1. Context

Headfirst Média Inc. is a provincial corporation that processes personal information in the course of its activities. This policy aims to ensure the protection of personal information and to govern the way in which Headfirst Média Inc. collects, uses, communicates, stores and destroys it or how it otherwise manages it.

In addition, it aims to inform any interested person about the way in which Headfirst Média Inc. processes their personal information. It also covers the processing of personal information collected by Headfirst Média Inc. by technological means.

2. Application and definitions

This policy applies to Headfirst Média Inc., which includes in particular its directors, employees, consultants, volunteers, as well as to any person who otherwise provides services on behalf of Headfirst Média Inc. It also applies with regard to the Headfirst Média Inc. website, as well as all websites controlled and maintained by Headfirst Média Inc.

It covers all types of personal information managed by Entête Média Inc., whether it is the information of its clients, potential or current, its consultants, its employees, its members or any other persons (such as visitors to its websites or other).

For the purposes of this document, personal information is information which concerns a natural person and which allows, directly or indirectly, to identify them. For example, this could be a person's name, address, email address, telephone number, gender or banking information, health information, ethnic origin, language , etc.

Sensitive personal information is information for which there is a high degree of reasonable expectation of privacy, e.g. ex. health information, banking information, biometric information, sexual orientation, ethnic origin, political opinions, religious or philosophical beliefs, etc.

Generally speaking, an individual's professional or business contact information does not constitute personal information, for example an individual's name, title, address, email address or work telephone number. More particularly and for the sake of precision, within the meaning of the Act respecting the protection of personal information in the private sector of Quebec, and as of September 22, 2023, sections 3 (collection, use, communication), 4 (conservation and destruction ) and 6 (data security) do not apply to information about a person relating to the exercise of a function in a company, such as their name, title, function, as well as address, l 'address email and telephone number of their place of work.

These same paragraphs also do not apply to personal information that has a public nature under the law, as soon as this policy comes into force.

3. Collection, use and communication

As part of its activities, Headfirst Média Inc. may collect different types of information, for different purposes. The types of information that Headfirst Média Inc. may collect, their use (or the intended objective) as well as the means by which the information is collected are indicated in Appendix A of this policy.

Headfirst Média Inc. will also inform the persons concerned, at the time of collecting personal information, of any other information collected, the purposes for which it is collected and the means of collection, in addition to other information to be provided as required by the law. Headfirst Média Inc. applies the following general principles regarding the collection, use and communication of personal information:

Consent :

• Generally speaking, Headfirst Média Inc. collects personal information directly from the person concerned and with their consent, unless an exception is provided for by law. Consent may be obtained implicitly in certain situations, for example, when the individual decides to provide their personal information after having been informed by this policy on the use and communication for the purposes indicated therein (see Appendix A for more details). Thus, this policy and the information it contains may be consulted by the person concerned at the time of collection of personal information.

• Normally, Headfirst Média Inc. Inc. must also obtain the consent of the person concerned before collecting their personal information from third parties, before communicating it to third parties or for any secondary use thereof. However, Headfirst Média Inc. may act without consent in certain cases provided for by law and under the conditions provided for therein. The main situations where Headfirst Média Inc. may act without consent are indicated in the relevant sections of this policy.

Collect :

• In all cases, Headfirst Média Inc. only collects information if it has a valid reason to do so. In addition, the collection will only be limited to the necessary information needed to fulfill the intended objective.

• Please note that Headfirst Média Inc.'s services and programs are not aimed at minors, and more generally, Headfirst Média Inc. does not intentionally obtain personal information concerning minors (in these cases, the information cannot be collected from him without the consent of a parent or guardian).

• Collection from third parties. Headfirst Inc. may collect personal information from third parties. Unless there is an exception provided for by law, Headfirst Média Inc. will request the consent of the person concerned before collecting personal information concerning them from a third party. In the event that such information is not collected directly from the person, but from another organization, the person concerned may request the source of the information collected from Headfirst Média Inc.

In certain situations, Headfirst Média Inc. may also collect personal information from third parties, without the consent of the person concerned, if he or she has a serious and legitimate interest in doing so and a) if the collection is in the interest of the person concerned. person and it is not possible to do so with them in a timely manner, or b) if this collection is necessary to ensure that the information is accurate. Also, Headfirst Média Inc. Inc. may collect personal information indirectly, notably by using platforms such as:

• Facebook, Instagram, LinkedIn and YouTube which have their own conditions and privacy policies, which can be consulted for more information.

This collection by third parties may be necessary to use certain services or programs, or to otherwise do business with Headfirst Média Inc. When required, Headfirst Média Inc. will obtain the consent of the person at the appropriate time.

Possession and use :

• Headfirst Média Inc. ensures that the information it holds is up to date and accurate at the time of its use to make a decision relating to the person concerned.

• Headfirst Média Inc. may only use an individual’s personal information for the reasons indicated herein or for any other reasons provided during collection. As soon as Headfirst Média Inc. wants to use this information for another reason or another purpose, new consent must be obtained from the person concerned, which must be obtained expressly if it involves sensitive personal information. However, in certain cases provided for by law, Headfirst Média Inc. may use the information for secondary purposes without the consent of the person, e.g. ex. :

o when this use is clearly for the benefit of that person;

o when necessary to prevent or detect fraud;

o when necessary to evaluate or improve protection and security measures.

• Limited access. Headfirst Média Inc. must put in place measures to limit access to personal information only to employees and persons within its organization who have the authority to read it and for whom this information is necessary in the exercise of their functions. Headfirst Média Inc. will request the consent of the person before granting access to any other person.

Communication :

• Generally, and unless an exception indicated in this policy or otherwise provided for by law, Headfirst Média Inc. will obtain the consent of the person concerned before communicating their personal information to a third party. In addition, when consent is necessary and when it concerns sensitive personal information, Headfirst Média Inc. must obtain the explicit consent of the person before communicating the information.

• However, the communication of personal information to third parties is sometimes necessary. Thus, personal information may be communicated to third parties without the consent of the person concerned in certain cases, in particular, but not exclusively, in the following cases:

o Headfirst Média Inc. may communicate personal information, without the consent of the person concerned, to a public body (such as the government) which, through one of its representatives, collects it in the exercise of its responsibilities or the implementation of a program which he manages.

o Personal information may be transmitted to its service providers to whom it is necessary to communicate the information, without the consent of the person. For example, these service providers may be event organizers, subcontractors of Headfirst Média Inc. designated for the execution of mandates in the programs administered by Headfirst Média Inc. and providers of cloud computing services. In these cases, Headfirst Média Inc. must have written contracts with these suppliers which indicates the measures they must take to ensure the confidentiality of the personal information communicated, that the use of this information is only made within the framework of the execution of the contract and that they cannot keep this information after its expiration. In addition, these contracts must provide that suppliers must notify the person responsible for the protection of personal information of Headfirst Média Inc. (indicated in this policy) of any violation or attempted violation of the confidentiality obligations concerning the personal information communicated and must allow this manager to carry out any verification relating to this confidentiality.

o If this is necessary for the purposes of concluding a commercial transaction, Headfirst Média Inc. could also communicate personal information, without the consent of the person concerned, to the other party of the transaction and subject to the conditions provided for by the law.

• Communication outside Quebec : It is possible that personal information held by Headfirst Média Inc. may be communicated outside Quebec, for example, when Headfirst Média Inc. uses cloud service providers whose server(s) are located outside Quebec or when Headfirst Média Inc. does business with subcontractors located outside the province.

Additional information on the technologies used:

• Use of cookies

Cookies are data files transmitted to a website visitor's computer by their Web browser when they visit that site and can have several uses.

The websites controlled by Headfirst Média Inc. use cookies in particular:

• To remember visitor settings and preferences, for example for the choice of language and to allow monitoring of the current session.

• For statistical purposes to know the behavior of visitors, the content consulted and to enable the improvement of the website.

The websites controlled by Headfirst Média Inc. use the following types of cookies:

• Session cookies: These are temporary cookies that are stored in memory for the duration of the website visit only.

• Persistent cookies: They are kept on the computer until they expire and they will be retrieved the next time you visit the site.

Certain connection cookies may be deactivated by default and visitors may choose to activate these functions or not, when consulting the Headfirst Média Inc websites. It is also possible to activate and deactivate the use of cookies by changing the preferences in the settings of the browser used.

• Other technological means used

Headfirst Média Inc. also collects personal information through technological means such as web forms integrated into a website controlled by Headfirst Média Inc. (for example, its contact form, its membership form to become a member, its form to register for the newsletter and seminars), questionnaires accessible online on its platforms and applications, as well as other platforms or form tools (e.g. Microsoft Forms).

If Headfirst Média Inc. collects personal information by offering a technological product or service that has confidentiality settings, Headfirst Média Inc. must ensure that these settings offer the highest level of confidentiality by default (cookies do not are not covered).

4- Retention and destruction of personal information

Unless a minimum retention period is required by applicable law or regulation, Headfirst Média Inc. will only retain personal information for the period necessary to achieve the purposes for which it was collected. Personal information used by Headfirst Média Inc. to make a decision relating to a person must be kept for a period of at least one year following the decision in question or even seven years after the end of the fiscal year in which the decision was made. been taken if it has tax implications, for example, the circumstances of an end of employment. At the end of the retention period or when the personal information is no longer necessary, Headfirst Média Inc. will ensure: 

1- to destroy them; Or

2- to anonymize them (i.e. they no longer irreversibly allow the person to be identified and it is no longer possible to establish a link between the person and the personal information) to use them for serious and legitimate purposes.

The destruction of information by Headfirst Média Inc. must be done in a secure manner, to ensure the protection of this information.

This section may be supplemented by any policy or procedure adopted by Entête Média Inc. concerning the retention and destruction of personal information, if applicable. Please contact the person responsible for the protection of personal information at Entête Média Inc. (indicated in this policy) to find out more.

5. Responsibilities of Headfirst Média Inc.

Generally speaking, Headfirst Média Inc. is responsible for the protection of the personal information it holds.

The person responsible for the protection of personal information at Headfirst Média Inc. is the Director of Technology. He or she must, generally speaking, ensure compliance with applicable legislation regarding the protection of personal information. The manager must approve the policies and practices governing the governance of personal information. More specifically, this person is responsible for implementing this policy and ensuring that it is known, understood and applied. In the event of the absence or inability to act of this manager, the president of Headfirst Média Inc. will assume the functions of the person responsible for the protection of personal information.

Headfirst Média Inc. staff members having access to personal information or being otherwise involved in its management must ensure its protection and respect this policy.

The roles and responsibilities of Headfirst Média Inc. employees throughout the life cycle of personal information may be specified by any other policy of Headfirst Média Inc. in this regard, where applicable.

6. Data security

Headfirst Média Inc. undertakes to implement reasonable security measures to ensure the protection of the personal information it manages. The security measures in place correspond, among other things, to the purpose, quantity, distribution, medium and sensitivity of the information. Thus, this means that information that can be qualified as sensitive (see the definition provided in section 2) will have to be subject to greater security measures and will have to be better protected. In particular, and in accordance with what has been mentioned previously concerning limited access to personal information, Headfirst Média Inc. must put in place the necessary measures to impose constraints on the rights of use of its information systems so as to that only employees who must have access to it are authorized to access it.

7. Rights of access, rectification and withdrawal of consent

To assert their rights of access, rectification or withdrawal of consent, the person concerned must submit a written request to this effect to the person responsible for the protection of personal information of Headfirst Média Inc., at the email address indicated at next section.

Subject to certain legal restrictions, data subjects may request access to their personal information held by Headfirst Média Inc. and request its correction in the event that it is inaccurate, incomplete or equivocal. They may also demand the cessation of the dissemination of personal information concerning them or that any hyperlink attached to their name allowing access to this information by technological means be deindexed, when the dissemination of this information contravenes the law or to a court order. They can do the same, or even require that the hyperlink allowing access to this information be reindexed, when certain conditions provided for by law are met.

The person responsible for the protection of personal information at Headfirst Média Inc. must respond in writing to these requests within 30 days of the date of receipt of the request. Any refusal must be justified and accompanied by the legal provision justifying the refusal. In these cases, the response must indicate the remedies under the law and the time limit for exercising them. The manager must help the applicant understand the refusal if necessary.

Subject to applicable legal and contractual restrictions, data subjects may withdraw their consent to the communication or use of the information collected.

They may also ask Headfirst Média Inc. what personal information is collected from it, the categories of people at Headfirst Média Inc. who have access to it and their retention period.

8. Complaint handling process

Reception

Any person who wishes to make a complaint relating to the application of this policy or, more generally, to the protection of their personal information by Headfirst Média Inc., must do so in writing by contacting the information protection manager. personnel of Headfirst Média Inc., at the email address indicated in the following section.

The individual must indicate their name, contact details, including a telephone number, as well as the subject and reasons for their complaint, giving sufficient detail so that it can be evaluated by Headfirst Média Inc. If the complaint made is not sufficiently precise, the person responsible for the protection of personal information may request any additional information that he considers necessary to be able to evaluate the complaint.

Treatment

Headfirst Média Inc. undertakes to treat any complaint received confidentially. Within 30 days following receipt of the complaint or following receipt of all additional information deemed necessary and required by the person responsible for the protection of personal information of Headfirst Média Inc. to be able to process it, the latter must evaluate it and formulate a reasoned written response by email to the complainant. This evaluation will aim to determine whether the processing of personal information by Headfirst Média Inc. complies with this policy, any other policy and practice in place within the organization and the applicable legislation or regulations.

In the event that the complaint cannot be processed within this period, the complainant must be informed of the reasons justifying the extension of the deadline, the progress of the processing of his complaint and the reasonable time necessary to be able to provide him with a definitive answer.

Headfirst Média Inc. must create a separate file for each complaint addressed to it. Each file contains the complaint, the analysis and documentation supporting its assessment, as well as the response sent to the person who made the complaint.

It is also possible to file a complaint with the Commission d'access à l'information du Québec or any other supervisory body regarding the protection of personal information responsible for the application of the law concerned by the subject of the complaint.

However, Headfirst Média Inc. invites any interested person to first contact their personal information protection manager and to wait for the end of the processing process by Entête Média Inc.

9. Approbation

This policy is approved by the person responsible for the protection of personal information at Headfirst Média Inc., whose business contact details are as follows:

Responsible for the protection of personal information :

Jacques-Yves Bleau

Email : [email protected]

For any requests, questions or comments regarding this policy, please contact the person in charge by email.

10. Publication et modifications

This policy is published on the Headfirst Média Inc. website, as well as on all websites controlled and maintained by Headfirst Média Inc., to which this policy applies, in relation to the personal information collected there. . This policy is also disseminated by any means likely to reach the people concerned.

Headfirst Média Inc. must also do the same for all modifications to this policy, which must also be the subject of a notice to inform the people concerned.

*Notes: Please note that the use of the masculine gender is intended to simplify this policy and make it easier to read.