Privacy Policy

Version 1.1 (March 24, 2025)

Preamble

This privacy policy applies to all stakeholders accessing or using the websites of Kezber & Associés Inc. or its affiliated entities, including Netlinux (9333-7806 Québec Inc.). For ease of reading, the term “Kezber” will be used to refer to all these entities collectively.

Kezber collects, uses, discloses, and retains various personal information in accordance with the Civil Code of Québec and the Act respecting the protection of personal information in the private sector.

Application

This policy applies to all confidential and personal information collected by Kezber, in compliance with the Act respecting the protection of personal information in the private sector, as well as any other applicable laws or regulations.

In this policy, the terms “we,” “our,” and “us” refer to Kezber and its head office.

This policy does not apply to information relating to legal entities or information of a public nature, i.e., information that is publicly known and accessible through legal means, as such information is not covered by the law.

Objectives

Through this policy, Kezber aims to outline its practices regarding the processing of personal information concerning its employees, website visitors, and individuals who communicate with us through various means (telephone, internet, email, fax, or others).

This policy is intended to:

• Protect the personal information of the public and our employees;
• Guide staff on Kezber’s practices regarding the processing of personal information.

What is Personal Information?

Personal information refers to information about an individual that allows them to be identified, such as their name, address, date of birth, and social insurance number.

Personal information of a sensitive nature, such as medical, intimate, or financial data, is considered sensitive due to the high reasonable expectation of privacy associated with it.

We treat all forms of personal information in the same manner, with the highest degree of confidentiality, regardless of its source or sensitivity.

Kezber’s Commitment to Privacy

Kezber is committed to respecting the privacy and personal information of its clients, employees, and anyone who communicates with us. To this end, Kezber undertakes to take all necessary measures to safeguard the confidentiality of the personal information in its possession.

More specifically, Kezber commits to:

• Training its staff on the protection of personal information;
• Assessing privacy-related risks;
• Implementing all necessary measures to protect personal information;
• Obtaining individuals’ consent when required;
• In the event of a privacy incident, recording the incident, notifying affected individuals if necessary, investigating the circumstances, and taking measures to prevent similar incidents in the future;
• Responding promptly to questions, requests, and complaints regarding personal information and its protection.

Privacy Incident

A privacy incident is defined as unauthorized access, use, or disclosure of personal information, as well as the loss of personal information or any other breach of its protection.

In compliance with the law, Kezber has implemented all necessary measures to prevent such incidents and has developed a response plan for privacy incidents.

In the case of a privacy incident deemed to pose a serious risk of harm to personal information, a notice will be sent to the Commission d’accès à l’information (Access to Information Commission), and the affected individual will be notified promptly.

Additionally, we maintain a register recording all privacy incidents.

Transparency

a. We make it our duty to provide and explain to anyone who requests:

• The purposes of data collection;
• The methods used for collection;
• Their rights to access and rectify this data;
• Their right to withdraw consent to our data collection.

b. If necessary, we will provide:

• The names or categories of third parties for whom the data is collected;
• The names of third parties to whom the information must be disclosed;
• An explanation of the possibility that the information may be disclosed outside Québec.

c. Upon request, we will also inform them of:

• The personal information collected about them;
• The categories of individuals within the organization who have access to this information;
• The retention period for this information;
• The contact details of the person responsible for protecting personal information.

d. Upon request, we will provide all information collected about them in clear and simple terms.

Kezber does not use any automated personal information processing systems, and therefore, no decisions are based on such systems.

Identification, Localization, and Profiling

Kezber uses technologies to automatically profile users of its website. When a user visits the website, Kezber automatically collects certain information about the device used, including information about the web browser, IP address, time zone, and installs certain cookies on the device. Additionally, as a user navigates the website, Kezber collects information about the web pages or products viewed, the websites or search terms that referred the user to our website, and how the user interacts with the website.

Consent

Since September 22, 2023, new rules govern consent for the collection, disclosure, or use of personal information:

• Consent must be requested for each purpose in clear and simple terms.
• When we request consent in writing, it will be presented separately from other information provided.
• Unless an exception applies, we cannot use personal information for purposes other than those specified in the consent.
• Express consent must be obtained before using sensitive personal information for a purpose other than that specified during collection.

However, in accordance with the law, your consent is not required when we use your personal information in the context of fulfilling a mandate entrusted to us, concluding a commercial transaction, providing services you requested, or when its use is clearly for your benefit.

Collection of Personal Information

a. Automatic Collection

As mentioned in section 7, Kezber automatically collects information about users of its website.

b. Collected Information

The following is a list of personal information collected by Kezber:

Clients

Kezber does not collect personal information about its clients, as they are all legal entities (businesses), which are not covered by the law.

Website Visitors

• Information about the web browser;
• IP address;
• Time zone;
• Information about the web pages or products viewed;
• Information about the websites or search terms that referred the user to our website;
• Information about how the user interacts with our website.

Recruitment (via website forms or other means)

• First name;
• Last name;
• Email address;
• Phone number;
• Information provided in the resume;
• Information provided in the cover letter;
• Any other personal information provided in the application;
• Any other personal information provided in a recruitment file from a third party, if applicable.

Cookies

When you visit the website, we automatically collect certain information about your device, including information about your web browser, IP address, time zone, and certain cookies installed on your device. Additionally, as you navigate the site, we collect information about the web pages or products you view, the websites or search terms that referred you to the site, and how you interact with the site. We refer to this automatically collected information as “device information.”

We collect device information using the following technologies:

a. Cookies are data files placed on your device or computer, often containing an anonymous unique identifier. For more information about cookies and how to disable them, visit https://www.allaboutcookies.org;

b. Log files track actions occurring on the site and collect data, including your IP address, browser type, internet service provider, referring/exit pages, and date and time;

c. Web beacons, tags, and pixels are electronic files used to record information about how you navigate the site.

Use of Personal Information

The collected information is used for:

Website Visitors:

• Automatically profiling users of our website.

Recruitment:

• Communicating with the candidate.

Disclosure and Sharing of Personal Information

Personal information in our possession will never be disclosed to third parties without the prior express consent of the individual concerned, except in the case of a court order, a legal obligation, or in compliance with the law.

Additionally, we share your personal information with third parties to help us use your personal information, as described in section 7. Furthermore, Kezber has clients with online stores on its servers, which are also subject to the Act respecting the protection of personal information in the private sector.

We may also use Google Analytics to help us understand how website visitors use the site.

However, the consent of the individual concerned is not required when we use their personal information in the context of fulfilling a mandate entrusted to us, concluding a commercial transaction, providing services requested by us, or when its use is clearly for their benefit.

Retention and Security of Personal Information

We retain personal information only for the time necessary and in accordance with our legal obligations. The information may be stored on both paper and digital media, but not necessarily on both simultaneously.

All digital personal information we retain is stored on secure cloud/local servers.

Our entire local network is protected by passwords, a modern and up-to-date firewall, and up-to-date antivirus software. Backups are performed daily on a third-party cloud system. Data stored on this service is password-protected and encrypted during both transmission and storage.

Physical servers are located in a locked room with a smart card system.

Finally, we also use the SharePoint platform for sharing digital documents.

Destruction of Personal Information

Personal information is destroyed once the purposes for which it was collected or used have been fulfilled, subject to any retention period required by law.

More specifically, Kezber has a retention and destruction policy for personal information, specifying the type of personal information and the associated destruction period. Kezber invites you to consult this policy for further details.

Digital personal information is destroyed when it is deleted from all our servers, computers, mobile devices, storage devices, and backups.

Any physical document containing personal information will be destroyed by shredding.

Finally, any storage device containing personal information and/or confidential information is destroyed by internal shredding or by a specialized company.

Privacy Settings for Technological Products and Services

The only technological product or service we offer to the public is our website. It collects personal information, but we ensure that, by default, our website provides the highest level of privacy possible.

Regarding data-sharing services, we use SharePoint. This platform is encrypted during both data transmission and storage. We share information only with the individuals concerned, and they are the only ones with access, which is protected by a unique password. This represents the highest level of privacy possible on this platform.

Right to De-Indexing

Any individual may request that their personal information no longer be disseminated or that any hyperlink associated with such information be de-indexed.

However, Kezber does not disseminate personal information or link personal information to hyperlinks.

Disclosure of Personal Information Outside Québec

In accordance with the law, before disclosing personal information outside Québec, a privacy impact assessment will be conducted.

If the assessment demonstrates that the information will receive adequate protection, it may be disclosed, subject to a written confidentiality agreement with the recipient(s) in compliance with the law.

Disclosure of Personal Information to Facilitate the Grieving Process

As of September 22, 2023, the law authorizes us to disclose personal information about a deceased person to their spouse or a close relative if the information is likely to assist in their grieving process, unless the deceased had provided written refusal to grant this right of access.

Collection of Personal Information About Minors Under 14

Personal information about a minor under 14 is never collected from them without the consent of the holder of parental authority or guardian, except when the collection is clearly for the minor’s benefit.

Access, Roles, and Responsibilities of Staff Members

All Kezber staff members are responsible for maintaining the security and confidentiality of personal information in our possession throughout its lifecycle. Access to employees’ personal information is restricted to management, human resources, and accounting personnel.

Additionally, staff members with access to personal information are subject to a confidentiality agreement requiring them to respect the confidentiality of the personal information they access.

The person responsible for the protection of personal information, who ensures that Kezber complies with and implements the principles of the Act respecting the protection of personal information in the private sector, must:

• Identify and implement policies and practices governing Kezber’s personal information protection practices;
• Ensure that Kezber has policies and practices for the retention and destruction of personal information and approve them;
• Define and approve the roles and responsibilities of staff members throughout the lifecycle of personal information;
• Establish and approve a process for handling complaints related to personal information protection;
• Ensure consultation at the start of any information system development or redesign project or electronic service delivery involving the collection, use, disclosure, retention, or destruction of personal information, regarding the privacy impact assessment of any acquisition project;
• Be proactive at all stages of an acquisition, development, or redesign project for information systems or electronic service delivery within Kezber to suggest, if applicable, personal information protection measures in line with the requirements of the Act respecting the protection of personal information in the private sector;
• Record the disclosure if an incident poses a risk of serious harm and a Kezber representative must notify any person or organization likely to reduce the risk, disclosing only the necessary personal information;
• Ensure consultation when a Kezber representative assesses the risk of harm to an individual whose personal information is affected by a privacy incident;
• In the context of a mandate, be informed of any breach or attempted breach by any person of any confidentiality obligations related to the disclosed information and conduct any related verification;
• Certify in writing the cessation of dissemination of personal information or the de-indexing or re-indexing of the hyperlink;
• Respond in writing to access or rectification requests promptly and within the timeframe specified by the Act respecting the protection of personal information in the private sector;
• Provide assistance in identifying requested information;
• Be involved in managing a privacy incident using applicable policies;
• Establish a process for handling complaints related to personal information protection.

The person designated for this role is Mr. Alan Kezber, President.

Portability of Personal Information

Any individual has the right to request a copy of their computerized personal information collected from them, unless the request raises serious practical difficulties. This personal information will be provided within 30 days in a structured and commonly used technological format. We may also, at your request, disclose this personal information to any person or organization authorized by law.

Complaint Process

If you wish to share questions or comments regarding this policy or its application, please contact the person responsible for the protection of personal information.

If you wish to file a complaint, you can contact the Commission d’accès à l’information du Québec via the following link: https://www.cai.gouv.qc.ca/a-propos/nous-joindre.

However, we invite you to first contact Kezber’s person responsible for the protection of personal information.

Modification of This Policy

We reserve the right to modify this policy at any time. We will inform you of changes by indicating the date of the last update at the beginning of this policy. You are responsible for reviewing it promptly to check for changes.

We strongly recommend reading this policy to understand how your information will be used. Any changes to this policy will apply to personal information collected before the effective date of the modified version, as well as to information collected on or after that date.

Person Responsible for the Protection of Personal Information

Alan Kezber
President
confidentialite@kezber.com
817, rue Principale Ouest, Suite 400
Magog, Québec J1X 2B4