1. Person Responsible for the Protection of Personal Information

This privacy policy is published by Soudure CBF, a company operating in the construction and welding industry, subject to the Act to Modernize Legislative Provisions Relating to the Protection of Personal Information (S.Q. 2021, c. 25), commonly known as Quebec Law 25.

As a Quebec-based company, Soudure CBF is committed to collecting, using, and retaining your personal information in compliance with the obligations set forth in Quebec Act 25 and any other applicable law.

This policy applies to anyone who visits our website, submits a request for a quote, applies for a job, or communicates with us by any other means.

2. Personal Information Collected

We collect the following personal information, organized by category:

2.1 Identification and Contact Information

• First and last name
• Email address
• Phone number
• Mailing address (if applicable)

2.2 Information Related to Website Navigation

• IP address (Internet Protocol)
• Pages visited and session duration
• Browsing behavior (clicks, scrolling)
• Approximate location (region or city, based on IP address)
• Device identifiers (browser type, operating system)

2.3 Information Related to Human Resources

Since we accept job applications, we also collect:

• Resume and Cover Letter
• Professional Experience and Training
• Professional References
• Any other information you choose to provide to us in connection with a job application

2.4 Consent Preferences

• Your choices regarding cookies stored by our Moelleux consent management platform

We collect only the information necessary for the purposes described in Section 3. We do not collect sensitive information such as health data, biometric data, or social insurance numbers, unless you voluntarily provide it to us in connection with a job application.

3. Purposes of Processing

Your personal information is used for the following purposes:

3.1 Responding to Your Inquiries or Quote Requests

Data in Question: identification and contact information.
Legal Basis: the consent you expressly provide by submitting a form to us, and our legitimate interest in responding to your business requests.

3.2 Processing Job Applications

Data in Question: information related to human resources.
Legal Basis: You give your express consent by submitting your application to us. This information is used exclusively for recruitment purposes.

3.3 Audience Measurement and Website Improvement

Data in Question: browsing information (IP address, pages visited, session duration, behavior, approximate location, device identifiers).
Service Used: Google Analytics 4 (United States).
Legal Basis: consent collected through our Moelleux platform before activating this service.

3.4 Security and Prevention of Form Abuse

Data in Question: device identifiers.
Service Used: Google reCAPTCHA, which is integrated into our forms to distinguish human users from automated bots.
Legal Basis: We have a legitimate interest in protecting the integrity of our website and preventing fraudulent submissions. This service is considered essential to the functioning of the website.

3.5 Optimal Display of Text Content

Data in Question: IP address.
Service Used: Google Fonts, to load the fonts used on the website.
Legal Basis: legitimate interest in providing a consistent visual experience. This service is functional and can be disabled through your cookie preferences.

3.6 Storing Your Consent Preferences

Data in Question: consent preferences and IP address.
Service Used: Moelleux (by Horizon-Cumulus, Joliette, Quebec), hosted in Quebec.
Legal Basis: A legal obligation under Quebec Act 25 to document and respect your choices regarding cookies.

4. Third Parties and Subcontractors

We use the following third-party service providers in connection with the operation of our website. Each is bound by contractual obligations to protect personal information.

Our website is hosted by Horizon-Cumulus (Joliette, Quebec). Data related to website hosting remains in Quebec.

We use Microsoft 365 (United States) to manage our business emails. Communications you send to us via email may therefore pass through servers located in the United States. See Section 5 for more details on transfers outside Quebec.

5. Transfers Outside Quebec

In accordance with Article 17 of Quebec Act 25, we hereby inform you that certain of your personal information may be disclosed to subcontractors located outside Quebec, specifically in the United States. Here are the situations in question:

• Google Analytics 4 (Google LLC, United States): Your browsing data (IP address, website behavior, approximate location) are transmitted to Google for the purpose of generating statistical reports. This transfer occurs only with your prior consent.
• Google reCAPTCHA (Google LLC, United States): Device identifiers are transmitted to Google to verify that form submissions are made by a human. This service is essential to the website's operation.
• Google Fonts (Google LLC, United States): Your IP address is transmitted to Google when the website's fonts are loaded.
• Microsoft 365 (Microsoft Corporation, United States): emails you send to us at info@soudurecbf.com pass through Microsoft's infrastructure, whose servers are primarily located in the United States.

Before any transfer outside Quebec, we ensure that the level of protection afforded to your personal information is equivalent to that provided for under Quebec Act 25, in particular by entering into appropriate contractual agreements with these providers (standard contractual clauses, data processing policies, etc.).

When required, a privacy impact assessment is conducted prior to the transfer, in accordance with Article 17 of Quebec Act 25.

6. Retention Period

We retain your personal information only for as long as is necessary to fulfill the purposes for which it was collected or to comply with our legal obligations.

Upon expiration of these periods, your personal information is securely destroyed or anonymized in such a way that you can no longer be identified.

7. Rights of Individuals

Quebec Law 25 grants you several rights regarding the personal information we hold about you. You can exercise these rights by contacting our Privacy Officer (see section 8).

7.1 Right of Access

You have the right to know whether we hold personal information about you and, if so, to obtain a copy of it, as well as information about its source, the purposes for which it is used, and the third parties to whom it has been disclosed.

7.2 Right of Rectification

If personal information about you is inaccurate, incomplete, or ambiguous, you may request that it be corrected. You may also request that outdated or unjustified information be deleted, based on the purposes of the processing.

7.3 Right to Erasure (Right to Be Forgotten)

You may request the deletion of your personal information when its retention is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.

7.4 Right to Data Portability

You have the right to receive, in a structured and commonly used technological format, the personal information you have provided to us, so that you can transmit it to another entity responsible for the protection of personal information.

7.5 Right to Withdraw Consent

When the processing of your personal information is based on your consent, you may withdraw your consent at any time. Withdrawing your consent does not affect the lawfulness of processing carried out prior to such withdrawal. For analytical and functional cookies, you can change your preferences at any time through our Moelleux consent management banner.

7.6 Processing Timeline

We undertake to respond to any request to exercise rights within 30 days upon receipt, in accordance with Quebec Act 25.

7.7 Right to File a Complaint

If you believe your rights have not been respected, you may file a complaint with the Quebec Information Access Commission (CAI):

• Website: www.cai.gouv.qc.ca

8. Person Responsible for the Protection of Personal Information

In accordance with Article 8.1 of Quebec Act 25, Soudure CBF has designated a Person Responsible for the Protection of Personal Information. Any questions, requests, or concerns regarding this policy or the processing of your personal information may be directed to:

• Name: Fannie Laroche David Blais
• Title: --
• Email: info@soudurecbf.com
• Phone: 418 248-1438

We will acknowledge receipt of your request as soon as possible and respond to it within a maximum of 30 days, as provided for in Quebec Act 25.

9. Effective Date and Versioning

This privacy policy takes effect on July, 15 2026.

Version: 2

We reserve the right to modify this policy at any time to reflect changes in our practices, applicable laws, or the services we use. In the event of a significant change, we will notify you by posting a notice on our website. The most recent version is always the one published at this address.

We encourage you to review this policy periodically to stay informed about how we protect your personal information.