Privacy and Personal Data Protection Policy

Précontentieux places particular importance on the confidentiality, security and protection of personal information and personal data processed in the course of its activities.

This policy describes the conditions under which Précontentieux collects, receives, uses, discloses, retains and protects personal information relating in particular to its creditor clients, debtors, users of its website and persons who communicate with its services.

It applies in particular to data processed through precontentieux.com, contact requests, client relationships, debt collection case management, written and telephone communications and payment monitoring.

Précontentieux is operated by:

Michael Sagbo Sole proprietor operating under the trade name Précontentieux NEQ: 2278584976 1 Place Ville-Marie Montréal (Québec) H3B 2C4 Canada

In accordance with the rules applicable in Québec, responsibility for protecting personal information held by the business rests with the operator, subject to any delegation validly made in accordance with the law.

For any question concerning data protection or to exercise a right:

dpo@precontentieux.com

Précontentieux may process information concerning in particular:

• its professional clients and prospective clients
• its clients’ representatives and contact persons
• debtors who are natural persons
• representatives of debtors that are legal persons
• persons mentioned in case documents
• Website users
• persons using contact forms
• persons communicating with Précontentieux by telephone, post or email
• professionals involved in processing a case

Depending on the nature of the case and to the extent necessary, Précontentieux may process in particular:

• first and last name
• identity and professional contact details
• postal address
• telephone number
• email address
• information relating to the business or professional activity
• case references
• nature, origin and amount of the claim
• principal, interest and ancillary amounts where applicable
• invoices
• contracts
• purchase orders or other supporting documents
• correspondence
• follow-up history
• information relating to disputes
• payment proposals
• payment schedules
• payments made or outstanding
• bank details where their processing is necessary
• documents provided in support of the case
• communications exchanged with Précontentieux
• telephone recordings where recording is implemented
• automated transcripts of telephone communications
• information submitted through Website forms
• technical data strictly necessary for the operation and security of the services
• Précontentieux applies the principle of data minimisation and must process only information that is adequate, relevant and necessary for the purposes pursued.

As part of a debt collection mandate, data relating to the debtor is generally provided to Précontentieux by the creditor.

It may include the debtor’s identity and contact details, information relating to the claim, invoices, contracts, supporting documents and the history of communications and follow-ups.

Where applicable regulations require a person whose data was obtained indirectly to be informed, that information is provided under the conditions and within the time limits prescribed by those regulations.

During communications relating to a case, the debtor may provide Précontentieux directly with information necessary to examine their situation, a dispute, a payment proposal or a payment.

Précontentieux asks the persons concerned to provide only the information necessary to process the case.

A person may spontaneously disclose sensitive information, including information relating to their health, a disability or a particular personal situation.

Précontentieux does not encourage the disclosure of detailed medical information where it is not necessary.

Where sensitive information is received, its processing is limited to what is necessary and must comply with the enhanced requirements prescribed by applicable regulations.

No medical information may be used for commercial prospecting purposes.

Personal information may be processed in particular to:

• manage relationships with creditor clients
• review and administer assigned cases
• undertake amicable debt collection measures
• identify and contact the debtor
• verify and document the existence and amount of a claim
• monitor communications
• process disputes
• receive and monitor payment proposals
• manage payment schedules
• monitor payments
• inform the creditor of developments in its case
• ensure the traceability of communications
• establish, retain or defend evidence where necessary and legally justified
• ensure service security
• prevent unauthorised access
• respond to requests to exercise rights
• comply with legal and regulatory obligations
• allow, where necessary, the involvement of a lawyer, a Commissioner of Justice (France) or another authorised professional
• establish, exercise or defend legal claims
• A debtor’s contact details received in connection with a debt collection case are not used by Précontentieux to send advertising or commercial solicitations to that debtor.

Processing is carried out on the appropriate legal basis or bases according to the data subject, purpose and applicable legal framework.

Processing may in particular be necessary:

• for the performance of a contract or pre-contractual measures concerning Précontentieux clients
• to comply with a legal obligation
• for the pursuit of a legitimate interest, where that basis applies and subject to the rights and freedoms of the data subject
• for the establishment, exercise or defence of legal claims
• or be based on consent where consent is legally required
• The fact that a debtor is contacted by Précontentieux does not mean that the debtor has entered into a contract with Précontentieux.
• Précontentieux therefore does not present performance of the contract entered into with the creditor as the contractual basis for processing in relation to the debtor where that basis is not legally applicable to the debtor.

In connection with case processing and client relationships, certain telephone communications may be audio-recorded where such recording is legally authorised, necessary and proportionate to the purpose pursued.

Recordings may in particular serve traceability or evidentiary retention purposes where such retention is legally justified.

The person concerned is informed of the recording in accordance with applicable requirements.

Recordings must not be used for a purpose incompatible with the purpose announced to the caller.

Access to recordings is limited to authorised persons and recipients to whom disclosure is necessary and legally permitted.

A data subject may request access to data concerning them contained in a recording, subject to the rights and freedoms of third parties and other limitations provided by law.

Where a call is lawfully recorded, Précontentieux may use an automated solution to produce a written transcript of the conversation.

The person concerned is informed that the transcript exists.

This technology is used as a transcription and traceability tool.

Précontentieux does not use this technology to make an automated decision producing legal effects or similarly significant effects concerning the debtor.

Decisions relating to case processing remain subject to human intervention.

Telephone recordings and their transcripts are retained only for the period necessary for the purpose that justified their processing.

Where evidentiary retention is legally justified, Précontentieux applies a period appropriate to the nature of the case, the purpose pursued and applicable statutory time limits.

Under the operating model currently contemplated by Précontentieux, operational retention of recordings and transcripts is limited to a maximum of twelve (12) months, unless a different retention period is required or permitted by a legal obligation, litigation, a claim, or the need to establish, exercise or defend a right.

Any retention beyond the operational period must be limited to necessary data and, where required, be placed in restricted-access archives.

Other personal information is retained for the period necessary for the purposes for which it was collected or received.

Certain information may then be retained in restricted-access archives where necessary to comply with a legal, accounting or regulatory obligation or to establish, exercise or defend rights.

At the end of the applicable periods, data is deleted, destroyed or anonymised where permitted by applicable regulations.

Within the limits of their responsibilities and need to know, information may be accessible or disclosed:

• to Précontentieux and expressly authorised persons
• to the creditor client for information necessary to monitor its own case
• to technical service providers necessary for the operation of the services
• to telephone and communications service providers
• to service providers responsible for sending or routing correspondence
• to institutions or service providers involved in processing payments where necessary
• to a lawyer
• to a Commissioner of Justice (France)
• to courts and legally authorised authorities where disclosure is required or permitted by law
• A creditor client’s access must be limited to the cases and data it is authorised to view.
• A creditor must not be able to access another creditor’s cases.

Depending on the services used and the needs of the case, Précontentieux may in particular use service providers such as:

• Quicktalk by Ringover
• iGoFlex
• AR24
• Esker
• La Poste
• OpenAI for the Website infrastructure
• and other service providers strictly necessary for operation, security or case processing
• The inclusion of a service provider in this list does not mean that it systematically receives all data from a case.
• Information disclosed must be limited to what is necessary to perform the service concerned.

Where a case so requires, information and documents may be disclosed to a lawyer, a Commissioner of Justice (France) or another authorised professional, in particular to assess next steps, commence or prepare proceedings, or establish, exercise or defend rights.

Such disclosure is not systematic.

Précontentieux is established in Québec, Canada.

In cases concerning persons located in France or the European Economic Area, certain data may therefore be accessed or retained in Canada.

Certain service providers may also process information from other territories, including the United States.

Where an international transfer is subject to specific requirements, Précontentieux implements the legal mechanism applicable to the transfer concerned and, where necessary, the appropriate safeguards prescribed by regulations.

Précontentieux must not present a country or transfer as automatically benefiting from an adequacy decision where the legal conditions for that decision are not actually met.

Précontentieux implements technical and organisational measures that are reasonable and appropriate to the nature of the information processed and the risks presented by the processing.

These measures are intended in particular to protect information against unauthorised access, use, disclosure, alteration, loss or destruction.

Access to cases must be granted according to each user’s need to know and permissions.

Précontentieux does not publish in this policy technical details of its infrastructure that could compromise its security.

Précontentieux is developing features intended ultimately to enable secure management of documents and cases through restricted-access portals.

Until a feature is actually available and operational, this policy must not present it as an available transmission method.

As of the date of this policy, certain documents required for case processing may in particular be sent to Précontentieux by email.

Once the secure portals are fully operational, this policy may be updated to accurately reflect how they operate.

Information submitted through a Website form is used to process the request made to Précontentieux and take the necessary follow-up action.

Information may be retained for an appropriate period even where the request does not result in a contractual relationship, to the extent necessary to follow up the request, ensure security, manage a potential dispute or comply with applicable obligations.

Each form collecting personal data must include, or make readily accessible, concise information about data processing and a link to this policy.

Where the GDPR applies, the data subject has, subject to the conditions it prescribes, in particular the following rights:

• right of access
• right to rectification
• right to erasure
• right to restriction of processing
• right to object
• right to data portability where the conditions are met
• right to withdraw consent where processing is based on consent
• rights relating to automated individual decision-making where those provisions apply
• The exercise of a right is not absolute and may be limited where the law permits or requires processing to continue.

Where Québec legislation applies, persons may exercise the rights granted to them in relation to personal information held by Précontentieux, including rights of access and rectification and, where the legal conditions are met, other rights prescribed by applicable legislation.

Any request relating to personal information or personal data may be sent to:

dpo@precontentieux.com

Précontentieux may request information reasonably necessary to verify the requester’s identity and prevent disclosure of data to an unauthorised person.

Requests are processed within the time limits prescribed by applicable regulations.

Any person may submit a question or complaint concerning the protection of their information to:

dpo@precontentieux.com

Where the GDPR and French regulations apply, the data subject also has the right to lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), under the conditions prescribed by the applicable regulations.

Where Québec legislation applies, the remedies it provides may in particular fall within the jurisdiction of the Commission d’accès à l’information du Québec.

The Website may use technologies strictly necessary for its operation, security, session management or the storage of certain user choices.

Any non-essential tracker requiring consent must be activated only after consent has been obtained where legally required.

Information relating to the technologies actually used must be described on the “Cookies and Tracking Technologies” page.

The use of an advertising or analytics tool that is not actually present on the Website must not be declared.

Précontentieux may amend this policy to reflect changes in its activities, tools or applicable legal requirements.

The date of the latest update must appear at the beginning of the policy.

Where a change requires specific notice to the persons concerned under applicable regulations, Précontentieux implements appropriate notification measures.

Précontentieux is a sole proprietorship established in Québec, Canada.

Processing carried out in connection with the contractual relationship with its creditor clients is subject to the rules applicable to Précontentieux in Québec, without prejudice to any other mandatory provisions that may apply.

The debtor is not a client of Précontentieux and is not a party to the contract entered into between Précontentieux and the creditor.

Where processing concerning a debtor or another person is subject to the GDPR, the French Data Protection Act or another mandatory French or European provision, the rights and obligations arising from those texts remain applicable.

This policy may not have the effect of depriving a person of mandatory protection granted to them by applicable regulations.

For any question concerning this policy, personal information protection or the exercise of rights:

dpo@precontentieux.com

Précontentieux 1 Place Ville-Marie Montréal (Québec) H3B 2C4 Canada