Privacy Policy

1. PREAMBLE
Soplex Insurance Solutions Inc. recognizes the importance of protecting privacy and is committed to safeguarding the personal information it collects and processes in the course of its activities.

2. OBJECTIVES
The Personal Information Protection Policy (hereinafter the “Policy”) aims to set out the principles applied by Soplex Insurance Solutions Inc. that govern the personal information protection (hereinafter “PIP”) practices concerning the Data Subjects. The Policy describes the standards and practices applied by Soplex Insurance Solutions Inc. with respect to:

• Protecting the personal information collected by Soplex Insurance Solutions Inc. throughout its life cycle, from collection, use, disclosure, and retention to its destruction or anonymization, in accordance with applicable laws;

• Ensuring compliance with applicable legal requirements, including the Act respecting the protection of personal information in the private sector (Quebec), the Personal Information Protection Act (Alberta), the Personal Information Protection Act (British Columbia), and the Personal Information Protection and Electronic Documents Act (Canada), and recognized PIP practices;

• Ensuring stakeholder trust and demonstrating transparency in how personal information is handled and what PIP measures are implemented by Soplex Insurance Solutions Inc.

3. SCOPE
The Policy applies to any identified or identifiable person whose personal information is collected by Soplex Insurance Solutions Inc. as part of its operations.

4. DEFINITION
Personal Information (PI) means any information about an individual that allows them to be identified directly or indirectly.

5. PERSONAL INFORMATION PROTECTION REQUIREMENTS
This Policy reflects Soplex Insurance Solutions Inc.’s ongoing commitment to comply with the PIP expectations of the following individuals:

a) Clients of Soplex Insurance Solutions Inc. who are natural persons (excluding businesses);
b) Staff members of clients whose PI is shared with Soplex Insurance Solutions Inc. during service delivery;
c) Representatives of service providers who must share PI to establish a business relationship, excluding business contact details;
d) Current or former employees and other staff members of Soplex Insurance Solutions Inc. and job applicants;
e) Visitors to the websites of Soplex Insurance Solutions Inc.;
f) Any other individual whose PI is collected or processed in the course of Soplex’s activities.

(Collectively referred to as “Data Subjects“)

5.1 Guiding Principles
Soplex Insurance Solutions Inc.’s PIP practices are defined and applied in accordance with the following guiding principles, in compliance with applicable laws:

• 5.1.1 Accountability:
  Soplex Insurance Solutions Inc. is responsible for the PI it holds, including information entrusted to third parties. A Privacy Officer, whose contact details appear in section 7, has been appointed and ensures that the Policy is enforced and that Soplex Insurance Solutions Inc. complies with applicable laws and regulations.
• 5.1.2 Purpose of Collection:
  Soplex Insurance Solutions Inc. determines the reasons for collecting, using, disclosing, and retaining PI before doing so and only collects what is necessary for those predefined purposes. The intended uses will be specified at the time of collection. As of the adoption date of the Policy, the purposes include, but are not limited to:
  •Assessing, qualifying, and underwriting risks;
  • Evaluating client needs and offering appropriate products and services;
  • Managing client files;
  • Establishing and maintaining client communications;
  • Confirming identity and verifying the accuracy of PI submitted in applications and updating it;
  • Detecting and preventing fraud or illegal activity;
  • Managing risk, security, and regulatory compliance;
  • Managing relationships with job applicants and employees.
• 5.1.3 Collection:
  Soplex Insurance Solutions Inc. limits PI collection to what is necessary. It collects PI directly from the Data Subject unless consent is obtained to collect from third parties or where otherwise authorized by law. PI may also be received from partners.
• 5.1.4 Limiting Use, Disclosure, and Retention
  • 5.1.4.1 Limitation:
    Use of PI is restricted to the purposes for which it was collected and for which the Data Subject has consented, except where exceptions are permitted by law or new consent is obtained. Access to PI is limited to personnel who require it for their duties, and PIP training is provided. Staff are bound by confidentiality agreements.
  • 5.1.4.2 Disclosure:
    Soplex Insurance Solutions Inc. may disclose PI to business partners, suppliers, or other third parties in its operations. It may also disclose PI to courts, regulators, public officials, prosecutors, or law enforcement. PI will only be disclosed for identified purposes with consent, unless exceptions apply.
  • 5.1.4.3 Retention:
    Soplex Insurance Solutions Inc. uses secure systems and IT service providers to ensure the confidentiality of retained PI. Data is kept for the necessary period and in accordance with legal retention requirements. PI is usually stored in Quebec but may be transferred outside the province if required, following a privacy impact assessment and contractual safeguards.
  • 5.1.5 Security Measures:
    Soplex Insurance Solutions Inc. applies security measures appropriate to the sensitivity of the PI to prevent breaches of confidentiality and integrity, in accordance with its information security frameworks.
  • 5.1.6 Transparency:
    Soplex Insurance Solutions Inc. documents its PI management practices in clear and accessible language and publishes them on its websites. It provides required information when PI is collected via technologies that allow identification, geolocation, or profiling.
  • 5.1.7 Rights of Data Subjects:
    Soplex Insurance Solutions Inc. has procedures to handle rights requests from Data Subjects, including access, correction, and withdrawal of consent. Requests must be sent to the Privacy Officer (see section 7) and will be handled per legal requirements.a) Access: Data Subjects may request a copy or consult their PI. However, access is not granted if doing so would reveal PI about another person or violate laws. Access is free, but in some cases (e.g., excessive or unfounded requests), administration fees may be charged. Any such fees will be communicated beforehand.
    b) Accuracy: Soplex Insurance Solutions Inc. aims to keep PI accurate and up to date, validating it with Data Subjects. They are invited to contact the Privacy Officer for corrections.
    c) Withdrawal of Consent: In some cases, Data Subjects may oppose processing and request that access be blocked, deleted, or restricted. If the purpose is essential to service provision, withdrawal will terminate the relationship with Soplex Insurance Solutions Inc.
    d) Portability*: Upon request, Data Subjects may obtain a copy of their collected PI. If computerized, the data may be provided in a readable written transcript.

*This provision takes effect as of September 2024.

• • e) Complaints: If a Data Subject believes their PIP rights have been violated, they may file a complaint with the Privacy Officer, the appropriate authority, or the courts. Requests will be answered within 30 days. If more time is needed, Soplex Insurance Solutions Inc. will notify the Data Subject in writing.

6. PRIVACY OFFICER
Soplex Insurance Solutions Inc. has appointed a Privacy Officer to ensure compliance with privacy laws. For any questions regarding the collection, use, disclosure, or retention of PI, you may contact:

Privacy Officer
Civic Address: 2828 Laurier Blvd, Suite 1300, Québec (Quebec) G1V 0B9
Tel: 1-866-321-2233
Email: confidentialite@synexcorp.ca

7. POLICY ADOPTION AND AMENDMENT
This Policy was adopted by the Executive Board of Soplex Insurance Solutions Inc. and is effective as of its adoption date. It supersedes all previous versions. The version history is available upon request. The applicable version of the Policy at the time of processing will govern the collection, use, disclosure, and handling of PI. The Privacy Officer is responsible for reviewing the Policy, which may be amended at Soplex Insurance Solutions Inc.’s discretion to reflect changes in legal requirements or practices. It will be reviewed at least every three years.