Privacy Policy

Policy and Practices on Privacy Protection

These POLICY AND PRACTICES ON PRIVACY PROTECTION (hereinafter, the « Policy ») are part of our program on management of personal information, whose monitoring and supervision were entrusted to a Privacy and Personal Information Officer. The Policy is meant to describe the means by which THERMOLEC LTD (hereinafter, « THERMOLEC », « WE », « US », or « OUR ») makes sure that your privacy and personal information are protected at all times.

WE may have to collect some personal information about you whenever WE must comply with legal duties or obligations relating to employment, safety, or any other parameter. In order to respect your privacy and abide by the legislative framework developed in that respect, WE apply with great care and caution the management, confidentiality, and non-disclosure principles laid out in this Policy.

PERSONAL INFORMATION

For the purpose of this Policy, « personal information » refers to any kind of information which, considered by itself or in combination with other information, allows one to identify a specific individual. No business contact information shall ever be assimilated to personal information. Hence, your name, title, professional coordinates, business e-mail address, and office phone number are all excluded from the protection granted to personal information.

Any user who remotely logs on to a corporate THERMOLEC application will be informed that their login data will be recorded and stored for security purposes.

WHAT WE COLLECT FROM YOU

Depending on interactions with the Company, we may not have collected all the categories of personal information listed below about each Employee. However, the Company may, when necessary collect the following categories of personal information:

Identifiers, such as a real name, alias, mailing address, unique personal identifier (e.g., Employee number, device identifier, unique pseudonym, or user alias/ID), online identifiers, IP addresses, email address, account name, social insurance number, date of birth, place of birth, driver’s license number, passport number, photograph, and other similar identifiers.
Demographic data, such as gender, sex, citizenship status, nationality.
Professional and employment-related information, such as compensation, benefits and payroll information (e.g., salary-related information, bonus-related information, tax-related information, benefits elections and details regarding leaves of absence), information relating to a position (e.g., job title, job description, department, terms of employment, business travel details), performance-related information (e.g., evaluations, training, promotions, disciplinary records), talent management information (e.g., résumé information, professional qualifications, occupation details, education details, certifications and professional associations, historical compensation details, previous employment details, screening and background check information, emergency contact information, dependent information, compliance information and other reporting channels, and the evidence gathered in the course of an investigation (including the report of the investigation or drug testing and the outcome of the report or results of testing).
Internet or other electronic network activity information, such as search history, browsing history, login information, and information regarding interactions with websites or applications while using Company devices, networks, or websites. Information pertaining to the use of any the Company issued or personal device connected to the Company systems is available in the SPX Information Security Policy.
Location data through the use of location technologies for real time tracking while employees are on duty for field service employees.
Surveillance information, such as call monitoring, tracking via computer and connected devices and video surveillance for more information you can consult the SPX Information Security Policy.
Other information you choose to provide, such as career planning, hobbies and interests.

HOW WE COLLECT YOUR PERSONAL INFORMATION

WE collect and receive personal information:

Directly from Employees information relating to dependents, family members, and emergency contacts;
From colleagues, for example during any evaluation process;
Automatically and indirectly from Employees, such as through logging and analytics tools, cookies, pixel tags, and other similar technologies on our websites and information technology systems and equipment, including through Employee monitoring tools and processes, location technology tools; and
From third parties, such as job applicant references and our service providers and business partners involved in our employment and retention processes.

To make sure you have the skills, expertise, and experience required by the position you are applying for, WE will ask you to provide references you must allow US to contact. WE may also collect personal information from public records as well as from third parties, in the latter case with your kind permission.

WHY WE COLLECT PERSONAL INFORMATION

As an employer, THERMOLEC must collect your personal information for management purposes, in order to comply with tax-related obligations, to maintain certain approvals and certifications current, and to provide employee benefits pursuant to mandatory government programs.

WE may use Employees’ personal information for the purposes of carrying out and supporting human resources functions and activities, including the uses described below.

Human resources management: including administrative management of personnel, work organization and career management, recruiting, performing background checks, drug testing, determining suitability for employment or promotion, and determining physical and/or mental fitness for work; payroll and benefits administration; reimbursing expenses; determining eligibility for and processing salary increases, bonuses, and other incentive-based compensation; providing references; efficient management and operation of our business (including providing access to facilities and managing attendance, absences, leaves of absence and vacations); enabling our personnel to communicate with one another and work together; expense and travel management; training; reviewing and evaluating performance; management of professional elections; managing disciplinary matters, grievances and terminations; receiving and investigating complaints about alleged unlawful activity through regular reporting and information channels; enforcing our rights; allocating and managing company assets and human resources.

Ensuring business continuity; protecting the health and safety of our staff and others; safeguarding, monitoring, and maintaining our IT infrastructure, office equipment, facilities, and other property; providing technical support; detecting or preventing theft or fraud, or attempted theft or fraud; facilitating communication with Employee and designated contacts in an emergency; strategic planning; placing and identifying resources such as field service employees, project management; compiling audit trails and other reporting tools; maintaining records relating to business activities, budgeting, and financial management; managing mergers, acquisitions, sales, reorganizations or disposals and integration with business partners.

Operating and managing IT: including communications systems and facilities, and monitoring the use of these resources; performing data analytics; improving our services; helping to ensure security and integrity, to the extent the use of personal information is reasonably necessary and proportionate for these purposes; debugging to identify and repair errors that impair existing intended functionality on our devices or networks.

Complying with legal requirements, such as tax, record-keeping and reporting obligations; conducting audits, management and resolution of health and safety matters; complying with requests from government or other public authorities; responding to legal process such as subpoenas and court orders; pursuing legal rights and remedies; defending litigation and managing internal complaints or claims; conducting investigations; and complying with internal policies and procedures.

Miscellaneous: certain short-term, transient uses; undertaking internal research for technological development and demonstration; undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the Company.

WE use the personal information pertaining to emergency contacts only to contact the person in case of emergency and the personal information concerning beneficiaries to manage Employee benefits.

DISCLOSURE OF PERSONAL INFORMATION

WE generally disclose the categories of personal information WE collect to the following categories of entities for business or commercial purposes as described in why we collect your personal information, above. WE may share personal information with the below categories of individuals who may be located outside of Canada. If you are a resident of Quebec, we may transfer personal information with the below categories of individuals who may be located outside of Quebec:

To our subsidiaries and affiliates located throughout Canada, and in the US;
To our service providers, such as IT operating system and platform vendors, human capital SaaS solutions, security vendors, monitoring and data analytics providers, insurance vendors, company banks, payroll processors, other benefits providers, auditors, accountants, outside legal counsel, professional advisors, contractors, suppliers, designated agents, and other professional services companies; and
To other third parties, such as regulatory authorities or other third parties in response to legal process or other legal reporting requirements; and to potential buyers (and their agents and advisors) in connection with any proposed merger, acquisition, or any form of sale or transfer of some or all of our shares or assets (including in the event of a reorganization, dissolution or liquidation); trade union representatives (if applicable); and other similar third parties where disclosure is required for an ordinary business purpose in connection with our provision of services.

Whenever information about you must be forwarded or otherwise disclosed to third parties, when required, WE shall seek and secure your consent before going any further.

CROSS-BORDER TRANSFERS

Your personal information may be transferred and stored outside of Quebec, including in other provinces in Canada and in the United States. Before any such transfer, THERMOLEC will conduct a Privacy Impact Assessment as required under the Quebec Privacy Act to ensure the information will receive adequate protection. This means your data may be subject to the laws of other jurisdictions, which may not provide the same level of protection as in the province of Quebec. WE will only engage third-party processors that have adequate security measures in place and will enter into written agreements that address the protection of your personal information.

LIMITED COLLECTION AND USE

Any collection of personal information must be strictly limited to the data THERMOLEC absolutely needs in order to properly create, manage, and maintain your employee’s file and to ensure the integrity, safety, and security of its online systems and web services. None of your personal information will ever be communicated to third parties, except when permitted by applicable law, without your explicit written consent.

WE retain personal information for as long as necessary to carry out the processing activities described in this Policy, including but not limited to administering the employment relationship, ensuring efficient business operations, compliance with applicable laws, regulations, rules, and requests of relevant law enforcement and/or other governmental agencies, and protecting our, our Employees’, and our business partners’ and clients’ rights, property, or safety and the rights, property and safety of others.

WE may retain personal information for a longer period of time if a longer retention period is required or permitted by applicable law, as well as our records retention requirements and policies. For example, we may retain personal information for longer periods of time, such as to carry out our human resources operations, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, comply with applicable laws, or based upon other criteria, including, but not limited to, the sensitivity and volume of such data.

In specific circumstances, we may also retain personal information for longer periods of time so that we have an accurate record of an Employees’ dealings with us in the event of any complaints or challenges.

PHYSICAL AND ADMINISTRATIVE MEANS OF PROTECTION

In accordance with the Quebec Privacy Act, THERMOLEC has established governance policies and practices regarding personal information that ensure its protection throughout its life cycle. These policies provide a framework for the keeping and destruction of personal information, define the roles and responsibilities of members of our personnel, and establish a process for dealing with complaints.

In order to ensure the safety of personal information and to prevent any kind of:

accidental or non-compliant deletion or destruction;
accidental losses;
unauthorized access;
unauthorized disclosures;
unauthorized alterations;
unlawful processing;

WE devised and implemented the following safety measures:

restricted and controlled physical access to offices and storage rooms;
restricted and controlled physical access to computer hardware;
personal information is processed by trained members of personnel;
OUR agents, representatives, third-party service providers, and other associates and partners who are likely to have access to personal information must not only execute non-disclosure agreements but also commit to implementing safety mechanisms as stringent as OUR own.

YOUR RIGHTS UNDER THE QUEBEC PRIVACY ACT

As an employee in Quebec, you have specific rights regarding your personal information:

Access and Correction: You have the right to request access to the personal information WE hold about you, including the categories of information, the sources from which it was collected, the purposes for which it is used, and the categories of third parties to whom it is disclosed. If any personal information is inaccurate or incomplete, you have the right to request that WE correct it.

Right to Withdraw Consent: You have the right to withdraw your consent to the use, collection, or communication of your personal information, subject to legal or contractual restrictions and upon reasonable notice. WE will inform you of the likely consequences of any such withdrawal.

Right to Data Portability: You may request a copy of your computerized personal information that WE collected directly from you, in a structured, commonly used technological format.

Automated Decision-Making: WE do not currently use automated systems to make decisions about employees. If this changes in the future, WE will inform you in advance. You have the right to be informed when a decision about you is based exclusively on automated processing, to obtain information about the principal factors and parameters that led to the decision, and to request that a member of our personnel review any such decision.

Right to De-indexation: You have the right to request that WE cease disseminating your personal information or de-index any hyperlink associated with your name that provides access to such information, if the dissemination causes serious injury to your reputation or privacy, or contravenes the law or a court order.

Response Timeframe: Upon receiving a request to access, correct, or exercise any of the above rights, WE will respond within thirty (30) days of receipt.

To exercise any of these rights, please submit your request in writing to the Privacy and Personal Information Officer identified below. An employee may be required to prove their identity prior to information being released.

PRIVACY AND PERSONAL INFORMATION OFFICER

Name	Markens Duvestil
Title	Privacy Officer
Email	confidentialite@thermolec.com
Phone	514 336-9025, ext. 234
Address	2060 boulevard Lucien-Thimens, Ville St-Laurent (Quebec) H4R 1L1

UPDATING THE POLICY

This Policy may be modified at any given time in order to adequately reflect legislative changes and/or THERMOLEC’s current business needs. Should any kind of material changes be made to provisions of the Policy, notices to that effect will be posted on our website. Changes deemed to be minor or otherwise non-substantial will simply be incorporated and posted as part of the updated version of the Policy. Employees are encouraged to review the latest version of the policy online to ensure they have up to date information on THERMOLEC’s privacy practices.

Date: July 8, 2026