: 955 PRÊT must be aware of the type, quantity, and sensitivity of the personal information it holds. It must determine why it collects, uses, or discloses it and where it is stored (within the company or with a Third Party).

Risk management: 955 PRÊT must ensure that legal and regulatory risks related to

the protection of personal information are identified and evaluated. To do this, it must conduct a Privacy Impact Assessment (PIA) when legal and regulatory requirements require it.

Training and awareness: 955 PRÊT must train and raise awareness among its Users. Training and awareness include legal and regulatory requirements, this policy, or any framework or documentation related to the protection of personal information. Training is updated as needed and must be tailored to the function and tasks of Users, when required. Training is provided to Users as soon as possible following their appointment or in connection with their new assignment, if relevant.

Accountability: Accountability aims to ensure that accurate, sufficient, and relevant information on the protection of personal information is communicated in a timely manner to the administration.

Continuous assessment and review: The Privacy Management Program should be subject to continuous assessment and review to ensure its relevance and effectiveness, especially in light of legislative changes and/or changes within the company.

SECURITY MEASURES

955 PRÊT employs appropriate security measures to protect the personal information under its custody or control. All Users must exercise caution and diligence when handling or manipulating personal information. They must always apply appropriate security measures (physical, organizational, and technological) to protect personal information, all in accordance with this policy.

RESPONSIBILITIES

As part of our commitment to protect your privacy, we have implemented privacy policies that describe the obligations of 955 PRÊT staff members when processing your personal information. All employees must obtain the necessary consents from you during the collection, use, and/or disclosure of your personal information, in accordance with the law. Moreover, they can only access your information if needed in the performance of their duties. The role of 955 PRÊT management in protecting your personal information includes ensuring compliance with appropriate guidelines regarding retention and destruction and maintaining a reporting process with the person responsible for the protection of personal information at 955 PRÊT. The person responsible for the protection of personal information helps all employees collect, use, disclose, and retain information in accordance with applicable laws and policies. The person responsible for the protection of personal information also acts as the official liaison with privacy regulatory bodies and is the main resource for all complaints, concerns, and questions related to privacy protection.

Now that you’ve reached the end of the French text, please let me know if there’s anything specific you would like assistance with or if you have any further questions.