Privacy Policy

Our Commitment to Your Privacy   Your Privacy Why do we have a privacy policy? We require your personal information to carry out some of our business processes within the scope out of our mission. Because your satisfaction in the way we protect your personal information is important to us, we have adopted this Privacy Policy (the “Policy”) to describe how we protect your personal information. The Policy is one of the cornerstones of our privacy protection program. The objective of the program is to ensure that Montreal Institute of Swimming Inc’s (herein referred to as “MIS”) meets its legal obligations under the Act respecting Access to documents held by public bodies and the Protection of personal information (the “Access Act”). The Policy sets out MIS’s commitments concerning the protection of your privacy and aims to establish and maintain your confidence in our privacy practices. In the interests of transparency, we are providing you with this Policy. What is personal information? Personal information is information concerning a natural person that allows this person to be identified. Your professional experience, your bank account numbers and your communication preferences are examples of personal information. What does the Policy apply to? The Policy determines how MIS processes the personal information of its customers, of external candidates applying for employment on its website, and of any other person, no matter the medium selected (for example, paper documents, sound recordings and databases). The Policy does not apply to personal information the law considers to be public. In addition, the Policy does not apply to personal information belonging to members of the MIS team, because other policies govern the protection of their personal information. Our wholly owned subsidiaries adhere to privacies policies that regulate their respective activities. Who is responsible for implementing the Policy? Every member of the MIS team is responsible for the implementation of the Policy. To this end, MIS has developed and deployed a training and awareness program throughout the organization to ensure that everyone has a thorough understanding of the Policy and can apply its principles when carrying out their functions. We also ensure that suppliers with whom we share your personal information as part of our activities respect the Policy. Please refer to the Communicating information section to learn more about these measures. How does MIS fulfill its responsibilities concerning your personal information? Protection of your privacy is of the utmost importance to MIS. We adopt practices and implement measures daily to fulfill our responsibilities based on the privacy protection principles set out in the Policy. We have appointed a team of experts to design and manage MIS’s privacy protection program and to advise the entire organization about privacy protection. We have created a committee to ensure that the necessary protection measures are taken for every project where personal information is handled. This committee includes the persons in charge of access to documents and protection of personal information, the person responsible for document management and the person responsible for information security. We have also taken steps to sensitize members of the MIS team to their respective roles in the protection of your privacy.   Collecting information What are our collection practices regarding your personal information? How do we collect your personal information? In most cases we collect your personal information directly from you:

• When you contact customer services.
• When you use your Client Space or our website.
• As part of our programs in which you participate.
• When you answer surveys or sign up for our digital communications.
• When you visit our facilities.

Your personal information is usually collected by members of MIS’s team. However, a third party may collect your personal information on our behalf, for example, when we conduct surveys. In this case we ask our service provider to inform you when it collects your personal information on behalf of MIS. What types of personal information do we collect and why? We collect and use your personal information so we can carry out our mission, and more specifically to: Communicate with you.

• Process your application for employment opportunities we have posted.
• Supply MIS’s services
• Manage our various programs
• Ensure the effectiveness and quality of our business processes on a permanent basis
• Understand and improve, on an ongoing basis, your experience as a customer or job applicant
• Offer useful information and content, as well as promote our services and programs
• Meet our legal and regulatory obligations
• Detect or prevent crimes and offences against our infrastructures including to prevent electricity theft.

We collect the personal information necessary for a specific purpose. When we collect your personal information, we inform you about how it will be used. For example, we invite you to consult our Terms of use and confidentiality on our website to learn more about the type of personal information we collect when you navigate our website and how we use this information. Are you required to provide us with your personal information? When we ask for your personal information, we let you know (unless it is obvious from the context) whether the information is mandatory and the implications of your refusal to provide the information. For example, you are required to identify yourself and provide your contact information so that we can create a customer account for you. However, responding to our surveys is entirely optional.   Using information How do we use your personal information? We use your personal information for the purposes we have disclosed. Occasionally, we might wish to use your personal information for other purposes. In this case we will ask for your consent in advance. Please note that there are certain situations where we are authorized by law to use your personal information without your consent. How do we ensure that your personal information is accurate, complete and up to date? We make sure to use the most recent information with which you have provided us. You have an important role in keeping your personal information up to date, and we provide methods for you to update or correct it as needed. To update your customer information, you can contact our customer services or go to your Client Space. To update information about a job application, you can use this contact form to contact us or consult your job application file. If you believe we are using personal information that is inaccurate, incomplete or ambiguous, you can exercise the rights provided for.   Communicating information Do we communicate your personal information? We share your personal information with third parties when you request it or consent to it. In certain instances permitted by law, we may share your personal information with third parties without your consent. When do we communicate your personal information with third parties without your consent? Our activities sometimes require us to share your personal information with third parties so they can carry out specific tasks or functions on our behalf. In this situation we might be required to share your personal information with third parties without your consent. Rest assured that we follow all legal requirements. For example, we may communicate your personal information without your consent to the following third parties:

• service providers who process this personal information for us, for example for data hosting purposes
• payment service providers
• collection agencies
• external legal counsels
• regulatory authorities, ministries, public bodies and government agencies who request it based on powers granted by law or when this information is necessary for the application of an act in Québec
• police departments, if the information is necessary for an investigation they are conducting or if the information is the subject of a search warrant or production order
• a court that orders us to provide the information

How can you ensure that our service providers are properly protecting your personal information? In cases where we share your personal information with service providers so they can perform the necessary services, we require them, by written contracts, to commit to protecting your information through measures that are as strict as our own. Among other things, we ensure that our suppliers use your personal information solely to provide the services required. Do we share information with Google to measure our advertising? To measure how well our online advertising works, MIS may share limited registration information with Google LLC. When you register for a program, we may send Google your email address and phone number in a scrambled (“hashed”) form that cannot be read, together with the date and time of the registration. Your name, your child’s information and your payment details are never sent. Google may use this information only to match the registration to clicks on MIS ads and to report the results to MIS, in aggregate, under its customer data terms. This information may be processed outside Québec. You can ask us at any time to stop including your information by contacting customer service. This does not affect your registration. Is your personal information communicated to other provinces or countries? Yes. However, before doing this, we ensure that your personal information will be protected to the same way degree it is here in Québec. The public bodies and government agencies of these countries, like those in Québec and Canada, may access your information in accordance with their local laws.   Consent When and how do we ask for your consent concerning your personal information? We ask for your written or verbal consent in situations in which the law requires us to do so. For instance:

• When we wish to collect personal information that you are not required to provide, for example, if we wish to use such information to show you advertising that matches your profile;
• When we share your personal information with a third party that requests it; and
• When we wish to use your personal information for purposes other than those previously indicated and you are not under any obligation to authorize this secondary use. If you do not consent, we will explain the possible consequences of your refusal. If you do consent, we will indicate the process for withdrawing your consent if you change your mind, and we will explain the implications of such a decision.

Lastly, to ensure that your consent is fully enlightened, we will provide you the information you need to make an informed decision in advance, and will do so in a transparent, clear and concise manner.   Security What security measures have we implemented to protect your personal information? Because your trust is vital to us, we implement generally recognized security standards to protect your personal information for the entire period your information is in our possession. When deciding which measures to apply, we consider a number of factors, including the sensitivity of the information in question and the context in which it will be used. Our security measures fall into three main categories:

1. Technological security measures Examples: firewall, management of access privileges, encryption of information
2. Physical security measures Examples: locked filing cabinets and restricted access to premises
3. Organizational security measures Examples: policies, procedures, training and awareness concerning information security, reliability/integrity checks, identification and authentication procedures when you contact us or use our secure electronic services such as your Client Space or your candidacy file.

We review these security measures regularly to ensure they are applied properly and continue to be fully effective and appropriate given the evolution of our systems and of information technologies. We have also established procedures for detecting and managing security incidents that may affect your personal information. Members of the MIS team are required to report any suspected or actual incident. How can you help protect your personal information? When managing access to the secure sections of the website available to you (for example, your Client Space or your employment application), it is essential that you choose a strong password that only you know. This can help prevent potential problems. Your password must be complex enough to prevent someone from guessing it based on information found, for example, on social media or the Internet. We recommend that you create a password consisting of a mix of uppercase and lowercase letters, special characters and numbers, and that you avoid any personal references (in other words, do not use your name, date of birth, etc.). You should also change your password regularly and make sure it is different from passwords you use on other sites. What should you do if you believe your personal information has been compromised? If you have reason to believe your personal information has been compromised, please contact our access to information and privacy team. Their contact information is provided under the question Whom should you contact if you have questions about the Policy?   Retention How long do we keep your personal information? We keep your personal information for as long as is necessary to carry out our activities and offer you our services, plus an additional period of time provided for in our retention rules, which we have adopted and have been approved by the Bibliothèque et Archives nationales du Québec. This additional time allows us to meet certain legislative and regulatory requirements, or to enter such information into evidence in the event that we are party to legal proceedings. If you have questions concerning the retention period that applies to a specific situation, please contact our access to information and privacy team. Their contact information is provided under the question Whom should you contact if you have questions about the Policy?   Your rights What are your rights concerning your personal information? You have the right to access your personal information. Only you can exercise this right, unless you authorize the disclosure of your personal information to a third party. In addition, if you believe that we hold personal information about you that is inaccurate, incomplete or ambiguous, or if you believe that we have collected, used, communicated or retained this information contrary to the Access Act, you have the right to request that we correct your information or that we stop collecting, using, releasing or keeping the information in ways you consider to be unauthorized by the law. The law provides certain restrictions on your exercise of these rights. We will advise you in such situations. If you submit a request to us in this regard, we may require that you identify yourself and provide proof of identification so that we may verify the request. If you wish to exercise your rights, we recommend that you begin by consulting your Client Space or candidacy file. Much of your information can be found there, and you can update some of it yourself. Please do not hesitate to contact us:

• For questions concerning your personal information as a customer – call customer service.
• For questions concerning your personal information as a candidate for a job posted on our website – contact our onboarding department.

You may send a request for access or a request for correction in writing at any time to one of MIS’s persons in charge of access to documents and protection of personal information. Their contact information is provided below:   info@swim-montreal.com 514-294-8259   Do we update our Policy? Yes, we review the Policy every year to ensure that it accurately describes our privacy protection practices. We also update the Policy following certain events, such as amendments to applicable legislation or changes in our activities. We indicate changes to our policy through notifications on our website. Whom should you contact if you have questions about the Policy? info@swim-montreal.com