PRIVACY POLICY

Responsible organization: BLAIS-LANDRY INC., doing business as ASSEK TECHNOLOGIES

Effective date: October 1, 2023

Last updated: July 14, 2026

1. Purpose and Scope of this Policy

This Privacy Policy explains how Blais-Landry inc., doing business as Assek Technologies (“Assek”, “we”, “us” or “our”), collects, uses, discloses, retains and protects personal information in the course of its activities.

It applies to Assek’s websites, the Oblik and Secur platforms, client portals, connected services, commercial communications and technical support services provided by Assek. It applies in particular to visitors to our websites, users of our platforms, representatives and contacts of our clients, recipients of alerts, and individuals who communicate with us.

This policy supplements the terms of use of our websites and platforms, the agreements entered into with our clients, and the privacy notices provided at the time of collection. Where a more specific notice is provided for a particular collection or service, that notice supplements this policy and prevails with respect to that collection to the extent of any inconsistency.

2. Definitions

For the purposes of this policy, the following terms have the meanings set out below:

“Assek” means Blais-Landry inc., doing business as Assek Technologies.

“Client” means an organization that enters into an agreement with Assek to use Oblik, Secur or another digital service of Assek.

“Authorized User” means an individual to whom a Client or Assek grants access to a Digital Service.

“Digital Services” means Assek’s websites, the Oblik and Secur platforms, and their related portals, interfaces, applications and features.

“Personal Information” means any information relating to a natural person that allows that person to be identified, directly or indirectly. In this policy, this expression also includes “personal data” where the GDPR applies.

“Service Provider” means a company or professional to whom Assek entrusts certain operations necessary for the provision, hosting, security, support or administration of its Digital Services.

3. Roles of Assek and its Clients

Oblik and Secur are primarily offered to organizations. In some cases, a client determines the purposes for which personal information is entered and used in our platforms. Assek then processes that information on behalf of the client in order to provide the agreed services, in accordance with the client’s instructions, the applicable agreements and the law.

Assek nevertheless determines the purposes of certain processing activities necessary for account administration, authentication and security, billing, technical support, operation of its services and compliance with its own legal obligations. Assek remains responsible for the personal information it holds or processes to the extent provided by applicable laws.

The client is responsible for ensuring that it has the required authorizations to collect, use and disclose the information it enters into Oblik or Secur. Where a request relates to information administered by a client, Assek may forward the request to the client concerned or cooperate with that client in responding to it, without limiting Assek’s own obligations.

4. Applicable Laws

This policy is intended to comply with Quebec’s Act respecting the protection of personal information in the private sector, Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) where applicable, and any other law applicable depending on the context.

Where the territorial application criteria of the European Union General Data Protection Regulation (GDPR) are met, Assek processes personal information in accordance with the applicable requirements of the GDPR and provides, where necessary, a supplementary notice specifying the information required for the processing concerned, including the applicable legal basis, relevant international transfers and the rights of the data subject. In the event of any inconsistency between this policy and an applicable law, that law prevails to the extent of the inconsistency.

5. Purposes of Collection, Consent and Other Authorizations

Before collecting personal information, Assek determines the purposes of the collection and provides the required information in clear and plain language. We obtain the consent of the individual concerned where required by law. Such consent must be clear, free, informed and given for specific purposes. Where sensitive personal information is involved, we obtain express consent where required by law.

Where information is necessary to create an account, use a feature or provide a requested service, it is collected and used for the purposes communicated at the time of collection. Refusal to provide required information may limit or prevent the provision of the service concerned. Assek collects, uses or discloses information without consent only in the circumstances expressly permitted by law.

An individual may withdraw consent to an optional use or disclosure, subject to legal or contractual restrictions and a reasonable period of time to give effect to the request. Withdrawal takes effect for the future and may limit certain services or features.

Where the GDPR applies, Assek relies on the appropriate legal basis for the processing, including consent, performance of a contract, compliance with a legal obligation, or the legitimate interests of Assek or a third party, depending on the nature of the processing and subject to the rights and freedoms of the data subject.

6. Personal Information We Collect

We limit collection to the information reasonably necessary for the purposes determined before or at the time of collection. The information collected varies depending on how an individual interacts with Assek.

6.1 Information collected automatically

When you visit our websites or use our Digital Services, we may automatically collect the following information:

  • IP address and, where available, an approximate location derived from it;
  • device type, operating system, browser and certain technical information;
  • pages, screens, links and features viewed or used;
  • access dates and times, login attempts and activity logs;
  • diagnostic information, errors, performance data and security events;
  • cookies and similar technologies described later in this policy.

6.2 Websites, inquiries and commercial communications

When you complete a form, subscribe to a newsletter, request a demonstration or communicate with us, we may collect:

  • your first and last name;
  • your email address and telephone number;
  • your position, profession and the name of your organization;
  • your communication preferences;
  • the content of your request, comments and any documents you choose to send us.

6.3 Information processed in Oblik

In connection with the Oblik platform and related connected services, we may process:

  • account information, including name, email address, telephone number, organization, role and access rights;
  • contact details of individuals designated to receive alerts or reports;
  • information relating to buildings, locations, units, zones, equipment, sensors and valves associated with the account;
  • measurements, states and data transmitted by connected sensors and devices;
  • alarms, alerts, commands, notifications, acknowledgements, follow-ups and event logs;
  • settings, dashboards, reports and configurations created or used by the client;
  • connection, usage, administration and technical support logs;
  • other information reasonably necessary for the service that a client or Authorized User enters in the fields or documents provided for that purpose.

Operational data relating to a building or device does not necessarily constitute personal information. It may, however, be considered personal information when associated with an account, a person, a unit or a location that allows a natural person to be identified directly or indirectly.

6.4 Information processed in Secur

In connection with the Secur platform and related intervention services, we may process:

  • account information, roles, permissions and access logs;
  • contact details of clients, representatives, occupants, suppliers, technicians and other individuals related to a project;
  • addresses and information relating to buildings, floors, rooms, zones and intervention projects;
  • information on devices, sensors, samples, environmental conditions and drying activities;
  • photographs, thermal images, annotations, observations, documents and other information added to a project file;
  • reports, estimates, invoices, billing information and communications related to the services;
  • activity in the client portal, support requests and technical information required for diagnosis;
  • other information reasonably necessary for the service that a client or Authorized User enters in the fields or documents provided for that purpose.

Certain information processed in Secur, including photographs, documents, observations or information relating to occupants, may be sensitive depending on its nature and context. Assek applies appropriate protective measures and obtains express consent where required by law. Users must not enter personal or sensitive information that is not necessary for the service.

6.5 Technical support, business relationships and information from third parties

When you request support or maintain a business relationship with Assek, we may collect your professional contact information, the content of requests and communications, technical information required for diagnosis, intervention history, contractual and billing information, and the documents you send us.

We may also receive information from a client, account administrator, installer, technician, authorized partner or Service Provider where necessary to create or administer an account, install or support a solution, process a request or provide the agreed services. Upon request and where required by law, we inform the individual concerned of the source of that information.

7. How We Use Personal Information

We use personal information for the purposes indicated at the time of collection, for compatible purposes that have a relevant and direct connection with those purposes, or in other cases authorized by law, including to:

  • provide, configure, administer, maintain and improve our websites, platforms and services;
  • create accounts, authenticate users and manage roles, permissions and access;
  • monitor devices and sensors, detect events, generate alerts and send notifications;
  • execute authorized commands, maintain an event log and produce dashboards and reports;
  • manage projects, interventions, documents, estimates, invoices and client portals in Secur;
  • respond to requests, provide technical support and diagnose errors or performance issues;
  • ensure security, prevent unauthorized access, detect fraud, investigate incidents and protect our rights;
  • manage our contractual, administrative, accounting and commercial relationships;
  • produce statistics and improve our services, favouring aggregated or de-identified information where reasonably possible;
  • send commercial communications, news or newsletters with the required consent;
  • comply with our legal, regulatory and contractual obligations.

Identifiable personal information entered by a client is used for general analysis or improvement of our services only where such use is compatible with the purposes communicated, is based on valid consent, or is otherwise permitted by law. Where we use de-identified information, we take reasonable measures to limit the risk of re-identification.

8. With Whom We Disclose Personal Information

8.1 Authorized personnel

We may make information available to authorized employees, officers and representatives of Assek who reasonably need it to perform their duties. These individuals are subject to confidentiality obligations and access controls adapted to their responsibilities.

8.2 Service Providers acting on behalf of Assek

We may disclose information to providers that help us operate our business and provide our services, including providers of cloud hosting and infrastructure, authentication, email, SMS or call delivery, technical monitoring, analytics, support, billing and information technology services.

We limit the information disclosed to what is necessary and govern the processing through written agreements and appropriate contractual, organizational and technical measures. These agreements provide, depending on the context, for confidentiality, purpose limitation, security measures, incident management, and retention or destruction of information.

8.3 Advisors and independent recipients

We may disclose information to legal counsel, accountants, auditors or other professionals where reasonably necessary. These recipients may be subject to their own professional, legal and ethical obligations with respect to the information received.

8.4 Clients, administrators and Authorized Users

Information contained in Oblik or Secur may be accessible to the client organization, its account administrators and the users it authorizes, according to the configured roles and permissions. Clients are responsible for managing their users and limiting access based on their needs.

8.5 Installers, technicians and authorized partners

Where necessary to install, maintain, inspect or support a solution, we may disclose limited information to installers, technicians, subcontractors or authorized partners. Access is limited to the information necessary for the intervention concerned and is governed according to the nature of the relationship.

8.6 Other disclosures

We may also disclose personal information:

  • where required or permitted by law;
  • to respond to an order, subpoena, investigation or legal proceeding;
  • to prevent fraud, protect the safety of a person, or defend the rights and property of Assek;
  • in connection with a merger, reorganization, financing, sale of assets or other business transaction, subject to the conditions and confidentiality measures provided by law.

Assek does not sell personal information.

Our websites and communications may contain links to third-party websites or services. The practices of those third parties are governed by their own privacy policies, except where they act as Service Providers on behalf of Assek.

9. Processing and Retention Outside Quebec

The main production databases for the Oblik and Secur platforms are configured to be hosted in Quebec.

However, certain Service Providers used by Assek may collect, process or retain information outside Quebec or Canada. This may include email, SMS or call delivery services, as well as certain technical logs, delivery information, account data or backup copies held by those providers.

Before disclosing personal information outside Quebec or entrusting the processing of personal information to a person or organization located outside Quebec, Assek conducts the privacy impact assessment required by law and enters into a written agreement taking into account the results of that assessment. The disclosure takes place only if the information receives adequate protection in light of the circumstances and generally recognized principles regarding the protection of personal information.

Information processed in another jurisdiction may be accessible to courts, law enforcement authorities or other authorities of that jurisdiction, in accordance with the laws applicable there.

10. Retention, Destruction and Anonymization

We retain personal information only for the period necessary to achieve the purposes for which it was collected, provide the services, comply with our contractual commitments and meet legal, accounting, security and business continuity requirements. Applicable periods are determined based on the nature of the information, its sensitivity, the purposes of processing and the obligations attached to it.

For Oblik and Secur, the following rules generally apply:

  • sensor data and event logs are retained for a minimum period of one year. After that minimum period, they are retained for as long as necessary to provide the services and are deleted upon the client’s request or at the end of the contractual relationship, subject to a different period agreed with the client, legal or contractual obligations, security requirements and backup cycles;
  • user account data is retained for the duration of the contractual relationship and for as long as the account remains active. When the account is closed, it is deactivated and then deleted from active systems in accordance with the account closure process, subject to information that must be retained to comply with a legal obligation, maintain security logs or protect the rights of Assek or the client;
  • information related to projects, reports, estimates, invoices and service files is retained according to the client’s operational needs and the applicable legal, tax, accounting or contractual retention periods.

Information collected through our websites, forms, commercial communications and support activities is retained for as long as necessary for the relevant purposes or until consent is withdrawn, where consent is the basis for processing, subject to applicable retention obligations.

Our Service Providers may retain certain information, logs, delivery evidence or backup copies according to the settings configured by Assek, the applicable service agreements and, where necessary, their legal obligations. Assek limits retention periods to the extent reasonably possible and requests deletion where the service and applicable agreements allow it.

Deletion from active systems may not result in immediate deletion from backup copies. These copies are isolated from ordinary use and are deleted or overwritten according to normal backup cycles, except where longer retention is required by law or necessary for security and business continuity.

At the end of the applicable period, information is securely destroyed. Where Assek chooses to anonymize the information rather than destroy it, anonymization is carried out irreversibly and in accordance with legal requirements and generally recognized best practices.

11. Security of Personal Information and Confidentiality Incidents

Assek applies reasonable security measures, taking into account in particular the sensitivity of the information, the purpose for which it is used, its quantity, distribution and medium. Depending on the nature of the service and the information concerned, these measures include in particular:

  • secure connections and authentication mechanisms;
  • role-based access controls and the need-to-know principle;
  • logging, monitoring and detection of certain unusual activities;
  • backups and service continuity measures;
  • confidentiality obligations and awareness measures for personnel and providers;
  • processes for managing access, vulnerabilities and confidentiality incidents.

No method of electronic transmission or storage is entirely risk-free. Despite the measures in place, Assek cannot guarantee absolute security.

Assek maintains procedures to detect, examine, document and address confidentiality incidents. Where an incident meets the risk threshold provided by an applicable law, Assek promptly notifies the individuals concerned and the competent authorities, including the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada, as applicable. Assek also takes reasonable measures to reduce the risk of harm and prevent similar incidents.

12. Governance and Handling of Complaints

The person in charge of the protection of personal information oversees Assek’s policies and practices regarding the protection of personal information and ensures their implementation. These policies and practices are adapted to the nature and scope of Assek’s activities and are reviewed when necessary.

Personnel who collect, use, disclose, retain or destroy personal information are informed of their responsibilities. Their access to information is limited to what is necessary to perform their duties, and awareness or training measures are implemented according to their roles.

Any complaint relating to the protection of personal information may be sent to the person in charge at the contact information provided at the end of this policy. Assek acknowledges receipt of the complaint, examines it confidentially, may request the information reasonably necessary to process it and communicates its response within a reasonable time, taking into account the nature and complexity of the complaint.

13. Your Rights Regarding Your Personal Information

Subject to the exceptions and conditions provided by applicable laws, an individual may request, in particular:

  • confirmation of the existence of personal information held by Assek concerning them and access to that information;
  • information about the use of their information and the third parties or categories of third parties to whom it has been disclosed;
  • correction of inaccurate, incomplete or ambiguous information;
  • withdrawal of consent to certain uses or disclosures;
  • deletion or cessation of retention of information in the cases provided by law, including where its collection, use, disclosure or retention is not authorized;
  • cessation of dissemination or de-indexing of certain information where the conditions provided by law are met;
  • communication of certain computerized information in a structured and commonly used technological format, where the right to portability applies;
  • additional information about how their information is processed or the filing of a complaint.

Where the GDPR applies, an individual may also have, depending on the context, rights to erasure, restriction of processing, objection and portability, as well as the right to withdraw consent and lodge a complaint with a competent supervisory authority.

We may request reasonable information to verify the identity of the person making a request. In Quebec and under PIPEDA, access or correction requests are generally processed within 30 days of receipt, subject to extensions, exceptions and other terms permitted by law.

Where a request concerns information administered by a client in Oblik or Secur, Assek may coordinate the response with that client or direct the individual to that client. This coordination does not limit the rights of the individual concerned or the obligations applicable to Assek.

An individual who is not satisfied with the handling of their request or complaint may contact, depending on the applicable law, the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada or the competent European supervisory authority.

14. Cookies and Similar Technologies

A cookie is a small file stored on a device when an individual visits a website. Our websites and Digital Services may also use similar technologies to ensure their operation, maintain a session, protect accounts, remember preferences, understand usage and diagnose issues.

We may use the following categories:

  • essential cookies: necessary for operation, security, authentication and provision of the services;
  • preference cookies: used to remember certain choices and settings;
  • analytics cookies: used to understand the use of our websites and improve their design and operation.

Certain cookies or analytics tools may be provided by third parties. Where the law requires prior consent, non-essential cookies and functions are activated only after the individual has expressed their choice in our cookie management tool. Where a technology includes functions that allow identification, location tracking or profiling, the required information is provided before those functions are activated.

You may modify your choices in the cookie management tool where available and manage certain cookies in your browser settings. Disabling essential cookies may prevent certain features from functioning properly.

15. Commercial Communications

With the required consent, Assek may send newsletters, news, invitations or other commercial communications. Each promotional email includes a mechanism allowing you to unsubscribe. Withdrawal of consent to commercial communications does not prevent Assek from sending operational, security or contractual communications necessary for the provision of the services.

16. Minors

The websites, Oblik and Secur are intended primarily for organizations and professional users. Assek does not seek to collect personal information directly from minors.

In Quebec, personal information concerning a minor under the age of 14 is not collected directly from that minor without the consent of the person having parental authority or the tutor, unless the collection is clearly for the benefit of the minor. Where the GDPR applies to a direct offer of information society services to a child, the rules relating to the age of consent provided by the GDPR and the law of the relevant State apply.

Where a client enters information concerning a minor into a platform, the client is responsible for ensuring that such collection, use and disclosure are authorized and comply with applicable requirements.

17. Changes to this Policy

This Privacy Policy may be amended from time to time to maintain compliance with the law and reflect changes to our activities, platforms, providers or processing practices. The last updated date indicated at the beginning of the policy will be modified accordingly.

Where changes are material, we inform the individuals concerned by means of a notice on our website, in a platform, by email or by any other appropriate means depending on the context. We recommend reviewing this policy periodically.

18. Person in Charge of the Protection of Personal Information

To exercise your rights, ask a question or file a complaint relating to the protection of personal information, please contact Assek’s person in charge of the protection of personal information:

Alexis Trépanier

Person in charge of the protection of personal information

Email: confidentialite@assek.ca

Telephone: (418) 833-8084

4820 rue de la Pascaline, Suite 100

Lévis, Quebec  G6W 0L9

Canada