Privacy Policy

1. Subject matter and scope

This Policy sets out how Phanexa collects, uses, retains and discloses personal information in the course of providing its products, services and facilities to customers, and how it complies with applicable Canadian privacy laws.

2. Definitions

• "personal information" — information concerning a natural person that allows that person to be identified, regardless of the medium on which it is stored or the form in which it may be accessed. Information relating to a legal person, such as a company or a corporation, does not constitute personal information.
• "customer" — any person who uses, or has requested to use, Phanexa's products, services or facilities, including its website and any other application, communication or information-exchange platform.
• "third party" — any natural or legal person other than Phanexa, its employees or its customers.

3. Our responsibilities

Section 1 — Accountability

The mandate to implement and enforce this Policy is entrusted to:

Mohamed Wahba — Vice President, Legal Affairs, Corporate Secretary and Privacy Officer of Phanexa.

The Privacy Officer is also responsible for decisions concerning the communication of personal information to the individuals concerned or their representatives, to Phanexa's partners or collaborators, and to third parties, including law-enforcement or judicial authorities. Such decisions are made in accordance with applicable laws and with this Policy.

If the Privacy Officer is absent, or if an emergency arises and the Privacy Officer cannot be reached in a timely manner, responsibility for applying the Policy and for deciding on the communication of personal information is exercised by the person to whom the Privacy Officer has delegated his authority in matters of privacy.

Section 2 — Collection and use of personal information

The personal information that Phanexa collects includes, in particular, information about your identity — such as your first and last name, residential address, telephone number, e-mail address, social insurance number, date of birth, photographs and scanned documents — as well as financial information concerning you and your purchases, such as the payment method used, the value of the goods and services purchased and information related to your movements.

In most cases, Phanexa collects personal information directly from you. However, Phanexa may also obtain personal information about you from third parties with your consent — for example from partner airlines — or without your consent where the law permits, for instance when the collection of the information is clearly in your interest and your consent cannot be obtained in a timely manner.

Phanexa only collects and uses personal information that is necessary for the following purposes:

• 1. To provide products and services. For example, we may collect and use your address or e-mail address to deliver, by any appropriate means, the products and services you have requested.
• 2. To process a payment relating to the use of our products, services and facilities. For example, we collect and use financial information to process payments linked to your use of Phanexa's services.
• 3. To comply with our legal and regulatory obligations. For example, we may collect and use personal information to comply with a court order or to make required reports to government authorities.
• 4. To improve the products, services and facilities we offer. For example, we conduct customer satisfaction surveys to enhance our offering.
• 5. To respond to questions, comments and suggestions. For example, when questions are sent to us through the "Contact Us" page of our website.
• 6. To verify your identity. For example, to confirm that you hold the qualifications you claim to hold.
• 7. To communicate with you for direct-marketing purposes. For example, we may use your contact details to inform you of new products, services and facilities.
• 8. To improve your online experience. Your use of Phanexa's website or application allows us to automatically compile information relating to your user profile, which may include your computer's IP address, the operating system you use, the identity of your internet service provider, the date and time at which you accessed Phanexa's website or application, the previously visited site that directed you to Phanexa, and the content you view and download on our website or application. To do so, our website — like most websites — uses cookies, which are stored on your computer when you visit it. Phanexa uses this information to tailor its website to your preferences (including the advertisements displayed) and to produce statistics on the use of its website for improvement purposes. As with most internet browsers, you can delete cookies from your computer's hard drive, block the creation of new cookies or be warned before a cookie is set. If you do so, your use of our website may be affected and you may not be able to access all of its features.

Section 2 — Collection and use (continued)

Your personal information will not be used for any purpose other than those listed above, unless you consent to the new use or unless such other use is allowed under the conditions set out by law.

Section 3 — Communication of personal information

Phanexa acknowledges that, except in the cases described below and under the other conditions provided by law, communication of personal information to third parties requires your consent.

In accordance with applicable law, Phanexa may communicate your personal information without your consent in the following situations, among others:

• 1. the communication is made to a lawyer — in Quebec, to a lawyer or notary — acting on behalf of Phanexa;
• 2. it is made for the purpose of collecting a debt;
• 3. it is required pursuant to a subpoena, warrant or order issued by a court, person or body with the power to compel the production of information, or under rules of procedure relating to the production of documents;
• 4. it is made to a government institution — or a subdivision thereof — that has requested the information by citing the source of its legitimate authority to obtain it and, as the case may be, the fact that: (i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs; (ii) the communication is requested in order to enforce Canadian, provincial or foreign legislation, to conduct investigations related to such enforcement, or to gather security-related information to enable such enforcement; or (iii) it is requested for the purpose of enforcing Canadian or provincial law;
• 5. it is made, at the organization's initiative, to an investigative body, a government institution or a subdivision thereof, where the organization has reasonable grounds to believe that the information relates to a breach of an agreement or a contravention of federal, provincial or foreign law which has been, is being or is about to be committed, or where it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs;
• 6. it is made to a person who needs the information in the event of an emergency that threatens the life, health or safety of any individual and, if the person concerned is still alive, the organization will inform that person in writing without delay;
• 7. it is made for statistical purposes;
• 8. it is regulatory information that may be accessed by the public;
• 9. it is required by law.

Section 3 — Communication (continued)

Phanexa may also share your personal information without your consent with its agents, representatives, consultants, data managers and other service providers where such information is necessary for them to carry out their mandate or service agreement. In every such case, your personal information will be used only to provide specific services and will be kept confidential in accordance with this Policy.

Section 4 — Consent

For the consent to the collection, use and communication of personal information to be valid, the purposes must be stated in a manner that allows the individual to reasonably understand how the information will be used or communicated.

When you provide us with personal information, you consent to its use in the manner described in this Policy and, where applicable, further clarified at the time of collection. Depending on the nature and sensitivity of the personal information, your consent may be explicit — for example, by checking a box to indicate that you agree to the collection, use or communication of your personal information — or implicit — for example, where the purposes for using your personal information are reasonably apparent.

Subject to any legal or contractual restriction and to reasonable prior notice, you may refuse to give your consent, or withdraw your consent at any time. A refusal or withdrawal of consent may, however, prevent Phanexa from providing you with a product or service or from granting you access to certain of its facilities.

You may refuse or withdraw your consent by contacting us at [email protected]. Our staff will explain to you the options available and the consequences of your refusal or withdrawal, and will record your choices in our files.

Section 5 — Accuracy

Phanexa recognizes the importance of keeping the personal information concerning its customers accurate, complete and up to date. To that end, Phanexa has put in place reasonable measures to ensure the accuracy and completeness of the information having regard to the purpose for which it was collected. It remains the responsibility of the customer, however, to inform Phanexa of any significant change in his or her personal information during the business relationship with Phanexa.

Section 6 — Retention and protection measures

Phanexa has implemented various measures to protect your personal information against the risks of loss and theft, as well as against the risks of unauthorized access, communication, reproduction, use, modification or destruction. These measures include physical, administrative and electronic (technological) safeguards that are reasonable in light of the degree of sensitivity of the personal information collected, the quantity of information, its distribution, its format and the methods used to retain it.

Phanexa reviews and updates, on an ongoing basis, the security measures put in place to protect the security and confidentiality of the personal information it holds, in particular technological measures — in order to take into account technological developments and to counter unwarranted risks of intrusion into its databases and computer systems.

Phanexa retains the personal information concerning you only for as long as is necessary to achieve the purpose for which it was collected, to satisfy the legal requirements to which Phanexa is subject, and to protect its legitimate business interests.

Phanexa may process and store your personal information in Canada or in the United States. As a result, Canadian or United States governments, courts, law-enforcement organizations or regulatory bodies may, depending on the case, have access to your information under the laws in force in the jurisdictions where the information is located.

Phanexa may also use third-party service providers (for example, data-hosting or payment-processing providers) to manage one or more aspects of its business activities, including the processing or management of personal information. Whenever we engage an external company, we use contractual or other appropriate means to ensure that your personal information is protected in accordance with the law applicable to Phanexa and that it is collected, used, retained and destroyed in a manner that complies with this Policy. Where a third party to whom Phanexa transmits personal information about you operates in a foreign jurisdiction, local legislation may also allow the local authorities referred to above to access your personal information without your consent.

Section 7 — Access

Customers are entitled to access the personal information that Phanexa holds about them. Access requests must be made in writing and addressed to the Privacy Officer, Phanexa Inc., Montreal, Quebec, Canada, or by e-mail to [email protected].

In certain situations, and in accordance with applicable law, Phanexa may refuse to give you access to personal information concerning you. Examples of such situations include the following:

• 1. the disclosure of the information would reveal personal information about another individual;
• 2. the disclosure of the information would reveal confidential business information;
• 3. the information is covered by the solicitor–client privilege between a lawyer and his or her client;
• 4. the information was collected in the course of an investigation into non-compliance with an agreement or a contravention of a federal or provincial statute.

Section 7 — Access (continued)

Where access cannot be granted, Phanexa will notify you of the reasons for its refusal in writing.

If the personal information held by Phanexa about you is found to be inaccurate or incomplete, you may also submit a request for correction to Phanexa using the same procedure applicable to access requests. Where the information must be corrected, struck out or completed, Phanexa will amend the information accordingly and, if required, send the amended information to any third party that has access to the information in question.

Phanexa undertakes to respond to any access or correction request within 30 days of receipt of the written request, unless circumstances justify an extension. In such a case, Phanexa will send to the requesting party, within 30 days of the request, a notice of extension indicating the new time period and the reasons for the extension.

Access to your personal information is generally granted free of charge. Phanexa may, however, charge fees in accordance with applicable law, provided that it informs the requesting party of the approximate amount of such fees before acting on the request.

Section 8 — Review of the Policy

Phanexa's policies and procedures for the protection of personal information are updated on an ongoing basis. Please consult the most recent version of the Policy on our website at www.phanexa.com. A copy of the Policy may also be mailed to you upon written request addressed to the Privacy Officer, Phanexa Inc., Montreal, Quebec, Canada, or by e-mail to [email protected].

Section 9 — Your questions and concerns regarding compliance with this Policy

Any question or concern regarding this Policy and Phanexa's compliance with it, as well as any related complaint, must be sent in writing to the Privacy Officer, Phanexa Inc., Montreal, Quebec, Canada, or by e-mail to [email protected].

The Privacy Officer will investigate each written complaint received. Where a complaint is well founded, the Privacy Officer will take the measures necessary to resolve it, including modifying this Policy or the procedures used to protect personal information, where appropriate. In each case, the complainant will be notified in writing of the outcome of the investigation.

The Privacy Officer reports annually to Phanexa's board of directors on the number of complaints received during the preceding year, their nature, and the measures taken in response to them.

For any general question regarding the federal rules applicable to Phanexa in respect of the protection of personal information in Canada, or to obtain a copy of the Personal Information Protection and Electronic Documents Act, please contact the Office of the Privacy Commissioner of Canada at 112 Kent Street, Ottawa, Ontario K1A 1H3, or visit its website at https://www.priv.gc.ca/en.