Governance and Privacy Policy

1. General Statements

LABPLAS INC. ("LABPLAS") is a Quebec-based manufacturer of sterile products for analysis and sampling, boasting a multidisciplinary center for the production of world-class unique machines, research and development, microbiological sciences, information technology development, and in-house human resources and legal support services. Therefore, it is possible that LABPLAS may need to use certain personal, confidential, or sensitive information during its corporate mission to fulfill its legal and regulatory requirements (e.g., compiling employee health records), to enable its members to meet their ethical obligations, and to provide goods and services in accordance with the requests of its partners.

This Personal Information and Privacy Governance Policy ("Policy") is intended to inform you of our general principles regarding the collection, use, and disclosure of your personal information, our data retention schedule, our procedures for the methods of destroying personal information and anonymization, our procedures for receiving and processing complaints about our practices under the Policy, and how you can exercise your rights. It also covers our security tools in place to protect your data, how we manage any incidents related to breaches of confidentiality, as well as statements regarding the use of surveillance cameras and biometric systems.

The Policy is approved and regularly updated by our Privacy Coordinator, who can be reached at the email address protectiondesdonnees@labplas.com.

2. What We Collect

Personal information refers to information that can directly or indirectly identify an individual, excluding any name, job title, address, or business phone number of an employee within a company. In cases where we collect sensitive information, typically to enable some of our employees and partners to fulfill their ethical obligations, we will always inform you and seek your consent for that specific collection. Sensitive information includes data inherently linked to your person, such as your biometric data or medical information. Information sensitive for cultural reasons, such as those related to your ethnicity or religious beliefs, is never collected by LABPLAS.

We limit the collection, use, and disclosure of personal information to what is necessary to achieve the purposes for which it was collected, based on our business relationship with you. This information may include:

1. Identity and General Information: This includes your name, postal address, phone number, country of residence, profession, email address, job title, a government-issued identification document, such as a valid driver's license or health insurance card, as well as other documents or means to confirm your identity. Some general information may also be recorded in an entry log at our office entrances for security purposes.
2. Financial Information: such as payroll or billing information. Specific requests for credit inquiries regarding our partners will be communicated to you in writing, and your consent will be sought.
3. Legal Inquiries: This encompasses personal information in the event of internal legal notices, the drafting of certain contracts for hiring purposes, the inclusion of your name and address in a patent registry, the compilation of your personal information for legitimacy and compliance validation due to certain corporate checks on an official business registrar, and the initiation of certain legal proceedings.
4. Privileged Communication: Furthermore, we may collect information that you choose to provide during your communications with us. Both our human resources and legal services advise against sending any confidential information until we have confirmed in writing that you are authorized to do so. Messages sent to our human resources or legal department do not establish a client-professional or client-attorney relationship. They may not be protected by confidentiality obligations and, as a result, may be disclosed to third parties.
5. Professional and Legal Background: This includes personal information found in your resume and interview guides that you provide to us as part of the hiring process. Mandatory background checks are conducted for internal positions to ensure the strength of our supply chain as part of our security programs with international partners (C-TPAT and under the Canadian Air Cargo Security Regulations).
6. Marketing Information: This pertains to personal information you provide when subscribing to our publications or joining our mailing lists for surveys or access to exclusive content. LABPLAS complies with the Canadian Anti-Spam Law and does not engage in any practices aimed at exploiting digital technology. With your consent, we may take your photo during events and share it on our social media platforms.
7. Publicly Available Information: If certain information about you or provided by you is publicly accessible, for example, on LinkedIn or in a newspaper article, LABPLAS may gather such information. This also includes your interactions with us on various social media platforms, such as clicking buttons like "like," "upvote," or "downvote," as well as your comments and other engagements.
8. Health Information: If you are an employee, we only collect medical information, with your consent, during the onboarding process using a designated form or in situations concerning your health and safety to comply with provincial and national laws or regulations. If you are a partner, we may need to collect, with your consent, specific information such as food allergies or restrictions due to a particular disability during LABPLAS-organized events.
9. Digital Information: 
   (i)For anyone visiting our website, we collect information about your browser and device, such as your Internet Protocol (IP) address, operating system type, browser type, time zone, unique device identifier, and information regarding your browsing history or data collected through cookies or other tracking technologies related to your activity on our website. This may encompass the pages you've viewed, the time of access, page load speed, and how you interacted with these pages. Additionally, we analyze certain patterns related to website traffic, usage, and related site information to enhance your experience during your visit to our website. We utilize cookies to store information about your visit, allowing us to remember your preferences and facilitate a smoother and faster navigation and exploration of our website. You have the option to delete these cookies at any time. LABPLAS configures the security and privacy settings of its website to the highest default standards. If an identifier enables you to access a platform/portal from our website, LABPLAS collects and retains this identifier, along with your password, for security purposes. We strongly recommend using a unique password, different from all your other online credentials.
   
   
   Do we collect personal data from our website users once they navigate to third-party sites?
   
   
   
10. Biometric Data: If you contact us by phone, your voice may be recorded for quality control purposes. You will be informed of this at the beginning of the call. Additionally, our camera systems monitor various key areas of our headquarters to safeguard our operations, employees, and the supply chain. No camera is used to specifically monitor an individual and is only accessed in the event of reported security incidents. Due to the sensitive nature of the images captured by the cameras, the servers periodically delete the content without anonymization or archiving. Finally, we offer our employees a micro-market service in the cafeteria, where transactions can be made using fingerprints. LABPLAS ensures, through its partner, that these data are processed with the same level of confidentiality as outlined in this policy.
11. Economic Sanctions: Various laws and regulations require us to conduct certain checks related to fraud prevention, anti-money laundering, corruption, checks against lists of sanctioned individuals and entities, and other types of verifications mandated by regulations. We may collect information in a designated register for this purpose to facilitate the qualification of our partners, expedite our logistics services, and ensure supply chain security.

3. The Purposes for Which We Use Your Personal Information

We collect, use, disclose, and process your personal information for the following purposes:

1. Compiling our employee and legal records in compliance with the law and our ethical obligations. This includes any information related to your job application.
2. Establishing your identity to confirm that we can enroll you in our systems and comply with requirements related to fraud prevention, anti-money laundering, corruption, and other legal and regulatory obligations. This is also done to protect ourselves and our partners from unlawful practices, individuals, or entities, as well as to minimize the risk of errors.
3. Producing and enhancing our goods and services, particularly to ensure the efficiency of our operational processes, from order to delivery.
4. Providing you with information about our products that you have ordered and those that may be of interest to you, sending you our marketing communications, notifications for various updates, invitations, surveys, or other communications, including email communications, in compliance with the requirements of the Canadian Anti-Spam Law.
5. Complying with any legal framework for due diligence. This may include inquiries to third parties for professional advice, such as seeking legal opinions.
6. Fulfilling our financial obligations, whether for payroll, billing, credit inquiries, or acting as a creditor.
7. Enhancing our website based on user interactions and improving our services when you contact us.
8. Strengthening security, both for the cybersecurity of our systems and our supply chain obligations, as well as for physical locations where we operate.
9. Protecting our legitimate business interests, such as ensuring our payments as a debtor, enhancing our business relationships, and providing any other form of significant and real security for our partners and employees that is not mentioned elsewhere in this Policy.

Regarding your sensitive information, LABPLAS processes these data for the following reasons, within the limits permitted by law:

1. We have obtained your explicit consent to process them in a specific situation. This consent must be obtained separately for each new event for which we would need to request your consent; 
2. It is necessary to protect your interests, for example, in cases where an employee experiences a medical emergency, and we must address the medical urgency;
3. This data is publicly available, for instance, when you have voluntarily published content on the web;
4. In the event of litigation, but only to the extent necessary for a full and complete defense of the specific dispute;
5. There is a motive of public interest, such as preventing a terrorist act.

Please note that we do not sell any personal information.

4. How We Collect Your Personal Information

For the purposes stated above, we may collect personal information in various ways, including:

1. Directly from you, which may occur through your interactions with us, when you subscribe to our communications and social media, apply for a job, or when you have clearly given consent in one form or another.
2. From third parties, such as banks with whom you may have affiliations, but strictly limited to purposes related to legitimacy, solvency, and risk management. Conversely, we do not accept personal information about third parties from you without unequivocal evidence of their consent. LABPLAS does not gather any personal information through hearsay.
3. From information already publicly available.
4. Through our website using cookies or other tracking technologies.

5. Your Data Is Shared Only with the Following Parties:

1. Our employees, agents, and subsidiaries, to the extent necessary for the performance of their job duties.
2. Various experts or consultants, foreign correspondents, or other external advisors, and specific specialized third parties, for the purpose of analyzing our business processes and enhancing our products and services.
3. Our cloud and intranet systems are partially monitored and managed by a third-party provider, which contributes to network maintenance, security, and the implementation of cybersecurity best practices. This third party also assists in cases of virtual intrusion attempts.
4. Common law courts, administrative tribunals, and arbitrators, when applicable.
5. Government agencies and authorities responsible for enforcing specific laws.
6. Our insurers and our prevention mutual, within the strict limits of their mandates.
7. In the event of a merger, acquisition, or sale, we may transfer the personal information we hold to third parties, solely for the purpose of completing such a merger, acquisition, or sale.
8. To individuals mentioned in your requests, when necessary.

6. Where We Store Your Personal Information

We maintain personal information at our headquarters. Additionally, we may transfer the personal information we collect about you to other locations in Canada and the United States for the purposes outlined in this Policy.

We inform our suppliers that they must implement and uphold measures in accordance with prevailing privacy standards to protect your personal information.

7. Our Personal Information Retention Policy

We will retain your personal information only for the purposes for which it was collected or as required by law. At the end of the applicable retention period, we securely destroy your personal information. We do not anonymize any data at the end of the applicable retention period.

8. Our Security Measures in Place

LABPLAS is a member of programs stemming from the Canadian Air Cargo Security Regulations and U.S. Customs and Border Protection's C-TPAT program, which entail obligations to adhere to security measures, including access control, second-tier cargo screening, partner vetting, criminal background checks, the application of industry best practices in cybersecurity, and compliance with international shipping instrument integration and mastery. We undergo periodic audits to validate the implementation, traceability, and effectiveness of our programs. In addition, we have our own administrative rules, such as privacy impact assessments, procedural and digital network structure rules, the use of software for protection, health and safety, and ethical record-keeping.

That being said, digital transfers are never entirely secure. While LABPLAS follows contemporary best practices in cybersecurity, we cannot guarantee the security of the information you transmit to us. These transfers are at your own risk.

9. Your Personal Information

We may, from time to time, inquire about the currency and accuracy of your personal information. If you discover that your information is no longer current or accurate, please notify our Coordinator of Personal Information, and we will strive to make the necessary updates, if applicable, as promptly as possible.

10. Amendment, Objection, and Portability of Your Personal Information

You have the right to object to the personal information we collect about you and request modifications or deletions (subject to our legal obligations or if it pertains to our legitimate interests). You also have the right to request access to your personal information in a clear, understandable, and legible format. It may also be provided to you in a portable format. You can also request from our Coordinator of Personal Information a report on how this information has been used and disclosed, subject to certain exceptions provided by law.

11. Third-Party Hyperlinks

Our website may contain hyperlinks to third-party websites. We have no control over the personal information practices of these third parties. These sites may be hosted and owned by companies outside of Canada and may not necessarily adhere to the same legal standards as our company. It is your responsibility to review their personal information processing policies and determine if they meet your expectations. To learn more, please read our Terms of Use published on our website.

12. Children Under Fourteen (14) Years Old

We do not knowingly collect any personal information about minors, except (i) for children aged fourteen (14) and older, but only if they are employed at our company during the summer, in which case we are subject to ethical, health and safety obligations, and to facilitate their payroll, and (ii) for children aged fourteen (14) and older who submit their resumes on our Careers web section for summer job opportunities.

Although our website primarily features scientific content, biotechnology publications, general information about our company, and job postings, it is not intended for individuals who have not reached the age of majority. If we learn that we have collected personal information about minors (in contexts other than those described in the first paragraph above), we will take reasonable steps to locate and delete this personal information.

13. Withdrawal of Consent

You may withdraw your consent to the collection, use, and disclosure of your personal information at any time, subject to legal restrictions, such as fulfilling our ethical obligations. LABPLAS reserves a reasonable period to assess your request and act, if applicable, in accordance with your instructions. Withdrawing your consent to the collection, use, and disclosure of your personal information may impact our ability to provide you with products and services, issue a purchase order, act as a debtor, or fulfill our due diligence obligations.

You can request not to receive marketing communications by following the unsubscribe instructions in each communication or by contacting our Coordinator of Personal Information.

14. Complaint Procedure

If you have a complaint about the use of your personal information, we will process it through a procedure to identify one or more root causes and then issue corrective and preventive actions (a "CAPA"). To initiate the complaint process, please contact our Coordinator of Personal Information. They will open a ticket in our system and provide you with a confirmation of receipt within seventy-two (72) hours. Except in urgent situations, LABPLAS reserves up to thirty (30) days to provide you with a final response regarding the root cause and the issuance of corrective/preventive actions.

15. In Case of an Incident

If LABPLAS identifies a breach of confidentiality regarding your personal information, you will be notified as soon as possible. Similar to our complaint process in Article 14, LABPLAS documents its internal non-compliances and conducts investigations to identify one or more root causes and issue corrective and preventive actions. LABPLAS informs you of the findings of its investigation and is also subject to the requirements of the Personal Information Protection and Electronic Documents Act, particularly regarding the maintenance of relevant records of these incidents.

16. Policy Amendments

This Policy may be amended from time to time. If we make substantial changes to this Policy (such as the information we collect or the purposes for which it is collected), we will highlight these changes at the end of our Policy in a designated revision table. Changes dating back more than one (1) year will be removed from the table.

Former Statement	New Statement	Policy Article	Date of Modification
-	-	-	Effective as of September 21, 2023