PRIVACY POLICY OF EUGERIA

• Table of contents
• Important terms used in this Policy
• Scope of this Policy
• Acceptance
• Types of personal information that we collect
• How we collect personal information
• How we use of your personal information
• Who can access your personal information
• Extraterritorial transfers of your personal information
• How we obtain your Consent
• How we use automated decision-making tools
• How we use cookies
• Security safeguards and security incidents
• For how long we retain your personal information
• Your rights concerning your personal information
• How you can contact us
• Modifications to the Policy
• Additional information

Protecting your privacy is important to Eugeria Inc. and its affiliates (collectively, "Eugeria" or "we"), and that is why we take the privacy of our users' personal information and compliance with applicable laws very seriously. The purpose of this privacy policy (the "Policy") is to explain and describe how we process your personal information in the operation of our enterprise. Eugeria acknowledges that it is responsible for the protection of personal information and can demonstrate its compliance with applicable legislation when processing personal information.

This Policy is one of the cornerstones of our privacy protection program, that consists of multiple other internal policies, procedures, and security practices that ensure the adequate protection of your personal information. 

1. Table of content

We recommend that you read this Policy in full to ensure that you are fully informed about the manner in which we process your personal information before choosing to use our services or otherwise provide personal information to us. 

Should you prefer to refer to specific sections of this Policy, the following topics will be covered in the next sections of this Policy:

• 2. Important terms used in this Policy

• 3. Scope of the Policy

• 4. Acceptance

• 5. Types of personal information that we collect

• 6. How we collect personal information

• 7. How we use your personal information

• 8. Who can access your personal information

• 9. Extraterritorial transfers of your personal information

• 10. How we obtain your consent

• 11. How we use automated decision-making tools

• 12. How we use cookies

• 13. Security safeguards and security incidents

• 14. For how long we retain your personal information

• 15. Your rights concerning your personal information

• 16. How you can contact us

• 17. Modifications to the Policy

• 18. Additional information

2. Important terms used in this Policy

It is important for you to understand the meaning of the following terms when reading this Policy:

• “GDPR” means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data, including this regulation as saved into United Kingdom law by virtue of the United Kingdom’s European Union (Withdrawal) Act 2018;

• “personal information” is information concerning a natural person that allows this person to be identified, or any other similar definition given to such term in applicable laws;

• “process” or “processing” means generally any operation or set of operations which is performed on personal information or on sets of personal information, whether or not by automated means, such as to collect, use, disclose, transfer, store, adapt, store, etc.

Eugeria operates its business in many different jurisdictions throughout the world. This Policy has been constructed to comply with all said jurisdictions. As such, certain concepts and defined terms used in this Policy have been generalised to ensure this Policy remains consistent with all applicable data protection laws. Should you have any questions concerning this Policy, please do not hesitate to contact our Data Protection Officer using the information set out in Section 16 below.

3. Scope of this Policy

The Policy applies to personal information in our possession or control, including information collected when a user or customer browses Eugeria’s website, purchases products or services from Eugeria, or otherwise retains Eugeria’s services (collectively, the "Services"), as well as when you apply for a position with us. The Policy also applies to information we receive from third parties about you while providing our Services.

If you are an employee, consultant, director, officer or other representative of Eugeria (each, a “Representative”), we refer you to the internal privacy policy of Eugeria made available generally to its Representatives. This Policy does not apply to the processing of personal information of Representatives.

4. Acceptance

By accessing our Services or otherwise providing personal information to us, you agree to be bound by the terms and conditions contained in the Policy. For the sake of clarity, your use of our Services constitutes your consent to Eugeria processing your personal information in accordance with the terms of this Policy. 

Certain specific uses or communications of your personal information may, however, require additional and separate consent from you; in such a case, this will be explicitly indicated in the Policy and your acceptance of this Policy will not result in your automatic acceptance of these specific uses or communications.

If you wish to use Eugeria’s Services, but that you do not consent, in whole or in part, to Eugeria collecting, using, and disclosing your personal information as set out in this Policy, please contact our Data Protection Officer using the information set out in Section 16 below. In such a case, we will attempt to accommodate you, but you understand that we may not be able to provide our Services to you.

5. Types of personal information that we collect

Personal information that we collect

In application of the data minimisation principle, we collect only your personal information that is necessary to provide you with our Services, to maintain our relationship with you and to meet our legal obligations. If you refuse to provide us with such personal information, we may not be able to deliver our Services to you or evaluate your candidacy for a position with us.

We may collect the following categories of personal information about you:

• Identification Information: your first name and last name, your email address, your phone number, your address (for invoicing and delivery purposes), your country of residence, your time zone, etc.

• Payment Information: your credit or debit card number, your banking information and your associated payment information.

• Purchases information: your order numbers with us, your purchase history, etc.

• Professional information: your business email address, your job function, your organisation’s address, your organization name, your work location, etc., when you are making any transaction with us on behalf of an organisation.

• Personal preferences: your language of preference, your product preferences, your navigation preferences, etc.

• Technical Information: certain data regarding your email activities (when you have consented to receive our newsletters), technical information about your equipment and the operating system used to access our Services, your browsing habits, your geolocalisation, your network connexion, your IP address, your demographics, the operating system you are using, the previous website you visited before navigating on our website, etc.

• Information related to your application: information about your profile when you apply for a job with us, such as your professional history, your professional skills, your academic background, and any other similar information allowing us to evaluate your application.

• Information added to our Services: information that you may add to our Services, such as a review or feedback.

• Other information provided to Eugeria: information concerning your interactions with us, such as when you send us emails, make service requests, or contact our customer service, and information concerning your interactions with our product partners when required to assist with an issue, complaint or question concerning such products.

Please note that we have no control over the categories of personal information that you may provide to us over the course of our interactions or that you may input or publish through our Services in an open text field. Therefore, it is possible that other types of personal information may be processed by Eugeria if you provide them to us on your own initiative. 

Sensitive personal information

As part of your use of our Services, Eugeria could end up processing sensitive personal information about you (also called special categories of personal information). For reference, sensitive personal information is personal information that, due to its nature, in particular its medical, biometric or otherwise intimate nature, or the context of its use or communication, entails a high level of reasonable expectation of privacy. Examples of sensitive information may include health information, sexual orientation, morphological, behavioral, or biological characteristics, philosophical or religious beliefs, political opinion or financial status. 

For example, when you purchase certain products through our Services or browse certain pages on our website, your purchase and browsing history may reveal information about your health, given the nature of the information and products listed on our website. This sensitive personal information will be used and disclosed strictly to enable us to provide our Services to you (this may include, when you are on our website only, making product recommendations based on your purchase or browsing history).

We do not use this sensitive personal information for any other purpose, as we are aware that you have a high expectation of confidentiality regarding this information. If we collect, use, or disclose sensitive personal information to a third party for any purpose other than those mentioned above (for example, for targeting or web marketing purposes), we will obtain your explicit consent in advance.

Obligation to provide personal information

When we ask for your personal information, we indicate to you, unless it is reasonably implicit in the context, whether you are obliged to provide this information and what the impact will be if you do not provide it.

For example, you must provide certain personal information such as your name, address, and payment information if you wish to purchase a product or Service from us. However, you are entirely free to participate or not in our surveys or to consent, when using our website, to the use of certain cookies that allow us to retarget you in our online marketing campaigns (see Section 12 for more information about cookies). You are also entirely free regarding the informational content you may choose to add to some of our Services (for example, you are free regarding the content of any review you may post on our website).

6. How we collect personal information

Generally, we obtain information directly from you. However, we may also collect personal information about you from outside sources, with your consent or without your consent, if permitted by law.

Among others, here are certain ways we use to collect personal information about you: 

• Direct interactions with you: We obtain personal information directly from you when you contact Eugeria, when you add information in the course of using our Services, when you subscribe to our newsletter, when you respond to a survey, etc.

• Automated collection methods: When you use our Services, we may collect certain technical and business information about your equipment, your use of our Services, your browsing habits, etc. You can find more information about automated collection methods in Sections 5 and 12 of this Policy, and in the cookie consent tool used on our website.

• Partner products: We work closely with companies for whom we act as resellers or distributors. In certain instances, and where the law permits, we may obtain personal information about you directly from them, for example, when you have requested to be contacted by this partner company in a territory where we act as a distributor. 

• Third-party and public information: We may obtain information from third parties that are authorized to disclose this information or that make this information generally available to the public on their website or in publicly available databases, including, for example, advertising networks, analytics providers, or social media (such as LinkedIn, Facebook, and others). We may also obtain information from third-party providers when you apply for a job with us through a partner website where we post certain positions, or when we conduct background or credit checks.

• Governmental entities: We may obtain, in limited circumstances, information about you from governmental bodies, agencies and registries. 

7. How we use of your personal information

We process your personal information for the following purposes, and based on the following legal basis: 

The achievement of certain purposes identified above by Eugeria (such as web marketing targeting) requires that you explicitly consent to the collection of specific personal information about you, or that you explicitly consent to that purpose (such as using your personal information for email marketing). Eugeria will not pursue these purposes if you do not consent to the collection of the required personal information, or if you do not consent to that purpose when it requires your explicit and separate consent.

Eugeria may also use your personal information to compile statistics, for example to detect trends in the demand for services or products, or to detect trends in the use of its Services and to improve them. However, these statistics do not identify you and have been anonymized. Eugeria may also create anonymized datasets from these statistics, for which Eugeria will be the sole owner. Information is considered anonymized when it is, at all times, reasonably foreseeable in the circumstances that it irreversibly no longer allows for your direct or indirect identification.

Where authorized by law, your personal information may also be used for another purpose than those set out above without your consent. Otherwise, your personal information will not be used for purposes other than those described above, except with your consent.

8. Who can access your personal information

Eugeria has business activities in different countries around the world. To provide you with the best possible experience, we need to share your personal information with internal and external parties. We acknowledge that, except as described below or as permitted by law, the communication of your personal information to third parties requires your consent. Whenever Eugeria is required to disclose your personal information, Eugeria will endeavor to disclose no more information than is required under the circumstances.

You have the right to know, upon request, to whom your personal information is disclosed and the circumstances leading up to the disclosure and contact information for making such a request is provided in section 16 of the Policy.

Internal communications

Access to your personal information within our corporate group does not require your consent but is strictly limited to those Representatives for whom such information is necessary to carry out their duties and responsibilities. These Representatives have been trained to handle this personal information in accordance with Eugeria's privacy protection program.

External communications 

We retain the services of providers and we establish partnerships with third parties located around the world to deliver our Services to you. Eugeria may share your personal information, without your consent, with third parties who require such information in connection with Eugeria’s business or to assist Eugeria in administering and delivering its Services. Such third parties will contractually guarantee in writing that they will use your personal information exclusively for specific purposes, that they will keep it confidential and protected in accordance with this Policy and best practices, that they will ensure that they do not retain this personal information beyond the period required to accomplish the purposes for which it was communicated, and that they will otherwise comply with all applicable data protection legislation. 

We communicate personal information to the following categories of recipients and for the following functions:

• Service providers: we may disclose your personal information with service providers with whom we have contracted in order to provide our Services to you. These providers will access and process your personal information only as instructed by us. This may include customer relationship management, IT infrastructure, money collection, data hosting, marketing, billing, accounting, data analysis, information security, network and systems monitoring, software development and release, technical support, or other similar services.

• Other business partners and manufacturers: we may partner with other companies to support our business or to offer you new products or services. This may include manufacturers, resellers, referral partners, social networks or event sponsors. 

• Professional advisers: in some instances, we may share your personal information with professional advisers and consultants, including lawyers, bankers, auditors or accountants.

• Counterparty to a business transaction: subject to applicable law, Eugeria may share your personal information when it enters into or negotiates a business transaction involving the sale or transfer of all or part of its business or assets, or the financing of its activities. This could include, for example, a merger, bank or equity financing, acquisition, transaction, or bankruptcy proceeding implicating the enterprise of Eugeria.

• Third-party, where otherwise required: Eugeria may, acting in good-faith, communicate your personal information with third-parties, including public authorities, regulatory authorities, government agencies and ministries, (i) to prevent fraud or serious physical harm to any person, (ii) to comply with any court order, law, or judicial proceeding, including to respond to any governmental or regulatory request, in accordance with applicable laws, including in cases of alleged or actual breach of privacy, or (iii) to enforce its terms of use and other agreements or legal rights, including for billing and collection purposes.

Please note that this Policy does not apply to information collected about you by third parties through websites or third-party services that you may access via our website. We encourage you to review the privacy policy of these third-party sites or services before accessing or using them.

9. Extraterritorial transfers of your personal information

As a result of its international activities, Eugeria may need to disclose your personal information outside of the province, state, or country in which you normally reside, for example to the service providers and partners identified in Section 8 above, subject however to the dispositions of Section 5 as concerns sensitive personal information.

Where applicable, we will take all appropriate measures to ensure that the recipient of your personal information located in another jurisdiction will protect it with the same standards of protection as Eugeria would in your jurisdiction, and that your personal information will not be used for purposes other than those permitted by the collection or by applicable law in your jurisdiction. This may include conducting a privacy impact assessment before authorizing an international data transfer.

If you reside in a member state of the European Economic Area (“EEA”) or in the United Kingdom, this means that your personal information may be accessed and processed outside of the EEA or the United Kingdom by Eugeria and/or by one of our trusted partners or service providers. When your personal information is transferred outside the EEA or the United Kingdom, we require that an adequate level of protection is in place according to the requirements of applicable privacy laws. We also rely on appropriate transfer mechanisms in accordance with applicable laws.

10. How we obtain your Consent

We will always obtain your consent to process your personal information when required under applicable laws. For example, your consent may be required if we wish to use your personal information for a purpose not provided for in this Policy and not otherwise permitted by law. In such a case, Eugeria acknowledges that your consent must be manifest, free and informed. Your consent must be requested for specific purposes, in clear and simple language, and requested in a manner which is clearly distinguishable from all other matters. 

Depending on the nature and sensitivity of the personal information, and taking into account your reasonable expectations, your consent may be express or implied (when permitted at law). Generally, Eugeria will seek your consent at the time of collection, except where we are required or otherwise permitted by law. 

Your consent can be withdrawn at any time, subject to applicable legal restrictions and reasonable notice. We strive to make it as easy to you to withdraw as to give your consent. However, please note that if you choose to withdraw your consent to the processing of your personal information, Eugeria may no longer be able to provide certain of its Services to you. The withdrawal of your consent will not affect the lawfulness of processing based on consent before its withdrawal.

Without limiting the foregoing, you may change your preference to receive email marketing communications or participate in surveys at any time by clicking on the unsubscribe link in the concerned message or by contacting us.

11. How we use automated decision-making tools

Your personal information may be used by Eugeria to make automated decisions (including profiling) about (i) services and products that may be of interest or relevance to you, and (ii) detection and prevention of fraud. This automated decision making will have no legal effect on you, nor will it similarly significantly affect you. Upon request, Eugeria will provide you with information on the functioning of this automated system.

12. How we use cookies

Our Services use cookies, which are small data files that are stored on your computer when you visit it in order to remember information about you such as your preferences or past actions. These cookies are notably used to provide you with a good experience while browsing our website, as well as for statistical and marketing purposes. When you consent to receiving marketing email communications from us, we also use web beacons (also known as tracking pixels), which are pieces of software code embedded in an email message which allow us to track pages viewed and messages opened.

The personal information collected through cookies allows Eugeria and our service providers to manage and tailor the Services to your preferences, compile statistics and information to improve such Services, analyze trends, gather demographic information about our user base, and identify your areas of interest in order to provide you with relevant content and better target our marketing efforts.

The information we may compile through cookies may include, for example, your computer's Internet Protocol (IP) address, the operating system you are using, your Internet service provider's identity, the date and time you accessed the Services, the content viewed on our Services, and the website from which you accessed our Services.

When you visit our website for the first time, a cookie consent banner will pop up and ask you to customize your cookie preferences. If you decide to change your preferences at a later date, you can easily do so by clicking on the cookie parameters tool appearing at the bottom of the page on our website. With most web browsers, you can also delete cookies from your computer's hard drive, block the creation of cookies, or receive a warning before a cookie is stored. We encourage you to visit your browser's instructions or help section for more information on cookies. 

However, note that blocking some types of cookies may restrict access to some pages, areas or functionalities of our Services.

13. Security safeguards and security incidents

Security measures that have been implemented by Eugeria

Eugeria has put in place a series of security safeguards to protect your personal information against loss or theft, as well as unauthorized access, disclosure, copying, use and modification, that are reasonable considering, amongst other things, the sensitivity of the information, its use, quantity, distribution, medium and market standards.

These physical, electronic, and administrative measures include: 

• Secure storage: Eugeria protects its systems and your data within accredited data centers managed by reputable, industry-leading service providers.

• End-to-end encryption: Your data is encrypted at rest and in transit using strong encryption and communication protocols such as AES-256 and TLS 1.3.

• Zero-trust security: Eugeria’s systems are built on the zero-trust security model and internal systems are segregated from publicly accessible systems.

• Access control: Access to information systems is limited to trusted Representatives only and is provided only when strictly necessary while following the principle of least privilege. 

• Contractual security and confidentiality: Eugeria includes security and confidentiality obligations in all contractual agreements with its customers, vendors, employees and other third-parties, ensuring roles and responsibilities are communicated to everyone and contractually binding.

• Physical security measures: Eugeria implements physical security measures, such as restricting access and securely storing any document or file that may contain personal information.

• Administrative security measures: Eugeria adopts necessary measures, such as internal policies and procedures, to ensure that all of its Representatives are informed about the contents of the Policy and are aware of its privacy practices. Eugeria conducts continuous monitoring of said policies and procedures.

We review these security measures regularly to ensure they are applied properly and continue to be fully effective and appropriate given the evolution of our systems and of information technologies.

However, since no mechanism provides flawless security, there is always some degree of risk. The safety and security of your information also depends on you. Where you have chosen a password for access to certain parts of our Services, you are responsible for keeping this password confidential and to change it regularly. 

In the event of a security incident

If a security incident or personal data breach (collectively, an “Incident”) involving personal information occurs, Eugeria will, where required by law, disclose to the affected individuals and to the relevant governmental or supervisory authority (such as the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada, the UK’s Information Commissioner’s Office, or the appropriate regulatory authority within the European Union) the occurrence of such Incident and take steps to minimize the impact of the Incident on affected individuals. Eugeria will also investigate the Incident and adopt methods to reduce the risk of a same nature or similar type of Incident occurring again. Eugeria maintains a record of all Incidents involving personal information and, upon request and where required by law, will make such a record available to the appropriate privacy authorities. 

14. For how long we retain your personal information

Eugeria retains your personal information only as long as necessary to fulfill the purposes for which it was collected and to meet legal retention requirements, in compliance with its data retention schedule. As such, the duration of storage depends on the purposes for which the personal information was originally collected, as described in Section 7 of this Policy, and takes into account the recommendations of applicable enforcement authorities. After the conservation period is over, we will either destroy your personal information or anonymize it for serious and legitimate purposes in compliance with Eugeria’s internal data retention and disposal policy. 

For example, your personal information related to a transaction placed on our website will be retained for the priod required to fulfill the transaction and honour the applicable warranty. Afterwards, we will keep the information for a period of time which enables us to handle or respond to any complaints, queries, concerns or legal procedures relating to the transaction. These deadlines vary according to each situation and must consider the exhaustion of any appeals and applicable limitation periods. As such, we may retain your personal information after our business relationship with you has ended.

15. Your rights concerning your personal information

You have certain rights relating to your personal information that are subject to applicable law, in addition to the other rights set out in this Policy. The availability to you of such rights depends on the privacy legislation applicable to you; as such, certain of these rights may not be available to you. Note that after exercising certain of these rights, we may no longer be able to provide certain of our Services to you. 

Should you wish to exercise any of these rights, please refer to the procedure set out in Section 16. Note that the law provides certain restrictions on your exercise of these rights. We will advise you in such situations.

Your rights may include:

Right to access

You have the right to request access to your personal information held by Eugeria. You also have the right to obtain confirmation that we hold personal information about you, as well as certain information about how we process such information.

Right to withdrawal of consent

When we process your information based on consent you have previously given, you may withdraw said consent at any time. More details are provided as concerns consent in Section 10.

Right of rectification

Eugeria recognizes that it is important to keep personal information accurate, complete, and up-to-date, and takes reasonable steps to ensure the accuracy and completeness of the information it uses or discloses. However, you are responsible to inform Eugeria of any significant changes to your personal information that may occur after it has been provided to Eugeria. If you believe that we hold personal information about you that is inaccurate, incomplete or ambiguous, you have the right to request that we correct your information. Any rectification of your personal information will be communicated to third parties to whom the information has been disclosed.

Right to erasure

You may ask that we erase your personal information in certain limited circumstances, for example when said personal information is no longer necessary in relation to the purpose for which it was collected. In the event of a request for erasure, note that Eugeria may retain all or a portion of the personal information that has been the subject of the request for as long as necessary to allow you to exhaust any recourse provided by law. Any deletion of your personal information will be communicated to third parties to whom the information has been disclosed.

Right to restrict or object to processing

You may impose certain restrictions on Eugeria’s processing of your personal information in certain limited instances, for example when its processing is unlawful, and you oppose its erasure. You may also object to its processing (including profiling) in certain limited circumstances, such as when the processing is based on the legitimate interests of Eugeria that you dispute or when your personal information is processed for direct marketing purposes. 

Right to data portability

You may ask that we provide you with your personal information in a structured, commonly used and machine-readable format, and that we transmit the same to another controller without hindrance.

Right to formulate a complaint

You have the right to make a complaint at any time to the supervisory authority/privacy regulator of your own country or your province of residence. To facilitate the exercise of your rights, we have provided a link to the website of certain supervisory authorities in Section 18 below.

16. How you can contact us

Question, concerns or requests generally

All questions, concerns, complaints or requests (collectively, a “Request”) regarding this Policy or about the processing of your personal information, including requests concerning the exercise of your rights set out in Section 15 above, should be made in writing to Eugeria’s Data Protection Officer, as person in charge of the protection of personal information at Eugeria. 

Eugeria Inc.

Data Protection Officer

4020, Saint Ambroise Street, Suite 497

Montreal, Quebec, H4C 2C7

Email: privacy@eugeria.care 

Eugeria will respond to any valid request made by you within the delays provided for in applicable law. If we refuse to comply with your request, Eugeria will inform you of the reasons for the refusal and the sections of the applicable law that support the refusal, subject to the limitations of the law, and inform you of your potential recourses.

Note that if you submit a request to us, we may require that you identify yourself and provide proof of identification so that we may verify the request.

Where permitted at law, we may charge reasonable fees to you to answer your request. In such a case, we will inform you of the applicable fees beforehand. 

European Union and United Kingdom

Given that it is not yet conducting business activities in the EEA or the United Kingdom, Eugeria has not appointed a representative in these jurisdictions in accordance with Article 27 of the GDPR. When the time comes, the contact details of this representative will be posted in this section of the Policy. You will then be able to contact this representative regarding any questions related to the GDPR. 

17. Modifications to the Policy

We occasionally update this Policy and reserve the right to change the content of this Policy at any time. Any changes made will be communicated to you through our website. Notice of changes may also be given to you by email, if you have provided us this information as part of our business relationship. Eugeria also reserves itself the right to make administrative or clerical modifications to this Policy that do not affect your rights or obligations without sending you any communication or notice. The date of the latest version of this Policy appears at the bottom of the page. We recommend that you print a copy of this Policy for your records and review this section of our Services periodically. You are considered to have accepted any modifications to this Policy if you continue to use our Services following a modification. 

18. Additional information

For more information about your privacy and your rights, you may consult the following resources made available by law enforcement authorities: 

• In Quebec: Commission d’accès à l’information du Québec https://www.cai.gouv.qc.ca/

• In Canada: Office of the Privacy Commissioner of Canada www.priv.gc.ca (or the applicable Provincial authority)

• In the European Union: European Commission https://commission.europa.eu/law/law-topic/data-protection/reform/what-are-data-protection-authorities-dpas_en (or the applicable member state’s supervisory authority) 

• In the United Kingdom: Information Commissioner’s Office https://ico.org.uk/

Policy updated on August 12, 2024.