Controller

TES CANADA is the controller and responsible for processing your personal data. This privacy policy is issued for TES CANADA When we mention "TES CANADA", "we", "us" or "our" in this privacy policy, we are referring to TES CANADA as the sole body which is responsible for processing your data. TES CANADA does not include any other company for processing your information when you apply for and receive training from us, and in the delivery of any subsequent certificates. We have appointed a Data Protection Officer who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the Data Protection Officer using the details set out below.

Contact details

If you have any questions about this privacy policy or our privacy practices, please contact our Data Protection Officer, by post to TES CANADA, Unit 335, 3750 46 Ave SE, Calgary, Alberta, Canada, T2B 0L1, or by email to data.protection@tescan.ca, or by Landline: +1 403 245 5548.

Changes to the privacy policy and your duty to inform us of changes

This version was developed in August 2022 and would be under regular review. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Unless we say otherwise, this privacy policy applies to:

Candidates:
an individual who has applied for and/or attended training, exams and/or inspections with TES CANADA.

Customers:
a customer of TES CANADA.

Contacts:
all contacts of TES CANADA, for example, business contacts, suppliers and potential customers; and

Visitor:
visitors to our sites and website. Some sections of this privacy policy only apply to users in Canada. We make it clear where this is the case.

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes first name, maiden name, last name, username or similar identifier, title, date of birth;
• Contact Data includes work/billing address, home address, email address and telephone numbers;
• Candidate Data includes Candidate ID number, sponsorship status and sponsoring company name and address, professional memberships, details of any disability or specific requirements, events booked and/or attended, venues and booking references, inspections and/or examination type applied for and completed, pre-certification experience and examination records, verifier details (including name, telephone number, email address, company and role, and relationship to the Candidate);
• Customer Data includes details of your orders for services, details of historical orders and payments to and from you;
• Financial Data includes bank account and payment card details, details of payments to and from you;
• Technical Data includes the internet protocol (IP) address used to connect your device, the type of device you are using, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access a website;
• Profile Data includes your username and password and any feedback you provide including feedback received following your receipt of any training, or via direct email crm@tescan.ca ;
• Usage Data includes information about how you use our website and services; and
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific Website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

Special category (or sensitive) personal data

We request details of any disability or medical condition or specific medical requirement you may have when you apply to attend our training courses, exams and inspections. These are referred to as “special categories” of personal data. There are additional special categories of personal data but we do not collect these (for example, details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with services). In this case, we may have to cancel a service you have with us, but we will notify you if this is the case at the time.

We use different methods to collect data from and about you including through:

• Information we receive directly from you. You will provide us with your personal data when you fill in forms or correspond with us by post, phone, email or otherwise. This includes personal data you provide when you:
  - purchase our services;
  - apply for and receive our training, exams and inspections;
  - when you access the training portal or attend training events and symposiums;
  - subscribe to our publications;
  - request marketing to be sent to you;
  - respond to a survey; or
  - give us feedback in any other way or when you contact us for any reason.
• From your member organization/employer. Your employer will provide us with information about you when registering you for a training course, exam or inspection. This will include, for example, your name and contact details, role and previous experience.
• Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other Website employing our cookies.
• Information provided by other-third parties. When you use our website, we may receive information about that use from other companies who provide us with services in connection with them.

We will only use your personal data when the law allows us to and to enable us to provide our services and operate our website effectively. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract, we are about to enter into or have entered into with you;
• Where it is necessary for our legitimate interests (or those of a third-party) and your interests and fundamental rights do not override those interests; and
• Where we need to comply with a legal obligation.

Generally, we do not rely on consent as a legal basis for processing your personal data although we will get your consent before sending third-party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.

Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. Please note that we may process your personal data for more than one lawful basis, depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific lawful basis we are relying on to process your personal data where more than one is set out in the table below.

More about the information we use and why

Where we need consent to use your personal information, we will clearly ask you for this; and you can withdraw that consent at any time. For example, we may ask you to positively opt-in to us sending you marketing communications. If you have any questions or you need any further information regarding how we use your information, please contact us.

Marketing

We may use your personal information to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you. You will receive marketing communications from us if you have requested information from us or purchased services from us and you have not opted out of receiving that marketing. We will not provide your personal information to any other third-party businesses outside TES CANADA for marketing purposes unless we have your express permission to do so. Should you wish to opt-out of receiving marketing messages at any time, you can follow the opt-out links on any marketing message sent to you or contact us at any time.

Privacy Notice for TES CANADA Website Users

TES CANADA is committed to protecting the privacy and security of your personal information. This privacy notice describes how we collect and use personal information about you, in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). TES CANADA is a ‘data controller’ This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice. Our principal activities are:
• Consultancy
• Engineering
• Technical training
• Events

Our privacy policy covers TES CANADA Website:

This privacy and cookie use policy explains how we use any personal information we collect about you when you use these websites.

Anonymous Access

You can access our website home pages and browse much of our site without disclosing your personal information.

Other Website

Our website include links to external Website. Such third-party web service providers may collect personal information about our visitors. This privacy and cookie use policy only applies to these Website so when you link to other Website you should read their own privacy and cookie use policies.

Search Engine Marketing

We use Google AdWords service to advertise on the Google search result page. Google uses cookies to serve ads based on your past visits on our website. For more information on Google AdWords services and how to opt-out, please refer to Google specific privacy policy and settings for Google ads.

Google Ads and Remarketing

We use the remarketing feature from Google Ads. This feature is used to present Website users advertising within the Google ad network. A "cookie" is stored in the browser of a user to the Website that enables the user to be recognized on Google's network after they leave our website. Google can present the user with advertisements that relate to content that they had previously viewed up on website that use the remarketing feature from Google. According to its own policy, Google does not collect any personal data with this process. Nevertheless, if you do not want to use the remarketing feature from Google, you can disable it by changing the appropriate settings at Google Ad Settings.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. However, we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

We share your personal data with:

• • carefully selected companies to operate the website, to provide our services to you and to support our business (for example, IT database, and services and marketing support);
• • in some circumstances, to a data protection regulator or in order to comply with the law or a legal process or where we have another legitimate interest that is not outweighed by your interests and fundamental rights (for example, to maintain the security of our computer systems).
• • if you are a Candidate, to:
  - other TES CANADA facilities for the purposes of delivering your training;
  - your employer, if your employer is organizing your training, exam and/or inspection; and
  - external examining bodies for the provision of certificates;
• • if you are a Customer, your information will be available to other TES CANADA facilities This is so that we can assess the services we provide and identify further opportunities for us to develop these and to grow the business.
• • third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.
• We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

If you are a Contact or Visitor and you are based in Canada, your information will only be processed in Canada, as applicable.
We may need to share your personal data within TES CANADA facilities, this may involve transferring your data outside Canada.
If you are a Candidate and you receive training outside Canada, your information will be accessed by TES CANADA staff in the relevant location. Details of your training will then be transferred back to Canada where our systems will be updated.
If you are a Customer, your information is stored on our Customer Portal Database, some of which can be accessed from TES CANADA facilities.
We take reasonable precautions to ensure that your information will be adequately protected whenever it is transferred outside Canada, and that it will be treated in a way which is consistent with Canada data protection laws.
We will only transfer your personal data either:
• to countries that have been deemed to provide an adequate level of protection for personal data; or
• where we have specific contracts in place, approved for use in Canada, which give personal data a similar level of protection it has in Canada.
Please contact the Data Protection Officer using the contact details, if you want further information on how and when we transfer your personal data out of Canada.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. Details of these are available from our Data Protection Officer. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

How long will you use my personal data for?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you or your employer. To determine the appropriate retention period for personal data, we consider the nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. If you would like further information as to how long we retain your information, please contact the Data Protection Officer.

Updating and accessing your information

If you are in Canada, you have the right under Canada data protection laws to access personal information held about you, subject to certain conditions, and to ask for it to be changed or deleted. If you would like to access or amend the personal information which we hold about you, or if you would like us to stop using your personal information, please contact us. To learn more about the rights you may have in relation to your personal information see “Your rights”.

Your rights

By law you have the following rights with regard to your personal information:

• • Access. You have the right to obtain confirmation as to whether or not your personal information is being processed, and, if it is, request access to that personal information (commonly known as a “data subject access request”). We will need you to prove your identity before we release any personal information to you.
• • Correction or deletion. You have the right to ask us to correct or delete any personal information that we hold about you (unless we have the legal right to retain it). You also have the right to ask us to delete your information where you have exercised your right to object to processing (see below).
• • Objection. You have the right to object to processing of your information where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your information for direct marketing purposes.
• • Restriction. You also have the right to restrict us from processing your personal information. You can ask us to temporarily stop processing information about you, for example if you want us to establish that it is accurate or the reason for processing it.
• • Change of preferences. You can change your information processing preferences at any time. For example, if you have given your consent to us to send you marketing material in a particular way, but have changed your mind, you can contact us or click the relevant link in any communication you receive (where this specifically relates to marketing messages, see “Marketing”).
• • Data portability. In some circumstances, you have the right to ask us to transfer a copy of the personal information we hold about you to someone else.

Please note that if you ask us to stop processing your personal information in a certain way or if you ask us to delete your information, and we need to use that information to provide the website to you, then you may not be able to continue to use them. This does not include your right to object to direct marketing, which can be exercised at any time without restriction. If you would like to exercise any of the rights mentioned above, please contact us.
The above rights do not apply to anonymized personal information.

No fee usually required to access your personal information

You will not normally have to pay a fee to access your personal information (or to exercise any of the other rights set out above). However, we may charge a reasonable fee if your request for access is unreasonable or excessive. Alternatively, we can refuse to comply with the request.

What we may need from you

We may need to request specific information from you to confirm your identity and verify your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Right to withdraw consent

Where you have consented to the collection, use or transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

If, for any reason, you are not happy with the way that we have handled your personal information, please contact us or send email to crm@tescan.ca .

Document owner and approval

The Data Protection Officer is the owner of this document and is responsible for keeping it up to date. The current version of this document is available to all employees and anyone and/or organization for whom we will process personal data in pursuit of conducting TES CANADA activities.