TABLE OF CONTENTS:

• 1. Scope of this policy
• 2. Types of Personal Information collected
• 3. Use of collected personal information
• 4. Personal Information security protocols
• 5. Your rights

1. SCOPE OF THE POLICY

"Personal Information" means any information relating to an individual that allows them to be identified directly or indirectly. The policy applies to Personal Information that AquaAction holds or controls, including information collected during the use of the Website and that of contractors interacting with AquaAction.

The policy also applies to Personal Information collected by AquaAction concerning its employees, volunteers, or candidates for a volunteer or employee position.

2. TYPES OF PERSONAL INFORMATION COLLECTED

Personal Information collected automatically

When you visit aquaaction.org, we automatically collect information about your device and your interaction with our Website through Google Analytics. This includes the following Personal Information:

• IP Address
• Approximate location associated with the IP address
• Various hardware and software details
• Content viewed on our website
• Links clicked while navigating the website

Personal Information collected non-automatically

Personal Information of some Website users is also collected via the online participation form. This includes:

• First name
• Last name
• Email
• Any other Personal Information you voluntarily communicate to us

Personal Information on donors is collected, which includes, as applicable:

• First name
• Last name
• Personal address
• Email
• You will also be subject to the policy and terms of use of our Donorbox service provider for your online payment method.

Personal Information about contractors interacting with AquaAction is collected, via the "AquaEntrepreneur" application form or otherwise, which includes, as applicable:

• First name
• Last name
• Personal address
• Email
• Phone number
• Business project descriptions
• Entrepreneurs' CVs
• Other information required for application evaluation

Personal Information about our employees and volunteers is collected, and from people applying for either of these titles, which includes, as applicable:

• First name
• Last name
• Personal address
• Email
• Phone number
• Personal banking details (for employees only)
• CV submitted by applicants
• Other Personal Information required for the supervision of employees and volunteers

Personal Information about various partners of AquaAction may also be collected from time to time.
Generally, AquaAction will seek your consent at the time of collecting your Personal Information, unless it is required or otherwise authorized by law. Your consent is presumed when you voluntarily submit Personal Information through a form, online or otherwise.

3. USE OF COLLECTED PERSONAL INFORMATION

Please note that we only collect Personal Information that helps us achieve the purposes set out in this policy. We will not collect additional Personal Information without informing you in advance.

Purposes

We use the Personal Information collected by the Website to:

• Send targeted communications via our newsletter;
• Conduct statistical analyses to improve the website;
• As part of a security protocol for Personal Information;
• Respond to your communication requests.

Other purposes for which AquaAction collects your Personal Information are determined before or at the time of collection. AquaAction may use Personal Information about you to:

• Enable you to make a donation;
• Evaluate and, if appropriate, fund your business projects;
• Establish and maintain our relationship with you;
• Process your job application or volunteer position application;
• Prevent errors and fraud;
• Comply with legal requirements.

When you are an employee of AquaAction, it may use your Personal Information to:

• Supervise your work;
• Process your pay;
• Perform pre-employment checks;
• Verify your justification for absence;
• Meet regulatory requirements related to occupational health and safety or occupational diseases.

Communication to Third Parties

Occasionally, we will communicate Personal Information to contractors interacting with us to third parties, including lawyers and accountants who may advise these contractors. In all cases, we will obtain prior consent from the concerned contractor for this communication.

We also communicate Personal Information to third-party IT service providers, as required for them to provide such services to us.

4. SECURITY MEASURES

AquaAction has implemented a series of security measures to protect your Personal Information against loss or theft and against unauthorized access, disclosure, reproduction, use, and modification, taking into account their sensitivity and the purposes for which they are used.

AquaAction is also committed to taking the necessary measures to ensure that all its employees are informed about the content of this policy and trained in best practices in protecting Personal Information. Your Personal Information is stored in a secure and controlled environment.

We use up-to-date TLS protocols to encrypt information exchanges across the Website, as well as robust security measures with two-factor authentication to prevent unauthorized access.

We commit to not selling or sharing your Personal Information with third parties, except as required by law or in legal proceedings. We may disclose to any member of our organization the user's Personal Information that they reasonably need to achieve the purposes set out in this policy.

Transfer Outside Quebec

User Personal Information may be accessed, processed, or collected outside Quebec, but only within Canada. Any such communication of Information outside Quebec to another province will be in the context of the execution of a service contract or a business contract for which we have obtained confidentiality commitments.

Duration of Personal Information Storage

We store Personal Information for as long as necessary, but for a maximum of 7 years for Personal Information for which the law requires such a retention period, particularly for tax purposes. We will ensure that users are notified if their Personal Information is retained longer than this period.

In Case of Incidents Involving Personal Information

If we suspect a privacy incident that could affect Personal Information, we take reasonable steps to reduce the risks of harm and prevent similar incidents from occurring in the future.

If we are aware of a breach of your Personal Information or any other similar privacy incident, and such an incident poses a serious risk of harm, we commit to inform you and the Quebec Access to Information Commission, and, if applicable, the Canada Information Commissioner, in accordance with legal requirements.

5. YOUR RIGHTS

User Rights

You have various rights regarding your Personal Information. We will comply with the rights provided by applicable laws:

• The right to be informed of their use, disclosure, retention, and destruction (this policy aims to inform you in this regard).
• The right to access your Personal Information and obtain more details on how it is used, disclosed, retained, or destroyed (see details below).
• In some cases, the right to object to, restrict, or withdraw your consent to their collection, disclosure, or retention by sending a reasonable notice to the email address provided at the end of this policy (see details below).
• The right to correct your Personal Information if it is inaccurate or ambiguous, and to have it completed if it is incomplete (see details below).
• The right to have your Personal Information erased, subject to our legal retention obligations.
• The right to obtain your Personal Information in a standardized, machine-readable format.

To exercise these rights, contact our Personal Information Protection Officer:

• Soula Chronopoulos
• Address:1275 Avenue-des-Canadiens, Montréal, (Québec) H3B 0G4
• Email: Soula Chronopoulos
• Website: www.aquaaction.org

Right of Access and Rectification

AquaAction recognizes the importance of accurate, complete, and up-to-date Personal Information and takes reasonable measures to ensure the accuracy of the information it uses or communicates.

However, it is your responsibility to inform AquaAction of any significant changes to your Personal Information that may occur and to ensure that all Personal Information in your account is accurate, by making relevant changes directly in your account via our website or by contacting AquaAction by email at the address indicated at the end of this policy text.

Consent and Withdrawal of Consent

You may visit our website without revealing your identity by adjusting your browser settings to disable cookies and using private browsing. However, some features may require the collection of certain Personal Information.

Minors

Individuals under 14 years old are considered minors for the purposes of collecting Personal Information. Their Personal Information cannot be collected without the consent of the holder of parental authority or the guardian, except when such collection is clearly for the benefit of the minor. Therefore, if you are the holder of authority or the guardian of a minor who has contacted AquaAction, you must give your consent for the collection of the minor's information; if you are informed that a minor has provided us with Personal Information without your consent, please notify us immediately. This section applies, with necessary adjustments, to individuals who are not legally competent to give their consent.

External Links

Our website may contain links to other websites. We are not responsible for their privacy practices.

Update