Overview

We are committed to protecting and using your personal information responsibly. If you have any questions about this privacy policy, please contact the person in charge of the protection of personal information within HPS Montréal (Designated Privacy Officer):

Name: Abdelilah Bahaoui

Email: DPO_HPSMontreal@hps-worldwide.com

This privacy policy is for any individual:

• Who contacts HPS Montréal inc. (“HPS Montréal”) about our products and services, or
• Who is a HPS Montréal job applicant, or
• Who works with HPS Montréal, such as suppliers providing goods and services to HPS Montréal, or
• Who is end-customer of our clients for whom we provide payment services.

It is important that you read this policy so that you are aware of how and why we are using such information. This privacy policy describes how we collect and use your personal information during and after your relationship with us, in compliance with all applicable Privacy Laws in Canada.

If you are an HPS Montréal employee, you can find our privacy policy relating to employment on the intranet.

This privacy policy was last updated on November 29^th , 2024.

Who we are

HPS Montréal inc. (“HPS Montréal”, “we”, “our”, “us”) is an innovative payment solutions company providing payment solutions for issuers, acquirers, card processors, independentsales organisations, retailers, and national and regional switches.

PowerCARD is HPS Group’s comprehensive suite of solutions that covers the entire payment value chain by enabling innovative payments through its omni-channel solution that allows the processing of any transactions coming from any channels initiated by any means-of-payment.

Purpose(s) of personal information processing

Personal information we process on our own behalf

HPS Montréal will process your personal information based on your consent and relevant employment law for the following business processes:

• To evaluate any application submitted in response to one of our job postings, or by any unsolicited application,
• To contact you if, for example, we wish to offer you a job or obtain more information about your application,
• To send you our newsletter,
• To promote our services,
• To promote the website,
• To obtain or create statistics that allow us to evaluate the performance of the website,
• To ensure the functionality of the website,
• To facilitate the use of our website and to improve and measure its performance,
• To identify the most frequented pages of the website in order to measure their performance, interest in them and the interest of our potential customers in our services,
• To evaluate the effectiveness of the website in acquiring and retaining visitors,
• To provide informative communications about the Services and, more generally, our activities and
• New Purposes (if applicable). We will notify you and ensure that we obtain any necessary consent for the collection, use or disclosure of your personal information for any purpose other than those listed above, if any.

How we collect your personal information

• Automatically via strictly necessary cookies from visitors to the HPS Group website.
  • Your IP address,
  • Your browser (Chrome, Microsoft Edge, Firefox, Safari, etc.),
  • Your operating system (Windows, Mac OS...),
  • The domain name of your internet service provider,
  • The date and time of your visit to the Site,
• The pages you visit on the Site, ando The address of the website from which you are accessing the Site.
• During communications between a visitor and an employee or authorized representative of HPS Montréal, in connection with the services offered by HPS Montréal, whether through video conferences, emails, telephone calls, social media, instant messaging, electronic forms, or other.
• Through resumes sent electronically or via postal services to HPS Montréal. Candidate personal information held typically consists of:
  • Your first and last name,
  • Telephone number,
  • Email address,
  • Curriculum vitae and cover letter, previous studies information,
  • Language preference,
  • Accommodation needs,
  • Previous employers,
  • Position held,
  • Salary expectations.
• From candidates, through the electronic application forms available on the HPS Group website, accessible by accessing the individual pages present for the positions offered.
• When candidates sign up for automatic notification when new available positions are posted.
• From candidates through various communications (videoconferences, emails, instant messaging, phone calls, faxes, social media, electronic forms, or other), inconnection with their potential hiring.
• When website visitors subscribe to our newsletter, through the electronic form foundin the pop-up window appearing for these purposes.
• When website visitors consent to voluntarily respond to surveys sent by HPS, through electronic forms.
• When registering website visitors for events or conferences, through electronic forms.
• On our CCTV equipment when you visit our premises

Personal information processed by HPS Montréal on behalf of our clients

We process your personal information on behalf of our clients (usually Banks, Financial Services Companies or large retailers). We have signed relevant personal information protection clauses and/or agreements with those clients. We will only process the minimum amount of personal information to fulfil the services we provide on behalf of our clients:

• Your first and last name,
• Date of birth,
• Billing address,
• Telephone number,
• Email address,
• Card number,
• Card Type,
• Card expiry date,
• CVV number,
• Bank account details,
• Transaction details.

Our services, provided to you as an end-customer on behalf of our clients (usually banks, financial services companies, or large retailers), include:

Debit & Credit Card Management:

• Issuing you with a new card,
• Replacing your card in the event it is lost or stolen,
• Helping our clients to investigate any issues you may encounter using one of the cards issued to you.

Transaction Management:

• Authorising payments you make using your debit/credit card in store and online,
• Liaising with national and international card network schemes (like Visa, Mastercard,etc.) and other card providers to ensure that your card balance is correct and up todate,
• Reconciliation and settlement of payments made using your card (this may involve us sharing your personal information with other financial institutions, for example, if you make a payment to a store that uses another bank to manage its payments we will need to send personal information to that bank.

Reporting:

• We prepare reports for our clients detailing all card transactions that have taken place to help ensure that they can correctly apply all relevant changes and charges to your bank balance and to prepare your bank statements.

We work with a supplier, that provides on-demand cloud computing platforms services for our Information Technology requirements. They oversee and manage the security of the datacentre located in Canada where we store all our business-related data for Canada, and the datacentre in the United States of America (USA), where all our business data is backed up to.

How we safeguard your personal information

We use administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of personal information against loss, misuse and unauthorized access, disclosure, alteration, and destruction.

The safeguards we use include:

• Ensuring the physical security of our offices, warehouses or other sites,
• Ensuring the physical and digital security of our equipment and devices by using appropriate password protection and encryption,
• Using standard security protocols and mechanisms (such as secure socket layer(SSL) encryption) to transmit sensitive personal information,
• Maintaining a personal information protection policy for, and delivering personal information protection training to all employees,
• Limiting access to your personal information to only those who need to use it in the course of their work.

Who we share personal information with

We may share your personal information internally within the HPS Group or externally with third parties or suppliers in Canada. Please note that we have suitable data protection agreements in place with all other parties. These parties include:

• HPS Montréal's service providers, in terms of cloud hosting, website maintenance and administration, information systems, customer management systems, billing systems, insurance services and services for the secure destruction of personal information,
• HPS office in Morocco will receive the personal information arising from your use ofour website,
• HPS office in France provide additional technical support and assistance to HPS Montréal. They may receive personal information in relation to specific technical issues,
• Our clients – the banking, financial services and retailers on whose behalf we process your personal information.

We reserve the right to disclose your personal information to any other person or entity where required or permitted by applicable law, or with your consent.

How we safeguard the international transfer of your personal information

We use Standard Contractual Clauses as a safeguard to enable the international transfer ofpersonal information in addition to the standard organisational and technical security measures covered above. We have also conducted Transfer Impact Assessments (TIAs) to identify and mitigate any privacy risks in relation to any international transfer of your personal information. Including:

• Transfer to the US for backup purposes,
• Transfer to France for technical support.

To obtain a copy of the standard safeguards please use the contact details provided at the beginning and end of this policy.

Automated processing

Our information technology systems are configured to perform automated processing to ensure quick approval of your transactions. To obtain more information on this please use the contact details provided at the beginning and end of this policy.

How long we keep your personal information

Your Rights

How to make a complaint to the Supervisory Authorities in Canada.

You can complain to the supervisory authorities in Canada if you are unhappy with how we have used your personal information.

If you are a resident of Alberta, British Colombia or Quebec you should make your complaint to the relevant authority:

To the Office of the Information and Privacy Commissioner of Alberta

#410, 9925 - 109 Street, Edmonton, Alberta, T5K 2J8
Phone: 780-422-6860
Toll Free: 1-888-878-4044
Email: ESchiman@oipc.ab.ca

or

To the Commission d'accès à l'information du Québec

525 René-Lévesque Boulevard East, Suite 2.36
Quebec City, Quebec G1R 5S9
Phone: 418-528-7741
Email: renseignements@cai.gouv.qc.ca

or

To the Office of the Information and Privacy Commissioner for British Columbia

4^th Floor, 947 Fort Street, Victoria B.C. V8W 9A4
Phone: +1 250 387-5629
Email: info@oipc.bc.ca

If you live elsewhere in Canada, please contact the Office of the Privacy Commissioner of Canada using the information provided below:

The Office of the Privacy Commissioner of Canada

30 Victoria Street, Gatineau, Quebec, K1A 1H3
Phone: +1 819-994-5444
Email: general@oic-ci.gc.ca

How to withdraw your consent from communication

You can withdraw or change your consent from processing you consented to subject to applicable law and your contractual obligations.

To do so, please contact our designated Privacy Officer using the contact information provided in this policy. Withdrawing your consent may have an impact on our ability to interact appropriately with you, particularly with respect to the performance of our services.

This Policy is reviewed at least annually.

Date of last review: October 2025.