Privacy Policy

nventive (the "Company", "we", "us", "our") respects the privacy of individuals and will only collect, use or disclose your personal information in accordance with this Privacy Policy (the "Policy"). For the purposes of this Policy, "personal information" means any information about an individual that allows that individual to be identified, such as the name, date of birth, contact information, information about the individual's identity and communications with the Company, which may be in any form. We recognize everyone's right to privacy and our obligation to maintain the confidentiality of personal information. The Company takes steps to protect and maintain the confidentiality of the personal information of those with whom it does business, including users of its products and services, as well as past and prospective customers ("Users" and each a "User", "you", "your", as applicable) and the Company is responsible for personal information in its possession or custody.

This Policy explains how the Company collects, uses, communicates, retains and protects the personal information of its Users in the course of its activities, in particular in connection with the use by its Users of the Company's products, services, software, applications and websites (the "Services").

By providing personal information to the Company, Users agree to this Policy and to the terms and conditions of use of the software and applications offered by the Company, available on our Website. If you access our Services, you agree to be bound by the terms and conditions contained in the Policy. If you do not agree to be bound by these terms and conditions, please do not access or use our Services.

The Company reserves the right to update this Policy at any time, and such changes will be effective immediately, unless otherwise indicated. Users are requested to check this Policy regularly for changes. Users are deemed to have accepted changes to this Policy if they continue to provide personal information to the Company after changes have been published. Therefore, the Company recommends that you print a copy of this Policy for your records and review this section of our Services periodically.

The types of personal information collected by the Company depend on several factors as well as the context. The Company only collects personal information that it considers necessary for the conduct of its business and for the fulfillment of the purposes set out in this Policy.

The Company collects personal information about Users from a variety of sources, but most information comes directly from Users through their use of the Services. For example, without limitation, personal information may be collected when a User enters information into the Company's Services, applies for a job posting on its Website or registers to receive the Company’s newsletter. Personal information collected may include, but is not limited to, identifying information, such as first and last name, date of birth, complete residential address, telephone number, e-mail address and Internet Protocol address (commonly referred to as "IP address"), as well as any other information relating to a User's application for employment on our Website. The Company may also collect personal information about Users from external sources, with or without consent, if permitted by law.

The Company collects personal information from Users in order to establish, manage and maintain its relationship with them, and more specifically, for the purposes described in this Policy. The Company recognizes that a User's consent to the collection, use and disclosure of his or her personal information must be manifest, free and enlightened, and must be given for specific purposes. Depending on the nature and sensitivity of the personal information, a User's consent may be express (such consent may be given verbally, in writing or electronically) or implied (for example, when a User voluntarily provides personal information).

In addition to the purposes already set out in this Policy, the Company will inform Users of the purposes for which personal information is collected at or before the time the information is collected. If the Company seeks to use personal information that has been collected for a purpose not previously disclosed, it will seek your consent prior to such use, unless otherwise required or permitted by law.

For example, by law, a User's personal information may be used for the following purposes:

• when their use is for purposes compatible with those for which they were collected (for example, when you voluntarily provide us with information through a form);
• when their use is clearly for the benefit of a User;
• when their use is necessary for the prevention and detection of fraud or the evaluation and improvement of protection and security measures;
• when their use is necessary for the supply or delivery of a product or service that a User has requested from the Company; or
• when their use is necessary for study, research or statistical purposes, provided they are depersonalized.

Subject to legal or contractual requirements, a User may at any time withdraw his or her consent to the collection, use or disclosure of his or her personal information by writing to the Company's Privacy Officer at the contact information below, upon reasonable notice. However, the withdrawal of such consent may limit the Company's ability to offer certain Services to the User, prevent the Company from providing them to the User, or even require the Company to cease offering them to the User.

When a User uses the Company's Website and enters information in free-form text or other fields, as applicable, the User acknowledges that the Company has no control over the nature and type of information that a User chooses to enter in such fields. The User hereby accepts that the Company collects such information in connection with its Services and processes it in accordance with the terms hereof. The Company recommends that you do not enter any sensitive personal information in these fields. If a User chooses to enter sensitive personal information, he or she expressly consents to the collection, use and disclosure of such information by the Company in accordance with the Policy, including disclosure to third parties both within and outside Quebec.

The Company will never ask a User to share sensitive personal information in order to access and use its Services and Website. For reference, sensitive personal information is personal information that, because of its medical, biometric or other intimate nature, or because of the context in which it is used or communicated, gives rise to a high reasonable expectation of privacy. Examples of sensitive information include health, sexual orientation, morphological, behavioural or biological characteristics, philosophical or religious beliefs, or financial status.

The Company may collect and use personal information for the following purposes:

• To provide customized Services or information requested by Users, to identify any User as a user of the Company's Services and to maintain the business relationship between the Company and any User;
• To enable Users to access the Company's Website and Services;
• Offer a User employment with the Company when a User applies for employment;
• Communicate with Users in connection with the Company's activities, for internal quality assurance purposes or to manage the quality of information provided;
• To detect and prevent fraud;
• For statistical and accounting purposes;
• To inform Users of news, updates, information and special offers concerning the Company's Services, in accordance with Canada's anti-spam legislation.
• To improve the Company's range of services and to support our research and development efforts;
• To measure User interest in the Company's Services;
• If the Company has reasonable grounds to believe that they may be useful in the investigation of a contravention of federal, provincial or foreign law, or in the protection or defence of a legal interest;
• As required or permitted by law.

Personal information may be used by the Company to make automated decisions about services that may be of interest or relevance to a User. This automated decision-making would have no legal or juridical effect on a User, but would simply aim to automatically generate recommendations on the basis of personal information. Upon request, the Company will provide a User with information on the operation of any such automated system.

The Company retains the personal information it collects as long as necessary for the conduct of its business and the fulfillment of the purposes for which it has been collected, and as long as it is reasonable to do so for customer service, legal or business purposes. The period of retention depends on the Service and the nature of the information collected. At the end of this period, the information will be destroyed, deleted, or anonymized.

The Company recognizes that, subject to the conditions described below or when authorized by law, the communication of a User's personal information to third parties requires his or her consent.
Access to your personal information within the Company does not require your consent, but is strictly limited to those persons for whom such information is necessary for the performance of their duties and responsibilities.

The Company may share a User's personal information, without the User's consent, with its agents, service providers or consultants who require such information in connection with the Company's business or to assist the Company in administering its Services. Such agents, service providers and consultants will warrant by contract that they will use the personal information disclosed to them only to provide specific services and that they will maintain the confidentiality of such information in accordance with this Policy.

The Company may also, without consent, disclose a User's personal information when authorized or required to do so by law, for example to prevent fraud or risk of serious physical harm to any person. Whenever the Company is required to disclose personal information concerning a User, it will endeavour not to disclose more information than is required in the circumstance.

The Company may from time to time disclose information outside the province in which a User normally resides (to another province or outside Canada) in connection with the performance of a service or a business contract, for example, for hosting or data processing. In such cases, the Company will take all measures to ensure that the third-party service provider will protect personal information with the same standards of protection as those in force within the Company, and that your personal information will not be used for purposes other than those authorized at the time of the collection or by law. If the Company discloses sensitive personal information about a User outside Canada, it will obtain the express consent of the User. A User has the right to know, upon request, to whom his or her personal information is disclosed and the circumstances that led to its disclosure.

The Company takes the protection of the User's personal information seriously.

The security and protection of personal information is important to the Company. The Company takes security measures to protect Users' personal information from unauthorized use or disclosure, loss or theft.

These security measures include:

• physical measures (for example, office access chips for employees, data backup and archiving using an external system, etc.);
• administrative or organizational measures (for example, restricting access to what is strictly necessary, restricting modifications according to the principle of least privilege); and
• technological measures (such as depersonalizing your personal information, using passwords and multi-factor authenticators, using a firewall, encrypting data, using SSL protocol, etc.) that are reasonable given the sensitivity of the information, its use, quantity, distribution and medium.

The Company also takes the necessary steps to ensure that all its employees are aware of the contents of the Policy and informed about privacy practices.

However, since no mechanism can guarantee flawless security, there is always an element of risk. In the event of a confidentiality incident involving personal information, the Company will, where required by law, disclose the incident to the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada and the individuals concerned, and will adopt measures to minimize the impact of the security incident. The Company will also study the confidentiality incident and adopt methods to reduce the risk of a similar type of confidentiality incident occurring in the future. The Company keeps a register of all confidentiality incidents involving personal information and, on request and when required by law, will make this register available to the competent privacy protection bodies.

The Company will ensure that personal information about Users is as accurate, complete and up to date as possible for the purposes for which it is to be used. It is, however, the User's responsibility to ensure that personal information, such as contact information, is updated with the Company.

Users may have access to their own personal information in order to consult, update or rectify it by communicating in writing with the Company's Privacy Officer by e-mail or by mail at the contact information below.

Any such request must contain sufficient details for the Company to process it. The Company undertakes to respond to any such request within a reasonable time and, insofar as possible, within a maximum of thirty (30) days. However, the Company must first verify the identity of the person making such a request.

The Company may refuse in writing to give access or to modify a User's personal information for serious reasons. In the event of a refusal to provide or correct information, the Company will provide you with the reasons for its refusal and the sections of the applicable law that support its refusal, subject to the restrictions provided by law, and will inform you of your recourse. The Company may charge a fee for the transcription, reproduction or transmission of a User's personal information and in such case, will notify the User in advance of the applicable fee.

The Company's Website uses cookies, which are small data files that are stored on a User's computer when he or she visits our Website. These cookies are used to provide Users with a better browsing experience on our Website. The personal information collected by cookies enables the Company and its service providers to tailor the Website to Users' preferences and to compile statistics about the consultation and use of the Website in order to improve it.

The Company may use cookies to record anonymous, non-personal information about visits to our Website and to collect information about Users' browsing activities. Information that may be compiled through the use of cookies may include: the Internet Protocol address (or IP address) of your computer, the operating system you are using, the identity of your Internet service provider, the date and time you access this Website, the previous Website you visited from which provided you the link to our Website, as well as the content viewed and downloaded from our site.

The Company may use the following cookies:

• Necessary cookies: These cookies are necessary to enable the basic functionalities of the site. The Website cannot function properly without these cookies.
• Functional cookies: These are used to optimize a User's experience of the Company's website.
• Statistical cookies: These cookies help the Company understand how a User interacts with the Company's website by collecting and reporting information anonymously.
• Performance cookies: The Company uses Google Analytics, Google Marketing and Google Ad Manager to collect and process certain analytical data and to analyze the use of our Websites. Google Analytics is subject to Google's Privacy Policy and Terms of Use. For more information on Google Marketing and Google Ad Manager, please refer to their respective policies.
• Advertising cookies: These may be used for research, planning and reporting purposes in order to establish a profile of Users' interests.
• Social network cookies: These cookies may be activated when a User shares content from the Company's Website. A User is then subject to the data use policies of social networking platforms (e.g., Facebook, LinkedIn), which may store cookies (including targeting cookies) on the User's computer.

As with most Internet browsers, it is possible to erase cookies from your computer's hard drive, block the creation of cookies or receive a warning before a cookie is stored. However, doing so may affect your use of the Company's Services, and you may no longer have access to all its functions. We invite you to consult the Ads Setting and Network Advertising Initiative sites as well as your browser's instructions or help section for more information on cookies.

The Services may contain hyperlinks to third-party websites (e.g., GitHub) (the "Third-Party Sites") that may lead the User away from the current website. The Company provides these hyperlinks as a convenience. The Third-Party Sites are not under the control of the Company, which therefore has no control over the privacy and confidentiality practices of the Third-Party Sites. Accordingly, any personal information transmitted through Third-Party Sites is subject to the privacy policy of such Third-Party Sites. It is the User's responsibility to consider these policies in order to ensure the protection of his or her personal information.

The Company uses social media in addition to operating the Services. Social media accounts are public and are not hosted by the Company. Users who choose to interact with the Company through these social media accounts should therefore read the terms of service and privacy policies of these third-party service providers and the applications used to access them.

Personal information that is provided to the Company through social media accounts is collected in order to capture conversations between a User and the Company. It may be used to respond to inquiries, for statistical evaluation and reporting purposes, and for all other purposes identified in this Policy.

If you are located in a European Union ("EU") country or use our Services offered to EU residents, and we collect, track, use or otherwise process personal information collected from you or through your use of our Services, or transfer such personal information, we will do so in accordance with this Policy, the applicable Terms of Use and in compliance with the requirements of the General Data Protection Regulation (EU 2016/679) (GDPR). In the event of a conflict between this section and the rest of the Policy, the provisions of this section will take precedence, only where the processing takes place while the data subjects are in the EU and where the processing activities relate to the provision of goods or services or the monitoring of the behaviour of such data subjects, insofar as it relates to behaviour taking place within the EU.

17.1 Consent - If your consent is provided in a written statement that addresses other matters, the Company will ensure that the request for consent to process your personal information is clearly distinguishable.

17.2 Collection, retention and use of personal information - The Company will retain personal information only as long as necessary for the fulfillment of the purposes for which it was collected and will take reasonable steps to identify in advance the period of time personal information may be retained or the criteria for determining that period of time.

17.3 Automated individual decision-making - The Company recognizes that you have the right to know whether your personal information is being processed by an automated decision-making system. Upon request, the Company will provide you with information on the operation of this automated system. Unless required or authorized by law, you have the right to refuse that a decision based exclusively on an automated system be made in your respect, when this decision has legal consequences for you.

17.4 Privacy impact analysis - The Company will conduct a privacy impact analysis before implementing new technologies that are highly likely to infringe on your rights and freedoms, including your right to privacy.

17.5 Right to erase data - Where permitted by law, you have the right to request that the Company remove and erase your personal information without unreasonable delay.

17.6 Accuracy and protection - Before collecting personal information, the Company will implement appropriate technical and organizational measures to ensure the protection of personal information. The Company will only share personal information with external agents, mandataries, consultants, data processors or service providers when they assure the Company that appropriate measures have been put in place to protect personal information.

17.7 Accountability - The Company acknowledges that it is responsible for the protection of personal information and ensures that it is able to demonstrate its compliance with the GDPR when processing personal information.

17.8 Complaint procedure, right of access or rectification - The Company takes all necessary measures to facilitate the exercise of your right to access, rectify or obtain your personal information. You can always obtain confirmation from us that personal information is being processed. Any rectification or erasure of your personal information will be communicated to third parties to whom the information has been disclosed.

If you have any questions, comments or suggestions about this Policy or the Company's privacy practices that are not addressed in this Policy, you may contact the Company's Privacy Officer in writing by e-mail or by mail at the contact information below. You may file a complaint with the Company's Privacy Officer if you believe that the Company is not complying with its obligations. The Company will investigate any such complaint and, if justified, will take appropriate measures to correct the situation. If you are not satisfied with this internal investigation of your complaint, you may contact the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

Users may contact us to request that we delete or correct their personal information from our systems, or to request access to their personal information. We will do our best to respond to such requests. If such information is deleted from our systems, your account may be deactivated. In all cases, we may retain an archival copy of your records, as required by law or for legitimate business purposes.

The Privacy Officer can be contacted at the following address and e-mail:

Francis Venne

1117 rue Sainte-Catherine Ouest, Bureau 900, Montréal (Québec), H3B 1H9

francis.venne@nventive.com