POLICY ON CONFIDENTIALITY AND PROTECTION OF PERSONAL

DATA CONCERNING CUSTOMERS AND USERS

Approved by the data protection officer

1. General purpose

»), our web applications (« Web Applications »), our mobile applications (« Mobile

Applications »), and all associated services (collectively, the « Services »).

It also aims to ensure the security and protection of the data collected, processed,

used, communicated, and retained by Dipôle against unauthorized access, use, or

disclosure. It also aims to protect this data against any infringement of its integrity.

Furthermore, this policy is intended to determine the rules related to the processing of

this data, including access, communication, use, retention, and destruction, as well as

the rights of access, portability, rectification, withdrawal, erasure, and objection, as

applicable.

Documents Act (S.C. 2000, c. 5), and the General Data Protection Regulation (GDPR)

of the European Union.

3. Applicable laws

Data processing practices may vary depending on the jurisdictions in which Dipôle

operates.

Considering that all of Dipôle's customers are businesses, this policy is more inspired

by the GDPR.

However, should a natural person residing in Quebec become a customer of Dipôle,

this policy will also apply in Quebec. This policy applies to all users of the website,

regardless of where they are located.

Dipôle ensures to implement the necessary physical, computer, and technological

security measures to guarantee compliance with the confidentiality of the data

communicated to it in the course of its activities.

4. Scope

This policy applies to all employees, agents, suppliers, and partners of Dipôle who

may have access, in the performance of their duties, to data.

This policy concerns the data of customers and users of Dipôle's website. The

customer and the user of Dipôle's website are hereinafter referred to as the

"customer".

by a third party, regardless of the nature of their medium and regardless of the form in

which they are accessible: written, graphic, sound, visual, computerized, or other.

6. Definition of data Any factual or subjective information concerning an individual that

allows identification directly or indirectly and that is not publicly available under the

law.

Applicable in Quebec: However, data does not include the coordinates of

businesses, such as a name and a position, as well as business postal address, email

address, and workplace telephone number, if these coordinates are used to

communicate with an individual in the course of their professional duties.

7. General principles

Dipôle takes security measures to ensure the protection of data collected, processed,

8. Data collection

Dipôle is a professional software development company. In the course of its activities,

Dipôle collects data about its customers directly from them or from third parties. Where

applicable, Dipôle informs its customers about the data collected from these third

parties. In all cases, it informs the customer of the purposes for which the data is

processed, the categories of persons who have access to the data within the

company, the duration of data retention, and the contact information of the data

the first communication of the data. Dipôle may collect the following data:

informed consent of the customer, which is obtained through one or more detailed

consent forms expressed in simple and clear terms or through a pop-up window upon

arrival on the site.

In compliance with applicable laws, when Dipôle collects data, it requires the

customer's consent by communicating in advance the purposes for which this data is

collected and will be used.

Dipôle will seek to obtain new distinct consent before using the data held for purposes

that are not compatible with those for which they were initially collected and will inform

Dipôle collects data from the customer with their prior consent and immediately

provides in simple and clear terms, including the following information during collection

and subsequently upon request:

• The name of Dipôle;

• The purposes for which this data is collected;

• The means by which the data is collected;

• The rights to access, portability, rectification, withdrawal, erasure, and objection, as

applicable, provided by applicable laws;

• The name of the third party for whom the collection is carried out, if applicable;

• The name of the third parties to whom it will be necessary to communicate the data;

• The possibility that the data may be communicated outside Quebec or outside the

• To verify their identity;

• To communicate with them;

• To personalize its services;

• To provide a quote;

• To send notifications and newsletters;

• To ensure customer service;

• To improve the services offered;

• To provide services in a personalized way;

• To provide assistance and resolve technical issues;

• To generate invoices, account statements, and reports;

• To conduct marketing and promotion;

• To perform profiling;

• As permitted or required, for any applicable legal or regulatory obligation or provision;

• Any other compatible purpose;

• To assert its rights, if applicable.

Dipôle uses the data collected solely for the purposes for which consent has been

obtained. Thus, unless specific consent is provided, Dipôle does not communicate,

sell, rent, give, exchange, share, or disclose any data to third parties.

This data is accessible only to employees and to suppliers or agents of Dipôle who

necessarily need it to perform their duties, and they are required to respect the

confidentiality of this data.

servers, encryption, deployment of appropriate access rights management systems

and processes, careful selection of processors, adequate training of Dipôle personnel

who have access to data in the course of their duties, and other necessary measures

to ensure appropriate protection of data against any unauthorized use or

dissemination.

Dipôle uses information technologies to support its business processes in order to

offer better service delivery and appropriate data security. Dipôle implements

adequate security and access management measures to ensure the confidentiality,

integrity, and availability of the data it holds, based on the sensitivity of these data, the

suppliers, in compliance with the law, to facilitate the communication of data between

them and other stakeholders.

When data is communicated to third parties outside Quebec or outside the European

Union, Dipôle conducts a privacy factor assessment. In doing so, Dipôle considers the

sensitivity of the data, as well as the nature, scope, context, and purposes of the

protection. The transfer of this data may occur outside Quebec when appropriate

safeguards are provided by contract for the intended purpose.

Dipôle and its suppliers may be required to provide retained data due to a court order,

an administrative investigation, or other situations stipulated by law. In the event of a

sale, buyout, acquisition, or any other restructuring of

Dipôle's activities, it may be required to communicate data to potential or existing

buyers and their advisors for the purpose of the said transaction.

Dipôle will ensure compliance with the requirements of applicable laws before any

their data held by Dipôle, unless exceptions provided by applicable laws apply.

Applicable in Quebec: Unless there are serious practical difficulties, the

computerized data collected directly or indirectly from the customer will be provided in

a structured, commonly used technological format.

Applicable only under the GDPR: The customer may request that their data be

returned to them or transferred to another company under certain circumstances and

subject to the requirements of applicable laws. This data must be provided in a

commonly used and machine-readable format.

b) Right to Rectification The customer may request that their data be corrected,

for the purposes for which they were collected.

The customer may also withdraw their consent to use their data at any time. This

withdrawal of consent will only take effect for the future, upon receipt by Dipôle. Upon

receipt of the notice of withdrawal of consent, Dipôle commits to cease any use of the

data in question and to proceed with their destruction, subject to any legal or

regulatory obligations regarding their retention.

However, it may be possible that Dipôle cannot meet its obligations in the event of a

request for withdrawal of consent or early destruction. In this case, Dipôle cannot be

d) Right to Object Applicable only under the GDPR: The customer may object to the

processing of their data for a specific use.

16. Destruction

Data is retained for the period necessary to achieve the purposes for which it was

collected and is then destroyed. Data may be retained beyond the achievement of the

purposes for which it was collected when another retention period provided by another

law applies. They will be destroyed in accordance with applicable laws or, if

applicable, processed in a way that it can no longer be attributed to the customer, for

example through anonymization.

17. Customer responsibility

The customer who transmits data to Dipôle is responsible for its accuracy.

client’s equipment or system.

In the event that the confidentiality of their data is compromised or their identity is

usurped, the customer is required to notify Dipôle as soon as possible by contacting

the designated data protection officer identified below.

18. Data breach and measures to be taken

A data breach refers to unauthorized access to data, unauthorized use of data,

unauthorized communication of data, data loss, or any other violation of data

protection. In the event of a data breach, Dipôle will take prompt measures to mitigate

the risks of harm to the customer and to prevent further breaches of the same nature

freedoms of the customer, Dipôle will notify the data protection authority as soon as

possible, and if feasible, 72 hours at the latest after becoming aware of it.

Furthermore, should the breach present a high risk to the rights and freedoms of the

customer, Dipôle will inform them, in addition to the data protection authority.

19. Obligations in the event of access to third-party data