COMPLIANCE WITH QUEBEC BILL 25

This Privacy Policy complies with Quebec's Act to modernize legislative provisions as regards the protection of personal information (Bill 25). Everia is committed to protecting your personal information in accordance with the requirements of this law.

Privacy Officer

Name: Everia Data Protection Team
Email: info@everia.ca
Phone: (514) 661-2543
Mailing Address: 333 R. Saint-Denis, 5e Avenue, Laval (Quebec) H7N 4M9, Canada

IMPORTANT NOTICE ABOUT TEXT MESSAGING DATA

Everia ("we," "us," or "our") does NOT share customer subscription information, including phone numbers and consent records, with affiliates or third parties for marketing, promotional, or any other purpose unrelated to the provision of our direct services. All text message subscription data is kept strictly confidential.

1. Information We Collect

illons

We collect the following types of information:

Personal Information:

• Name, email address, phone number, physical address
• Payment information when making a purchase or requesting a quote
• Subscription logs and timestamps for all communication channels (SMS, email, etc.)

Non-Personal Information:

• IP address, browser type, device information
• Website usage patterns and analytics
• Cookies and similar technologies

Customer Communications:

• Records of enquiries and services
• Appointment details and preferences
• Service History and Reviews

2. Purposes and legal bases for using your information

We use your personal information only for the following purposes, in accordance with Law 25. For each purpose, we indicate the legal basis that justifies the processing:

• Service delivery: Providing requested artificial intelligence services (chatbots, automation)
  Legal basis: Performance of the contract
• Contractual communication: Responding to your requests, confirming appointments, providing support
  Legal basis: Performance of the contract and legitimate interest
• Payment processing: Processing your financial transactions securely
  Legal basis: Performance of the contract and legal obligation
• Improving services: Analyzing usage to improve our offerings
  Legal basis: Consent (you can withdraw your consent at any time)
• Legal obligations: Comply with applicable tax and regulatory laws
  Legal basis: Legal obligation
• Security: Preventing fraud and protecting our systems
  Legal basis: Legitimate interest and legal obligation
• Marketing and promotional communications: Sending you offers, promotions, newsletters and marketing content by email or SMS
  Legal basis: Explicit and separate consent (separate checkbox during registration). You can withdraw your consent at any time by clicking "Unsubscribe" in our emails or by replying "STOP" via SMS. Withdrawing your consent does not affect the services you have subscribed to.

Important: Distinction between essential communications and marketing

Service-critical communications: Appointment confirmations, account updates, invoices, technical support. These messages are necessary for the service and do not require separate marketing consent.

Marketing Communications: Promotions, special offers, news, newsletters. These messages require your explicit and separate consent, which you can withdraw at any time without impacting your services.

How long we keep information

In accordance with Bill 25, we keep your personal information only as long as necessary for the purposes for which it was collected:

• Active customer data: For the entire duration of the contractual relationship + 1 year
• Billing data: 7 years (tax requirements)
• SMS/Email Consents: Up to revocation + 3 years for proof of compliance
• Anonymized analytics: Retained indefinitely (non-identifiable)
• Non-customer prospects: 2 years after last contact, then deletion

After these periods, your information is securely deleted or anonymized.

3. SMS messaging and compliance

Text Messaging Program Terms

By subscribing to our SMS messaging services, you agree to receive text messages related to our services, including appointment reminders, customer support, and important updates.

Subscription and consent:

• You will only receive messages if you have explicitly subscribed
• We keep time-stamped records of all subscription actions
• We comply with Canada's Anti-Spam Legislation (CASL) and all applicable laws

Unsubscribe Instructions:

• You can cancel SMS notifications at any time by replying "STOP"
• You will receive a final confirmation message and no further messages will be sent unless you re-subscribe
• All unsubscribe requests are processed within 24 hours

Frequency and content of messages:

• The frequency of messages varies depending on your interactions with our company
• Messages will be directly related to the services you have requested
• We do not send promotional content without specific consent

Help and Support:

• Answer "HELP" for assistance or contact us at info@everia.ca
• Customer support is available during business hours

Operator Information:

• Standard messaging and data rates may apply
• Carriers are not responsible for delayed or undelivered messages
• Supported carriers include Rogers, Bell, Telus, Videotron, and most regional carriers

SMS data protection declaration

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Sharing information with subcontractors for support services, such as customer service, is permitted. All other categories of use exclude text messaging subscription and consent data; This information will not be shared with any third party.

We implement strict data protection measures to protect your SMS subscription information and consent records.

4. Sharing and Disclosure of Your Information

We never sell, rent or transfer your personal information for commercial purposes. We may share your information only with:

Service Providers and Subcontractors:

In accordance with Law 25, we use subcontractors to help us with our operations. All our processors are contractually obliged to protect your data and to use it only for the permitted purposes:

• Go High Level (GHL): Customer relationship management (CRM) platform, marketing automation, SMS and email sending, appointment management. Hosting: United States (SOC 2 Type II certification).
• Google Workspace / Google Cloud: Email hosting, document storage, web analytics (Google Analytics). Hosting: United States and Canada (ISO 27001 certification).
• Payment processors: To process financial transactions in a secure manner (PCI-DSS certification).
• SMS/telephony providers: Only for the delivery of messages to which you have consented.
• Web Hosting Services: To ensure the availability of our website.

Safeguards: All of these providers are bound by data processing agreements that comply with Law 25, ensuring the confidentiality, security, and limited use of your information.

Legal Compliance:

• If required by law, legal process or to protect our rights
• In response to valid law enforcement requests or court orders

Business transfers:

• In the event of mergers, acquisitions or asset sales
• In such cases, your data remains protected under the terms of this policy

All of the above categories exclude text messaging subscription and consent data; This information will not be shared with any third parties, with the exception of aggregators and text messaging service providers.

5. Data Security

We implement and maintain reasonable security measures to protect your personal information:

• Encrypt sensitive data in transit and at rest
• Secure access controls and authentication mechanisms
• Regular security assessments and updates
• Employee training on data protection
• Breach notification protocols that comply with applicable laws
• Secure backup systems and disaster recovery procedures

Despite these measures, no method of transmission over the Internet or electronic storage is 100% secure. We strive to use commercially acceptable means to protect your personal information, but cannot guarantee absolute security.

6. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Analyze site traffic and user behavior
• Remembering your preferences
• Improve website functionality and user experience
• Measuring the effectiveness of our services

You can control cookies through your browser settings. Disabling cookies may limit your ability to use certain features of our website.

7. Your rights under Quebec's Bill 25

In accordance with Bill 25, you have the following rights regarding your personal information:

Right of access:

• Obtain confirmation that we hold information about you
• Receive a copy of your personal information
• To know the purposes of use and the categories of people who have access to them

Right to rectification:

• Correcting inaccurate or incomplete information
• Update your contact information

Right to portability:

• Receive your information in a structured, commonly used and machine-readable format
• Transfer this data to another controller (where technically feasible)

Right to withdraw consent:

• Withdraw your consent at any time for email marketing ("unsubscribe" link)
• Withdraw your consent for SMS by answering "STOP"
• Withdraw your consent for analytics and service improvement
• Withdrawal does not affect the lawfulness of processing based on consent prior to withdrawal
• Withdrawing marketing consent does not affect your contracted services

Right to object:

• Object to processing of your information based on our legitimate interest
• Object to processing for direct marketing purposes (including profiling)
• In the event of an objection, we will cease the processing, unless we demonstrate compelling legitimate grounds
• To exercise this right: info@everia.ca

Right to de-indexation:

• Request an end to the dissemination of your personal information
• Applicable in certain specific circumstances

Right to erasure (right to be forgotten):

• Request deletion of your information when it is no longer needed
• Subject to our legal retention obligations (e.g. tax invoices)

Right to lodge a complaint:

• File a complaint with the Commission d'accès à l'information du Québec (CAI)
• Website: www.cai.gouv.qc.ca
• Toll free: 1-888-528-7741

Response time: We will respond to your requests within 30 days of receipt. If additional time is required, we will inform you with the reasons.

To exercise your rights: Contact our Privacy Officer at info@everia.ca or use the contact information in Section 12.

8. Transfers of Information Outside Quebec

In accordance with Bill 25, we inform you that some of your personal information may be transferred, hosted or processed outside of Quebec:

Hosting Services:

• Our servers may be located in Canada or the United States
• Our hosting providers are contractually obligated to protect your data

Payment Processing:

• Payment processors can process transactions outside of Quebec
• They are PCI-DSS certified for payment data security

SMS/Email Services:

• Our email providers may have servers outside of Quebec
• All data is encrypted in transit

Protection: All of our foreign suppliers are contractually required to provide a level of protection equivalent to that required by Bill 25. In the event of an access request by a foreign authority, we will notify you to the extent permitted by law.

9. Confidentiality Incidents

In accordance with Bill 25, in the event of a confidentiality incident that poses a risk of serious harm:

• Notification to the CAI: We will notify the Commission d'accès à l'information du Québec without delay
• Notification to data subjects: We will notify you directly if your information is compromised
• Content of Notice: Nature of the incident, information involved, actions taken, measures to mitigate risks
• Record: We keep a record of all confidentiality incidents

10. Links to Third-Party Sites

Our website may contain links to third-party sites. We are not responsible for their privacy practices. We encourage you to review their policies. This policy applies only to information collected by Everia.

11. Changes to this Policy

We may change this policy periodically to reflect changes in our practices or legal requirements. The most recent version will always be available on our website with the effective date.

Important Changes: For any material changes affecting your rights, we will notify you by email or by a notice on our website at least 30 days prior to the effective date, in accordance with Bill 25.

12. Contact Us

For any questions about this Privacy Policy, the exercise of your rights or the processing of your personal information:

Privacy Officer:
Email: info@everia.ca
Phone: (514) 661-2543

Everia
General Email: info@everia.ca
Phone: (514) 661-2543
Address: 333 R. Saint-Denis, 5e Avenue, Laval (Québec) H7N 4M9, Canada
Secondary Office: 2035 Mélisande Street, Laval, Quebec H7A 3T1

Commission d'accès à l'information du Québec (for complaints):
Website: www.cai.gouv.qc.ca
Phone: 1-888-528-7741
Address: 525 René-Lévesque Boulevard East, Suite 1.200, Quebec City, Quebec G1R 5S9

By using our website and services, you acknowledge that you have read and understood this Privacy Policy in accordance with Quebec's Bill 25.