Attraction

POLICY ON THE PROTECTION OF PERSONAL INFORMATION FOR PERSONS WORKING FOR ATTRACTION

Effective : 2023-09-22

1. Purpose and Scope of Application

Attraction Media Inc. and Attraction Images Inc. (and all its parent companies and business units) (hereinafter collectively "Attraction") are committed to treating personal information of any persons working for them in compliance with the Act respecting the protection of personal information in the private sector and the Personal Information Protection and Electronic Documents Act. This Policy informs individuals working for Attraction of its practices regarding the collection, use and disclosure of their personal information, as well as their rights with respect to this information.

Attraction actively operates in the North American media and entertainment industry, including independent television production sector by producing and distributing various productions, namely in the fields of television, film and new media, including podcasting, of which includes all the financial, artistic and technical resources used by Attraction in the development of a project (hereinafter, "Production" or "Productions").

This Policy applies to all persons (private, public, sole proprietors or incorporated) working for Attraction, including employees and contractors (hereinafter, "Designated Persons" and “you”). It serves as a framework for our obligations regarding the collection and protection of your personal data.

The entirety of the Policy may not automatically apply to you. Attraction will collect, use and disclose your personal information depending on the scope of our collaboration with you, in fair and legal ways. We will inform you and seek your consent for the ways in which we will collect, use, and disclose your personal information. We are committed to preserving the confidentiality of your personal data. We are also committed to addressing any changes to your personal information if required to do so.

If you have any concerns or inquiries, please do not hesitate to contact us as indicated at the end of this Policy.

2. Definition of “personal information”

In this Policy, "personal information" refers to any information relating to a person, allowing this person to be identified. Personal information will be considered sensitive when, due to its private nature, it reveals details about an individual, or due to the context of its use or communication, demands a high expectation of privacy.

Collection of personal information

Attraction may collect personal information necessary to manage a working relationship with Designated Persons. As such, Attraction may collect the following personal information:

• Identifiers and contact information: such as name, business and/or personal e-mail and mailing addresses, business and/or personal telephone number, government-issued identification (such as social insurance number, visa and/or passport information, and/or work/resident permit), and driver's license.
• Demographic information: such as date of birth, gender, citizenship, marital status, list of dependents. In some cases, Attraction may collect demographic information in connection with an equity, diversity and inclusion programs, on a voluntary basis (such as ethnic origin, sexual orientation, etc.).
• Medical information: such as all medical data required to set up insurance policies for key Production personnel including any relevant health-related information such as medication taken, allergies, dietary restrictions.
• Information on political opinions, religious or philosophical beliefs: In some cases, Attraction may, on a voluntary basis, collect demographic information in connection with an equity, diversity and inclusion programs, or for the needs of production.
• Information on lifestyle and consumption habits: In some cases, Attraction may, on a voluntary basis, collect demographic information such as hobbies and high-risk sport, for the purposes of demographic information or for the needs of production.
• Professional or employment-related information: such as title, salary and other benefits, compensation history, work schedule and employment status, work experience including resume, education, licenses and other credentials, union membership if applicable, benefit or leave information, information relating to any problems or disputes that may arise, performance reports and appraisals, psychometric test results, credit records, disciplinary records, record search results or any criminal record searches, date of termination and reasons (voluntary or involuntary and details) for termination.
• Financial information: for payroll purposes (financial institution and bank account number), or other forms of remuneration, and information necessary for the issuing of tax forms.
• Emergency contact information: such as names, contact information and the nature of the relationship with them.
• Information regarding the use of Internet on Attraction networks, devices and premises: such as their IP address (if it identifies the employee or user) and their device ID (for example, if the employee or user connects to Attraction's Wi-Fi network either through a work or personal device). Attraction may collect information about Designated Persons' use of their work e-mail account, the Internet, computers, telephones and other Attraction devices to which they have access in the course of their employment, and their personal devices used in the course of their employment. Attraction may also collect video images and photographs through closed-circuit video cameras.
• Other information: such as that provided through the payroll system.

3. Retention and destruction of personal information

Attraction takes appropriate measures to protect you personal information. These measures include restricting physical access to Attraction's offices and files, restricting unauthorized access, disclosure, use and mishandling of personal information in Attraction's possession and control, storing archival materials with reliable third parties in secure facilities, and using firewalls, passwords and file encryption for online activities.

Attraction's goal is to prevent any unauthorized access, loss, misuse, sharing or modification of personal information in its possession. Attraction also uses these safeguards when deleting or destroying personal information of Designated Persons.

Attraction endeavors to ensure that personal information is stored on servers in Quebec or in Canada. However, information stored on Attraction's service providers’ servers may be located outside Canada and may therefore be subject to the laws of that country, including any laws permitting access by governmental authorities. Subject to such foreign laws, to the best of its abilities, Attraction will use contractual measures to maintain levels of protection, minimally, to match those of the laws applicable in Quebec and Ontario.

Attraction retains personal information only as long as is reasonably necessary for the fulfillment of the purposes for which it was collected, or as permitted or required by the Act respecting the protection of personal information in the private sector and the Personal Information Protection and Electronic Documents Act. Once no longer required, personal information is securely destroyed or anonymized, in accordance with the law.

The following periods of time are deemed reasonable for retaining personal information:

• In perpetuity; for documents containing copyright, neighbouring rights or any other rights necessary for the exploitation of a work (for example, contracts with authors, directors, performers, musical compositions, etc.);
• Ten (10) years following the end of the fiscal year of a legal entity for which the person working for Attraction was issued tax documents;
• Three (3) years following the end of the project; for all other personal information of Designated Persons.

However, for the purposes of clarity, personal information collected for the purposes of production prior to 2023, said retention periods will be implemented progressively over the next five (5) years. Therefore, personal information of Designated Individuals who worked for Attraction on productions prior to 2023 may be retained for longer periods than those stated above.

4. Use of personal information

Attraction uses the personal information of Designated Persons for the purposes of managing its employment relationships and for other legitimate purposes detailed in this Policy, as well as for other purposes permitted by the Act respecting the protection of personal information in the private sector and the Personal Information Protection and Electronic Documents Act.

For example, Attraction may use the personal information of Designated Persons for the following purposes:

• To administer staff, including verifying the identity of individuals working for Attraction, managing taxes and social security, managing any requests made by tax and/or regulatory authorities, planning schedules and monitoring attendance and hours worked, setting up emergency contact information and processing work-related requests from Designated Persons;
• To process employee benefits, including determining eligibility for Attraction employees and their dependents and beneficiaries; to administer payroll, sick pay and leave; to evaluate performance, including making decisions regarding assignments, training, compensation and promotions;
• To take the necessary measures to protect the health and ensure the safety and physical and psychological integrity of Designated Persons;
• To administer internal business activities, such as implementing disaster recovery, business continuity or similar emergency plans and procedures; conducting internal reviews, audits and investigations; creating statistics and analytical tools for legitimate business purposes (such as improving Attraction's business processes and personnel management);
• To prepare and manage work visa applications;
• To comply with legal and regulatory obligations, meet security requirements, and for fraud management purposes, including internal investigations, failure to perform duties and breach of employment contract, including monitoring the use of Attraction's information technology systems.
• In addition to the purposes described above, Attraction may also collect personal information from Designated Persons for any other purpose, with their consent, where required by the Act respecting the protection of personal information in the private sector.

Attraction may only make the personal information of other Designated Persons available to persons working for Attraction to the extent necessary for the performance of their work. Attraction employees who have access to personal information of other Designated Persons must ensure that appropriate measures and controls are in place to protect such information. Attraction employees will not share, copy or use the personal information of other Designated Persons for any purpose other than the performance of their duties.

5. Disclosure of personal information

Attraction may also disclose Personal Information of Designated Persons to third parties for purposes detailed in this Policy and other Attraction policies and notices, or as required or permitted by the Act respecting the protection of personal information in the private sector and the Personal Information Protection and Electronic Documents Act.

For example, Attraction may disclose personal information of Designated Persons to the following categories of third parties:

• Government agencies that require access (for example, to respond to employment insurance requests, in connection with a grant or program application, etc.).
• Attraction's service providers when necessary to perform a service contract. These services may include: auditing services, information technology services, payroll administration services, human resources administration services, benefit provision and administration services, or professional service firms such as law firms or accounting firms that provide professional services to Attraction. Attraction may disclose the personal information of Designated Persons to certain of its service providers located outside of Quebec or Ontario. For such purposes, Attraction will enter into a written contract with any such service provider, setting out the protections required to ensure the protection of Designated Persons' personal information, in accordance with the Act respecting the protection of personal information in the private sector and the Personal Information Protection and Electronic Documents Act.
• To third parties for reference or background checks or when contractually required by a client of Attraction.
• To third parties in connection with a proposed or completed business transaction (for example, a purchase/sale of a business or assets, a merger or a financing transaction) to which Attraction is a party, but only to the extent that the personal information is necessary for such transactions, in which case Attraction will comply with applicable legal requirements when processing personal information.
• In addition, Attraction will cooperate with organizations responsible for the application of the Act respecting the protection of personal information in the private sector and the Personal Information Protection and Electronic Documents Act and will comply with any court order or law requiring the disclosure of personal information, without further notice or consent from Attraction employees.

6. Accuracy, Access and Rectification

Persons working for Attraction must provide Attraction with accurate and complete personal information and must update their personal information held by Attraction promptly after any change in such information.

Designated Persons may request information about, and access to, their personal information held by Attraction, and may request that their personal information be amended if it is inaccurate or incomplete, subject to various exceptions set out in the Act respecting the protection of personal information in the private sector and the Personal Information Protection and Electronic Documents Act (including where access must be denied protecting others and to protect Attraction's privileged or confidential information).

Designated Persons may also request further information about Attraction’s management of their personal information, including the people who have access to their personal information within Attraction, and the retention period applicable.

Designated Persons may request access to their personal information or any other inquiries in writing to their direct managers or supervisors. If necessary, they may also submit a formal request directly with Attraction’s Privacy Officer, as indicated below.

7. Lifecycle of personal information, roles and responsibilities

All Designated Persons who receive personal information in the course of their work are responsible for maintaining its confidentiality, to the extent provided by this Policy.

More specifically, within Attraction, the Executive Vice-President, Finance and Operations shall be named Privacy Officer, and is responsible for ensuring compliance with the Act respecting the protection of personal information in the private sector and the Personal Information Protection and Electronic Documents Act.

8. Complaints and inquiries

Designated Persons may request access to their personal information or any other inquiries in writing to their direct managers or supervisors. They may also submit a formal request directly with Attraction’s Privacy Officer by e-mail at vieprivee@attraction.ca or by mail at Attraction – Personal Information at 200-5455 De Gaspé ave., Montréal QC, Canada H2T 3B3.

However, should a privacy breach occur, it must be reported immediately to the Privacy Officer. Such breaches include:

• Access to personal information not authorized by law;
• unauthorized use of personal information;/ or
• Unauthorized disclosure of personal information;
• The loss of personal information or any other breach in the protection of such information.

Attraction maintains a confidentiality incident registry recording all privacy breaches or incidents involving personal information, including incidents that do not present a risk of serious harm (hereinafter the "Privacy Breach Registry"). To fulfill its duties, the Privacy Officer may collect information concerning the confidentiality incident from Designated Persons. To this effect, they will use a confidential form (hereinafter "Privacy Incident Form"), to analyze whether the privacy incident presents a risk of serious harm to the persons concerned.

9. Changes to this Policy

Attraction regularly reviews all its policies and procedures, and may revise this Policy, available at https://www.attraction.ca/en/privacy-policy.

In addition, Attraction will provide privacy and information security training to Designated Persons as required.

---

Attraction Digital

Privacy Policy

Attraction Web s.e.c. (hereinafter "Attraction" or "we") is concerned about respecting the confidentiality of the personal information it collects through this website (the "Site") and is committed to protecting it and not use only for the purposes for which they were collected. This policy is intended to inform you of our privacy practices.

By submitting your personal information to Attraction, you indicate that you consent to our collection, use and disclosure of your personal information in accordance with this policy. If you do not consent to Attraction's collection, use and disclosure of your personal information in accordance with this policy, please do not provide any personal information to Attraction.

In some jurisdictions, you can withdraw your consent to our use and disclosure of personal information about you or opt out of certain uses and disclosures. If you wish to withdraw your consent or refuse to participate, please contact our Privacy Officer (see contact details below).

Scope and Application

This policy extends to all personal information collected by Attraction through your use of the Site. The term personal information means any information relating to an individual and allowing that person to be identified.

No registration is required to access the Site. The Site automatically collects certain non-identifiable information about its users, such as the type of device you use, the IP address of your device, and the time you accessed the Site. This non-identifiable information is used for system administration and allows us to provide you with a better user experience. This information does not contain any personal information and we will not include personal information that would allow us to know your identity.

Information We Collect

The aforementioned information is collected and used in particular for the following purposes:

• to allow you to take advantage of the features and services offered through the Site;
• in order to send you notifications, if necessary;
• in order to deal with problems reported to us;
• to answer your questions;
• to evaluate and improve the content of our Site; And
• any other purpose you have agreed.

We only use personal information for the purposes for which it was collected and as stated herein.

Where appropriate, we retain your personal information for a reasonable period of time either to fulfill the stated purposes or as required by law, whichever is longer. Once the set objectives have been achieved and the personal information has become useless, we ensure its anonymity or we destroy it in such a way as to ensure its protection against unauthorized access or communication.

We never share your personal information with anyone outside of Attraction without your consent, with the exception of:

• our suppliers of goods or services whose services have been retained to perform certain functions on our behalf. We take the necessary steps to ensure that these providers process your information only for the purposes we have determined;
• any entity in the event of a merger or a change of control of Attraction, in whole or in part;
• any public authority if required by law, or to defend our rights, or otherwise in accordance with the law; And
• as required and/or permitted by law.

Attraction reserves the right to allow certain advertisers to display commercial advertising on the Site. This advertising is not under the control of Attraction and advertisers may use cookies to target the advertising displayed. Advertisers' use of cookies is governed by their own privacy policies, not this policy.

The data is kept by Attraction au Québec on servers equipped with secure systems, protected against access by unauthorized persons and malicious use. Only persons (employees or agents) who need to have access to the information as part of their duties have access to it.

The Site may include links to sites operated by third parties. By clicking on these links, you are leaving the Site. Attraction has no control over these sites and the fact that they are listed on the Site does not engage the responsibility of Attraction. Any information you transmit through these sites will be subject to the privacy policy of the latter.

From time to time, we may modify this policy. An appropriate indication will be given to users in the event of any modification. Attraction's collection, use and disclosure of your personal information will be governed by the then current version of this policy.

If you have any questions about this policy, access to personal information, the collection, use and disclosure of personal information, or how you can complain or update your information personal information, please contact our Privacy Officer as follows:

By email: numerique@attraction.ca

LAST UPDATED: 2017-08-17