1. Identity of the Organization Responsible for Your Personal Information

This privacy policy is published by Dunton Rainville S.E.N.C.R.L. (hereinafter "we," "us," or "the Firm"), a limited liability partnership practicing law in Quebec, Canada.

The Firm is subject to Quebec Law 25 — formally known as An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25) — as well as to any other applicable privacy legislation. This policy explains how we collect, use, disclose, retain, and protect personal information about visitors to our website and individuals who interact with us in the course of our activities.

By using our website or submitting personal information to us, you acknowledge that you have read and understood this policy.

2. Personal Information We Collect

We collect personal information only to the extent necessary for the purposes described in this policy. The categories below reflect what we actually collect based on how you interact with our website and services.

2.1 Contact and Identification Information

• Full name
• Email address
• Phone number
• Mailing or business address
• Professional title or organization name (when provided)

2.2 Newsletter and Marketing Communications

• Email address
• Communication preferences (language, areas of interest)
• Engagement data (email opens, link clicks) collected by our email service providers

2.3 Employment and Recruitment Information

When you apply for a position with the Firm, we collect information necessary to evaluate your candidacy, which may include:

• Full name, contact details, and address
• Résumé, cover letter, and professional references
• Educational background and professional credentials
• Work history and skills
• Any other information you voluntarily provide in your application

2.4 Website Navigation and Technical Information

When you visit our website, certain information is collected automatically by the tools described in Section 4, subject to your consent choices:

• IP address (approximate geolocation)
• Device and browser identifiers
• Pages visited, time spent, and navigation behavior
• Session duration
• Advertising identifiers and social identifiers (when marketing cookies are accepted)
• Transaction data related to conversions (when marketing cookies are accepted)

2.5 Consent Preferences

Our consent management platform, Moelleux (operated by Horizon-Cumulus, Joliette, Quebec), records your cookie consent choices and stores them via a cookie named moelleux_{site_key} on your browser for up to 13 months. Your IP address is also logged at the time of consent for audit purposes. These records are hosted in Quebec (OVH, Beauharnois).

3. Purposes for Which We Use Your Personal Information

We use personal information only for the purposes for which it was collected, or for compatible purposes permitted by law. The legal basis for each purpose is indicated below.

3.1 Operating and Improving Our Website

Purpose: To ensure the website functions correctly, to measure audience traffic, and to improve the user experience.
Services involved: Moelleux (consent management), Google Analytics 4 (audience measurement).
Legal basis: Consent (for analytics cookies); legitimate interest (for strictly necessary functions such as security and session management).

3.2 Marketing and Advertising

Purpose: To measure the effectiveness of our advertising campaigns, to reach visitors who have previously shown interest in our services (remarketing), and to display relevant advertisements on third-party platforms.
Services involved: Meta Pixel (Facebook), Google Ads / Conversion.
Legal basis: Consent (marketing cookies must be explicitly accepted via our consent banner before these services are activated).

3.3 Newsletter and Marketing Email Communications

Purpose: To send you legal updates, event invitations, and other communications about the Firm's services when you have subscribed or otherwise expressed interest.
Services involved: Mailchimp (newsletter delivery, United States); Mandrill by Mailchimp (transactional email, United States). Both services are operated by Intuit Inc. and process data in the United States. See Section 5 for details on cross-border transfers.
Legal basis: Consent (you may withdraw at any time via the unsubscribe link in every email or by contacting us directly).

3.4 Responding to Inquiries and Client Communications

Purpose: To respond to questions submitted through our contact forms, to communicate with existing and prospective clients, and to manage our professional relationships.
Services involved: Microsoft 365 (email infrastructure, United States). See Section 5.
Legal basis: Consent or legitimate interest (pre-contractual or contractual necessity when you initiate contact with us).

3.5 Recruitment and Human Resources

Purpose: To receive, evaluate, and process employment applications, and to contact candidates regarding open positions.
Legal basis: Consent (provided when you submit your application) and, where applicable, legal obligation under employment law.

3.6 Security and Fraud Prevention

Purpose: To protect our website and users from automated abuse, spam, and fraudulent submissions.
Services involved: Google reCAPTCHA (bot detection, United States).
Legal basis: Legitimate interest (protecting the integrity of our website and the security of our users).

3.7 Display of Website Content

Purpose: To render our website correctly across devices and browsers.
Services involved: Google Fonts (web typography, United States). Your IP address is transmitted to Google's servers when fonts are loaded.
Legal basis: Legitimate interest (ensuring optimal display of our website content).

3.8 Recording and Honoring Consent Choices

Purpose: To record your cookie consent preferences and ensure that only the tools you have authorized are activated during your visit.
Services involved: Moelleux by Horizon-Cumulus (Joliette, Quebec). Data hosted in Quebec.
Legal basis: Legal obligation under Quebec Law 25 (obligation to obtain and document consent for non-essential cookies).

4. Third Parties and Service Providers

We work with the following third-party service providers. Each provider acts as a processor on our behalf or as an independent controller, and each is bound by contractual obligations to protect your personal information. Where a service is subject to your consent, it will only be activated after you have made your choice in our consent banner.

We do not sell your personal information to any third party. We do not disclose personal information to third parties except as described in this policy or as required by law.

5. Transfers of Personal Information Outside Quebec

Several of our service providers are located in the United States and process personal information on servers outside Quebec and Canada. Under section 17 of Quebec Law 25, we are required to inform you of these transfers and the safeguards in place.

5.1 Destination Countries and Services

• Google LLC (United States) — Google Analytics 4, Google Ads / Conversion, Google Fonts, and Google reCAPTCHA. Your IP address, device identifiers, navigation behavior, and related data may be processed on Google's servers in the United States.
• Meta Platforms, Inc. (United States) — Meta Pixel. Device identifiers, advertising identifiers, social identifiers, and browsing behavior may be processed in the United States.
• Intuit Inc. / Mailchimp and Mandrill (United States) — Your email address and communication engagement data are processed in the United States for the purpose of delivering our newsletter and transactional emails.
• Microsoft Corporation (United States) — Microsoft 365 processes email communications, which may include personal information you share with us, on infrastructure located in the United States.

5.2 Contractual Safeguards

Before transferring personal information outside Quebec, we conduct or rely upon a Privacy Impact Assessment (PIA) — known in French as an évaluation des facteurs relatifs à la vie privée (EFVP) — as required by section 17 of Quebec Law 25, to confirm that the receiving jurisdiction offers an adequate level of protection. We also enter into data processing agreements with our providers that include contractual clauses requiring them to protect your personal information in accordance with standards equivalent to those applicable in Quebec.

Please be aware that once personal information is transferred to a foreign jurisdiction, it may be subject to the laws of that country, including laws that may allow government authorities to access information in certain circumstances.

5.3 Consent Management — Hosted in Quebec

Your cookie consent records and this privacy policy are hosted exclusively in Quebec by Moelleux (Horizon-Cumulus, Joliette, Quebec) on OVH infrastructure located in Beauharnois, Quebec. No consent data leaves Quebec.

6. Retention of Personal Information

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. The following table summarizes our standard retention periods.

When the applicable retention period expires, personal information is securely deleted or anonymized so that it can no longer be linked to an identifiable individual.

7. Your Rights Regarding Your Personal Information

Quebec Law 25 grants you the following rights with respect to personal information we hold about you. To exercise any of these rights, please contact our Person responsible for the protection of personal information using the details in Section 8. We will respond within 30 days of receiving your request, as required by law.

7.1 Right of Access

You have the right to ask us whether we hold personal information about you, and to receive a copy of that information in a clear and understandable format. You may also ask us to confirm the sources of the information, the purposes for which it is used, and the categories of third parties to whom it has been disclosed.

7.2 Right of Rectification

If personal information we hold about you is inaccurate, incomplete, ambiguous, or outdated, you have the right to ask us to correct it. Where applicable, we will notify third parties to whom the information was disclosed of any correction made.

7.3 Right to Erasure (Right to be Forgotten)

You have the right to ask us to delete personal information about you when it is no longer necessary for the purposes for which it was collected, when you withdraw your consent and there is no other legal basis for processing, or when the information was collected unlawfully. Please note that we may be required to retain certain information to comply with legal or professional obligations, in which case we will inform you of the applicable limitation.

7.4 Right to Portability

Where personal information was collected through automated means and with your consent, you have the right to receive it in a structured, commonly used, and machine-readable format, and to have it transmitted to another organization where technically feasible.

7.5 Right to Withdraw Consent

Where we rely on your consent as the legal basis for processing, you may withdraw that consent at any time without penalty. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. You can:

• Withdraw cookie consent at any time by clicking the consent preferences link available on our website;
• Unsubscribe from our newsletter by clicking the unsubscribe link in any marketing email we send you;
• Contact us directly using the information in Section 8 for any other consent-based processing.

7.6 Right to File a Complaint

If you believe that we have not handled your personal information in accordance with Quebec Law 25, you have the right to file a complaint with the Quebec Information Access Commission (CAI):

• Website: https://www.cai.gouv.qc.ca

We encourage you to contact us first so that we have the opportunity to address your concern directly.

8. Person Responsible for the Protection of Personal Information

In accordance with section 3.1 of Quebec Law 25, Dunton Rainville S.E.N.C.R.L. has designated a Person responsible for the protection of personal information who oversees compliance with this policy and with applicable privacy legislation.

You may contact our Person responsible for the protection of personal information for any question, request, or concern regarding the handling of your personal information:

• Name: --
• Title: Responsable de la protection des renseignements personnels
• Email: [email protected]
• Phone: 514 866-6743

We will acknowledge your request promptly and provide a substantive response within 30 days, as required by Quebec Law 25. If your request is complex or voluminous, we may extend this period and will notify you accordingly.

9. Effective Date and Version History

This privacy policy takes effect on 22 juin 2026 and supersedes any prior version.

Version: 2

We may update this policy from time to time to reflect changes in our practices, the services we use, or applicable law. When we make material changes, we will update the effective date above and, where appropriate, notify you by email or through a notice on our website. We encourage you to review this policy periodically.

Continued use of our website after a revised policy has been posted constitutes your acknowledgment of the updated terms, subject to any consent requirements that apply to specific processing activities.