Privacy Policy

01

Our Commitment

Sémaz Inc. (hereinafter "Sémaz") is a consulting firm that supports organizations — primarily manufacturing and technology SMEs in Québec — in their organizational innovation and product innovation initiatives. In carrying out this mission, Sémaz may collect a limited amount of information, particularly when you contact us or request a diagnostic call.

Sémaz is committed to implementing reasonable measures to reduce the risk of privacy incidents involving personal information, and to protecting the privacy of personal information belonging to its clients, partners, suppliers, employees, and anyone who interacts with it. We value the trust placed in us by our clients and partners, and we recognize that maintaining that trust requires transparency and accountability in the way we collect and handle the information shared with us.

Sémaz commits to collecting, processing, or disclosing information that identifies a person only with that person's consent, unless the law permits or requires otherwise, in which case your consent is not required.

02

Legal Framework

This policy is established in accordance with the Act Respecting the Protection of Personal Information in the Private Sector of Québec (as modernized by Bill 25) and, where applicable, the Personal Information Protection and Electronic Documents Act (PIPEDA) at the federal level. Any commercial electronic communications we may send you are governed by Canada's Anti-Spam Legislation (CASL).

03

Policy Objectives

This policy aims to inform users of the reasons why, and the manner in which, Sémaz — or any person acting on its behalf — collects and uses their personal information. It is written in plain language to ensure informed consent.

For the purposes of this policy, "personal information" means any information that concerns a natural person and that directly or indirectly identifies them — for example: name, address, personal email address, personal phone number, or language of communication.

In general, a person's professional contact details — such as their name, title, work address, work email, or work phone number, used for professional purposes — do not constitute personal information under applicable law. Given that our clientele consists exclusively of businesses (B2B), most of the contact details we process are of this nature.

04

Obtaining Consent

We obtain consent before collecting personal information. Consent may be express or implied, and may be given directly by the individual or by their authorized representative.

We favour express consent (verbal, written, or electronic). However, implied consent may be reasonably inferred from a person's actions: for example, completing our contact form with a name, email address, and phone number in order to request a diagnostic call constitutes implied consent to using that information to respond to you.

To determine the appropriate type of consent, we consider the sensitivity of the information, the purposes of collection, and the reasonable expectations of a person in a similar situation. If we wish to use information for a new purpose, we will describe the intended use and seek your consent again. You may withdraw your consent at any time (see "Your Rights").

05

Information We Collect

Sémaz collects information only by lawful means and only for the purposes disclosed in this policy, or as permitted or required by law. The nature of the information collected varies depending on how you interact with us:

• Name and contact details. First and last name, company, job title, professional email address, and phone number, used to communicate with you and follow up on your request.
• Information about your organization. Approximate size and industry sector of your company, provided to help us better qualify and prepare for our discussion.
• Content of your requests. Information you voluntarily share with us — for example, when you describe your main challenge in a free-text field, by email, or by phone.
• Browsing data. When you visit our website, certain technical data may be collected through cookies (see "Cookies & Similar Technologies"): IP address, browser type and version, pages viewed, and the date, time, and duration of your visit.

06

Why We Collect Your Information

We collect and use your information for the following purposes:

• To respond to your requests and provide our consulting services. Following up on a contact request or diagnostic call, preparing and carrying out our mandates, and managing the client relationship within our contractual obligations.
• To improve our website and services. Understanding how our site is used in order to improve its functionality and relevance.
• To communicate with you. Sending you, with your consent, resources, invitations, or a newsletter. Every commercial electronic communication includes an unsubscribe mechanism, in compliance with CASL.
• To gather your feedback. Inviting you to complete a survey, particularly following a training session or mandate, in order to evaluate and improve the quality of our services.
• To meet our legal obligations. Complying with applicable laws, regulations, and requirements.

07

Disclosure to Third Parties

We do not share your personal information with companies, organizations, or individuals outside of Sémaz, except with trusted service providers and partners who act on our behalf and need it for the purposes described in this policy, or in the following cases:

• With your consent.
• To operate our tools and host our data. We work with service providers who process information on our behalf, in accordance with our instructions and with a level of protection at least equivalent to our own. These providers include:
  • HubSpot — customer relationship management (CRM) platform, hosting our contact forms, managing our communications and newsletters. Information you submit through our website's form is stored in HubSpot.
• For cloud storage. Some of these providers store information on servers located outside of Québec or Canada (including in the United States in the case of HubSpot). Before transferring personal information outside of Québec, Sémaz conducts the assessment required by law to ensure that adequate protection is in place.
• For legal reasons. When disclosure is necessary to comply with applicable laws and regulations, or to assert our legal rights.

08

Information Security

Sémaz places great importance on the security of your personal information and is committed to handling it in accordance with recognized industry norms and standards, solely for the purposes for which it was collected. Information is kept in a controlled and secure environment, protected against unauthorized access, use, or disclosure.

In the event of a privacy incident that poses a risk of serious harm, Sémaz will take the required steps to mitigate the consequences, notify the affected individuals and the Commission d'accès à l'information when required by law, and record the incident in a register maintained for that purpose.

09

Cookies & Similar Technologies

Sémaz may use cookies, pixels, and log files to collect certain information about visitors to its website, including through HubSpot and its analytics tools. Cookies are small pieces of information sent to your browser when you visit the site. They may include your IP address, browser type and version, pages viewed, and the date, time, and duration of your visit.

Some cookies are necessary for the site to function properly; others are used to measure audience reach or support our communications activities. You can configure your browser to be notified of cookies and choose whether to accept them.

Our site may contain links to third-party websites. This policy ceases to apply once you leave our site, and Sémaz is not responsible for how those third parties handle your information.

10

Retention of Information

Sémaz retains your personal information only for as long as necessary for the purposes for which it was collected, and for the duration required by its legal and contractual obligations. Once the retention period has expired, the information is securely destroyed or anonymized. Only reports or statistics containing anonymized data may be retained beyond that period.

11

Your Rights

Under applicable law, you may, upon request:

• Access the personal information we hold about you;
• request its correction if it is inaccurate, incomplete, or ambiguous;
• withdraw your consent or request to stop receiving our communications;
• request the portability of certain computerized information you have provided to us.

To exercise these rights, please contact our privacy officer (see below). If a request concerns information displayed on third-party platforms, please contact those third parties directly.

12

Contact Us or File a Complaint

For any questions regarding this policy or the use of your personal information, or to exercise your rights, please contact our privacy officer:

13

Changes to This Policy

We may update this policy from time to time. Any reduction of your rights will not be applied without your explicit consent. We always indicate the date of the last update and, if the changes are significant, we publish a prominent notice on our website.