Privacy and Personal Information Protection Policy

This Privacy and Personal Information Protection Policy (the “Policy”) sets out the terms relating to the confidentiality and protection of your personal information or data that apply when you, among other things, visit or browse the website operated by Metriform Inc., including how your personal information or data is collected, used and disclosed. The Policy also contains information about your rights regarding your personal data.

By providing us with personal information (through our website, by email, in person or by telephone), you agree that it will be processed in accordance with this Policy, and you authorize Metriform Inc., its third parties and its service providers to process your personal information for the purposes set out below.

Furthermore, by providing us with personal information, you acknowledge and accept the Policy and the practices, as well as the terms of use set out below, relating to the collection and use of your personal information or data by Metriform Inc., including, in particular, the processing of your personal information or data and the measures taken to protect it.

Metriform Inc. uses your personal information to provide you with our services and to conduct our business, to administer and perform our services, including to fulfil our obligations under any agreement entered into between you and us.

We may also use personal information in any of the following ways:

• To respond to requests for information;
• For research and development purposes (including from a security standpoint);
• For recruitment purposes – to allow us to process job applications and to assess whether a person meets the requirements of a position for which they may apply with us;
• To comply with our legal or regulatory obligations;
• To prevent fraud and/or carry out other background checks that may be required at any time under applicable law or regulations;
• To enforce our rights and to comply with our legal or regulatory obligations regarding the disclosure of information;
• To ensure that we are paid – to recover payments owed to us and, where applicable, to enforce such recovery through debt collection agencies or other legal means (including by initiating legal proceedings);
• To reorganize or change our business – if we undertake a reorganization (for example, by merging, consolidating or divesting part of our business), we may need to transfer some or all personal information to an applicable third party (or its advisors) as part of any due diligence process or transfer to the reorganized entity or to that third party, for the same purposes as those set out in this Policy.

In addition, this Policy applies to a wide range of activities, particularly when you wish to receive information or choose to communicate with Metriform Inc. (for example, applying for a position or contacting us online, etc.). The personal information you must disclose may include, as the case may be, your contact information, your email and mailing addresses, your telephone numbers, your résumé, or other information or data of a personal nature, or even, in some cases, your comments and suggestions.

This information is collected for specific purposes, and its collection depends on how you choose to interact with Metriform Inc. Accordingly, Metriform Inc. processes and retains personal information in strict confidence, in accordance with applicable laws, and uses personal information only to the extent permitted by those laws. As a result, your personal information will be accessible only to authorized Metriform Inc. personnel who need to know it in order to perform a function related to the purposes set out in this Policy.

In this Policy, the term “personal information” means any information that concerns you as an identified or identifiable individual, including in particular the personal information mentioned in the section “Collection and Use of Your Personal Information”, or as otherwise defined by applicable law.

In this regard, we may collect and process various types of personal information in the course of our activities and the provision of our services, including:

• Identity information, such as a last name or first name;
• Contact information, such as a name, address, email address and telephone number;
• Billing and financial information, such as a billing address, bank account information or payment data;
• Recruitment information, such as a résumé and information about education and employment history;
• Website usage information and other technical information, such as details about visits to our websites, or information collected through cookies and other tracking technologies;
• Any other personal information provided. Please note that if you provide us with personal information about other individuals (such as your clients, directors, officers or shareholders), you must ensure that you have duly informed them that you are providing us with their information and that you have obtained their consent to such disclosure.

We do not collect information from children or other persons under the age of 16. If you are a minor, please do not provide us with any personal information. If you are a parent or guardian and you know that your children have provided us with personal information, please contact us. If we learn that we have collected personal information from minors without verification of parental consent, we will take steps to delete that information from our servers.

As a general rule, where applicable, we inform you at the time we collect your personal information to whom and for what purposes we disclose it, or we otherwise obtain your consent to such disclosure.

Generally, and unless an exception is set out in this Policy or otherwise provided for by law, Metriform Inc. will obtain the consent of the person concerned before disclosing their personal information to a third party. In addition, where consent is required and the information is sensitive personal information², Metriform Inc. will obtain the express consent of the person before disclosing the information.

However, personal information may be disclosed without the consent of the person concerned in certain cases, including, but not limited to, the following:

1. Where permitted by the Act, in particular:
   1. For study, research or statistical purposes (sections 21, 21.0.1 and 21.0.2 of the Act);
   2. In the context of a commercial transaction (section 18.4 of the Act);
2. Where required by law or by a competent authority;
3. Where necessary to supply or deliver a product or provide a service you have requested.

Subject to a retention period provided for by law, contractual restrictions, or a legal obligation incumbent on Metriform Inc., your personal information will be retained until the earlier of (i) the time needed to fulfil the purposes for which it was collected or used and (ii) the withdrawal of your consent. At the end of the retention period, or when the personal information is no longer needed, Metriform Inc. will:

1. Destroy it; or
2. Anonymize it (that is, make it anonymous so that the person can no longer be identified from the personal information) in order to use it for serious and legitimate purposes.

Please note that we will never ask you for personal information (such as your date of birth) by email. If you receive a suspicious email that appears to come from us, please contact us.

Metriform Inc. takes reasonable security measures to protect the personal information it manages. We have implemented physical, organizational and security measures to protect your personal information against loss or theft, as well as against unauthorized access, use or transmission. For example:

1. Access to your personal information is restricted to authorized Metriform Inc. personnel who need it for authorized purposes;
2. We make our authorized personnel aware of the importance of protecting personal information.

However, we cannot guarantee that the protective measures we use will always be effective. No method of transmitting information over the Internet or of storing information is completely secure. A breach of security measures may give rise to risks such as phishing and identity theft. In such cases, we promptly take steps to mitigate the risks and to notify you where there is a real risk of serious harm or where the law requires us to do so.

You may submit a written request to access your personal information, to request that it be corrected, or to withdraw your consent. Your request must be made in writing and addressed to the person in charge of the protection of personal information at Metriform Inc., using the contact information below.

The person in charge of the protection of personal information will respond to your request within 30 days of receiving it.

For any request, question or comment regarding this Policy, please contact the person in charge of the protection of personal information:

MARIA FASCIONE
Telephone: (450) 661-6950
Fax: (450) 661-7151
Email: [email protected]

You acknowledge and agree that emails you send to Metriform Inc. are not necessarily under its control and are not necessarily protected before they reach Metriform Inc.’s servers.

Consequently, Metriform Inc. cannot guarantee the security of your data transmissions. Any data you transmit is transmitted at your own risk.

Despite Metriform Inc.’s adoption of this Policy for its managers and authorized employees, such information may be disclosed or intercepted without authorization.

Metriform Inc. cannot be held liable for any loss or damage of any kind whatsoever, direct or indirect, suffered in connection with the use of the website operated by Metriform Inc., including the manner in which your personal information or data is collected, used and disclosed, including, without limitation: special damages, punitive, exemplary, incidental, moral or consequential damages, loss of profits, loss of earnings or loss of information, damages for business interruption, and any other expenses, losses or damages resulting from the use or unavailability of the website operated by Metriform Inc.

The use of the website operated by Metriform Inc., including the manner in which your personal information or data is collected, used and disclosed, is governed by the laws and courts of the Province of Quebec, district of the City of Montréal. Any dispute or litigation between you and Metriform Inc., or any other person, arising out of, in connection with, or relating to this Policy, the website operated by Metriform Inc. or any related matter will be resolved before the courts of Quebec sitting in the City of Montréal, to which you irrevocably submit and whose exclusive jurisdiction you recognize for any dispute or litigation.

This Policy may be supplemented by any policy or procedure adopted by Metriform Inc. regarding the retention and destruction of personal information, where applicable. Please contact the person in charge of the protection of personal information at Metriform Inc. to learn more.

In addition, since we may revise and update this Policy from time to time, we encourage you to consult it regularly. If we make changes to it, we will inform you by changing the date shown at the end of this document.

Last updated: 2023-09-20