LCO PRIVACY POLICY
1. Introduction
This Personal Information Protection Policy (hereinafter referred to as the “Policy”) defines the manner in which we, LCO – Construction and Management Consultants Inc. (hereinafter referred to as “LCO” and “we”), collect, hold, use, or disclose the Personal Information of our clients, users of our website https://lcogroup.com/ (the “Website”), including users who access our services through our proprietary software-as-a-service application, ESTEL, available at https://www.estelbylco.com/ (the “Application”), and other individuals with whom we interact in the course of our business (“you”), other than employees and contract staff of LCO, who are subject to separate treatment.
We are committed to treating any Personal Information we collect, hold, use or disclose with care, in accordance with this Policy and applicable law.
Where you access the Application, this Policy forms an integral part of, and should be read together with, the ESTEL Terms of Service that govern access to and use of the Application.
2. Types of Personal Information
This Policy applies to Personal Information regardless of the type of medium or the form in which it is accessible: written, graphic, sound, visual, taped, filmed, computerized, or others.
We define “Personal Information” as any information about an identifiable individual, or that taken alone or combined with other data, allows an individual to be identified. By way of illustration, Personal Information could consist of, but is not limited to:
- first and last name;
- date of birth;
- telephone number, residential address and email address;
- preferred language;
- time zone;
- financial, credit, billing, and account information;
- details about the use of our Website and, where applicable, our Application, obtained by means of cookies or similar technologies;
- Internet protocol (IP) address, browser type, device type, operating system, locale preferences, and mobile carrier; and
- any other Personal Information that you provide to us.
3. The Purposes for Which we Collect Personal Information
We collect Personal Information for the following purposes :
- to provide and maintain our products, services, Website and Application;
- to develop and manage our business, activities and operations;
- to develop, test, validate, maintain, improve, and train our products, services, and technologies, including the artificial intelligence and machine learning models used in the Application, to generate, process, test, validate, and improve AI-generated outputs, and to develop new products, features, and services, all in accordance with this Policy, the ESTEL Terms of Service, and applicable law;
- to create, retain, use, and disclose de-identified, anonymized, aggregated, statistical, and derivative information derived from Personal Information for analytics, benchmarking, research, product improvement, artificial intelligence development, and other lawful business purposes, provided that such information does not identify any individual;
- for marketing and advertising purposes;
- for statistical purposes relating to the use of our Website and Application;
- to respond to or manage requests submitted to us;
- to evaluate a job candidate’s application and to determine whether to offer such candidate a position at LCO;
- to comply with our legal, regulatory and risk management obligations;
- any purpose permitted or required by applicable laws; and
- any other purpose to which you have consented.
4. Means by which we Collect Personal Information
We generally collect Personal Information i) directly from the individual concerned; or ii) from a number of independent sources, such as social networks, our service providers or other business partners.
We also collect, through cookies and similar technologies, a limited amount of Personal Information from users of our Website and, where applicable, our Application. These technologies may collect information such as your Internet Protocol (IP) address, browser type, device type, operating system, pages or features accessed, requests made, and the dates and times of your interactions. They help us improve our products, services, Website and Application.
Cookies are small text files or strings that a website can send to your device to identify your web browser and track activity. Our Application may use similar technologies, such as software development kits (SDKs), device identifiers, or analytics tools, to collect comparable information.
For more information regarding our use of cookies and similar technologies, or to exercise any choices regarding those technologies, please contact our Privacy Officer using the contact information in Section 12.
5. Outsourcing, Storage and Transfers of Personal Information
We may disclose the Personal Information we have collected to third parties in the following circumstances :
- to service providers that assist us in operating our products, services, Website and Application, including providers of data storage and processing, cloud computing, hosting, analytics, marketing and other business support services;
- to comply with an applicable statute, regulation, rule of law, subpoena, search warrant, court or regulatory order, lawful requests by public authorities, including to meet national security or law enforcement requirements, or other legal process;
- to exercise our legal rights and remedies or limit the damages we may suffer;
- to protect the safety and/or security of the Website, Application or the general public;
- in the event of a commercial transaction, including the sale, transfer or assignment, in whole or in part, of shares or assets of LCO; and
- any other circumstances to which you have consented.
If you are a Quebec resident, note that your Personal Information may be transferred to places outside Quebec. Indeed, we use service providers located outside of Quebec to carry out specific mandates in the normal course of business. Furthermore, your Personal Information may be stored in data centers located outside Quebec.
To protect your Personal Information in all such cases, we use contractual and other means to provide a comparable level of protection to that used by LCO (as outlined in Section 8).
6. Your Consent under this Policy
We will not collect, hold, use or disclose your Personal Information without your consent unless it is authorized or required to do so by applicable law.
By submitting your Personal Information, using our Website or Application and using our services, you consent to the collection, use and disclosure of your Personal Information to the extent described in this Policy and as required or permitted by applicable law.
If you provide Personal Information concerning another individual to us, you represent that, prior to submitting such information, you have obtained the necessary consent or authority to permit us to collect, use and disclose such Personal Information for the purposes set out in this Policy, or the collection, use and disclosure is permitted by applicable law.
Where you access the Application in connection with services we provide to a client organization, that client organization is responsible for the Personal Information that it or its authorized users submit to or generate through the Application, including for obtaining any consents required to do so. In such cases, we process that Personal Information as a service provider on behalf of, and in accordance with our agreement with, the client organization, and the client organization remains responsible for its own privacy practices.
You may vary or withdraw your consent to the use and disclosure of your Personal Information, or opt-out of certain uses and disclosures, subject to legal and contractual restrictions as well as applicable law. Please note that the withdrawal of your consent may prevent us from continuing to provide our products and services or access to our Website or Application.
If you require any assistance in understanding the scope of the consent being sought or to vary or withdraw your consent, please contact our Privacy Officer using the contact information in Section 12.
7. Your Rights
7.1.Canada
If you are a resident of Canada, or if Canadian privacy laws otherwise apply to you, the collection, use, and disclosure of your Personal Information are governed by applicable Canadian privacy laws, including the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”), and applicable provincial privacy legislation, including the Quebec Act respecting the protection of Personal Information in the private sector (commonly referred to as “Law 25”), the Alberta Personal Information Protection Act, and the British Columbia Personal Information Protection Act.
You have the following rights regarding your Personal Information:
- to access and request an exported or physical copy of the documents containing your Personal Information, subject to the exceptions provided by applicable law;
- to have the Personal Information we have about you rectified, amended and updated if it is incomplete, ambiguous, out of date or inaccurate;
- to request the deletion of your Personal Information where such a right is provided under applicable law, including, where applicable, where the retention of the information is no longer justified for the purposes for which it was collected, where the information was collected unlawfully, or where it has become obsolete; and
- to withdraw or change your consent to our processing of your Personal Information, subject to applicable legal and contractual restrictions. In some instances, withdrawing your consent may result in us no longer being able to provide our Services or access to our Website.
We may request certain Personal Information for the purpose of verifying the identity of the person seeking to exercise their rights.
7.2. European Economic Area and United Kingdom
If the processing of your Personal Information is subject to the EU General Data Protection Regulation 2016/679 (“EU GDPR”) or the United Kingdom General Data Protection Regulation (“UK GDPR”), this subsection applies to you.
For the purposes of the EU GDPR and the UK GDPR, LCO acts as a controller in respect of the Personal Information it collects and processes for its own purposes. Where LCO processes Personal Information on behalf of a customer, LCO acts as a processor.
Our lawful bases for processing Personal Information may include where:
- you have given consent;
- processing is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract;
- processing is necessary for our legitimate interests or those of a third party, except where such interests are overridden by your rights;
- processing is necessary to comply with a legal obligation; or
- processing is necessary to protect vital interests of an individual.
In addition to the rights described above, you may also have the right to object to certain processing, request restriction of processing, request data portability, and lodge a complaint with a competent supervisory authority.
7.3. United States
Certain United States state privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act, may provide individuals with additional rights regarding Personal Information. This subsection applies where applicable U.S. state privacy laws govern our processing of your Personal Information.
Subject to applicable law, you may have the right to:
- access or request information about the Personal Information we collect, use, or disclose;
- request correction of inaccurate Personal Information;
- request deletion of Personal Information;
- obtain a copy of Personal Information in a portable format;
- opt out of certain processing, which may include targeted advertising, profiling, or the sale or sharing of Personal Information as defined by applicable law; and
- not be discriminated against for exercising your rights.
California residents may also have rights under California Civil Code section 1798.83 (also known as the “Shine the Light Law”) regarding certain disclosures of Personal Information for direct marketing purposes.
In certain states, you may have the right to appeal our decision if we deny a request, and we will provide information on how to do so where required.
Requests to exercise rights may be submitted using the contact information provided in this Policy. We may take reasonable steps to verify your identity before fulfilling a request, and authorized agents may submit requests where permitted by law.
8. How we Safeguard Personal Information
In order to protect the Personal Information that is in our possession, we employ administrative, physical, and technological safeguards which are appropriate to the sensitivity of the Personal Information provided. These safeguards also prevent the accidental or unlawful destruction, loss, unauthorized alteration or disclosure, access, or misuse of the Personal Information in our possession. We follow generally accepted industry standards to protect the information that is provided during its submission and once it has been received. These include measures to deal with any suspected data breach.
Once collected, Personal Information may be retained in electronic or physical form within our document management systems, third-party technologies used by us, or both. Only those personnel who reasonably require the Personal Information to perform their duties are granted access to the information and they are bound by a duty of confidentiality.
It is important to note that, despite our best efforts to protect your Personal Information, there is a risk associated with the disclosure, exchange and storage of information, as no form of electronic transmission or storage is perfectly secure. While we take commercially appropriate measures to protect your Personal Information, we cannot guarantee that it will be completely secure or free from unauthorized access, loss, or misuse.
9. Links to Third-party Websites and Services
Our Website and Application may contain links to third-party websites or services that are not owned or controlled by LCO. This Policy only applies to information collected by us for the purposes mentioned in Section 3 above. We have no control over these third-party websites or services, and your use of third-party websites and features is subject to privacy policies posted on those websites. We are not responsible or liable for the privacy or business practices of any third-party websites linked to our Website or Application.
10. Personal Information of Children
Our products and services are not directed to children. However, in the course of providing our services, we may collect and process Personal Information relating to minors where such information is provided by a parent, guardian, or other individual who is authorized to provide it, or where otherwise permitted or required by applicable law.
If you believe that Personal Information relating to a child has been provided to us without appropriate authorization, please contact our Privacy Officer using the contact information set out in Section 12.
11. Retention and Destruction of Personal Information
The Personal Information we collect is retained for varying periods of time depending on the type of information in question and the purposes for which it is collected and used. Subject to a retention period provided or permitted by applicable law, the Personal Information we hold is destroyed or anonymized once it is no longer necessary for the purposes for which it was collected or used, or for any subsequent compatible purpose. Retention periods may also depend on legal, accounting, tax, reporting, or operational requirements.
12. How to Contact Us
In order to obtain more information on the Policy or the use of your Personal Information, to exercise your rights or to file a complaint, please contact our Privacy Officer using the following contact details:
LCO – Construction and Management Consultants Inc.
ATTN: Privacy Officer
Telephone: 1-514-846-8914
3500 Blvd de Maisonneuve W., 2 Place Alexis Nihon, Suite 1290, Westmount, QC H3Z 3C1, Canada
Changes to this Policy
We may change this Policy from time to time to reflect changes to our privacy practices or for other operational, legal or regulatory reasons. Changes will be effective upon notification to you or upon posting the revised Policy on our Website or making it available through our Application, as applicable. By continuing to use our Website, Application or services after such changes become effective, you acknowledge that you have read and accepted the revised Policy, to the extent permitted by applicable law.