Privacy Policy

Welcome to Use Access. We hope you enjoy using our "Services", which include (i) visiting our website at https://useaccess.io/, including all current and future sub-pages and sub-domains (the "Website"); and (ii) using our "Platform", accessible (x) via our mobile application (the "Application") using the handheld device or tablet on which you have downloaded the application (the "Device") or (y) online from any type of device with a web browser, which allows building managers (each an "Administrator") to offer their "Residents" a smart building communication system, allowing them to grant their "Visitors" remote access to their building.

This privacy policy (the "Policy") covers personal information collected from you or about you if: (1) you visit our Website; (2) you are an Administrator or Resident and you have created an account that allows you to use the Platform; or (3) you are a Visitor accessing a Resident's building.

Use Access takes your privacy and the security of your personal information very seriously. We publish this Policy to explain who we are, describe the personal information we collect from you and about you, and indicate what we do with your personal information while you use the Services or communicate with us. The Policy also explains the rights conferred to you under applicable laws and how you can communicate with us and with competent authorities to assert these rights. We invite you to read it carefully.

Here are the key elements of the Policy that will allow you to immediately identify the important parts to make an informed decision about your consent to the collection, use and disclosure of your personal information. By transmitting personal information to us by any means, you consent to the collection, use and disclosure of such information. You will find the details in the rest of the Policy.

Before setting out the details of the Policy, here are some terms and expressions that we think you should know when reading this Policy.

9429-2232 Québec inc., operating under the name ProductShop ("ProductShop") is a company located in Montreal, Quebec, Canada, at the address indicated below, which owns and operates Use Access and the Services. In this Policy, "Use Access" may, depending on the context, refer to ProductShop and/or its affiliates and their respective shareholders, officers, directors, employees, agents, associates, principals, representatives, successors and assigns (collectively, their "Representatives"). The use of pronouns and possessive adjectives "we", "our" or "ours" in the Policy also refers to ProductShop. In this Policy, any person who uses the Platform is referred to as a "User", which includes an Administrator, a Resident or a Visitor. Any visitor to the Website, User or any person for whom we hold personal information may be referred to as "you".

Under PIPEDA, Use Access is an "organization"; under the Quebec Privacy Act, Use Access is a "business"; and under the CCPA, Use Access is a "business".

If you have any questions about the content of this Policy or any other matter relating to the protection of your privacy or your data, or if you wish to exercise any of your rights regarding personal information, you can reach us at the following contact information:

You have the following rights regarding your personal information held by Use Access, as well as other rights relating to the protection of your privacy. Note that not all of these rights are necessarily available to you, they depend on the Privacy Laws that apply where you are located. These rights may be exercised without affecting the prices or fees charged by Use Access, if any, in connection with its Services. Please note, however, that exercising some of these rights may affect your ability to use some or all of the Services:

• the right to withdraw your consent to Use Access's use of your personal information at any time;
• the right to have your personal information erased from Use Access's records;
• the right to have a link removed from Use Access (or on the Website or Platform) that is linked to your name;
• the right to access your personal information and any relevant information about its collection, use and disclosure;
• the right to obtain a copy of your personal information in an easy-to-read format so you can transfer it to another organization;
• the right to have your personal information corrected or updated if you believe it is inaccurate or outdated;
• the right to refuse marketing communications we send you, at any time;
• the right to know if Use Access shares your personal information (and if so, who receives it). Although you can contact our Chief Privacy Officer if you need clarification or more details, we invite you to consult this information elsewhere in this Policy;
• the right to require Use Access to refrain from selling your personal information. Please note that Use Access does not sell your personal information;
• the right to limit the use of your personal information if it is inaccurate or if the collection, use or disclosure we make of it is contrary to law;
• the right to refuse any form of marketing or targeted advertising by Use Access, if applicable.

If you wish to exercise any of these rights, contact our Chief Privacy Officer at the coordinates above, or consult certain relevant sections further in this Policy.

Please note that if you request the erasure of your personal information, we will do so to the extent possible. However, Use Access reserves the right to retain some for a reasonable period to meet certain legal obligations or for the needs of any legal proceeding.

Use Access limits the amount of personal information it collects to what is strictly necessary and appropriate for the purposes identified. We do not use or disclose your personal information for purposes other than those for which it was collected, unless you consent or applicable law permits or requires it.

The table below describes all personal information we may collect directly from you, and what we do with it. Under PIPEDA and the Quebec Privacy Act, the legal basis for our collection and use of this personal information is your informed consent, and by transmitting this personal information to us, you acknowledge having given this consent to Use Access.

We sometimes obtain personal information about you from third parties, or third parties collect it on our behalf and use it. This table explains the details about this personal information – what it is, where it comes from and what we do with it or what the third party does with it. Under PIPEDA and the Quebec Privacy Act, the legal basis for our collection, use and disclosure of this personal information is your informed consent, and by transmitting this personal information to third parties, you acknowledge having given this consent. None of this data comes from publicly available sources.

To the extent that analytical identifiers are generated by third parties or collected from third parties, they may be considered personal information collected from third parties. You will find details about this further in this Policy.

We do not collect from you any data considered sensitive under Privacy Laws, unless you voluntarily transmit it to us, which you should avoid.

We only disclose certain of your personal information to third parties designated in the table below, with an indication of how they use it. Each type of third party identified below is subject to a contractual obligation not to 1) transfer or sell your personal information; 2) use your personal information for any purpose other than the purpose identified in the table below.

We transmit personal information to law enforcement agencies or other public authorities if: 1) applicable law requires it in response to legitimate requests, including to meet national security or law enforcement requirements; 2) we believe this measure is necessary to investigate, prevent or take action regarding illegal activities, fraud or situations involving potential threats to anyone's safety; 3) we believe it is necessary to investigate, prevent or take action regarding situations involving abuse of the Services infrastructure or the Internet in general (such as bulk spam, denial of service attacks or attempts to compromise the security of the Services infrastructure or Services in general); or 4) if we are required to do so under applicable law.

We may also transmit personal information: 1) to joint ventures or other organizations under common control with Use Access (in which case we will ask these entities to comply with this Policy); 2) if Use Access merges with another entity or undergoes a business reorganization (in which case we will ask that entity to assume our obligations under this Policy, or we will inform you that you are covered by a new privacy policy).

We will never share your personal information with other third parties, except in these circumstances or to the extent that applicable Privacy Laws authorize it. We do not sell or rent your personal information to third parties for direct marketing or any other purpose.

In addition, please note that all categories of personal information described in the table above are disclosed to our service providers who provide the technical infrastructure of the Website and Platform, including our hosting service provider DigitalOcean and Google Cloud Platform. These companies retain personal information and keep it available for you and us, including for archival purposes. These companies are equally subject to a contractual obligation not to 1) transfer or sell your personal information; or 2) use your personal information for any purpose other than the purpose identified in this paragraph.

Use Access automatically collects certain information using "Third-Party Analytics Programs" to help it better understand Users and visitors of its Website and how they use the Services, but none of this information personally identifies you, except by an alphanumeric string. Thus, each time you consult the Website or the Platform, we automatically note (as applicable) your IP address, the type of browser and computer or device used, the time of access, the referring web page, the web pages visited or content consulted and any other related information. We use the information collected in the manner generally described in this Policy and to better understand your needs and the needs of Users and visitors of its Website overall. Use Access also uses information obtained for statistical purposes to track the number of people who have visited the Website and Platform and the pages viewed on the Website and Platform in order to make improvements to the Services and its activities.

Your IP address and other relevant information we collect using Third-Party Analytics Programs may also be used to trace any fraudulent or criminal activity.

We manage our own mailing list with the help of a third-party email service provider (the "Email Service Provider") to send emails (i) to visitors of our Website who have requested to get in touch with our team or (ii) to Residents related to the Services, their accounts and Platform updates. Personal information is transferred to the Email Service Provider to ensure proper email delivery. The Email Service Provider does not use your personal information for other purposes, does not transfer or sell it to other third parties.

You can unsubscribe at any time from Use Access's mailing list by following the link displayed at the bottom of all Use Access emails. Other types of emails, such as emails associated with the Platform and your account, do not include an unsubscribe option since they are necessary for your use of the Services.

Use Access's email practices are designed to comply with anti-spam laws, including the law called the Canadian Anti-Spam Law or "CASL" (S.C. 2010, c. 23) and the U.S. CAN-SPAM Act of 2003. If you believe you have received an email from us that violates these laws, please contact our Chief Privacy Officer using the contact information provided above in this Policy.

Use Access continuously evaluates and modifies its use of various advertising networks that may change according to needs. Use Access currently does not use any advertising network, but reserves the right to do so in the future, in which case this Policy will be updated accordingly.

Use Access uses tracking technologies ("cookies" and related technologies such as beacons, pixels and invisible tags) on the Website and in connection with the Platform. Cookies are small text files placed on your computer or device when you visit a website, to track site usage and improve user experience by storing certain data on your computer or device. By using the Services, you accept their use, but only if you explicitly consent to this use, in accordance with the cookie banner presented to you when you visit the Website or Platform. By default, all non-essential cookies are disabled when you first visit the Website or Platform; you can use our cookie management tool to accept or refuse other categories of cookies.

You can set your browser or device to refuse cookies or delete them after they are recorded. You can consult the help section of your browser or device for instructions, but here are instructions for the most commonly used browsers and operating systems:

• Google Chrome
• Mozilla Firefox
• Microsoft Edge
• Opera
• Apple Safari
• iOS
• Android

Note that deleting or blocking certain cookies may harm your user experience on the Website or Platform. In addition, deleting certain cookies could completely prevent the use of certain functions.

We have implemented very strict technical and organizational methods to ensure that we only collect, use and disclose, by default, personal information that is necessary for each need. These methods aim to prevent any loss or unauthorized use of your personal information as well as any unauthorized access to it. They include, for example, restricted access to offices, staff training, password use and well-defined internal policies as well as information technology practices.

We have also implemented a procedure to detect any alleged breach of data security. If Privacy Laws require us to do so, we will inform you, as well as any competent supervisory body, of an alleged data security breach within the time limit provided by the applicable Privacy Law.

Use Access applies industry best practices (in terms of equipment, electronics and procedures) to ensure the security of data collected (including personal information). In addition, we use independent web hosting providers and partners to obtain the computer hardware, software, networks, storage and related technology necessary to operate the Services. These third parties have been selected based on their high standards for electronic and physical security. For example, Use Access uses DigitalOcean or Google Cloud Platform to host Services and Platform data, including personal information.

All information, including personal information, is encrypted and transmitted via the Secure Sockets Layer protocol ("SSL protocol") or the Transport Layer Security protocol ("TLS protocol"), strict security standards for data transfer and transactions over the Internet. You can use your browser to verify the validity of Use Access's SSL security certificate on the Website and Platform.

In addition to the measures to protect your personal information described in the previous section, we have developed and implemented certain internal procedures and policies regarding personal information, including the following:

1. A framework for the retention and destruction of personal information, including when we may retain anonymized data;
2. The definition and description of the roles and responsibilities of Use Access staff members throughout the personal information lifecycle;
3. A process for handling complaints and individual requests regarding personal information and the exercise of individual rights under Privacy Laws;
4. An information technology policy and procedure to deal with potential data breach incidents involving personal information under Use Access's custody.

For Website visitors and Quebec Users, we strive to keep your personal information in Quebec. However, some of our third-party service providers may be located in other provinces or countries where your personal information may be transferred. In this case, we take the following measures to protect your personal information:

1. We perform what the Quebec Privacy Act calls a "privacy impact assessment" (or "PIA") before personal information leaves Quebec. If the PIA does not meet our standards and the standards required by the Quebec Privacy Act, we do not transfer your personal information to such a service provider.
2. If it allows us to transfer personal information to such a service provider outside Quebec, we sign what is commonly called a "data processing agreement" (DPA), or enter into other contractual arrangements with the service provider, which protects the personal information transferred to it and limits its use to what we have agreed with it to do. This data processing agreement complies with the requirements of the Quebec Privacy Act.

In addition, whenever we consider sending your personal information outside Quebec to a third party that is not a service provider, we will perform a PIA. If the PIA does not meet our standards and the standards required by the Quebec Privacy Act, we do not transfer your personal information to such a third party.

If you are in Canada, outside Quebec, and if you are dissatisfied with the response received or the measures taken by our Chief Privacy Officer, you can file a complaint with the Privacy Commissioner of Canada. You will find instructions for this on their website. In Quebec, you can file a complaint with the Commission d'accès à l'information, using the information you will find on their website.

Your personal information is retained only for the time necessary for the purpose of processing. For example, we will retain your account information as long as you hold an account on the Platform. In the case of Residents, their personal information is retained for three months after their account is deleted from the Platform, as well as certain personal information of Visitors associated with that account. Notwithstanding the foregoing, screenshots will be deleted 30 days after collection.

Notwithstanding the foregoing, we may be required to retain your personal information longer in order to meet our obligations under applicable laws.

In some cases, when Privacy Laws permit, we may retain anonymized personal information for legitimate operational purposes.

Use Access does not use automated decision-making processes regarding your personal information in the context of providing the Services.

We do not intentionally collect personal information from children under 16 years of age. If we learn that we have inadvertently received personal information from a person under 16 years of age through the Website or Platform, we will delete this information from our records.

Below is the complete list, as well as a description, of the features of your Device developed by third parties that the Application accesses and/or may modify. Unless otherwise indicated, these permissions apply to both the iOS and Android versions of the Application. Where applicable, these features will only be activated with your explicit authorization. You acknowledge that refusing this explicit authorization may impair or limit your user experience.

• External storage – The Application may access your Device's external storage to save system files necessary for the proper functioning of the Application.
• Notifications – The Application may send you notifications (only with your explicit authorization).
• Wi-Fi connection information – The Application may retrieve information regarding network connectivity and connection speed of your Device.

You can uninstall the Application; uninstallation methods may vary depending on your Device or the iOS or Android version used. Use Access has no control over the uninstallation function and disclaims all liability for your use of it.

The date at the top of this page is when the Policy was last updated. Since Privacy Laws are constantly evolving, we must update this Policy from time to time. You will always find the most recent version at this URL. We will always post a notice on the Website and Platform if we make significant changes to this Policy and we will make reasonable efforts to communicate with you if we have your contact information, for example, if you are an Administrator or Resident.