1. Context

This policy aims to ensure the protection of personal information and to define how Automatisation Miraculus S.E.N.Q. collects, uses, discloses, retains, and destroys, or otherwise manages, such information. Additionally, it aims to inform any interested individuals about how Automatisation Miraculus S.E.N.Q. handles their personal information. It also pertains to the processing of personal information collected by Automatisation Miraculus S.E.N.Q. through technological means.

2. Scope and Definitions

This policy applies to Automatisation Miraculus S.E.N.Q., including its executives, employees, consultants, volunteers, and anyone providing services on behalf of Automatisation Miraculus S.E.N.Q. It also extends to the website of Automatisation Miraculus S.E.N.Q. and all websites under the control and management of Automatisation Miraculus S.E.N.Q.

It encompasses all types of personal information managed by Automatisation Miraculus S.E.N.Q., including information about current or potential clients, consultants, employees, members, or any other individuals, such as visitors to its websites, among others.

For the purposes of this policy, personal information is defined as any information related to an identifiable individual, whether directly or indirectly. This may include data such as the name, address, email address, phone number, gender, banking information, health information, ethnic origin, language, etc.

Sensitive personal information is information for which there is a high degree of reasonable privacy expectation, such as health, financial, biometric information, sexual orientation, ethnic origin, political opinions, religious or philosophical beliefs, etc.

The above provisions do not apply to personal information that has a public character under the law, from the effective date of this policy onward.

3. Collection, Use, and Disclosure

In the course of its operations, Automatisation Miraculus S.E.N.Q. may collect various types of information for various purposes. The types of information that may be collected by Automatisation Miraculus S.E.N.Q., their use (or purpose), and the methods of collection are detailed in Annex A of this policy.

Automatisation Miraculus S.E.N.Q. will also inform the individuals concerned, at the time of the collection of personal information, about any other information collected, the purposes of the collection, and the methods used, in addition to providing other information required by law.

Automatisation Miraculus S.E.N.Q. follows the following general principles regarding the collection, use, and disclosure of personal information:

Consent:

As a general rule, Automatisation Miraculus S.E.N.Q. collects personal information directly from the individual concerned and with their consent, unless an exception is provided by law. Consent may be obtained implicitly in certain situations, for example, when the individual chooses to provide their personal information after being informed by this policy about its use and disclosure in accordance with the detailed purposes (see Annex A for more details). Therefore, the individual concerned can refer to this policy and the information it contains at the time of the collection of personal information.

Normally, Automatisation Miraculus S.E.N.Q. must also obtain the consent of the individual concerned before collecting their personal information from third parties, disclosing it to third parties, or for any secondary use. However, Automatisation Miraculus S.E.N.Q. may act without consent in certain cases provided by law and in accordance with its terms. The main situations where Automatisation Miraculus S.E.N.Q. may act without consent are outlined in the relevant sections of this policy.

Collection:

In all circumstances, Automatisation Miraculus S.E.N.Q. only collects information if there is a valid reason to do so. Moreover, the collection will be limited to the information necessary to achieve the intended purpose.

It is important to note that the services and programs of Automatisation Miraculus S.E.N.Q. do not target minors, and more generally, Automatisation Miraculus S.E.N.Q. does not intentionally collect any personal information about minors (in such cases, information cannot be collected without the consent of a parent or guardian).

Collection from Third Parties: Automatisation Miraculus S.E.N.Q. may collect personal information from third parties. Unless an exception provided by law applies, Automatisation Miraculus S.E.N.Q. will seek the consent of the individual concerned before collecting personal information about them from a third party. If such information is not collected directly from the individual but rather from another organization, the individual concerned may inquire about the source of the information collected by Automatisation Miraculus S.E.N.Q.

Retention and Use:

Automatisation Miraculus S.E.N.Q. ensures that the information it holds is up-to-date and accurate at the time of its use to make a decision concerning the individual in question.

An individual's personal information can only be used by Automatisation Miraculus S.E.N.Q. for the purposes specified in this policy or for other reasons provided at the time of collection. When Automatisation Miraculus S.E.N.Q. wishes to use this information for different or additional purposes, new consent must be obtained from the individual concerned, and such consent must be expressly obtained if it is sensitive personal information. However, in certain cases provided by law, Automatisation Miraculus S.E.N.Q. may use the information for secondary purposes without the consent of the individual, for example:

• When this use is clearly for the benefit of the individual;
• When it is necessary to prevent or detect fraud;
• When it is necessary to assess or improve protective and security measures.

Limited Access: Automatisation Miraculus S.E.N.Q. implements measures to restrict access to personal information only to employees and individuals within its organization who have the necessary qualifications and for whom this information is essential in the performance of their duties. Automatisation Miraculus S.E.N.Q. will seek the consent of the individual before granting access to any other person.

Disclosure:

In general, and unless an exception is specified in this policy or otherwise provided by law, Automatisation Miraculus S.E.N.Q. will obtain the consent of the individual concerned before disclosing their personal information to a third party. Furthermore, when consent is required, especially for sensitive personal information, Automatisation Miraculus S.E.N.Q. must obtain the explicit consent of the individual before disclosing such information.

However, it may sometimes be necessary to disclose personal information to third parties. Thus, personal information may be disclosed to third parties without the consent of the individual concerned in certain cases, including, but not limited to, the following situations:

• Automatisation Miraculus S.E.N.Q. may disclose personal information, without the consent of the individual concerned, to a public body (such as the government) that, through its representatives, collects it in the exercise of its powers or in the implementation of a program it manages.
• Personal information may be disclosed to service providers to whom it is necessary to communicate this information without the consent of the individual. For example, these service providers may be event organizers, subcontractors designated by Automatisation Miraculus S.E.N.Q. for the execution of mandates in the programs it administers, and cloud service providers. In these cases, Automatisation Miraculus S.E.N.Q. must enter into written contracts with these providers specifying the measures to be taken to ensure the confidentiality of the disclosed personal information, limit the use of this information to the execution of the contract, and stipulate that they cannot retain this information after its expiration. Furthermore, these contracts must specify that providers must notify the responsible person for the protection of personal information at Automatisation Miraculus S.E.N.Q. (as indicated in this policy) of any breach or attempted breach of confidentiality obligations regarding the disclosed personal information and allow this person to conduct any verification related to this confidentiality.
• If it is necessary for the purpose of concluding a business transaction, Automatisation Miraculus S.E.N.Q. may also disclose personal information, without the consent of the individual concerned, to the other party to the transaction, subject to conditions provided by law.

Disclosure Outside Quebec: It is possible that personal information held by Automatisation Miraculus S.E.N.Q. may be disclosed outside Quebec, for example, when Automatisation Miraculus S.E.N.Q. uses cloud service providers whose servers are located outside Quebec, or when Automatisation Miraculus S.E.N.Q. deals with subcontractors located outside the province.

Additional Information on Technologies Used:

Use of Cookies

The websites under the control of Automatisation Miraculus S.E.N.Q. use cookies, which are data files transmitted to the visitor's computer by their web browser when accessing the site, serving various purposes. These cookies are used, among other things, for:

• Remembering visitors' settings and preferences, such as language choice, and enabling tracking of the current session.
• For statistical purposes to understand visitor behavior, the content viewed, and thereby improve the website.

The types of cookies used are as follows:

• Session Cookies: Temporary, they are retained only for the duration of the visit to the website.
• Persistent Cookies: They remain on the computer until expiration and will be retrieved during the next visit.

Certain cookies may be disabled by default, and visitors have the option to choose whether to activate these functions when browsing the websites of Automatisation Miraculus S.E.N.Q. Enabling or disabling cookies can also be done by modifying preferences in the settings of the used browser.

Use of Google Analytics

Some websites of Automatisation Miraculus S.E.N.Q. use Google Analytics to continuously improve their performance. Google Analytics analyzes a visitor's interaction with an Automatisation Miraculus S.E.N.Q. website, using cookies to generate statistical reports on visitor behavior and the content viewed.

The information from Google Analytics will never be shared by Automatisation Miraculus S.E.N.Q. with third parties. Visitors have the option to install a browser add-on to disable Google Analytics.

Collection of Personal Information through Technological Means

Automatisation Miraculus S.E.N.Q. also collects personal information through technological means such as web forms integrated into its websites (e.g., contact form, membership application form, newsletter and seminar registration form), online surveys on its platforms and applications, as well as other form tools (e.g., Microsoft Forms).

When personal information is collected through the provision of a technological product or service with privacy settings, Automatisation Miraculus S.E.N.Q. ensures that these settings offer the highest level of privacy by default (except for cookies).

4. Retention and Destruction of Personal Information

Unless a minimum retention period is required by law or applicable regulations, Automatisation Miraculus S.E.N.Q. will retain personal information only for the period necessary to achieve the purposes for which it was collected.

Personal information used by Automatisation Miraculus S.E.N.Q. to make a decision about an individual must be retained for at least one year following the decision, or even seven years after the end of the fiscal year in which the decision was made if it has tax implications, such as in the circumstances of termination of employment.

At the end of the retention period or when personal information is no longer necessary, Automatisation Miraculus S.E.N.Q. will ensure:

• to destroy them; or
• to anonymize them (meaning that they no longer allow, in an irreversible manner, the identification of the individual, and it is no longer possible to establish a link between the individual and the personal information) in order to use them for serious and legitimate purposes.

The destruction of information by Automatisation Miraculus S.E.N.Q. will be carried out securely to ensure the protection of this information.

This section may be supplemented by any policy or procedure adopted by Automatisation Miraculus S.E.N.Q. regarding the retention and destruction of personal information, if applicable. For more information, please contact the responsible person for the protection of personal information at Automatisation Miraculus S.E.N.Q. (as indicated in this policy).

5. Responsibilities of Automatisation Miraculus S.E.N.Q.

In general, Automatisation Miraculus S.E.N.Q. assumes responsibility for the protection of the personal information it holds.

The person responsible for the protection of personal information at Automatisation Miraculus S.E.N.Q. is the Director of Operations of the organization. He or she is generally responsible for ensuring compliance with applicable privacy legislation. The responsible person must approve policies and practices governing the governance of personal information. Specifically, this person is responsible for the implementation of this policy and ensuring that it is known, understood, and applied. In the absence or inability to act of this responsible person, the President of Automatisation Miraculus S.E.N.Q. will assume the functions of the person responsible for the protection of personal information.

Members of the staff of Automatisation Miraculus S.E.N.Q. who have access to personal information or are otherwise involved in its management must ensure its protection and comply with this policy.

The roles and responsibilities of Automatisation Miraculus S.E.N.Q. employees throughout the life cycle of personal information may be specified by any other policy of Automatisation Miraculus S.E.N.Q.

6. Data Security

Automatisation Miraculus S.E.N.Q. is committed to implementing reasonable security measures to ensure the protection of the personal information it manages. These security measures are adapted, among other things, to the purpose, quantity, distribution, medium, and sensitivity of the information. Thus, information considered sensitive (see the definition in section 2) will be subject to more stringent security measures to ensure enhanced protection. In line with the previous mention of limited access to personal information, Automatisation Miraculus S.E.N.Q. will implement necessary measures to restrict the usage rights of its information systems, allowing access only to authorized employees who need it.

7. Access, Correction, and Withdrawal of Consent Rights

To exercise their rights of access, correction, or withdrawal of consent, the individual must submit a written request to the person responsible for the protection of personal information at Automatisation Miraculus S.E.N.Q., at the email address indicated in the following section.

Subject to certain legal restrictions, individuals have the right to request access to their personal information held by Automatisation Miraculus S.E.N.Q. and may request the correction of this information if it is inaccurate, incomplete, or ambiguous. They also have the right to request the cessation of the dissemination of personal information about them, or that any hyperlink attached to their name that provides access to this information through technological means be delinked, when the dissemination of this information violates the law or a court order. These requests can also be made to require the relinking of the hyperlink providing access to this information, under the conditions provided by law.

The person responsible for the protection of personal information at Automatisation Miraculus S.E.N.Q. must respond in writing to these requests within 30 days of receiving the request. Any refusal must be justified and accompanied by the legal provision justifying the refusal. In such cases, the response must indicate the remedies available under the law and the deadline for exercising them. The responsible person must assist the requester in understanding the refusal if necessary.

Subject to applicable legal and contractual restrictions, individuals may withdraw their consent to the communication or use of the information collected. They may also request from Automatisation Miraculus S.E.N.Q. the personal information collected from them, the categories of persons at Automatisation Miraculus S.E.N.Q. who have access to it, and its retention period.

8. Complaint Handling Process

Receipt Any person wishing to file a complaint regarding the application of this policy or the protection of their personal information by Automatisation Miraculus S.E.N.Q. must do so in writing by addressing the person responsible for the protection of personal information at Automatisation Miraculus S.E.N.Q., at the email address indicated in the following section.

The individual must provide their name, contact information, including a phone number, as well as the subject and reasons for their complaint, providing sufficient details to allow an assessment by Automatisation Miraculus S.E.N.Q. If the complaint is not sufficiently precise, the person responsible for the protection of personal information may request any additional information deemed necessary to assess the complaint.

Processing Automatisation Miraculus S.E.N.Q. is committed to treating any received complaint confidentially.

Within 30 days of receiving the complaint or receiving any additional information deemed necessary and required by the person responsible for the protection of personal information at Automatisation Miraculus S.E.N.Q. to process it, the latter must assess it and provide a reasoned written response, sent by email to the complainant. This assessment aims to determine whether the processing of personal information by Automatisation Miraculus S.E.N.Q. complies with this policy, any other policies and practices in place within the organization, and applicable legislation or regulations.

If the complaint cannot be processed within this timeframe, the complainant must be informed of the reasons justifying the extension of the deadline, the progress of the complaint processing, and the reasonable time needed to provide a final response.

Automatisation Miraculus S.E.N.Q. must create a separate file for each complaint received. Each file includes the complaint, the analysis, and documentation supporting its assessment, as well as the response sent to the person who filed the complaint.

It is also possible to file a complaint with the Commission d'accès à l'information du Québec or any other oversight body responsible for the enforcement of the law related to the subject of the complaint. However, Automatisation Miraculus S.E.N.Q. encourages anyone interested to first contact its person responsible for the protection of personal information and to wait for the completion of the processing by Automatisation Miraculus S.E.N.Q. before taking this step.

9. Approval

This policy is approved by the person responsible for the protection of personal information at Automatisation Miraculus S.E.N.Q., whose business contact information is as follows:

Person in Charge of Personal Information Protection: Simon Petit, 120 Rue Desrochers, Mont-Saint-Hilaire, QC J3H 3C8, simon@miraculusautomatisation.com

Pour toute demande, question ou commentaire dans le cadre de la présente politique, veuillez communiquer avec le responsable par courriel.

10. Publication and Amendments

This policy is published on the website of Automatisation Miraculus S.E.N.Q., as well as on all websites controlled and maintained by Automatisation Miraculus S.E.N.Q., to which this policy applies, regarding the personal information collected therein. This policy is also disseminated by any means capable of reaching the individuals concerned.

Automatisation Miraculus S.E.N.Q. must also do the same for any changes to this policy, which must be communicated to the individuals concerned through a notice.

Note: Please note that the use of the masculine gender is for the purpose of simplifying this policy and facilitating its readability.

Version Table and Changes:

• Version: 1.0
• Effective Date: November 22, 2023
• Changes since the last version: N.A. - First version

Appendix A

Here is a non-exhaustive list of the types of information that Automatisation Miraculus S.E.N.Q. might collect, their use, or the intended purpose, as well as the means by which the information is collected. This includes, but is not limited to, the following elements.

Please note that most of the personal information managed by Automatisation Miraculus S.E.N.Q. consists of clients' personal information, employee details, job applicants' information, and consultant data. Concerning other categories of individuals mentioned in the table below, the provided information is predominantly of a professional or business nature (refer to Section 2 on professional contact details). It's important to highlight that, in the majority of cases, Automatisation Miraculus S.E.N.Q. also collects individuals' professional titles/positions, the name of the organization, and/or the organization's address (see Section 2 on professional contact details).

Relationship with Miraculus S.E.N.Q. Automation, services, program, etc.	Type of personal information.	End of collection/use.	Method of gathering information (means).
	Either of this information, when required:	Used for:	Can be collected.
Client	Name Address Email City Postal code Phone number		Through a form on the website.