1. Who we are

Mondrian Innovation Inc. (“Mondrian,” “we,” “us,” “our”) is a Quebec consulting firm specializing in artificial intelligence and digital transformation, headquartered in Quebec, Canada. This privacy policy (the “Policy”) applies to personal information we hold or control, including information collected when you visit our website and throughout our business activities, such as our consulting services, client relationship management, recruitment and the operation of our digital tools (the “Services”).

Mondrian is responsible for the personal information it collects. Our person in charge of the protection of personal information (our “Privacy Officer”) can be reached at:

Email: info@mondrian.ca

Phone: 514-834-6211

By accessing or using our Services, you agree to be bound by the terms and conditions of this Policy.

2. Personal information we collect

In providing our Services, Mondrian collects the following categories of personal information:

2.1 Identification information

• First and last name
• Work email address
• Phone number
• Job title and organization name
• Mailing address

2.2 Transaction information

• Billing details
• Supplier and client account information
• Transaction and engagement history
• Information about the Services Mondrian provides to a client

2.3 Information about our team members

• First and last name, contact information and social insurance number (for payroll purposes)
• Résumé, degrees and certifications
• Information related to employment contracts and job applications
• Time and attendance data (e.g., hours worked per project)
• Compensation and benefits information

2.4 Browsing information and cookies

• IP address and session identifiers
• Pages visited on our digital properties
• Usage and performance data
• Browsing preferences and settings

2.5 Information you provide voluntarily

• Messages sent through our contact forms
• Newsletter subscriptions
• Email correspondence
• Résumés and other information submitted with a job application
• Information provided in the course of a business relationship with a client

When you provide information voluntarily (section 2.5), you acknowledge that we have no control over the nature or type of information you choose to share. You therefore agree that Mondrian may collect this information as part of its Services and process it in accordance with this Policy. If you choose to include sensitive personal information, you expressly consent to its collection, use and disclosure by Mondrian in accordance with this Policy, including disclosure to third parties inside and outside Quebec.

Mondrian recognizes the importance of keeping personal information accurate, complete and up to date, and takes reasonable measures to ensure the accuracy and completeness of the information it uses or discloses. However, it is your responsibility to inform Mondrian of any significant change to your personal information.

3. Purposes of processing, and other uses permitted or required by applicable law

Mondrian collects and uses personal information for the following purposes:

3.1 Delivering our Services

• Carrying out consulting and digital transformation engagements
• Managing client relationships (communications, follow-ups, reporting)
• Billing and accounting

3.2 Improving our Services and communications

• Assessing client needs and satisfaction
• Sending business communications and newsletters (with consent)
• Developing case studies (with the client’s explicit consent)

3.3 Security and compliance

• Detecting security incidents
• Meeting our legal and regulatory obligations
• Managing access rights to our systems
  

Personal information will not be used for any purpose other than those described above unless the individual concerned has consented, or unless the law requires or permits it.

4. Subcontractors and disclosure to third parties

Within our organization, access to personal information is strictly limited to those who need it to carry out their duties and responsibilities.

In delivering its Services, Mondrian relies on service providers and third-party tools. These third parties are contractually bound to protect personal information in accordance with the requirements of the Act respecting the protection of personal information in the private sector.

The categories of service providers we use include:

4.1 Cloud tools

Mondrian uses Microsoft (Microsoft 365, Azure) and Google (Google Workspace) solutions to manage its communications, documents and digital infrastructure. These providers may process personal information outside Quebec. Appropriate contractual safeguards are in place, and a privacy impact assessment is conducted to ensure an equivalent level of protection.

4.2 Artificial intelligence platforms

In the course of our engagements, we may use AI models provided by third parties (including OpenAI and Anthropic). Mondrian ensures that no personal information is shared with these platforms without a prior privacy impact assessment, and that no sensitive personal information is shared without the explicit consent of the individual concerned.

4.3 Customer relationship management (CRM) and marketing tools

Mondrian may use CRM and marketing tools to manage client communications and business development activities. These tools are configured to limit collection to strictly necessary data.

Mondrian does not sell or rent your personal information to third parties.

5. Transfer of information outside Quebec

Because some of our service providers are located outside Quebec, your personal information may be transferred to and processed in other Canadian provinces or abroad.

In accordance with section 17 of the Act respecting the protection of personal information in the private sector, Mondrian conducts a privacy impact assessment (PIA) before any transfer outside Quebec to ensure that the information will be adequately protected. If we disclose sensitive personal information about you outside Quebec, we will obtain your express consent.

You can find out more about how these transfers are carried out by contacting our Privacy Officer.

6. Retention period

Mondrian retains your personal information only for as long as needed to achieve the purposes for which it was collected, or to meet its legal obligations, including:

• Client and engagement records: 7 years after the engagement ends (tax and accounting obligations)
• Employee records: duration of employment plus 5 years after it ends
• Browsing data: 13 months maximum
• Unsuccessful applications: 6 months (unless you consent to a longer retention period)

Once the retention period expires, or once the purposes for which the information was collected or used have been achieved, as applicable, the information is securely destroyed or anonymized.

7. Exercising your rights

Withdrawing consent: You may withdraw your consent to the use of your personal information at any time, subject to applicable legal restrictions. Your withdrawal will take effect within 30 days of your request. If we are unable to respond within that time frame, we will let you know. Please note that if you withdraw your consent to the collection, use or disclosure of your personal information, Mondrian may no longer be able to provide certain Services.

Access: You have the right to request access to the personal information Mondrian holds about you, and to obtain confirmation that we hold personal information about you. Where your personal information was collected electronically, we will provide it in a structured, commonly used technological format. Access is free of charge, although reasonable fees may be charged to transcribe, reproduce or transmit the information.

Correction: You may also ask that your personal information be corrected if it is inaccurate, incomplete or ambiguous, or if its collection, disclosure or retention is not authorized by law, by submitting a request to our Privacy Officer.

To exercise these rights, or to raise any other complaint or concern about your personal information, send a written request to our Privacy Officer at info@mondrian.ca, along with sufficient proof of identity. We will respond within 30 days of receiving your written request.

8. Security of personal information

Mondrian implements appropriate technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration or destruction. These measures may include:

• Role-based access control
• Encryption of data in transit and at rest
• Periodic privacy risk assessments
• Employee training on the protection of personal information
• Confidentiality incident management and notification protocol

However, since no system is completely secure, some degree of risk always remains. In the event of a confidentiality incident likely to cause serious harm, Mondrian will notify the Commission d’accès à l’information (CAI) and the individuals concerned within the time frames required by applicable law.

9. Cookies and similar technologies

Our digital properties may use cookies and similar technologies for functional, analytics and personalization purposes. On your first visit to our website, you will be asked to consent to the use of non-essential cookies.

You can change your cookie preferences at any time through your browser settings or by contacting us.

10. Changes to this policy

Mondrian reserves the right to amend this Policy at any time, including to reflect legislative, regulatory or operational changes. Any changes will be posted on our website, and the date of the latest version of this Policy appears at the bottom of the page. The current version is always available on request.

11. Contact us

If you have any questions about this Policy or the protection of your personal information, please contact our Privacy Officer:

Privacy Officer

Mondrian

Email: info@mondrian.ca

Address: 5455 De Gaspé Avenue, Suite 710, Montréal, Quebec H2T 3B3

You may also contact the Commission d’accès à l’information du Québec (CAI):

• Website: www.cai.gouv.qc.ca
• Phone: 1-888-528-7741