Privacy Policy

Last updated: January 13, 2026

1. Scope and Applicability

This Privacy Policy describes how EV Management ("we," "us," or "our") collects, uses, discloses, retains, and protects personal information through its website evmgmt.ca and related online interactions (the "Website").

We are a technology consulting services firm providing business-to-business (B2B) services. This Privacy Policy applies to visitors, prospective clients, job applicants, and other individuals whose personal information may be collected through the Website.

This policy is designed to comply with:

• Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) • Quebec Law 25 (Act respecting the protection of personal information in the private sector) • The EU General Data Protection Regulation (GDPR) • The California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)

2. Person Responsible for the Protection of Personal Information

In accordance with Quebec Law 25, the person responsible for the protection of personal information is:

Title: Privacy Officer Organization: EV Management Email: info@evmgmt.ca

This role is responsible for ensuring compliance with applicable privacy laws and responding to privacy-related inquiries.

3. Personal Information We Collect

3.1 Information You Provide Voluntarily

We may collect personal information you submit voluntarily, including:

• Name • Business email address • Business phone number • Company name and role • Resume / curriculum vitae (CV) • Employment history, education, and professional qualifications • Any information included in messages or uploaded documents

3.2 Automatically Collected Information

When you access the Website, we may automatically collect:

• Anonymized IP address • Browser type and version • Device and operating system • Pages visited, date/time, and referring URLs

This information is collected through cookies and similar technologies.

4. Purposes of Collection

We collect personal information for the following purposes:

• Providing and improving our consulting services • Responding to inquiries and business requests • Recruitment and candidate evaluation • Website performance analysis and optimization • Security, fraud prevention, and compliance • Meeting legal and regulatory obligations

5. Legal Bases for Processing (GDPR)

Where GDPR applies, we process personal data based on one or more of the following legal grounds:

• Consent (e.g., analytics cookies) • Legitimate interests (e.g., B2B communications, recruitment evaluation) • Performance of a contract or pre-contractual measures • Compliance with legal obligations

6. Cookies, Tracking, and Consent

6.1 Cookie Overview

Cookies are small text files. We use two categories:

Essential cookies (always on) Site functionality, session security, form submission. No explicit consent required.

Analytics cookies (consent required) Deployed only after your explicit consent. Measure performance and usage. Can be declined without affecting functionality.

6.2 GDPR Compliance (EU)

Under GDPR and the ePrivacy Directive: • Analytics cookies are NOT deployed until you explicitly consent • Right to accept, refuse, or withdraw consent • Consent is separate from analytics data • No pre-checked boxes • 365-day retention aligns with GDPR reasonableness

6.3 CCPA/CPRA (California & US states)

Under CCPA, CPRA, and similar state laws: • Right to know: Ask what cookies are collected • Right to delete: Request deletion of data • Right to opt out: Refuse analytics cookies • No discrimination: Refusal does not affect service • No sale: Browsing data is not sold • IP anonymization: Only anonymized IP is collected

Contact: info@evmgmt.ca

6.4 PIPEDA (Canada)

Under PIPEDA: • Informed consent: Explicit consent required before analytics cookies • Collection limitation: Only data you consent to • Use limitation: Analytics used only to improve the site • Transparency: Full disclosure of cookie purposes • Access rights: Request access to your analytics data • Accountability: Records maintained to demonstrate compliance

Privacy Officer: info@evmgmt.ca

6.5 Quebec Law 25

Under Quebec Law 25: • Explicit consent required: Prior, express, informed consent for analytics • No implied consent: Browsing alone is not consent • Right to withdraw: Change consent anytime via our banner • Transparency: All cookies clearly disclosed • Security: SameSite=Lax and Secure flags • Duration limits: Max 365-day retention

Contact: info@evmgmt.ca

6.6 Google Analytics 4

GA4 with IP anonymization: • Anonymized IP: Last 8 bits removed • No personal data: No names, emails, or identifiers • No third-party sharing: Data not shared with advertisers • 14-month retention: GDPR-compliant data minimization • Consent-based only: Initializes after acceptance

Optional: GA Opt-Out: https://tools.google.com/dlpage/gaoptout Google Privacy: https://policies.google.com/privacy

6.7 Manage Your Preferences

On our website • Accept/decline via the consent banner (bottom of every page) • Your choice saved as cookie_consent_v1

In your browser • Most browsers allow cookie control • Clearing cookies resets your consent choice

Extensions • Google Analytics Opt-Out • Privacy Badger, uBlock Origin, others

Your rights • Change your mind anytime • Declining cookies does not affect functionality • Request deletion of cookie data

6.8 Cookies We Use

Essential Cookies (No Consent Required) • cookie_consent_v1: Stores your consent preference | Expires: 365 days

Analytics Cookies (Requires Consent) • _ga: Google Analytics User ID | Expires: 2 years • _ga_*: GA4 session tracking | Expires: 2 years • _gid: GA4 session ID | Expires: 24 hours

Note: First-party cookies only, IP anonymization enabled, no third-party advertisers.

6.9 Third-Party Policies

Only Google Analytics 4 for analytics We DO NOT use: • Advertising/retargeting cookies • Social media tracking pixels • Affiliate cookies • Third-party profiling

Google Analytics • Subject to Google's Privacy Policy • US data processing (GDPR safeguards in place) • Opt out: https://tools.google.com/dlpage/gaoptout

Data transfers: Standard Contractual Clauses (SCCs) implemented for GDPR compliance.

6.10 Children and Cookies

Our website is not intended for children under 13 (or 16 in EU/Canada). • We do not knowingly collect cookies from children • If a child consents without parental permission, contact us: info@evmgmt.ca • We will delete data within 30 days

7. Data Retention

Personal information is retained only as long as necessary to fulfill the purposes for which it was collected, or as required by law. Once personal information is no longer needed, it is securely destroyed or anonymized. Typical retention: 1-3 years for business communications, longer for legal/tax records.

8. Automated Decision-Making

We do not use personal information for automated decision-making that produces legal or similarly significant effects, including profiling under applicable data protection laws.

9. Disclosure to Third Parties

We disclose personal information only to: (1) service providers under contract who process data on our behalf with appropriate safeguards; (2) legal or regulatory authorities where required by law; and (3) as necessary to protect our rights or investigate fraud or security incidents. We do not sell personal information.

10. Cross-Border Transfers

When personal data is transferred outside your jurisdiction (including to the United States), we use appropriate safeguards such as Standard Contractual Clauses (SCCs) for GDPR, and ensure vendors provide comparable protection. Data remains subject to contractual security and confidentiality obligations.

11. Security Measures

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the personal information, including access controls, encryption, network protections, and secure storage practices. No method of transmission or storage is completely secure; we take reasonable steps to prevent loss, unauthorized access, or disclosure.

12. Your Rights

Depending on your jurisdiction, you may have the right to: access your personal information; request correction or deletion; withdraw consent; object to or restrict processing; request data portability (GDPR); and lodge a complaint with a supervisory authority. Submit requests to the Privacy Officer using the contact information above.

13. California Privacy Notice (CCPA / CPRA)

If you are a California resident and CCPA/CPRA applies: we do not sell or share personal information as defined by CPRA; we do not use sensitive personal information for restricted purposes; you may request access, deletion, or correction of personal information collected in the past 12 months. Submit requests using the contact information in Section 2.

14. Children's Privacy

The Website is intended for business users and is not directed to children. We do not knowingly collect personal information from individuals under 13 (or under 16 where required by law).

15. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Updates will be posted on this page with a revised "Last updated" date. Continued use of the Website constitutes acceptance of the updated policy.

16. Contact Information

EV Management Email: info@evmgmt.ca Address: Montreal, QC, Canada