PRIVACY POLICY

Updated on May 28, 2026

At KIWI Technologies inc. (“we”, “our”, “us”), protecting your personal information is of paramount importance. In accordance with the Act respecting the protection of personal information in the private sector in Quebec, this policy (the “Policy”) aims to inform you, in clear and plain language, of our practices surrounding the collection, use, disclosure, and retention of your data, depending on whether you visit our Sites or use our Platform.

1. Scope of Application and Definitions

To facilitate the reading of this Policy, we use specific terms whose meanings are aligned with our Terms of Use:

  • “Sites”: Refers to our public and showcase websites, accessible notably through the following hyperlinks: https://kiwi.ca, https://wehoop.com, https://stageplus.ca, and https://traceabl.com.
  • “Platform”: Refers to our software application infrastructure operated in Software-as-a-Service (SaaS) or Platform-as-a-Service (PaaS) mode, marketed under the trademarks WeHoop, STAGE+, Équipa, and Traceabl.
  • “Client”: Refers to any organization, business, or institution (notably healthcare and social services network establishments) that has entered into a service agreement with KIWI for the use of the Platform.
  • “Authorized User”: Refers to any physical person (student intern, coordinator, manager, Client employee) duly authorized by a Client to access and use the Platform via a secure account.

2. Policy Summary

The table below provides a quick overview of how we process personal information based on your interaction profile.

Component Visitors of our Sites Authorized Users of our Platform
Collection Methods Automatic, when browsing our web pages. Voluntary entry by the Authorized User or transmission by the Client.
Nature of Data Anonymized or technical browsing data (IP address, cookies). Nominative and sensitive data (Authentication, HR files, vaccination status, traceability).
Legal Status Data Controller: KIWI determines the processing purposes for its own audience analytics needs. Data Processor (Subcontractor): The Client owns the data; KIWI acts solely under its business instructions.
Digital Markers Disabled by default. Activation option via the “Manage Consent” button. Required to securely maintain the authenticated application session.

3. Collected Information and Collection Distinctions

We only collect personal information that is necessary to achieve serious and legitimate purposes. Processing differs depending on the environment you access:

3.1 When You Access Our Sites (Automatic Collection)

During your public browsing on our Sites, we automatically collect audience measurement data via “Digital Markers” (cookies, HTML5 storage, web beacons):

  • The IP address, type, model, and operating system of your device;
  • The web browser used (language, type, and version);
  • The date, time, pages viewed, and approximate geographical location.

⚠️ PROTECTION RULE: Digital markers that allow us to identify, locate, or profile you for advertising purposes are strictly disabled by default. You must voluntarily activate them to modify your browsing experience.

3.2 When You Use Our Platform (Authorized Users)

To execute our services and enable the functionality of the applications (WeHoop, STAGE+, Équipa, Traceabl), we process the information provided by the Client or entered by you as an Authorized User:

  • Access and Identity Data: Last name, first name, professional or personal email address, unique login identifiers, encrypted passwords, and multi-factor authentication data.
  • STAGE+ Specific Data: Resumes, cover letters, intern contact details, vaccination status (when required by the internship environment), license number (notably for medicine), assignment histories, internship evaluations, and equipment loan tracking.
  • Traceabl Specific Data: Identification numbers, timestamps, and geolocation of medical samples or assets subject to traceability.
  • Recruitment and HR Data (KIWI Employees): Academic background, bank details for payroll, Social Insurance Number (SIN), professional references, and criminal record checks.

4. Purposes of Processing (For what purposes?)

We use your personal information exclusively for the following reasons:

  • Provision of the Platform: Manage and maintain Authorized User accounts, ensure the security of application accesses, and notify users in the event of maintenance operations or service outages.
  • Technical Support and Quality Control: Respond to your team's support requests, analyze the technical stability of the applications, and fix software bugs.
  • Application Management and HR: Process applicant files and administer the employment relationship with KIWI's internal staff.
  • Contractual and Legal Compliance: Validate a Client's access rights, authenticate the source of connections, and comply with our regulatory obligations.

5. Disclosure and Cross-Border Transfers

5.1 Technology Providers and Partners

We do not sell or rent your personal information. We disclose it only to our essential technological subcontractors (secure cloud and web hosts, technical analysis tools, system notification delivery agencies).

5.2 Transfers Outside of Quebec

Some servers of our cloud service providers may be located outside the province of Quebec. Before any transfer or hosting, KIWI mandatorily conducts a Privacy Impact Assessment (PIA) to contractually guarantee that the third party deploys security measures equivalent to Quebec standards.

6. Security Measures and Incident Management

We deploy rigorous physical, administrative, and technological protection protocols:

  • End-to-End Encryption: All data transiting through our Sites and our Platform is encrypted using the TLS (Transport Layer Security) security protocol.
  • Internal Governance: Access rights are limited according to the principle of the need-to-know, confidentiality agreements are signed by our employees, and recurring training is provided on managing cyber risks.
  • Incident Management: We maintain an official registry and apply a rapid response plan in the event of a privacy incident in order to limit the impact and immediately notify the affected Clients.

Risk Disclaimer: Despite the deployment of these robust measures, no method of transmission or storage is completely infallible. We cannot guarantee zero risk of a privacy incident. If you suspect a security breach, please contact us immediately.

7. Your Rights and How to Exercise Them

In accordance with the legislation, you have a right of access, rectification, and withdrawal of your consent regarding your personal information.

7.1 Critical Role as a Subcontractor (Platform Information)

When KIWI processes data within its Platform on behalf of a Client (e.g., a CIUSSS or a hospital), the Client remains the sole and unique Controller for the processing of this information.

  • If you are an Authorized User and your request concerns your internship data, forms, or application profile, you must address your request for access or rectification directly to the Privacy Officer of the Client (your home or internship organization).
  • If KIWI receives a request directly from an Authorized User in this regard, it will immediately forward it to the affected Client.

7.2 Requests Related Directly to Our Sites or KIWI

For any request concerning data from our Sites or your direct relations with KIWI, you must submit a written request to our internal Officer (see Section 8). We will respond within a maximum of thirty (30) days.

8. Contact Information of the Officer

For any questions regarding this Policy or to file a complaint regarding our practices, please contact our official Officer:

  • Attn: Privacy Officer
  • Company: KIWI Technologies inc.
  • Address: 206-3125, rue Flaubert, Québec (Québec) G2E 2J2
  • Phone (toll-free): +1 855 274 1118
  • Email: [Insert email address, e.g., privacy@kiwi.ca]

If our handling of your internal complaint does not satisfy you, you retain the legal right to submit an official complaint to the Commission d’accès à l’information du Québec via their online portal: https://www.cai.gouv.qc.ca/.

9. Revision and Update

This Policy may be amended to reflect technological or legislative changes. In the event of a modification, a notice will be visibly published on our Sites and sent by email to users for whom we have a valid address. Modifications will take effect fifteen (15) days after their publication.