PRIVACY POLICY - M-itech Software Inc.

1. Scope

This Policy applies to personal information we collect through all of our software, applications and services, our websites, portals and interfaces, in the course of our communications with clients and users, and during the creation and management of accounts.

2. Information Collected

2.1 Information Provided Directly

Identification information (name, professional email address, phone number), account information (login credentials, preferences), billing information and communications.

2.2 Information Collected Automatically

Usage data (features used, access frequency), technical data (IP address, browser type, operating system) and connection logs.

2.3 Client Data

Client Data (data relating to your activities, buildings, equipment, systems, etc.) that you submit in our software is processed in accordance with the applicable Terms of Use and remains your property in its original form ("Raw Client Data"). M-itech may create Derived Data (aggregated, anonymized, statistical data, models, indicators or information) from Client Data, Results or use of the Service. Derived Data is the exclusive property of M-itech, as set out in the Terms of Use.

3. Purposes of Processing

We use personal information to provide, operate and maintain our services, create and manage user accounts, process payments, provide technical support, send service-related communications, improve our services, create Derived Data for analysis and development purposes, ensure the security of the Service and prevent fraud, and comply with our legal obligations.

4. Legal Basis for Processing

We process personal information on the following bases: performance of the contract, legitimate interests (improving our services, ensuring security), consent where required by law, and legal obligations.

5. Sharing of Information

5.1 Service Providers

We use third-party providers for hosting, payment processing, billing, communications and other technical services. M-itech selects its providers taking into account their security practices, certifications and the data processing terms they offer. The use of these services is governed by the terms of use and data processing agreements of each provider.

5.2 Legal Obligations

We may disclose information if required by law, court order, or a competent governmental authority.

5.3 Business Transfers

In the event of a merger, acquisition or sale of assets, personal information may be transferred.

6. Sub-processors and Hosting

M-itech uses third-party sub-processors to provide certain aspects of the Service, including hosting, infrastructure, payment processing, communications and other technical services. The majority of data is hosted in Canada. Certain sub-processors may be located in other jurisdictions, as specified in Section 7.

The detailed list of sub-processors is available upon request. M-itech may change its sub-processors at any time without notice. Sub-processors are independent entities subject to their own terms of use and privacy policies, and are treated in accordance with applicable local laws.

Within M-itech, only the technical team has access to personal information, to the extent necessary for the performance of their duties.

Sub-processors are subject to their own privacy policies and security practices. M-itech governs its relationships with its sub-processors through data processing agreements (DPAs) and endeavors to select reliable partners offering appropriate security guarantees.

7. International Transfers

Your information may be transferred to and processed in jurisdictions other than the one in which you reside, including Canada and the United States, where some of our sub-processors may be located. In such cases, we ensure that appropriate safeguards are in place to protect your information in accordance with the laws applicable in your jurisdiction, to the extent that this is within our control. Where required by applicable law, a privacy impact assessment is conducted prior to any transfer of personal information outside the jurisdiction of origin.

8. Data Retention

We retain personal information for as long as necessary to provide the services, comply with our legal obligations, and resolve disputes. Upon termination or expiration of the Subscription, Client Data is retained for a grace period of thirty (30) days, during which the Client may request the export of its data in accordance with the Terms of Use. Upon expiration of the grace period, Client Data is deleted from production systems within a reasonable time. Backup copies may be retained in accordance with backup retention cycles and will be deleted during normal rotation. M-itech may also retain data to the extent required by applicable laws, including for accounting, tax or compliance purposes.

In accordance with the Terms of Use (Sections 11 and 13), M-itech retains a perpetual and irrevocable license on all Derived Data created from Client Data, Results or use of the Service. Such Derived Data is the exclusive property of M-itech and may be retained and used permanently for analysis, statistics, improvement, research, development and any other commercial purposes, including after the termination of your subscription, without time limitation or obligation to delete. As Derived Data is anonymized and aggregated, it does not constitute personal information and is therefore not subject to deletion or portability obligations.

9. Security

We implement appropriate technical and organizational security measures for the systems under our direct control. However, we cannot guarantee the security or confidentiality of data processed by our third-party sub-processors.

In the event of a privacy incident presenting a risk of serious harm, M-itech notifies the competent authorities and the affected individuals with diligence, in accordance with applicable laws. M-itech maintains a register of all privacy incidents.

10. Your Rights

In accordance with the applicable personal information protection laws in your jurisdiction (including, without limitation, Law 25 in Quebec, PIPEDA in Canada, the GDPR in Europe, or any other applicable legislation), you may, to the extent provided by such laws:

• Access your personal information
• Request the rectification of your information
• Request the deletion of your information
• Withdraw your consent
• Request the portability of your information in a structured and commonly used technological format
• File a complaint with the competent data protection authority in your jurisdiction (in Quebec: the Commission d'accès à l'information)

11. Cookies

Our services use essential cookies necessary for the technical operation of the service, including for authentication and session management. No consent is required for these essential cookies. Our showcase website does not use any advertising or cross-site tracking cookies. It uses a privacy-friendly, cookieless analytics tool that measures aggregated traffic without storing cookies on your device and without collecting personally identifiable information. Apart from this, it collects only the personal information that you choose to provide through our contact form, in accordance with the purposes described in Section 3.

Because our analytics tool does not use cookies and does not identify you individually, no consent banner is required. If we add any analytics or audience-measurement technology that relies on cookies or that identifies you in the future, it will be disabled by default and enabled only with your consent.

12. Privacy Officer

M-itech has appointed a privacy officer responsible for ensuring compliance with this Policy and applicable laws.

13. Modifications to the Policy

We may modify this Policy at any time. Modifications take effect upon publication. Your continued use of our services after the publication of modifications constitutes your acceptance of the modified Policy.

14. Contact

For any questions regarding this Policy or to exercise your rights:

To exercise your rights, you may contact us by email or in writing at the address above. We will respond to your request within thirty (30) days.

To withdraw your consent to analytics cookies (if applicable), you may change your preferences via our consent banner or your browser settings.

15. Language

This Policy is drafted in French and may be translated into other languages. In the event of any discrepancy between the French version and a version in any other language (including English), the French version shall prevail.