Privacy Governance Summary

BEEM Technologies Inc. ("BEEM") is a Montreal-based company that provides the BEEM Data Platform to businesses. This page summarizes the rules and practices BEEM follows to govern personal information, as required by Quebec's Act respecting the protection of personal information in the private sector ("Law 25"). BEEM also follows the federal Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies. More detail is available in our Website Privacy Policy and Data Platform Privacy Policy.

Who is responsible

Our CEO, Alexandre Lataille, is the person in charge of the protection of personal information (Privacy Officer). You can reach the Privacy Officer at privacy@beemdata.com or by mail:

BEEM Technologies Inc., Attn: Privacy Officer
539 Bonsecours St, Montreal, Quebec H2Y 3C6

Roles and responsibilities

• Privacy Officer (CEO): oversees compliance with privacy law, approves privacy policies and notices, handles requests and complaints, decides on privacy impact assessments and leads the response to confidentiality incidents.
• CTO: puts in place and maintains the technical security measures that protect personal information (access controls, encryption, secure deletion).
• All staff and contractors: handle personal information only as their role requires, follow BEEM's policies and report any request, complaint or incident to the Privacy Officer without delay.

What we collect and why

When BEEM decides how personal information is used, it covers mainly:

• Customer contacts and prospects: name, job title, business contact details and communications, to sell, support and bill our services;
• Platform users: account details and usage logs, to give secure access to the platform, support it and improve it;
• Staff and candidates: the information needed to hire, pay and manage our team.

We collect only what we need for these purposes and, wherever possible, directly from the person concerned.

When our customers load data into the BEEM Data Platform, the customer decides what personal information it contains and how it is used. BEEM acts as a service provider: it processes that data only to deliver the service and under the customer's instructions. Questions about that data should be sent to the customer concerned; we will assist the customer as required.

How long we keep it and how we destroy it

We keep personal information only as long as needed for the purpose for which it was collected, or as long as the law requires (for example, financial records and payroll records). When it is no longer needed, it is securely destroyed or anonymized. At the end of a customer contract, the customer has 30 days to ask for a transfer or a copy of its data; otherwise BEEM deletes the customer's data by closing the customer's dedicated cloud environment.

Your rights

You can ask us to:

• access the personal information we hold about you, and learn how it is used and to whom it has been disclosed;
• correct information that is inaccurate, incomplete or out of date;
• receive the computerized information you provided in a structured, commonly used format (portability);
• withdraw your consent to a use of your information (you can also unsubscribe from our marketing emails at any time);
• stop the dissemination of your information or de-index a hyperlink to it, where the law allows.

Send your request to privacy@beemdata.com. We verify your identity before acting on it, and we answer in writing within 30 days. If we refuse a request, we explain why and tell you about your recourse.

Complaints

Send any complaint to privacy@beemdata.com or by mail to the Privacy Officer. We investigate and answer in writing within 30 days, with the outcome and any action taken. If you are not satisfied, you may contact the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or, where PIPEDA applies, the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Confidentiality incidents

Staff must report any suspected incident right away. BEEM acts quickly to reduce the risk of harm and prevent a repeat. The Privacy Officer assesses whether the incident creates a risk of serious injury to the people concerned; if so, BEEM notifies the Commission d'accès à l'information and the people concerned (and the Office of the Privacy Commissioner of Canada where PIPEDA applies). Affected customers are notified without undue delay. Every incident is recorded in an incident register, even when there is no serious risk.

Privacy impact assessments

BEEM assesses privacy risks before it starts a new project, system or feature involving personal information, uses information for a new purpose, or engages a new service provider that handles personal information. Before personal information is communicated outside Quebec, including to a service provider, BEEM assesses whether it will receive adequate protection, considering its sensitivity, the purpose, the safeguards in place and the legal regime of the destination, and puts a written agreement in place. The Privacy Officer approves each assessment before the work proceeds.

Training and awareness

All staff receive privacy and security training when they join BEEM and every year after, and must accept BEEM's policies.

Updates

This summary is reviewed annually by the Privacy Officer and updated when our practices change. The date of the last update is shown at the top of this page.