This policy explains how NeXafe Solutions Corp. (“NeXafe”, “we”) collects, uses, discloses and protects personal information, and how to exercise your rights. It complies with Québec’s Act respecting the protection of personal information in the private sector, the applicable federal law (PIPEDA) and Alberta’s Personal Information Protection Act.

1. Who This Policy Applies To

It covers information about people who:

• visit our website or contact us;
• represent a customer, prospect or supplier business;
• use the NeXafe platform (web or mobile) through an account created by their employer or a customer.

Information about our own employees is governed by a separate internal policy.

2. Our Two Roles

As the person in charge. NeXafe decides why and how it processes information about its visitors, business contacts and account holders (identification, login, billing, support). This policy fully applies to that information.

As a service provider. Our customers use the platform to manage occupational health and safety: site access registers, training, inspections, incident reports, program documents. The information our customers enter about their workers and visitors, including health information related to an incident, is the responsibility of the customer business. NeXafe processes it only to provide the service, according to the customer’s instructions and agreements with us. This processing is governed by our Terms of Service and Data Processing Agreement, published at nexafe.com. To exercise your rights over that information, contact your employer or the business that registered you first; we will help it respond.

3. Privacy Officer

Our person in charge of the protection of personal information oversees this policy and answers your questions, requests and complaints.

• Title: Director, Administration and Operations
• Email: support@nexafe.com
• Phone: 1 888 295-2808

4. Information Collected and Purposes

We collect only what is necessary for the purposes stated.

Emails. Users receive service emails needed to operate the platform. We send promotional emails only to people who have consented, in accordance with Canada’s Anti-Spam Legislation; every message includes an unsubscribe link.

Automated decisions. We make no decision based exclusively on automated processing of your information.

5. Consent

We obtain your consent before using your information, except where the law provides otherwise. Consent is express for sensitive information. If we want to use your information for a new purpose, we ask you first. You may withdraw consent at any time, subject to legal or contractual obligations; we will then explain the consequences, such as the inability to maintain an account. Our service is intended for businesses and is not directed at people under 14.

6. Cookies and Similar Technologies

Our website and platform use cookies:

• essential cookies, for login and security, always active;
• audience measurement.

Any feature that can locate you or build a profile of you is off by default.

7. Disclosure to Third Parties

We do not sell your information and do not use it to train general-purpose artificial intelligence models. We disclose it only:

• to our service providers, to the extent necessary for their mandate (section 8);
• to the customer business for which you use the platform;
• where the law requires or permits it, including to comply with a court order or a binding request from an authority, collect a debt or prevent imminent danger to a person;
• to a prospective acquirer, in a business transaction, under the conditions set by law.

8. Service Providers and Communication Outside Québec

Our service providers are contractually bound to confidentiality, security, use limited to their mandate, reporting of any incident and destruction of information when the contract ends. Some are located outside Québec. Before any communication outside Québec, we assess whether the information will receive adequate protection there. Information located in another country may be accessible to that country’s authorities under its laws.

9. Retention

We keep information only as long as necessary for the purposes stated or as required by law, then destroy or anonymize it securely.

10. Security

We protect information with measures suited to its sensitivity: encrypted communications, access control and logging, access limited to those who need it, written confidentiality undertakings, backups and staff training.

11. Confidentiality Incidents

If there is unauthorized access, use, disclosure or loss, we quickly take steps to reduce the risk and keep a register of incidents. If the incident presents a risk of serious injury, we notify the Commission d’accès à l’information, other competent authorities and the individuals concerned. When an incident affects a customer’s data, we notify that customer without delay.

12. Your Rights

Subject to exceptions provided by law, you may:

• access your information and learn how it is used and to whom it is disclosed;
• have it corrected if it is inaccurate, incomplete or equivocal;
• withdraw your consent;
• obtain your computerized information in a structured, commonly used technological format (portability);
• request that dissemination of information cease or that it be de-indexed, under the conditions set by law.

How. Write to the privacy officer (section 3). We will verify your identity and respond in writing within 30 days of receiving your request. The service is free; reasonable fees may apply to a complex request, after informing you. Any refusal is explained and indicates your recourses.

For information entered by your employer in the platform, see section 2.

13. Complaints

You may file a complaint with our privacy officer. We investigate and respond in writing within 30 days. If you are not satisfied with the response, you may contact:

• the Office of the Privacy Commissioner of Canada;
• the Office of the Information and Privacy Commissioner of Alberta;
• the Commission d’accès à l’information du Québec.

14. Changes

We may change this policy. The current version and its date are published on our website. We notify customers and users of any significant change before it takes effect.