Privacy Governance Policy

Last updated: August 24, 2026

Applies to: Nuxovia Solutions Inc., doing business as “Kouloo” (“Kouloo”, “we”, “us”, “our”), including the Kouloo mobile application, the website https://www.kouloo.com and the portal https://portail.kouloo.com.

1. Purpose

This Privacy Governance Policy describes the policies, practices, rules, and responsibilities established by Kouloo to ensure the responsible management and appropriate protection of Personal Information throughout its lifecycle.

Kouloo is committed to protecting the Personal Information of users, parents, guardians, and other individuals whose Personal Information may be collected, held, used, or disclosed in connection with its services.

This Policy is intended to govern Kouloo’s practices in accordance with applicable privacy laws, including Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25.

For information about the Personal Information Kouloo collects, the purposes for which it is used, information that may be disclosed, and individuals’ privacy rights, please see our [Privacy and Cookies Policy].

2. Scope

This Policy applies to employees, officers, contractors, agents, and other individuals acting on behalf of Kouloo who collect, use, disclose, retain, or may have access to Personal Information.

It applies to Personal Information processed in connection with:

• the Kouloo mobile application;
• the Kouloo website;
• the Kouloo portal;
• user and customer support;
• communications and notifications;
• service providers and partners used to provide Kouloo services; and
• any other Kouloo activity involving Personal Information.

3. Person Responsible for the Protection of Personal Information

The person with the highest authority within Kouloo is responsible for the protection of Personal Information. This responsibility may be exercised directly or delegated in accordance with applicable law.

Person Responsible for the Protection of Personal Information:
Andre Claude Chagnon, President

Email: legal@nuxovia.com
Telephone: 1-888-918-0144

The Person Responsible for the Protection of Personal Information oversees Kouloo’s privacy practices and may, among other things:

• approve Kouloo’s privacy governance policies and practices;
• advise Kouloo regarding its privacy obligations;
• participate in assessing risks associated with confidentiality incidents;
• receive and handle privacy-related requests and complaints;
• participate in Privacy Impact Assessments (PIAs), where required; and
• act as Kouloo’s primary contact for privacy-related matters.

The title and contact information of the Person Responsible are published on Kouloo’s website in accordance with applicable requirements.

4. Privacy Governance Principles

Kouloo applies the following principles when managing Personal Information:

• Necessity: We limit collection to the Personal Information necessary for identified purposes.
• Transparency: We clearly explain how and why Personal Information is collected and used.
• Consent: Where required, we obtain valid consent before collecting, using, or disclosing Personal Information.
• Purpose limitation: Personal Information is used only for identified and authorized purposes.
• Accuracy: We take reasonable measures to keep Personal Information accurate and up to date.
• Security: We apply safeguards appropriate to the risks and sensitivity of the information.
• Limited access: Access is limited to individuals who need the information to perform their duties.
• Limited retention: Personal Information is not retained longer than necessary or as required by law.
• Accountability: Privacy roles and responsibilities are defined and communicated to the individuals concerned.

5. Privacy by Design

Kouloo considers privacy protection from the design stage and throughout the development, modification, and implementation of its products, services, and technologies.

Where appropriate, Kouloo considers:

• the amount of Personal Information collected;
• the sensitivity of the information;
• the purposes for which it is used;
• who may have access to it;
• privacy risks;
• appropriate security measures;
• privacy settings;
• the protection of children’s Personal Information; and
• appropriate retention, deletion, and destruction practices.

Where required by law, Kouloo conducts a Privacy Impact Assessment (PIA) before implementing the applicable project.

6. Roles and Responsibilities of Personnel

Individuals who have access to Personal Information as part of their duties must:

• use Personal Information only for authorized purposes;
• limit access to information necessary for their duties;
• maintain confidentiality;
• comply with Kouloo’s policies and procedures;
• apply the security measures communicated to them; and
• promptly report any incident or situation that may compromise the protection of Personal Information.

Personal Information must not be accessed, copied, used, or disclosed for unauthorized purposes.

7. Children’s Personal Information

Kouloo is primarily designed for use by adults, including parents and guardians.

Kouloo does not knowingly allow children under the age of 14 to create their own accounts.

Where Kouloo collects Personal Information concerning a child under 14, it relies on the consent of the child’s parent or person having parental authority, except where applicable law provides otherwise.

Kouloo applies appropriate safeguards to children’s Personal Information, including restricted access and appropriate security measures.

8. Privacy Impact Assessments (PIAs)

Kouloo assesses privacy risks associated with its projects and activities.

Where required by law, Kouloo conducts a Privacy Impact Assessment (PIA), including:

• before acquiring, developing, or redesigning an information system or electronic service involving Personal Information; and
• before disclosing Personal Information to a person or organization located outside Quebec, or entrusting a person or organization located outside Quebec with the task of collecting, using, disclosing, or retaining such information on behalf of Kouloo.

The PIA considers, among other things, the sensitivity, purposes, quantity, distribution, and format of the Personal Information involved.

9. Service Providers, Agents, and Third-Party Providers

Kouloo may use service providers, agents, or third-party providers to provide hosting, infrastructure, authentication, mapping, notifications, analytics, security, customer support, or other services necessary for its operations.

When Personal Information is entrusted to a third party, Kouloo takes reasonable measures to protect its confidentiality and security.

Where required, applicable contracts or agreements include obligations relating to:

• confidentiality;
• limited use of information;
• security measures;
• incident management;
• retention and destruction of information; and
• other applicable obligations of the provider or agent.

Kouloo remains responsible for the protection of Personal Information it holds, even when its retention or processing is entrusted to a third party.

10. Transfers and Processing Outside Quebec

Kouloo assesses the circumstances in which Personal Information may be disclosed or processed outside Quebec.

Where required by law, Kouloo conducts a Privacy Impact Assessment before disclosing Personal Information outside Quebec or entrusting a third party located outside Quebec with the processing of Personal Information on its behalf.

Kouloo implements appropriate safeguards based on the risks identified and applicable legal requirements.

11. Security Measures

Kouloo implements reasonable administrative, technical, and physical security measures appropriate to the Personal Information it holds and the risks associated with its processing.

Depending on the circumstances, these measures may include:

• encryption of communications and stored information;
• access controls;
• authentication mechanisms;
• role-based permissions;
• secure infrastructure;
• access monitoring and logging;
• backup and recovery procedures;
• confidentiality obligations;
• security updates; and
• secure deletion or destruction measures.

Security measures are periodically reassessed to maintain an appropriate level of protection based on identified risks.

12. Privacy Incidents

Kouloo maintains a privacy incident management process to identify, contain, assess, and document incidents involving Personal Information.

When a privacy incident is brought to its attention, Kouloo takes reasonable measures to:

1. limit or contain the incident;
2. assess the risk of harm;
3. determine the information and individuals affected;
4. reduce the risk of harm;
5. take measures to prevent a similar incident from occurring;
6. document the incident in the applicable incident register; and
7. provide any notices required by law.

Kouloo considers, among other factors, the sensitivity of the information involved, the anticipated consequences of its use, and the likelihood that it will be used for harmful purposes.

Where an incident presents a risk that serious harm may be caused to affected individuals, Kouloo will notify the Commission d’accès à l’information and the affected individuals in accordance with applicable legal requirements.

Kouloo maintains a privacy incident register in accordance with applicable requirements.

13. Retention, Destruction, and Anonymization

Kouloo establishes rules concerning the retention and destruction of Personal Information.

Personal Information is retained only for the period necessary for the purposes for which it was collected or for the period required by law.

When Personal Information is no longer required, Kouloo takes reasonable measures to securely destroy it or, where appropriate and permitted by law, anonymize it.

Retention periods may vary depending on the nature of the information, its use, legal requirements, and operational needs.

14. Privacy Requests and Complaints

Kouloo maintains a process allowing individuals to submit requests or complaints concerning the protection of their Personal Information.

Individuals may contact Kouloo to:

• request access to their Personal Information;
• request correction of inaccurate information;
• withdraw consent where applicable;
• exercise rights provided by law;
• ask questions about Kouloo’s privacy practices; or
• submit a privacy complaint.

Requests and complaints may be submitted to:

Person Responsible for the Protection of Personal Information
Andre Claude Chagnon, President

Email: legal@nuxovia.com
Telephone: 1-888-918-0144

Mail:
Nuxovia Solutions Inc.
Attn: Legal Affairs
3, rue de Sannois
Terrebonne, Quebec J6W 0B2
Canada

Kouloo handles privacy requests and complaints in accordance with applicable legal requirements.

If an individual remains dissatisfied with the handling of their complaint, they may also contact the Commission d’accès à l’information du Québec.

15. Training and Awareness

Kouloo takes reasonable measures to ensure that individuals who handle Personal Information understand their responsibilities regarding privacy protection.

Depending on their duties, these measures may include:

• training;
• internal guidelines;
• confidentiality commitments;
• awareness communications; and
• reminders regarding privacy protection and security best practices.

16. Monitoring and Review

Kouloo periodically reviews its policies, practices, and safeguards to take into account:

• changes to its services;
• new technologies;
• identified risks;
• privacy incidents;
• legislative and regulatory changes; and
• relevant recommendations or guidance from competent authorities.

This Policy may be updated periodically. The date of the most recent update is indicated at the beginning of the Policy.

17. Related Policies and Documents

For additional information, please see:

• [Privacy and Cookies Policy]
• [Terms of Use]

18. Contact Information

For questions regarding this Policy or Kouloo’s privacy practices:

Andre Claude Chagnon
Person Responsible for the Protection of Personal Information
Nuxovia Solutions Inc.

Email: legal@nuxovia.com
Telephone: 1-888-918-0144

Mailing address:
3, rue de Sannois
Terrebonne, Quebec J6W 0B2
Canada

This Policy is available in French and English.

For Quebec residents, the French version prevails in the event of any discrepancy between the two versions.