PRIVACY POLICY – EMPLOYEE DOMAIN

1. WHAT IS THE SCOPE OF THIS POLICY?

This Policy applies to personal information used by Orange Digital in relation to our Services, with the exception of personal information collected in respect of our employees, former employees and applicants for employment with us, to which a separate policy applies.

This Policy does not apply to the collection, use, disclosure or retention of your personal information by third parties through their websites. Although some links in our Software may allow you to access content made available by third parties, we are not responsible for their collection of such personal information. We encourage you to read such third-parties’ privacy notices or policies and to direct any complaints, questions or requests related to your personal information collected on such third parties’ websites directly to the relevant third party.

2. HOW AND WHEN DO WE COLLECT PERSONAL INFORMATION?

We collect personal information directly from you the Individual User, as inputted by your Employer User or a Service Provider on the Software including, but not limited to the following instances:

1. When information collected from your mobile device or computer is uploaded or transferred to the Software. All such collection will be subject to express consent by the Individual User.
2. When you create an account for the Software, Orange Digital will have access to the personal information you enter to create your account.

3. TYPES AND PURPOSES OF USE OF YOUR PERSONAL INFORMATION

We only use your personal information as necessary to provide our Services, as elected by your Employer User or their Service Provider, or as required by law. Where applicable, we will obtain your explicit consent regarding the use of your personal information; however, where permitted by law, we rely on the principles of legitimate interest, on implied consent or on specific exceptions provided by law, as applicable. In addition to the purposes listed below, we may use your personal information for security purposes, including to detect, prevent and investigate potential fraud.

Below are the types of personal information we use and the purposes of such use. Please note that the type of personal information collected and processed by Orange Digital is determined by your Employer User and/or their Service Provider based on their use of the Software and related Services.

4. HOW DO WE PROTECT YOUR PERSONAL INFORMATION?

We are committed to protecting personal information in our possession in accordance with industry standards. Accordingly, we have implemented physical, electronic and operational security measures which comply with the standard industry practices to protect your personal information against loss, theft, unauthorized access, disclosure and unauthorized use. Such security measures are proportionate to the sensitivity of the information.

Please note that the transmission of personal information over the Internet is never completely secure despite the security measures taken by Orange Digital. Although we take precautions to protect your personal information, we cannot guarantee the security of personal information transmitted over the Internet. You choose to transmit information through this channel at your own risk.

5. HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION

The personal information we collect is retained only as long as necessary to fulfill the purposes set out herein and to comply with our legal and regulatory obligations. We have internal procedures and policies in place to ensure that your personal information is subject to a specified retention schedule, and that it is securely destroyed once this period has elapsed.

6. TO WHOM MAY WE COMMUNICATE YOUR PERSONAL INFORMATION?

Access to your personal information by our employees is limited to those of our employees who require access in order to perform their duties. Our employees are made aware of the need to protect personal information used by us, and we have implemented internal policies to ensure their protection.

We may also need to communicate some of your personal information externally. We require third parties to whom we disclose your personal information to respect the standards set by law and the security measures required to protect your personal information. We never sell your personal information, and will only disclose it where required by law, to your Employer User or their Service Providers, or with your consent.

The following are categories of third-parties to whom we may transfer your personal information in order to provide you with the Services:

6.1 To Our Service Providers

We do business with service providers to whom we may communicate or give access to your personal information when necessary for the performance of the Services.

We put in place written contracts with our service providers in order to:

• Guarantee the confidentiality of your personal information.
• Ensure that the information is used only to perform specific services.
• Ensure that service providers do not retain any personal information when they no longer need it to perform their specific services.
• Ensure that service providers communicate with us immediately in the event of an actual or purported confidentiality incident.

Examples of service providers we may transfer your personal information to are:

• Computer and technical support services
• Analytics services
• Law firms
• Cloud hosting service

6.2 To Legal Entities Within Our Group

We may share some of your personal information with other legal entities within our group where necessary to comply with our legal and regulatory obligations and to provide you with our Services.

6.3 To Courts, Law Enforcement Authorities, Regulators, Governmental Officials or Prosecutors

We may disclose your personal information to comply with a search warrant, to respond to an investigative body, to comply with a court order, if we believe disclosure is necessary to comply with applicable laws, if required by law, to pursue a legal claim or to assert a defence or if required by an Employer User for reporting purposes or to respond to the inquiry of an investigative body or governmental entity.

6.5 To Other Third Parties

We may need to disclose your personal information to other third parties in certain specific circumstances, always within the limits permitted by law or after obtaining your consent, for example:

• As part of a business transaction (a merger, an acquisition by another enterprise, obtaining a loan or financing, for example); or
• in the event of insolvency or bankruptcy;

7. COOKIE NOTICE

We may use cookies on our Website. Cookies are essentially text files containing small amounts of information which are downloaded to your computer or mobile device when you visit a site or use an application. They can improve your experience while you navigate on our Website in different ways; namely, cookies can be used to remember your preference settings and track your use of our Services and operating system so that it can be improved to meet your needs.

The following is a list of the types of cookies we may use in the provision of our Services:

• Essential Cookies: These are necessary for the proper functioning of our web application used to offer our Services. They enable basic features like page navigation and access to secure areas.
• Analytical/Performance Cookies: These cookies help us analyze how visitors interact with our web application used to offer our Services. They provide information on areas such as the most visited pages, time spent on the site, and any error messages received, allowing us to improve our operating system’s performance.
• Functionality Cookies: These cookies remember your preferences, such as language or region, to enhance your user experience.

You can set your cookie preferences on your preferred browser. Unless the cookie is necessary for the functionality of our Website, you can refuse or withdraw your consent to our cookies at any time even if you have previously consented. Please remember that if you do not consent to our essential cookies, parts of our Website will not work.

Additionally, we use Google Captcha. Google uses their own cookies in association with this functionality. Google reCAPTCHA is used to protect against spam and abuse. reCAPTCHA analyzes interactions on the Website to determine whether they are performed by a human or an automated system. As part of this process, Google may collect information about your device and interaction with our website, including your IP address, browser details, and cookies like _GRECAPTCHA. The data collected by reCAPTCHA is governed by Google’s Privacy Policy and Terms of Service. This information is used solely for security purposes and to prevent fraudulent activity.

8. WHERE CAN YOUR PERSONAL INFORMATION BE COMMUNICATED OR STORED?

Your personal information will be stored in Canada. However, our subcontractors, service providers and other third parties to whom we disclose your personal information may operate in different jurisdictions. In all cases, we ensure that your personal information is handled securely, and that a written agreement exists with any such third party ensuring that your personal information is stored in compliance with applicable laws and this Policy, where required. We conduct privacy impact assessments when appropriate and where required by applicable laws. We will not disclose your personal information unless we are satisfied that it will be adequately protected.

9. WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL INFORMATION?

9.1 Access to your personal information

Subject to the exceptions provided by law, you have the right to request a copy of, or access to the personal information we hold about you. You may exercise your right of access by contacting your Employer User or their Service Provider. In the event that your Employer User or their Service Provider is unable to provide access, Orange Digital shall provide you with access to your personal information upon request to our Privacy Officer, which request will include the steps taken with your Employer User or their Service Provider to request access from them. Access to your personal information is free of charge. However, if the request is excessive or unfounded, we may charge an administration fee for transcribing, reproducing, transmitting or requesting additional copies of your personal information. We will inform you of any such charges before processing your request.

We generally respond to all requests for access within 30 days of receipt of any such request. When we are unable to grant access, or if additional time is required to fulfill a request, we will notify you in writing.

9.2 Rectification of your personal information

If you consider that your personal information is inaccurate or incomplete, you may rectify it by contacting your Employer User or their Service Provider. It is your responsibility to inform us of any changes to your personal information so that your personal information uploaded onto the Software is kept up to date.

9.3 Obtain information on the processing of your personal information

You have the right to obtain additional information relating to the processing of your personal information. If you cannot find the answer to your questions in the Policy, you can contact your Employer User or their Service Provider.

9.4 Withdraw your consent

When you give your consent for secondary purposes, in other words, purposes that are not essential for the purposes of collection of your Employer User or their Service Provider, you may withdraw it at any time, without any consequence, by contacting your Employer User or their Service Provider who will communicate with our Privacy Officer to remove such personal information if such action is not possible using the Software functionalities available to your Employer User or their Service Provider . However, if you refuse to provide personal information that is necessary for your Employer User or their Service Provider to use our Services or that is required by law, you may no longer have the benefit of using the Software and related Services.

9.5 Dissatisfaction with the management of your personal information

If you have any questions, concerns or dissatisfaction with this Policy you may contact our Privacy Officer or with the management of your personal information, you may contact your Employer User or their Service Provider, as applicable.

10. CONFIDENTIALITY INCIDENTS

We take all incidents or attempted Confidentiality Incidents seriously.

For the purposes of the Policy, a “Confidentiality Incident” refers to any actual or potential unauthorized access, use, or communication of personal information, as well as the loss of personal information or any other breach of its protection. All Confidentiality Incidents will be treated in accordance with applicable privacy laws and where required, will be communicated to regulatory authorities and affected individuals.

11. POLICY UPDATE

This Policy takes effect on the date mentioned at the top of the page and replaces all previous versions. The history of previous versions of this Policy can be obtained by request to our Privacy Officer.

This Policy may be updated at our sole discretion based on changes in our practices and legislation on the protection of personal information. When this Policy is updated, the changes will be specifically brought to your attention and a notice will be available on the home page of our Website. When the changes are of a material nature or require your consent, we will notify you by email if we have your email address.