1. Background
AQC Capital is a venture capital investment fund operating throughout Quebec and headquartered at Place Ville-Marie in downtown Montreal.
In this document, the term “AQC” will be used for simplicity’s sake. AQC is a provincially chartered, for-profit corporation that collects and processes personal information in the course of its activities.
The purpose of this policy is to ensure the protection of personal information and to govern the manner in which AQC collects, uses, communicates, retains and destroys such information or otherwise manages it. In addition, it is intended to inform all interested parties of the manner in which AQC handles their personal information. It also applies to the processing of personal information collected by AQC by any technological means.
2. Application and Definitions
This policy applies to AQC, including its officers, employees and subcontractors, and to any person who otherwise provides services on behalf of AQC. It also applies to the website (https://aqccapital.ca//).
It covers all types of personal information managed by AQC, whether it be the information about potential or current entrepreneurs, self-employed workers (in investment), its employees, members of Anges Québec (AQ) or any other persons (such as visitors to its website or otherwise).
For the purposes of these terms and conditions, personal information is any information about an individual that directly or indirectly allows that individual to be identified. For example, it could be a person’s name, address, e-mail address, telephone number, gender or banking information, information about his or her personal financial situation, ethnic origin, language, and so on.
Sensitive personal information is information towards which there is a high reasonable expectation of privacy, e.g. financial information, banking information and biometric information.
Generally speaking, an individual’s professional or business contact information does not constitute personal information, such as an individual’s name, title, address, e-mail address or business telephone number. More specifically, and for greater clarity, under Quebec’s Act respecting the protection of personal information in the private sector , and as of September 22, 2023, sections 3 (collection, use, communication), 4 (retention and destruction) and 6 (data security) do not apply to an individual’s information relating to the exercise of a function within an enterprise, such as name, title, function, as well as address, e-mail address and telephone number at work.
3. Collecte, use and disclosure
Our investment process requires that we collect only a limited amount of data considered personal information, whether in person, by telephone, by videoconference, via website access (online form) or via employee e-mail boxes.
If you are a current or potential supplier, we collect basic data on the people with whom we communicate, such as their names, titles and contact details.
If you apply for a job at AQC, we will collect the data you provide such as your resume and the content of e-mails received if applicable.
AQC will inform individuals, at the time of collection of personal information, of any other information collected, the purposes for which it is collected and the means of collection, in addition to any other information required to be provided by law.
AQC applies the following general principles with respect to the collection, use and disclosure of personal information:
Consent:
· Generally, AQC collects personal information directly from the individual and with his or her consent, unless an exception is provided by law. Consent may be implied in certain situations, for example, when the individual decides to provide his or her personal information after having been informed by this policy of the use and disclosure for the purposes indicated herein. Thus, this policy and the information it contains will be available to the person concerned at the time personal information is collected.
· Normally, AQC must also obtain the consent of the person concerned before collecting his or her personal information from third parties, before communicating it to third parties or for any secondary use thereof. However, AQC may act without consent in certain cases provided for by law and under the conditions stipulated therein. The main situations in which AQC may act without consent are indicated in the relevant sections of this policy.
Collection:
· In all cases, AQC will only collect information if it has a valid reason to do so. Furthermore, the collection of information will be limited to that which is necessary to fulfill the purpose for which it is collected.
· Please note that AQC’s services are never intended for minors (under the age of 14).
· Collection from third parties. AQC may collect personal information from third parties. Unless an exception is provided by law, AQC will seek the consent of the individual concerned before collecting personal information about him or her from a third party. In the event that such information is not collected directly from the individual, but from another organization (e.g. AQ), the individual may request the source of the information collected from AQC
In certain situations, AQC may also collect personal information from third parties, without the consent of the person concerned, if it has a serious and legitimate interest in doing so and a) if the collection is in the interest of the person and it is not possible to collect it from him or her in a timely manner, or b) if such collection is necessary to ensure that the information is accurate.
This collection through third parties may be necessary to use certain services, or to otherwise do business with AQC. When required, AQC will obtain consent at the appropriate time.
Retention and use:
· AQC ensures that the information it holds is up-to-date and accurate at the time it is used to make a decision about an individual.
· AQC may use an individual’s personal information only for the purposes identified herein or for any other purposes identified at the time of collection. If AQC wishes to use the information for another reason or purpose, new consent must be obtained from the person concerned, which must be obtained expressly if the information is sensitive personal information. However, in certain cases provided for by law, AQC may use information for secondary purposes without the individual’s consent, e.g.:
· when such use is clearly for the benefit of the person;
· when necessary to prevent or detect fraud;
· when necessary to evaluate or improve protection and safety measures.
· Limited access. AQC shall implement measures to limit access to personal information to those employees and individuals within its organization who have a right to know the information and for whom the information is necessary in the performance of their duties. AQC will seek the consent of the individual before granting access to any other person.
Business-related disclosure to third parties:
· Generally, and unless an exception is indicated in this Policy or otherwise provided by law, AQC will obtain the consent of the individual concerned before disclosing his or her personal information to a third party. In addition, where consent is required and where sensitive personal information is involved, AQC will obtain the individual’s express consent prior to disclosing the information.
· However, disclosure of personal information to third parties is sometimes necessary. Thus, personal information may be disclosed to third parties without the consent of the individual concerned in certain cases, including, but not limited to, the following
· AQC may communicate personal information, without the consent of the person concerned, to a public body (such as the government) which, through one of its representatives, collects it in the exercise of its powers or the implementation of a program it manages.
· Personal information may be transmitted to partners (e.g. AQ and other co-investors) or service providers to whom it is necessary to communicate the information, without the individual’s consent. In such cases, the information must only be used to perform the service.
· If it is necessary for the purposes of concluding a commercial transaction, AQC may also communicate personal information, without the consent of the person concerned, to the other party to the transaction and subject to the conditions provided by law.
· Disclosure outside Quebec: Personal information held by AQC may be disclosed outside Quebec, for example, when AQC uses service providers whose offices are located outside Quebec or when AQC deals with subcontractors located outside the province.
Cookies and the Web site
· Use of cookies
Cookies are data files sent to a Web site visitor’s computer by his or her Web browser when the site is visited and can serve several purposes.
The Web site controlled by AQC uses cookies in particular:
· To memorize visitors’ settings and preferences, such as language choice, and to enable tracking of the current session.
· For statistical purposes, to track visitor behavior and content, and to help improve the website.
The AQC controlled website uses the following types of cookies:
· Session cookies: These are temporary cookies that are stored only for the duration of the website visit.
· Persistent cookies: These are kept on the computer until they expire and are retrieved the next time the site is visited.
AQC collects personal information via a form with a technological service that has a cache in a Web form, and AQC must ensure that these settings offer the highest level of confidentiality by default (cookies are not covered).
4. Retention and destruction of personal information
Unless a minimum retention period is required by financial market regulations or applicable AMF regulations, AQC will retain personal information only as long as necessary for the fulfillment of the purposes for which it was collected.
Depending on the nature of business activities, personal information used by AQC may be retained for periods ranging from a few months for resumes received, to more than 12 years for inactive contractor files or cases of employees who have left the company (the fund having a lifespan of approximately 12 years).
At the end of the retention period, or when the personal information is no longer required, AQC will :
1. destroy it; or
2. anonymize it (i.e., it no longer irreversibly identifies the individual and it is no longer possible to establish a link between the individual and the personal information) and use it for serious and legitimate purposes.
The destruction of information by AQC must be carried out in a secure manner, to ensure the protection of this information. The internal security policy defines the mechanisms for secure destruction.
This section may be supplemented by any policies or procedures adopted by AQC regarding the retention and destruction of personal information, if any. Please contact AQC’s Privacy Officer (identified in this policy) for further information.
5. AQC’s Responsabilites
In general, AQC is responsible for protecting the personal information it holds, regardless of whether the computer media are under its direct responsibility or via a cloud provider.
AQC’s Privacy Officer is a person in authority. He or she is generally responsible for ensuring compliance with applicable privacy legislation. The person in charge must approve the policies and practices governing the governance of personal information. More specifically, this person is responsible for implementing this policy and ensuring that it is known, understood and applied. In the event of the absence or inability to act of the Privacy Officer, the General Manager of AQC will assume the duties of the Privacy Officer.
AQC employees who have access to personal information or are otherwise involved in its management must ensure its protection and for complying with this policy.
The roles and responsibilities of AQC employees with respect to personal information may be specified by any other AQC policy in this regard, if applicable.
6. Data Security
AQC is committed to defining, implementing and enforcing an internal security policy and reasonable security measures to ensure the protection of personal information under its control. The security measures in place correspond, among other things, to the purpose, quantity, distribution, medium and sensitivity of the information. This means that information that may be considered sensitive (see definition in section 2) will require more stringent security measures and greater protection.
In particular, and in accordance with what was mentioned above concerning limited access to personal information, AQC must put in place the necessary measures to impose constraints on the rights of use of its information systems so that only employees who need to have access to them are authorized to access them.
7. Rights of access, rectification and withdrawal of consent
To exercise his or her right of access, rectification or withdrawal of consent, the person concerned must submit a written request to this effect to AQC’s Privacy Officer, at the e-mail address indicated in the following section.
Subject to certain legal restrictions, individuals may request access to and correction of their personal information held by AQC if it is inaccurate, incomplete or equivocal. They may also request that the dissemination of personal information concerning them cease, or that any hyperlink attached to their name allowing access to this information by a technological means be de-indexed, when the dissemination of this information contravenes the law or a court order. They may do the same or require that the hyperlink providing access to this information be reindexed, when certain conditions provided for by law are met.
AQC’s Privacy Officer must respond in writing to such requests within 30 days of receipt. Reasons must be given for any refusal, together with the legal provision justifying the refusal. In such cases, the response must indicate the remedies available under the law and the time limit for exercising them. If necessary, the person in charge must help the applicant understand the refusal.
Subject to applicable legal and contractual restrictions, data subjects may withdraw their consent to the communication or use of the information collected.
They may also ask AQC what personal information has been collected from them, what categories of people at AQC have access to it, and how long it is kept.
8. Complaints handling process
Reception
Any individual who wishes to make a complaint regarding the application of this policy or, more generally, regarding the protection of his or her personal information by AQC, must do so in writing to AQC’s Privacy Officer at the e-mail address indicated in the following section.
The individual will be asked to provide his or her name, contact information, including a telephone number, as well as the subject and reasons for the complaint, in sufficient detail to allow the complaint to be evaluated by AQC. If the complaint is not specific enough, the Privacy Officer may request any additional information he or she deems necessary to assess the complaint.
Treatment
AQC undertakes to treat all complaints received confidentially.
Within 30 days of receipt of the complaint or of receipt of any additional information deemed necessary and required by AQC’s Privacy Officer to process the complaint, the latter shall assess it and provide a reasoned written response by e-mail to the complainant. The purpose of this assessment will be to determine whether AQC’s handling of personal information complies with this policy, any other policies and practices in place within the organization, and applicable legislation or regulations.
If the complaint cannot be processed within this timeframe, the complainant must be informed of the reasons for extending the deadline, the progress made in processing the complaint and the reasonable time required to provide a definitive response.
AQC must keep a separate file for each complaint received. Each file contains the complaint, the analysis and documentation supporting its assessment, as well as the response sent to the person who initiated the complaint.
9. Approval
This Policy is approved by AQC’s Privacy Officer, whose business contact information is as follows:
AQC Privacy Officer
Ms Marianne Bohen
3 Place Ville-Marie
Suite 1-100, 1st floor
Montréal (Québec)
H3B 0E7
Email : [email protected]
For all requests, questions or comments relating to this policy, please contact the person responsible by e-mail.
10. Publication and Changes
This policy is published on AQC’s website, as well as on all websites controlled and maintained by AQC, to which this policy applies, with respect to personal information collected therein. This policy is also disseminated by any means appropriate to reach the persons concerned.
We reserve the right to update this Policy at any time. The most recent version of the Policy may be consulted by visiting our Web site. Your use of our website may also be subject to additional terms described in the Terms of Use and elsewhere on the website.
*Notes : Please note that the use of the masculine gender is intended to lighten this policy and make it easier to read.
Last updated: January 11, 2023