17 HYMAN

Groupe MACH and its subsidiaries are committed to protecting and safeguarding your personal information. With your consent, MACH, its subsidiaries, and its shopping centers collect and store certain personal information. We use this information for specific and legitimate purposes and for a determined duration. We have implemented measures to protect it.

You have the right to access and correct the personal information we hold and to withdraw your consent to its use at any time.

Website Visits

MACH websites use Google Analytics services for analysis to improve their content, campaigns, and website navigation.

When you visit our site, Google Analytics collects certain specific information, such as your IP address and other data that we only access in an anonymized and aggregated form, such as your browser or device.

We invite you to consult Google’s privacy policy for more details.

Contact Through Our Websites

If you write to us at the general site address or through a form on the site, we collect your email address and the information you choose to include in your message.

We use this information to assess the subject of your request, direct it to the appropriate person, and communicate with you. We retain your message for the time necessary to adequately process it and to offer you complementary services, for a maximum of 2 years.

Use of Cookies

Cookies are files stored on your device by a website that allows your browser to interact with the site.

MACH uses a cookie manager to collect your consent to share and allow us to use certain cookies to enhance your experience on our sites.

Necessary Cookies: Necessary cookies ensure the basic functions of the website. Without them, our site cannot function as intended.

These cookies do not store any personally identifiable data. If you do not consent to us collecting the necessary cookies, please do not browse MACH websites. For all other cookies, you can choose whether or not to consent to their use.

You can also modify your options at any time by clicking "Manage my cookies" at the bottom of the site.

Functional Cookies: Functional cookies enable certain functionalities, such as sharing website content on social media platforms, collecting feedback, and other third-party features.

Analytical Cookies: Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on the number of visitors, bounce rate, traffic source, etc.

Performance Cookies: Performance cookies are used to understand and analyze the key performance metrics of the website, which helps provide a better user experience for visitors.

Advertising Cookies: Advertising cookies are used to provide visitors with personalized advertisements based on previously visited pages and to analyze the effectiveness of the advertising campaign.

Our cookie manager retains authorized cookies for the duration you set according to your preferences.

Client Data

Contact and Billing Information

We collect information necessary for the sound financial management of our organization, such as the names and contact details of your internal contacts and your payment information. We keep this information for the duration of our collaboration and for a reasonable period afterward to provide you with optimal and personalized service if you choose to use our services in the future.

We retain payment information for up to 7 years, in compliance with applicable legal and tax provisions.

Job Applications

If you apply to MACH, one of its subsidiaries, or one of its shopping centers, we use the personal information contained in your resume and application documents (name, email, phone number, educational and professional background, etc.) to identify you, analyze whether your profile matches the sought profile, and exchange invitations, information, and documents related to the recruitment process.

Only employees of MACH and its subsidiaries directly involved in your candidate journey have access to the personal information contained in your resume.

We will keep your personal information for two years following their transmission. We will use it to contact you if a position similar to the one you applied for opens during this period.

Social Media Subscriptions

We have access to who subscribes to MACH and its subsidiaries' social media (names, profiles, etc.), and we can see how users interact with our posts (comments, shares, views, etc.).

If you visit our websites from one of our social media posts, we use certain trackers to assess the impact of our posts and measure the effectiveness of our campaigns.

See the “Website Visits” section above.

To learn more about the privacy policies of our social media, we invite you to consult the privacy policies of each social media platform.

Our Measures to Protect Your Personal Information

Your personal information is stored in Canada, or in the United States when used by service providers located in the United States (e.g., Google Analytics).

We take the following measures to keep your personal information secure:

• All new team members sign confidentiality clauses.

• All new recruits undergo background checks.

• All staff members receive mandatory cybersecurity training.

• Our telework policy contains additional provisions on the security and confidentiality standards of information used in the course of work.

• We choose reputable and trustworthy service providers and sign confidentiality agreements with them.

• Our electronic devices are password-protected and our internet network is firewall-protected.

• Our accounts are secured by multi-factor authentication.

Employees of MACH and its subsidiaries have access to your information only for one of the reasons described in this policy. We will never sell your information to an external person or organization.

Contact Regarding Your Personal Information

Anyone can, upon request to vie-privee@groupemach.com:

• Know and, if applicable, access the personal information held about them

• Withdraw their consent to the use of the personal information held about them

• Correct their outdated or inaccurate personal information

The request must clearly indicate that it is an access request to personal information and provide sufficient information to identify the person and the information sought.

To prevent fraudulent requests, MACH may take all reasonable measures to validate the identity of the person and reserves the right to refuse to disclose the requested information if the person does not fully cooperate with this validation or if there remains a doubt about their identity. We also reserve the right to refuse any request clearly made maliciously, excessively, abusively, and unjustifiably.

Personal information or confirmation of the absence of personal information will be provided by encrypted email within a reasonable time, not exceeding 60 working days.

Everyone must go through our cookie manager to disable non-essential cookies when visiting our site. See the "Use of Cookies" section for more information.

The person delegated to the protection of personal information at MACH is David Lazzari, whom you can contact for the reasons stated in this policy at vie-privee@groupemach.com.

Update

This policy was updated on July 15, 2024. Any changes will be immediately posted on our website, with a note of the new update date.