Privacy and Personal Information Protection Policy

Effective date: September 22, 2024

Date of last update: June 18, 2025

1.General Information

1.1 Introduction

Purpose of this Policy. Privacy protection is important to the Athos Group, which includes ATHOS SERVICES COMMÉMORATIFS INC., COMPLEXE FUNÉRAIRE AETERNA INC., LÉPINE CLOUTIER, LES ESPACES MEMORIA INC., and URGEL BOURGIE (hereinafter collectively referred to as the “Group,” “We,” “Us,” and “Our“). For this reason, We have implemented protective measures and sound management practices for Your Personal Information in accordance with applicable laws in Quebec and Canada. This policy describes Our practices regarding the collection, use, processing, disclosure, retention, and destruction of Personal Information of individuals who use Our Services, visitors to this Website, and its users (hereinafter “You,” “Your,” “Yours“).

Consent. By using Our website and those of Our subsidiaries, namely https://www.athos.ca, https://www.complexeaeterna.com/, https://www.lepinecloutier.com/, https://www.memoria.ca/, https://www.urgelbourgie.com/, https://www.crematoriumontreal.com/, https://fondationlepinecloutier.com/ and https://fondationurgelbourgie.com/ (hereinafter collectively referred to as the “Website“) or any of Our Services, You agree that We may collect, use, disclose, communicate, and retain (hereinafter referred to as “Process” or “Processing“) Your Personal Information in accordance with the terms described herein. If You do not agree to comply with and be bound by this Policy, You are not authorized to visit, access or use Our Website or Our Services, or to share Your Personal Information with Us.

Limitations of the Policy. This Policy does not apply to the Personal Information of employees, representatives, and consultants of the Group, or any other person affiliated with the Group, as well as any information that does not constitute Personal Information as defined by applicable laws in Quebec and Canada.

1.2 Data Protection Officer

Contact Information for the Data Protection Officer. Any comments, questions, or complaints regarding the Group’s privacy policy and practices may be addressed to our Data Protection Officer at the following contact information:

Phone: 418-686-8811

Email: [email protected]

Address: 2026 Blvd. René-Lévesque West, Quebec City (Quebec) G1V 2K8

2.Definitions

Definitions of Certain Terms and Expressions. The following terms and expressions, when capitalized in the Policy, have the meanings assigned to them below, unless otherwise specified in the text:

“Group,” “We,” “Us,” “Our“: ATHOS MEMORIAL SERVICES INC. and the following entities: COMPLEXE FUNÉRAIRE AETERNA INC., LÉPINE CLOUTIER, LES ESPACES MEMORIA INC., and URGEL BOURGIE.

“Service Provider“: any natural or legal person who processes Personal Information on behalf of the Group. These are third-party companies or individuals employed by the Group to facilitate the Services, provide the Services on behalf of the Group, perform services related to the Services, or assist the Group in analyzing the use of the Services.

“Cookie Banner“: pop-up window requesting Your consent to certain collections of Your Personal Information on the Website. Each of the Group’s Websites that use cookies has separate cookie banners (hereinafter collectively referred to as the “Cookie Banner“). Consent may be requested during Your visits to the various sites.

“Personal Information“: any information that relates to a natural person and allows that person to be identified, i.e., that directly or indirectly reveals something about the identity, characteristics (e.g., skills, preferences, psychological tendencies, predispositions, mental abilities, character, and behavior of the Data Subject) or the activities of that person, regardless of the nature of the medium and regardless of the form in which this information is accessible (written, graphic, audio, visual, computerized, or other).

“Data Protection Officer“: the person responsible for enforcing this Policy, whose contact details are provided in Section 1.2b) Data Protection Officerof this Policy.

“Services“: refers to the services provided by the Website and Our social media pages, such as:

• Introducing Our staff and team to You;
• Introducing You to Our network of several complexes and foundations;
• Conducting surveys;
• Offering You comprehensive memorial services for funerals, weddings, baptisms, or any other celebration or commemoration;
• Informing You about services offered to the benefit of the relatives of a deceased person or the deceased, such as commemorations, psychological support to facilitate mourning, repatriation services abroad, or Offering You the legal support of a notary to answer Your questions about inheritance;
• Assist visitors to the Website in easily offering their condolences to the loved ones of a deceased person through various means, such as sending flowers or condolence messages;
• Assisting participants in a memorial service in creating their itinerary to the locations where the memorial services are taking place;
• Assist with the publication of tributes;
• Assist the relatives of the deceased in publishing an obituary;
• Allow You to apply for a job via Our Careers section;
• Informing You about upcoming memorial events;
• Inform You about various products and Services that facilitate the organization of commemorative events, such as catering services;
• Allow You to use Our online store and make certain purchases there;
• Allow You to subscribe to Our communications.

“Website“: For the purposes of this Policy, the term “Website” includes https://www.athos.ca, https://www.complexeaeterna.com/, https://www.lepinecloutier.com/, https://www.memoria.ca/, https://www.urgelbourgie.com/, https://www.crematoriumontreal.com/, https://fondationlepinecloutier.com/ and https://fondationurgelbourgie.com/.

“Cookie“: Cookies are text files that are installed on Your computer or mobile device. These cookies may contain information about Your search history, the web pages You visit, and Your web browser.

“Process”, “Processing”: A concept encompassing all operations that may affect or concern Personal Information, including: collection, use, storage, destruction, communication, or transmission.

“You,” “Your,” “Yours“: Persons benefiting from Our Services, visitors to the Website, and all users who use the Group’s Services.

3.Processing of Personal Information

3.1Collection of Personal Information

3.1.1Means of Collection

Various Means. We collect Your Personal Information through Our Website or other technological means in various ways, including:

• Automatically. When You connect to Our Website, the device You use to connect will provide Us with Personal Information;
• Electronic Forms. By filling out and submitting one of Our electronic forms to Us;
• Emails Sent. Through emails You send to Us using one of the email addresses available on Our Website;
• Cookies. Through cookies, including the cookies identified in Our Cookie Banner;
• Surveillance Cameras. Through surveillance cameras installed on Our property; and
• Partners. Through third parties who collect your Personal Information for Us, as identified in the section Collection of Personal Information by Third Parties –Collection of Personal Information by Third Parties of this Policy.

Profiling, Identification, and Location. Our Website has features that allow Us to profile Your activities on Our Website, identify You, and locate You. These features are used by third parties identified in the section Access, Disclose, and Transfer of Personal Information –Access, Disclose, and Transfer of Personal Information through cookies. We disable these features by default. You can enable them through the Cookie Banner.

3.1.2Personal Information Collected

Categories of Information Collected. As part of Our activities, We may collect and process various types of Personal Information, including the information listed below:

• identification information and Your contact details, including Your first and last name, postal address, email address, and telephone number;

• demographic information, such as Your age or place of residence.
• technical or digital information, including connection information and other information about Your activities on the Website, such as Your IP address, the pages You have visited, the time and date of Your visits, Your number of connections, Your domain name, the address of the referring site (if You access the Website from another site), the type of browser You use, Your device’s operating system, and other hardware and software information;
• Your consent to the use of certain Cookies on Our Website and to the disclosure or use of Your Personal Information;
• information necessary for the provision of Our Services, such as information about the Services We have provided or are providing to You;
• information You choose to provide or send to Us, for example, when You fill out an online form, respond to solicitations or surveys, or communicate with one of Our employees or representatives;
• financial information, such as Your credit card number, if You wish to pay for Our Services online; and
• location information such as location data collected by Google Analytics.

3.2Collection of Personal Information by Third Parties

Funeraweb collects financial information (such as the existence of a transaction) on Our behalf. This collection only takes place when You use FuneraWeb’s services. For more information, see Funeraweb’s Privacy Policy.

3.3Refusing Collection

Refuse to Consent. Unless otherwise required by law or Your contractual obligations, You may refuse or withdraw Your consent to certain specific uses or disclosures of Your Personal Information:

• by not entering Your Personal Information in Our electronic or paper forms when the disclosure of such information is indicated as optional;
• by selecting “refuse” in the Cookie Banner; or
• by sending a request to Our Data Protection Officer at the contact information identified in section 1b) of this Policy.

Measures Available to Refuse Means of Collecting Personal Information. You may also provide Us with Your Personal Information by means other than technological means such as Our Website. You may provide Us with such information:

• By email;

• By telephone; or
• In person.

3.4Use of Personal Information

Purposes of Personal Information. We may use Your Personal Information for the purposes described below:

• to operate, maintain, monitor, develop, improve, and offer the features of Our Website;
• for the purposes set out in the Cookie Banner;
• to introduce and provide Our Services as described in the section – ;
• to fulfill Our contractual obligations to You;
• manage billing and process payments;
• process and resolve complaints and dissatisfaction;
• offer personalized recommendations based on purchase history;
• develop, improve, and offer new Services;
• protect Our property and staff with surveillance cameras;
• send You messages, updates, and security alerts;
• for marketing and business development purposes, if You have previously consented to the processing of Your personal information for these purposes;
• respond to Your questions and provide You with assistance as needed;
• conduct research, analysis, and statistics related to Our Group and Our Services;
• detect and prevent fraud, errors, spam, abuse, security incidents, and other harmful activities; or
• for any other purpose imposed or permitted by applicable laws.

If You submit a job application to Us, We will process Your application for the following purposes:

• evaluate Your job application;
• process and evaluate applications;
• interview candidates to assess their suitability to fit into the organization, share its values, and meet its criteria and the requirements of the position sought;

3.5Access, Disclose, and Transfer of Personal Information

Possible Access and Communication. We may transfer, communicate, or allow access to Your Personal Information to Our employees and Our Service Providers, who need this information to help Us operate Our Website, perform Our Services, carry out Our activities, or serve You.

3.5.1Access to Personal Information s Within the Group

Limitation of Access to Personal Information. Your Personal Information is only accessible to Our administrators, employees, or representatives who need access to Your Personal Information to perform their duties. As such, Your Information may be accessible within the various sectors of the entities comprising the Group:

• Our Data Protection Officer;
• Our IT (“Information Technology“) departments;
• Our finance department;
• Our sales departments;
• Our customer service departments;
• Our advertising department;
• any other department involved in the request;
• Our human resources department (in the case of job applications);

3.5.2Communication of Personal Information

Our Service Providers. Although we try to avoid sharing Your Personal Information with third parties, We may use service providers to perform various services on Our behalf, such as IT management and security, marketing, and data analysis, hosting, and storage. We have outlined below some instances in which such sharing may occur:

• The entities comprising the Group share all Personal Information with each other;
• We share Personal Information with Funeraweb. For more information, please see Funeraweb’s Privacy Policy.
• We use the Google Analytics cookie to analyze the Website’s audience and compile statistics. For more information, please refer to Google’s privacy policy and their table of cookies used for advertising and measurement (in English only);

Please note that this cookie may collect Personal Information that can locate You and profile Your web activities (targeted advertising).

This cookie communicates Personal Information to Google for the purposes identified in Our Cookie Banner.

• We use YouTube to showcase Our products and Services. For more information, please see Google’s privacy policy.
• We use Vimeo to showcase Our products and Services. For more information, please consult Vimeo’s privacy policy.
• We use Google Ads to deliver targeted advertising, analyze the audience of Our Services, compile statistics, and communicate with customers and prospects. For more information, please consult Google’s privacy policy and their table of advertising and measurement cookies (in English only) ;

Please note that this Cookie may identify You and profile Your web activities in order to provide You with advertising that matches Your interests (targeted advertising).

This cookie shares Personal Information with Google for the purposes identified in Our Cookie Banner.

• We use Cookies and Optimizely services to deliver targeted advertising. For more information, see Optimizely’s privacy policy.

Please note that this cookie may identify You and profile Your web activities in order to provide You with advertising that matches Your interests (targeted advertising).

This cookie shares Personal Information with Optimizely for the purposes identified in Our Cookie Banner.

• We use Meta (Facebook Pixel) services to deliver targeted advertising and to understand and deliver ads, compile statistics, and engage with customers and prospects. For more information, please see Meta’s privacy policy.

Please note that this cookie may identify You and profile Your web activities in order to provide You with advertising that matches Your interests (targeted advertising) or sell advertising products such as real-time auctions from third-party advertisers.

This cookie shares Personal Information with Meta for the purposes identified in Our cookie banner.

• We use Microsoft services (Azure, Outlook, and Microsoft Office) to store Our documents and emails. For more information, see Microsoft’s Privacy Statement.

All categories of Personal Information identified in Section 3.1 – Collection of Personal Information may be shared or stored through this service.

• We disclose Your Personal Information to data hosting providers for the hosting of Our Website.
• We use the services of several payment platforms such as PayPal, Global Payments, SnipCart, and Stripe to conduct commercial transactions on Our Services. For more information, see PayPal’s Privacy Policy, Global Payments’ Privacy Policy, SnipCart’s Privacy Policy, and Stripe’s Privacy Policy.
• We use Shopify cookies to deliver targeted advertising, understand user behavior and interaction, optimize the website, and make advertising on the site more relevant. For more information, see Shopify’s privacy policy.

Please note that this cookie may identify You and profile Your web activities in order to provide You with advertising that matches Your interests (targeted advertising).

This cookie shares Personal Information with Shopify for the purposes identified in Our Cookie Banner.

• We use Intuit Group’s MailChimp services to send Our newsletters and as a marketing platform. For more information, please see MailChimp’s Privacy Policy.
• We use SendGrid’s services to send, receive, and manage emails on a large scale, including transactional and marketing emails. SendGrid’s privacy policy can be found at Twilio , where You will find information on how SendGrid handles personal data, complies with regulations such as the GDPR, and protects its customers’ information through security measures and data processing agreements.
• We use CallRail’s services to track and analyze phone interactions, web forms, and SMS messages to identify lead sources and optimize marketing campaigns. CallRail is GDPR compliant and provides ways to access Your data, request its anonymization, or request its deletion. You can find their privacy policy directly atwww.callrail.com/privacy .
• We use the Unbounce tool to create and optimize landing pages, pop-ups, and navigation bars to maximize conversions, i.e., turning visitors into leads. Important information, such as the name or contact details of the contact, is collected using forms hosted on Unbounce. The data is deleted from the third-party platform once the optimization testing projects are complete. You can consult Unbounce’s privacy policies for more information: https://unbounce.com/product/security/gdpr/.
• We use the services of Hotjar Ltd to produce statistics and reports on Website navigation to analyze Website audience statistics. For more information, please see Hotjar Ltd‘s privacy policy.

This cookie communicates Personal Information to Hotjar Ltd for the purposes identified in Our Cookie Banner.

• If You order flowers, we share Your contact details and identifiers with florists so that they can deliver the flowers to You.
• We share information with document destruction agencies to destroy Personal Information.
• We use Metatracer on Our digital systems to facilitate the detection and management of Your Personal Information and that of Our employees, all to ensure Our compliance with privacy laws. Metatracer only collects identification information as Personal Information.

3.5.3Communication Outside Quebec

Communication of Personal Information Outside Quebec. We may communicate Your Personal Information outside Quebec.

Protections When Communicating Outside Quebec. Before communicating Your Personal Information to third parties outside Quebec, We conduct a privacy impact assessment to evaluate the risks that may affect the security of Your Personal Information. This assessment also identifies the appropriate security measures that will mitigate or eliminate these risks. The communication will then be subject to a written agreement binding these third parties to comply with such measures.

3.5.4Compliance with Legislation, Response to Legal Requests, Prevention of Harm, and Protection of Our Rights

Specific Disclosures of Your Personal Information. We may disclose Your Personal Information when We believe that such disclosure is authorized, necessary, or appropriate, including:

• to respond to requests from public and government authorities, including public and government authorities outside Your country of residence;
• to protect Our business;
• to comply with legal proceedings;
• to protect Our rights, the privacy of Our employees, officers, and directors, Our security, and Our property;
• to protect Your privacy and rights, or the privacy and rights of third parties;
• to enable Us to pursue available remedies or limit the damages We may sustain; and
• when required or permitted by applicable law, including laws outside Your country of residence.

3.6Consent

Consent to the Collection, Use, or Disclosure of Personal Information. Unless otherwise required by law, the Group obtains Your consent to collect, use, and disclose Your Personal Information. However, if You provide Us with Personal Information about other individuals, You must ensure that You have duly notified them that You are providing Us with their information and have obtained their consent to such disclosure.

Consent Criteria Required. We will seek Your express, free, informed consent for specific purposes before using or disclosing Your Personal Information for purposes other than those set out herein. We will also seek Your explicit consent whenever sensitive Personal Information is involved in any of the Group’s processing activities. We will ask for Your consent for each specific purpose in simple and clear terms, separately from any other information provided to You.

BY USING OUR WEBSITES, TRANSMITTING YOUR PERSONAL INFORMATION BY EMAIL OR USING AN ONLINE FORM, YOU AGREE TO THIS PRIVACY POLICY AND TO THE COLLECTION AND PROCESSING OF YOUR PERSONAL INFORMATION IN ACCORDANCE WITH THE PRIVACY POLICY.

Refusal to Use the Website. If You do not agree, please stop using the Website. Except where otherwise provided by law, You may withdraw Your consent at any time by giving reasonable notice. Please note that if You choose to withdraw Your consent to the collection, use, or disclosure of Your Personal Information, certain features of Our Website may no longer be available to You, or we may no longer be able to offer You certain Services.

3.7Retention of Personal Information

Retention of Personal Information. Subject to applicable laws, We retain Your Personal Information only for as long as necessary to fulfill the purposes for which it was collected, unless You consent to the use or processing of Your Personal Information for another purpose.

Additional Information. For more information about the periods during which Your Personal Information is retained, please contact Our Data Protection Officer using the contact details provided in section General Information.2 b) – Data Protection Officer of this Policy.

4.Your Rights

List of Rights. As a Data Subject, You may exercise the rights set out below by contacting Our Data Protection Officer in writing at the contact details provided in section General Information.2 b) – Data Protection Officer of the Policy. Please note that We may ask You to verify Your identity before responding to any of these requests.

• You have the right to be informed of the Personal Information We hold about You, its use, disclosure, retention, and destruction, subject to the exceptions provided for by applicable law;
• You have the right to access Your Personal Information, request a copy of the documents containing Your Personal Information, subject to the exceptions provided for by applicable law, and obtain, where applicable, additional details on how We use, disclose, retain, and destroy it by sending a written request to Our Data Protection Officer at the contact information identified in section General Information.2 b) – Data Protection Officer for this Policy;
• You have the right to have the Personal Information We hold about You corrected, amended, and updated if it is incomplete, ambiguous, outdated, or inaccurate by sending a written request to Our Data Protection Officer at the contact details identified in section General Information.2 b) – Data Protection Officer for this Policy;
• You have the right to withdraw or modify Your consent to the collection, use, and disclosure of certain Personal Information collected about You (as identified in the section Collection of Personal Information –Collection of Personal Information of this Policy) at any time, subject to applicable legal and contractual restrictions;
• You have the right to ask Us to stop disseminating Your Personal Information and to de-index any link attached to Your name that gives access to this information if such dissemination contravenes the law or a court order;
• You have the right to request that Your Personal Information be disclosed to You or transferred to another organization in a structured and commonly used technological format;
• The right to be informed of a privacy incident involving Your Personal Information that could cause You serious harm. To this end, We maintain a register of all privacy incidents and assess the harm they may cause; and
• You have the right to file a complaint with the Commission d’accès à l’information, subject to the conditions set out in applicable law.

5.Questions and Complaints

Complaint Process. You may address any complaints regarding Our practices and policies for protecting Your Personal Information by contacting Our Data Protection Officer using the contact information provided in section General Information.2 b) – Data Protection Officer.

Questions. You may also contact Our Data Protection Officer with any questions regarding this privacy policy using the contact information identified in section General Information.2 b) – Data Protection Officer.

Need to Identify Yourself. In order to respond to Your request, You may be asked to provide appropriate identification or to identify yourself in another way.

6.Security Measures

Purpose of Our Security Measures. We have implemented physical, technological, and organizational security measures to adequately protect the confidentiality and security of Your Personal Information against loss, theft, or unauthorized access, compromise, disclosure, reproduction, communication, use, or modification. These measures include, but are not limited to:

• Administrative Measures. At the administrative level, the adoption of a series of measures, policies, and procedures as part of the implementation of Our information governance program, which in particular:

• regulate access, communication, retention, and depersonalization, including the destruction or anonymization of Personal Information;
• determining the roles and responsibilities of Our employees throughout the life cycle of Personal Information and documents;
• establish procedures for responding to and addressing privacy incidents;
• regulate the process for requests and complaints relating to the protection and processing of Personal Information.
• Technical Measures. On a technical level, the use of several means such as:

• the use of Secure Socket Layer (SSL) technology;
• the use of VPNs;
• limiting access privileges to Personal Information to Our employees;
• the use of backup systems;
• the use of two-factor authentication; and
• the use of a firewall system.

Incomplete List of Measures. We have not listed all the measures We implement, given the public nature of this Policy.

Impossibility of Guaranteeing Complete Absence of Risk. Despite the measures described above, We cannot guarantee the absolute security of Your Personal Information. If You have reason to believe that Your Personal Information is no longer secure, please contact Our Data Protection Officer immediately using the contact details provided in section 1.2 b) –b) Data Protection Officer above.

7.Changes to this Privacy Policy

Right to Change this Policy. We reserve the right to change this Policy at any time in accordance with applicable law. If We make any changes, We will post the revised Privacy Policy and update the date at the bottom of the Privacy Policy. We will notify You reasonably in advance of the effective date of the new version of our Policy. If You do not agree to the new terms of the Privacy Policy, We encourage You to stop using Our Website and Services. If You continue to use Our Website or Services after the new version of Our Policy takes effect, Your use of Our Website and Services will be governed by that new version of the Policy.

8.Links to Third-Party Websites

Responsibility of Third-Party Websites. We may occasionally include references or links on Our Website to websites, products, or services provided by third parties (the “Third-Party Services“). These Third-Party Services, which are not operated or controlled by the Group, are governed by privacy policies that are entirely separate and independent from Ours. We therefore assume no responsibility for the content and activities of these sites. This Policy applies solely to the Website and the Services We offer.

9.Individuals Under the Age of 14

Consent of Minors Under 14 years of Age. If You are under 14 years of age, You must not provide Us with Your Personal Information without the consent of Your parents or guardian. If You are a parent or guardian and You learn that Your child has provided Us with Personal Information without consent, please contact Us by using the contact details provided in section 1.2 b) above to request that We delete that child’s Personal Information from Our systems.

10.Applicable Laws

Laws of Quebec and Canada. The laws of Canada and Quebec, excluding its conflict of law rules, will govern this agreement and Your use of the Website. Your use of the Website may also be subject to other local, provincial, national, or international laws.