This policy applies to candidates’ personal information that is under CGM’s control.

“Applicable Privacy Laws” means any laws, regulations, recommendations or notices applicable to privacy matters, including the Act respecting the protection of personal information in the private sector, and any other laws, regulations, recommendations or notices that replace, supplement, amend, extend, re-enact or codify applicable privacy laws.

“Candidate” refers to any individual who applies for employment at CGM or provides personal information to CGM for this purpose.

“Personal Information” means any information that relates to an individual and allows, directly or indirectly, that individual to be identified, such as a name, an employee number, a social insurance number (SIN), an online tracking identifier such as an IP address, or one or more specific characteristics relating to the physical, physiological, mental, economic, cultural or social identity of that individual.

We will only collect, use and disclose the personal information necessary to manage your application.

This includes the following uses:

To facilitate the hiring process :

• Checking references provided by a candidate
• Background checks
• Pre-employment assessments that are reasonably necessary to perform the job
• Interviews with potential job candidates
• With your consent, to contact you with other job offers that may be of interest to you

To contact you :

• Communicate with candidates

For statistics and analysis, including :

• Gather candidate demographic data to ensure the success of various Equity, Diversity and Inclusion (EDI) programs and strategies.
• For the safety of our infrastructures, including :
• Use various surveillance systems for security purposes, including the presence of candidates and others on our premises
• Use video cameras, which film our premises

We collect, use and disclose your personal information with your consent or as permitted or required by law. How we obtain your consent (i.e., the manner in which we obtain it) depends, among other things, on the circumstances.

The format:

• If you choose to provide us with personal information after reviewing this policy, we will assume that you consent to the use and disclosure of your personal information to the extent indicated in this policy.
• Otherwise, your consent may be requested expressly or implicitly, depending on the circumstances and the sensitivity of the personal information in question.

The source:

• In general, we will ask for your consent at the time we collect your personal information.
• If we want to use your personal information for a purpose that was not indicated to you at the time of collection or that is not provided for by law, we will ask you for new consent.
• If you provide us with personal information about another person (e.g. emergency contact), you are responsible for obtaining that person’s consent.
• We may collect your personal information from third parties (e.g. information obtained from references, background information) in compliance with the law.

We may collect the following categories of personal information:

Identity information

• Name
• Postal and e-mail address
• Phone number
• Date of birth
• Gender

Integration

• Curriculum vitae and references
• Background check results
• Residency, citizenship or work permit status
• With your consent, your belonging to a visible or ethnic minority, your identification with a disability or your identification with an indigenous group.

Employment administration

• Qualifications and skills
• Any personal information contained in a legal document relating to your employment
• In some cases, any personal information contained in a medical document that we, as the employer, need to know about
• Driver’s license (if required to drive for employment or as identification for a background check)

Image and recording

• Images and sound captured by our cameras on our physical premises
• With your consent, we can record certain calls or virtual meetings using our internal tools.

We may disclose your personal information to third parties, such as our service providers, for the purposes set out below. We will endeavour to protect any personal information disclosed by taking steps to ensure that the rules set out in this Privacy Policy are respected.

Service Providers: We may use service providers to perform services on our behalf. Categories of service providers with access to your personal information include service providers engaged to :

• website hosting
• human resources software
• management of security cameras and building access
• computer assistance
• a recruitment agency that supports us in our work
• volunteers closely involved in our recruitment activities

We will only use, disclose or retain your personal information for as long as necessary to fulfill the purposes for which it was collected and as permitted or required by law, unless we are required to keep it longer by law, court order or litigation.

If you are hired, we generally keep your personal information on file for the duration of your employment plus three years, unless we are required by law to keep it longer.

If you are not hired, we generally retain your personal information for three years after the decision has been made, unless we are required by law to retain it longer. During this period,

we may contact you for subsequent job offers. Your personal information will only be used for this purpose.

We store job applicants’ personal information on our servers in Quebec, Canada. That said, your information may be held and used outside Quebec, since not all of our suppliers are located in Quebec. If your information is located outside Quebec, we will ensure that it is adequately protected, for example (and if necessary) by conducting a Privacy Impact Assessment.

You have several rights with respect to your personal information, including :

Right of access and rectification

• You may request access to and copies of the personal information we hold about you.
• If your personal information is inaccurate, incomplete or ambiguous, or if its collection, communication or storage is not authorized by law, you may request that it be corrected.Right to withdraw consent to the use of your application
• You may withdraw your consent to the use or disclosure of your personal information.
• In some cases, withdrawal of your consent may mean that we will no longer be able to process your application. o Please contact us: [email protected]

We may ask you to provide proof of identity before responding to your request. This identifying information will only be used for this purpose.

To learn more about your rights, contact us or visit the website of the Commission d’accès à l’information du Québec.

To exercise your rights, please send a written request, accompanied by proof of identity, to our Privacy Officer at the contact details indicated in the “How to contact us” section.

We implement reasonable procedures and security measures to ensure the protection of your personal information.

However, no security measure is absolute or fully guaranteed. If you have reason to believe that your interaction with us is no longer secure (for example, if you believe that the security of any information you have provided to us has been compromised), please contact us immediately at the address listed in the “How to contact us” section.

Our Privacy Officer will independently assess allegations of violations of this policy by reviewing practices and procedures and determine whether follow-up corrective action is necessary, including disciplinary action up to and including termination.

The policy is effective as of the update date shown at the top of the page.

We reserve the right to change this policy from time to time. When we make changes to this policy, they will take effect immediately upon notice of the changes being made available to you on our website.