Personal Information Protection Policy

1. 1. Purpose and Scope

The purpose of this Policy is to protect personal information held and collected by Uni-Recycle Inc. and to establish clear rules regarding how such information is collected, used, communicated, stored, and managed.

This Policy also informs individuals about how Uni-Recycle Inc. processes personal data, including cookies and associated consent settings.

This Policy applies at all times to employees, interns, job applicants, clients, visitors, and users of the Uni-Recycle Inc. website, regardless of the channel through which personal information is provided (email, in person, telephone, or via the website).

By providing personal information, you consent to its processing in accordance with this Policy.

2. 2. Definitions

Personal Information refers to any information relating to an identifiable natural person, either directly or indirectly.

Examples include:

• Basic identifiers: name, address, phone number, email address
• Official identification data: social insurance number, passport number, driver’s license
• Financial information: credit card number, bank account details, tax information
• Professional information: job title, employer, employment history
• Health information: medical records, health insurance number
• Technological information: IP address, login identifiers, digital fingerprints

Personal information is considered sensitive when unauthorized disclosure creates a high risk to the individual (for example financial, medical, or biometric data).

3. 3. Collection of Personal Information

3.1 Information Collected

Uni-Recycle Inc. undertakes to collect only the information strictly necessary for the intended purposes. Depending on the context, the following information may be collected:

• Identity information: name and surname
• Contact information: address, email address, phone number
• Professional information: job title, employer
• Financial information: billing address and payment data
• Recruitment information: résumé, education, professional history
• Payroll information: Social Insurance Number (SIN)
• Any other information voluntarily provided

3.2 Purpose of Collection

Collected information may be used for the following purposes:

• Managing client relationships and service or order follow-ups
• Communications, information updates, and promotional offers (with consent)
• Recruitment and human resources management
• Payroll processing and employee benefits management
• Compliance with legal and regulatory obligations
• Website improvement and management

3.3 Consent

Uni-Recycle Inc. obtains valid, free, informed, and specific consent before collecting personal information or at the time of collection.

For sensitive information (financial, medical, biometric), explicit and active consent is required. A pre-checked box does not constitute valid consent.

You may withdraw your consent at any time, subject to applicable legal or contractual restrictions, by contacting the Person Responsible for the Protection of Personal Information (see Section 10).

4. 4. Website and Cookies

4.1 Necessary Cookies

Cookies classified as necessary are stored on your browser as they are essential for the basic functioning of the website and do not require your consent.

4.2 Analytical and Preference Cookies

Third-party cookies may also be used to:

• analyze website usage
• remember user preferences
• provide relevant content

These cookies are stored only with your prior consent, expressed through our consent manager upon your first visit to the website.

You may modify or withdraw your consent at any time through the cookie settings available on our website.

Disabling certain cookies may affect your browsing experience.

4.3 Third-Party Links

Our website may contain links to third-party platforms.

Once you leave our website, your browsing becomes subject to the terms and privacy policies of those third parties. Uni-Recycle Inc. has no control over these platforms and declines all responsibility for them.

5. 5. Sharing of Personal Information

Uni-Recycle Inc. may rely on third-party service providers (such as cloud service providers, payroll processors, or insurance administrators) to deliver certain services.

In such cases:

• These providers only have access to information strictly necessary to perform their services.
• They must process the information only for the purposes determined by Uni-Recycle Inc.
• They must apply protection measures offering a level of security equivalent to this Policy.

Uni-Recycle Inc. may also disclose information when required by law.

Uni-Recycle Inc. will never sell or rent personal information to third parties.

6. 6. Retention Periods and Storage Locations

6.1 Retention Periods

Personal information is retained only as long as necessary for the purposes for which it was collected or as required by law.

Examples of retention periods include:

• Client contact data: duration of the business relationship + 3 years
• Billing and financial data: 7 years
• Employee files (active): duration of employment + 7 years
• Employee files (terminated): 7 years after employment ends
• Résumés (unsuccessful applicants): 2 years
• System logs and access logs: 12 months
• Analytical browsing data (cookies): maximum 13 months
• General correspondence: 3 years
• Confidentiality incident register: 5 years

After the retention period expires, personal information is securely destroyed or anonymized.

6.2 Storage Locations

Personal information is stored on secure servers located in Canada.

Uni-Recycle Inc. uses Microsoft 365 cloud services (OneDrive and SharePoint) where confidential information may be stored.

In certain cases, information may be stored outside Canada if an authorized service provider is located abroad. When this occurs, the information may be subject to the laws of that jurisdiction. Uni-Recycle Inc. ensures that such providers offer adequate data protection safeguards.

7. 7. Security Measures

Uni-Recycle Inc. implements organizational, physical, and technical security measures to protect personal information from unauthorized access, use, disclosure, modification, or destruction.

These measures include:

• SSL/TLS encryption for communications
• Role-based access control and the principle of least privilege
• Secure username and password authentication
• Firewalls and network monitoring software
• Regular data backups
• Employee training and awareness

If a security incident may compromise your personal information, we may notify you by email in accordance with the requirements of Law 25.

8. 8. Your Rights

Under the Act respecting the protection of personal information in the private sector (CQLR c. P-39.1) as amended by Law 25, you have the following rights:

8.1 Right of Access and Correction

You may request access to personal information we hold about you and request corrections if necessary. A response will be provided within 30 days, subject to identity verification.

8.2 Right to Withdraw Consent

You may withdraw consent to the use of your personal information for commercial or promotional communications at any time.

8.3 Right to Data Portability

Since September 2024, you may request that computerized personal information you provided be communicated in a structured and commonly used technological format, or transferred to another organization where technically feasible.

8.4 Right to De-Indexing

You may request the removal of hyperlinks associated with your name that provide access to personal information if their dissemination violates the law or a court order.

8.5 Right to Object

You may object to the use of your personal information for certain purposes, including commercial solicitation.

Requests must be submitted in writing to the Person Responsible for Personal Information Protection.

9. 9. Personal Information of Minors

Uni-Recycle Inc. does not knowingly collect personal information from individuals under the age of 16 without explicit consent from a parent or legal guardian.

If a parent or guardian becomes aware that such information has been provided without authorization, they are invited to contact us. Immediate measures will be taken to delete the data.

10. 10. Management of Confidentiality Incidents

A confidentiality incident refers to any event, intentional or accidental, that results in or could result in unauthorized access, use, disclosure, modification, loss, or destruction of personal information.

Incidents are classified based on potential impact:

Minor incidents

Limited risk and quickly correctable.

Major incidents

Significant exposure requiring corrective actions and potentially mandatory notification.

All incidents must be reported immediately to the Person Responsible for the Protection of Personal Information, and a register of incidents is maintained for at least five years.

11. Person Responsible for Personal Information Protection

In accordance with Law 25, Uni-Recycle Inc. has designated a Person Responsible for the Protection of Personal Information (PRPPI).

For questions, requests, or complaints regarding this Policy:

Name	Gabriel Hubert
Title	Person Responsible for the Protection of Personal Information
Address	509 Père-Daniel Street, Trois-Rivières (Québec)  G9A 5Z7
Email	securite@uni-recycle.com
Website	www.uni-recycle.com

13. 12. Complaint Management

Uni-Recycle Inc. undertakes to handle all privacy-related complaints fairly, transparently, and promptly.

Complaints must be submitted in writing to the PRPPI and include a detailed description of the facts.

A written response will be provided within 30 days.

If the response is unsatisfactory, complaints may be filed with:

• Commission d’accès à l’information du Québec (CAI)
• Office of the Privacy Commissioner of Canada

14. 13. Policy Updates

Uni-Recycle Inc. may update this Policy at any time to reflect legislative, organizational, or technological changes.

The date of the latest update is indicated in the document header and footer.

Archived versions are retained internally and may be consulted upon request.

14. Referenced Documents

• Act respecting the protection of personal information in the private sector (CQLR c. P-39.1)
• Law 25 (L.Q. 2021, c. 25)
• ISO/IEC 27001:2022 – Control A.5.34
• Uni-Recycle Inc. Information Security Policy
• Register of confidentiality incidents