1. Person in Charge of Processing

The Aerospace Technology Center ("we," "us," or "our") operates this website and is responsible for the personal information collected through it. We are subject to Quebec Act 25 (An Act to modernize legislative provisions regarding the protection of personal information, S.Q. 2021, c. 25), which governs how we collect, use, disclose, and protect the personal information of individuals who interact with our website and services.

This policy explains what personal information we collect, why we collect it, who we share it with, and what rights you have regarding your information.

2. Personal Information Collected

We collect personal information in the following categories, depending on how you interact with our website:

2.1 Identification and Contact Information

• Name, job title, and employer
• Email address and phone number
• Any other information you voluntarily provide through contact forms or inquiries

2.2 Human Resources Information

Because we collect human resources information, we also process the following categories of personal information in connection with job applications and workforce management:

• Resumes, cover letters, and professional credentials
• Employment history and references
• Educational background
• Any other information provided as part of a job application or HR process

2.3 Technical and Navigation Information

• IP address and approximate geographic location
• Device identifiers and browser type
• Pages visited, session duration, and navigation behavior
• Advertising identifiers and social identifiers (when marketing tools are enabled)

2.4 Consent Preferences

• Your cookie consent choices, recorded and stored by our consent management platform

3. Purposes of Processing

We collect and use your personal information only for the purposes described below. Where we rely on your consent, you may withdraw it at any time (see Section 7).

3.1 Operating and Securing the Website

We use technical information—including your IP address—to deliver our website, protect it against threats, and optimize its performance. This processing is carried out through Cloudflare (content delivery and security) and Moelleux by Horizon-Cumulus (consent management and privacy policy hosting). Legal basis: legitimate interest in maintaining a functional and secure website.

3.2 Consent Management

We record your cookie preferences using Moelleux, operated by Horizon-Cumulus (9322-8310 Québec inc., Joliette, Quebec). A preference cookie named moelleux_{site_key} is stored in your browser for up to 13 months to remember your choices. Consent records and this policy are hosted in Quebec (OVH, Beauharnois). Legal basis: Legal obligation under Quebec Act 25 to document consent.

3.3 Audience Measurement and Website Improvement

With your consent, we use Google Analytics 4 (Google LLC, United States) and Microsoft Clarity (Microsoft Corporation, United States) to measure website traffic, analyze visitor behavior, and improve our content and user experience. These tools collect device identifiers, IP addresses, pages visited, session duration, navigation behavior, and approximate location. Legal basis: consent.

3.4 Advertising and Remarketing

With your consent, we use the LinkedIn Insight Tag (LinkedIn Corporation, United States) to track conversions from our LinkedIn advertising campaigns and to show relevant ads to visitors who have previously visited our site. This tool collects device identifiers, IP addresses, pages visited, advertising identifiers, and social identifiers. Legal basis: consent.

3.5 Responding to Inquiries

When you contact us through our website, we use the identification and contact information you provide to respond to your request. Legal basis: Consent (by submitting the form) and legitimate interest in responding to business inquiries.

3.6 Human Resources and Recruitment

We process HR-related personal information to evaluate job applications, manage our recruitment process, and fulfill our obligations as an employer. Legal basis: consent (for applicants) and legal obligation (for employees, under applicable employment law).

4. Third Parties and Processors

The following third-party services process personal information on our behalf or in connection with our website. We only engage processors that provide sufficient safeguards regarding the protection of personal information.

We do not sell your personal information to third parties.

5. Transfers Outside Quebec

Several of our third-party service providers are located in or operate infrastructure in the United States. Under section 17 of Quebec Act 25, before transferring personal information outside Quebec, we are required to conduct a Privacy Impact Assessment (PIA—also referred to as an EFVP, évaluation des facteurs relatifs à la vie privée) to ensure that the information will receive adequate protection in the destination jurisdiction.

The following transfers outside Quebec occur in connection with our website operations:

• Google Analytics 4 — United States: Visitor analytics data, including device identifiers, IP addresses, and navigation behavior, is processed by Google LLC in the United States. Google participates in the EU-U.S. Data Privacy Framework and relies on standard contractual clauses for international transfers. A PIA has been or will be conducted prior to this transfer.
• Microsoft Clarity — United States: Session recording and heatmap data is processed by Microsoft Corporation in the United States. Microsoft relies on standard contractual clauses and its participation in applicable cross-border data transfer frameworks. A PIA has been or will be conducted prior to this transfer.
• LinkedIn Insight Tag — United States: Advertising and conversion data is processed by LinkedIn Corporation (a Microsoft subsidiary) in the United States. LinkedIn relies on standard contractual clauses for international transfers. A PIA has been or will be conducted prior to this transfer.
• Cloudflare — United States: IP addresses and traffic data may be processed by Cloudflare, Inc. in the United States as part of its global CDN and security infrastructure. Cloudflare relies on standard contractual clauses for international data transfers. A PIA has been or will be conducted prior to this transfer.

Our website is hosted in Quebec through our hosting provider, and consent records managed by Moelleux remain in Quebec. No personal information processed exclusively within our consent management infrastructure leaves Quebec.

We also use Microsoft 365 (Microsoft Corporation, United States) for internal email communications. Email correspondence may therefore be processed on servers located in the United States. A PIA has been or will be conducted for this transfer in accordance with section 17 of Quebec Act 25.

6. Retention Period

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. The table below outlines our standard retention periods by data type.

Once the applicable retention period expires, personal information is securely deleted or anonymized so that it can no longer be linked to an identifiable individual.

7. Your Rights

Under Quebec Act 25, you have the following rights regarding your personal information. To exercise any of these rights, please contact our Privacy Officer (see Section 8).

• Right of access: You may request a copy of the personal information we hold about you, along with information about how it is being used and with whom it has been shared.
• Right to rectification: If any personal information we hold about you is inaccurate, incomplete, or ambiguous, you may ask us to correct it. If the information has been shared with third parties, we will notify them of the correction where feasible.
• Right to erasure (de-indexing): In certain circumstances—for example, if the information was collected without a valid legal basis, or if the purpose for which it was collected has been fulfilled—you may ask us to delete your personal information.
• Right to portability: You may request that we provide you with the personal information you have provided to us in a structured, commonly used technological format, so that you can transmit it to another organization.
• Right to withdraw consent: Where we process your personal information based on your consent (for example, for analytics or marketing cookies), you may withdraw that consent at any time by updating your preferences through our cookie consent banner or by contacting us directly. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

We will respond to your request within 30 days of receipt, as required by Quebec Law 25. In complex cases, we may extend this period and will notify you accordingly.

If you are not satisfied with our response, or if you believe we are not handling your personal information in compliance with Quebec Law 25, you have the right to file a complaint with the Quebec Information Access Commission (CAI) at https://www.cai.gouv.qc.ca.

8. Person Responsible for the Protection of Personal Information

In accordance with section 3.1 of Quebec Act 25, the Aerospace Technology Center has designated a person responsible for the protection of personal information. This individual is your primary point of contact for any questions, requests, or concerns regarding the handling of your personal information.

• Name: Fannie Laroche --
• Title / Role: --
• Email: info@aerocta.ca
• Phone: ------------------------

We will acknowledge receipt of your request promptly and provide a full response within 30 days, as required by Quebec Law 25. If your request is complex or involves a large volume of information, we may extend this period and will inform you of the new timeline in writing.

9. Effective Date and Versioning

This privacy policy takes effect on June, 11 2026 and supersedes any previous version.

Version: 2

We review this policy periodically and update it whenever our practices change, when new services are added to our website, or when required by changes to applicable law. When we make material changes, we will update the effective date above and, where appropriate, notify you through our website or by email. We encourage you to review this policy regularly to stay informed about how we protect your personal information.