Keolis Canada ("Keolis") collects, uses and discloses certain personal information in accordance with applicable privacy legislation, including applicable federal and provincial (including Quebec) privacy and data protection legislation (the "Act").

The purpose of this Keolis Privacy Policy is to govern the collection, use and disclosure of personal information in accordance with the requirements of the Act, whether such information is collected through our Web site or otherwise. The protection of your personal information is very important to us and remains a priority in all spheres of our activities.

1. Keolis collects the following data:

• Identifiers, contact details and similar information: Information including your first and last name, e-mail address, postal address, date of birth, online or similar identifier, gender, telephone number and language of communication.
  

• Correspondence and communications: Records of information provided by you or calls when you communicate with us directly.

• Professional or employment-related information: When you apply for a job via our Careers page or via another platform, we collect your personal information in order to process your application.

• Cookies: We use "cookies" to personalize our site or application for returning visitors. These cookies remain on your computer and are retrieved automatically during your subsequent visits to our site or application. These cookies contain only information about the type of customer and the pages frequently visited. No other information is stored in cookies. You can disable cookies on your computer. Disabling cookies may affect the functionality of our site for the user, and visitors who have disabled cookie handling will not be able to use our personalized account management feature.

• Web access logs: We also maintain standard web access logs, which record data on all visitors to transactional pages. These logs may contain: i) the Internet domain from which you access our site or application ii) your IP address (when you browse the Internet, your computer is automatically assigned an IP address, which is either static or dynamic; a static IP address may allow you to be identified, whereas a dynamic address generally does not); iii) the type of browser and operating system you use; iv) the date and time of your visit to the site; v) the pages you consulted on our site or application; and vi) the address of the websites from which you connected.

2. We use your personal data for the following purposes:

• Business relations: managing and administering our relationship with you so that we can personalize our services we offer you, strengthen our relationship and target our marketing and promotional campaigns.
  

• Communication: to send you e-mails, newsletters and other messages to keep you informed about our services and promotions.

• Professional or employment-related information: Responding to and interacting with you when you apply for a job via our Careers page or via another platform, collecting and managing your personal information to process your application and Curriculum Vitae.

• Website monitoring: to check that the website and our other technological services are being used appropriately and to optimize their operation.

• Online security: protecting our IT resources and technology platforms from unauthorized access or use, and guarding against malware and other security threats

• Regulatory: fulfilling our obligations under applicable laws and regulations, including our audit, verification and reporting obligations.

• Supplier management: managing our service providers.

3. Purposes for which we use your personal data:

We process your personal data for a number of reasons, including the following:

• when you have given us your consent (for example, when you have shared information for certain purposes);
  

• where the processing of personal data is permitted by applicable privacy laws;

• when we must do so to meet our obligations under applicable laws and regulations.

4. With whom do we share your data?

We share your data with the following third parties:

• our suppliers, including information and communication technology providers, outsourced business support service providers, marketing and advertising agencies. Our suppliers must adhere to equivalent standards of information security, and obtain only the data they need to perform their functions;

• law enforcement, regulatory or other competent authorities, in accordance with the requirements of applicable laws or best practices;

• third parties, in connection with the acquisition or transfer of part of our business or a restructuring thereof.

5. Security

We protect your information with physical, technical and administrative security measures. However, the transmission of information over the Internet is not entirely secure. While we take reasonable steps to protect your personal information, we cannot guarantee the security of any information you transmit to us, and you transmit such information at your own risk.

6. Data hosting

All personal information will be kept confidential in accordance with applicable federal and provincial (including Quebec) privacy and data protection legislation. Keolis takes reasonable administrative, technical and physical measures to protect your information from loss, theft and unauthorized access, use, alteration or destruction.

7. Transfer of your personal information

In order to operate our business, we may transfer your personal information outside of Quebec. This information may be subject to the laws of the countries to which it is transferred. When we transfer your data outside Quebec, we take the necessary measures to protect it.

8. Data retention

We retain data for the purposes for which it was collected and to which you have consented. The data is then destroyed in accordance with the law or following a retention period provided for in another legislation.

9. Revision and updating of the Policy

Keolis may update or modify this Policy from time to time. In the event of a change to the terms of this Policy, the documents containing the Privacy Policy will be updated.

10. Right

• Access: You have the right to access the personal data we hold about you.

• Correction: You have the right to request that the personal data we hold about you be corrected if it is incomplete or inaccurate.

• Withdrawal: You have the right to request that your personal data processed by us be withdrawn.

11. Contact us

For more information about how Keolis uses your personal information or about exercising your rights with respect to your personal information, please contact our Keolis Privacy Officer, Louise Ouellet, Director, Legal Affairs, by mail at 2450, boul. des Entreprises, Terrebonne, Québec, J6X 4J8 or by e-mail at confidentialité@keolis.ca.