Privacy policy

At Sourcinc, protecting your personal information is a priority. We are committed to being transparent about how we handle your data, whether you are a client, a candidate or simply a user of our services.

This Privacy Policy (the “Policy”) is a formal statement of our rights and obligations. It describes the principles, rules and practices we apply to comply with the laws that govern the protection of personal information, including:

• The Personal Information Protection and Electronic Documents Act (PIPEDA, Canada);
• Quebec’s Law 25, modernizing legislative provisions on the protection of personal information;
• The General Data Protection Regulation (GDPR, European Union);
• Any other legislation applicable in the territories where we operate.

This Policy aims to establish responsible and transparent practices for managing your personal information, and to inform you clearly about:

• The data we collect;
• Why we use it;
• How we protect it;
• Your rights regarding this information.

The Policy applies to all of our products and services, including:

• The Sourcinc website (https://sourcinc.ca);
• The co//app web application;
• The co//app application for Windows;
• The co//app application for macOS.

References to “Sourcinc services” in this Policy include all of our websites, applications, software and recruitment solutions.

Users located in the European Economic Area (EEA) and Switzerland: additional terms apply to you to reflect the rights provided by the GDPR (see section 13).

Application and scope

1.1 This Policy applies to any interaction you may have with Sourcinc, whether through our website, our applications, our software or our recruitment services. It covers all personal information (as defined in section 2) that we collect, use, retain or disclose, directly or through partners acting on our behalf.

1.2 The individuals concerned include, without limitation:

• Our current and prospective clients;
• Candidates (prospective or current) for the professional opportunities we advertise;
• Users of our services, applications and digital platforms;
• Anyone who contacts us through our official channels.

1.3 This Policy also governs personal information collected through the use of our official websites:

• www.sourcinc.ca
• www.sourcinc.com
• www.sourcinc.fr

as well as our applications:

• co//app web application;
• co//app for Windows;
• co//app for macOS.

1.4 The Policy also explains how we use cookies, third-party scripts (including RB2B, see section 4) and other similar tracking and analytics technologies.

1.5 Whenever you do business with Sourcinc or with a person acting on our behalf, your personal information is protected by the rights and safeguards provided in this Policy and by applicable data protection laws.

Definition of personal information

2.1 For the purposes of this Policy, and in accordance with applicable laws (PIPEDA, Law 25, GDPR), “personal information” means:

• Any information that concerns a natural person and allows that person to be identified, directly or indirectly.

2.2 This may include, by way of example and without limitation:

• Your last name, first name and contact details (email, phone number, address);
• Your account or user profile information;
• Your professional information, such as your position, your employer, your résumé and your career history, in connection with our recruitment services;
• Your banking, billing or credit information, where required for a transaction;
• Communication and service records (e.g. correspondence, information requests, complaints);
• Connection and browsing data collected when you use our websites and applications (see section 5 on cookies and similar technologies).

2.3 Personal information does not include:

• Aggregated or anonymized data that can no longer identify an individual, directly or indirectly;
• Information about a business, an organization or a position held, to the extent that this data does not directly identify a natural person.

2.4 When we collect data that is pseudonymized, aggregated or anonymized, we ensure it cannot be used to re-identify a person, except where a specific legal or technical obligation applies.

Collection and use of personal information

3.1 - Sources of collection

We mainly collect your personal information directly from you, with your consent, when you interact with us, for example when:

• You sign up for our services;
• You submit your résumé or an application form;
• You create or manage an account;
• You communicate with our team by email, phone or through our applications.

As a recruitment agency, we may also collect personal information about you from third-party sources you have authorized (e.g. LinkedIn, Indeed or other public professional sites), in accordance with those third parties’ privacy policies and applicable laws.

3.2 - Types of information collected

Depending on the context, the personal information we may collect includes:

• Last name, first name, contact details (address, email, phone number);
• Professional information (position, employer, career history, education, skills, résumé);
• Information relating to your Sourcinc account or user profile;
• Billing and payment information, where applicable;
• Information made public on professional networks or other lawfully accessible sources;
• Data relating to your use of our digital services (e.g. preferences, browsing history, application logins).

3.3 - Purposes of use

We use your personal information only for the purposes for which it was collected, including to:

• Establish, develop and manage our business relationships;
• Respond to your requests and manage your accounts;
• Provide our recruitment services and present applications to our clients;
• Verify candidates’ credentials and professional background;
• Authenticate identity and protect users’ privacy;
• Manage our internal operations (training, quality assurance, system security);
• Conduct internal analyses to improve our services and develop new offerings;
• Offer personalized recommendations and share suitable job opportunities;
• Conduct satisfaction surveys or market research;
• Meet legal or contractual obligations.

3.4 - Public profiles and proactive recruitment

If we contact you about a professional opportunity, we may use information made public on your professional profiles (e.g. LinkedIn, Indeed). This information will be used solely for recruitment and career development purposes. We only share your information with an employer after obtaining your explicit consent.

3.5 - Additional consent

Unless permitted or required by law, we will not collect or use your personal information for purposes other than those described above without first obtaining your explicit and informed consent.

Consent and third-party technologies

4.1 - Consent to collection and use

When you use our services or visit our websites, you accept this Policy and consent to the collection, use, processing and disclosure of your personal information as described in the preceding sections.

Sourcinc obtains the consent of the individuals concerned in various ways:

• In writing (forms, contracts, emails, online registrations);
• Verbally (by phone or during interviews);
• Electronically (applications, websites, cookie consent banner).

The form of consent will depend on:

• The sensitivity of the information collected;
• The reasonable expectations of the individual concerned;
• Applicable legal requirements.

As a general rule:

• By subscribing to our services, submitting your information or using our sites and applications, you consent to the collection and use of your personal information in accordance with this Policy;
• You retain the right at all times to withdraw or change your consent, subject to the limits provided by law (e.g. legal or contractual obligations).

4.2 - Use of third-party technologies (including RB2B)

To improve your experience and better understand how our site is used, we use certain analytics, tracking and marketing technologies.

In particular, we integrate a script provided by RB2B (https://www.rb2b.com/):

• This script helps us analyze web traffic, identify certain business visitors and optimize our B2B communications;
• The data collected by RB2B may include technical information (e.g. IP address, browser type, pages viewed, time spent on the site);
• This data is processed in accordance with RB2B’s privacy policy, available directly on its website.

Other tools or partners (e.g. Google Analytics, newsletter delivery providers, hosting providers) may also place cookies or scripts for analytics, functional or marketing purposes.

4.3 - Managing your preferences

You can manage your preferences regarding the use of cookies and scripts:

• By configuring your browser settings;
• By using the consent banner displayed on your first visit to our site;
• By contacting us directly to withdraw or change your consent.

Cookies and similar technologies

5.1 - Types of cookies used

Our website and applications use cookies and similar technologies (e.g. pixels, tags, scripts) that serve different purposes. These technologies may be placed by Sourcinc (“first-party cookies”) or by third-party partners (“third-party cookies”).

In particular, we distinguish between:

• Essential cookies: required for the basic operation of the site (e.g. session management, security). They cannot be disabled in our systems.
• Functional cookies: improve personalization and ease of use (e.g. remembering your preferences).
• Analytics and performance cookies: used to understand how visitors interact with our site, measure audience and improve the user experience (e.g. Google Analytics).
• Marketing and advertising cookies: used to personalize content, measure campaign effectiveness and identify business visitors (e.g. RB2B script).

5.2 - Retention period

How long cookies are kept varies with their purpose:

• Session cookies are deleted when you close your browser;
• Persistent cookies may be kept for a limited period (generally between 6 and 24 months), unless you delete them manually sooner.

5.3 - Managing your preferences

You have several ways to manage your cookies:

• Consent banner: on your first visit, you can accept, refuse or customize your cookie choices;
• Browser settings: you can configure your browser to block or delete certain cookies;
• Withdrawing consent: you can change your preferences at any time by clicking the “Manage my cookies” link at the bottom of our site (if applicable) or by contacting us directly.

5.4 - Limits if you refuse

Please note that refusing or deleting certain essential or functional cookies may affect how well the site works and limit your user experience.

Sharing and disclosure of personal information

6.1 - General principles

Sourcinc does not sell, rent or trade your personal information to third parties. We share it only for the purposes set out in this Policy, and only when necessary, legally permitted or with your explicit consent.

6.2 - Sharing with our clients

As part of our recruitment services, we may share your personal information with clients looking for candidates. For example:

• We search public professional sites (e.g. LinkedIn, Indeed) to identify relevant profiles;
• We then compile reports presenting information made public or voluntarily provided by candidates;
• We may contact you to confirm your interest in an opportunity before sharing your information with an employer.

Your personal information will only be disclosed to a client with your agreement.

6.3 - Sharing with third-party service providers

We use trusted service providers (e.g. hosting, newsletter delivery, analytics tools, collections, credit checks, quality control).

• These providers receive only the information strictly necessary to carry out their mandate;
• They may not use your information for purposes other than those agreed;
• They are bound by contractual confidentiality and security obligations equivalent to Sourcinc’s.

6.4 - Disclosures required by law

We may be required to disclose personal information under a legal obligation (e.g. regulation, court order, warrant, government investigation).

We also reserve the right to report any suspected illegal activity to the competent authorities and to disclose certain information in an emergency, when necessary to protect the life, safety or rights of others.

6.5 - Business transactions

In the event of a merger, acquisition, financing, sale or transfer of a business, your personal information may be disclosed to third parties involved in the transaction. In such a case:

• If the transaction is completed, your information will continue to be protected in accordance with applicable laws;
• If the transaction fails, we will require the third party to destroy or anonymize the information obtained.

6.6 - Other types of sharing

We may disclose your information to anyone authorized to act on your behalf (e.g. under a legal power of attorney or a duly authorized representative).

6.7 - Restricted access

Only Sourcinc employees and authorized third parties with a legitimate business need will have access to your personal information. This access is limited by strict security controls.

Retention of personal information

7.1 - General retention period

We keep your personal information only as long as needed to fulfil the purposes for which it was collected, and in accordance with applicable laws.

7.2 - Retention criteria

The actual retention period may vary depending on:

• The time needed to provide the services and run our business (e.g. performance, security, keeping financial and business records);
• The type of data concerned (e.g. a candidate’s résumé or profile kept until you request its deletion, subject to applicable legal time limits);
• Legal, regulatory or contractual obligations that require us to keep certain information (e.g. tax time limits, government investigations, litigation).

7.3 - End of retention

When personal information is no longer needed:

• It is securely destroyed; or
• It is de-identified/anonymized so that it can no longer be associated with an identifiable individual.

7.4 - Extended retention in case of litigation

In certain situations (e.g. disputes, investigations, audits, specific legal obligations), we may keep your information for an extended period, strictly limited to the purpose concerned.

Website and application privacy

8.1 - Information you provide directly

When you interact with our website or applications, we may collect the personal information you choose to share with us, including when you:

• Fill out a contact, survey or satisfaction form;
• Submit an application (résumé, professional and academic background);
• Sign up for our services or our newsletter;
• Create or manage a user account (e.g. preferences, pre-authorized payments).

This information is used only to process your requests, manage our relationship with you and improve our services.

8.2 - Information collected automatically

When you visit our website, we may collect certain technical information through cookies, pixels and other similar technologies, such as:

• IP address, browser type, operating system, screen resolution, language and approximate location;
• Pages visited, time spent, links clicked and searches made;
• Ads viewed or interactions with our content.

This data is used to measure and improve the effectiveness of our website, keep our systems secure and personalize your experience.

8.3 - Social networks and third-party services

We may collect or receive personal information through your interactions with our pages or profiles on social networks (e.g. LinkedIn, Indeed, Facebook, Instagram, YouTube).

• This data may include your connections, “likes”, comments, groups and public interactions.
• In some cases, we may supplement your information with data from public sources or authorized third parties.

We encourage you to review each platform’s privacy policy before sharing your information.

8.4 - Analytics and advertising tools

• Google Analytics: we use this tool to analyze how the website is used. The data is de-identified. You can disable Google Analytics through the browser add-on offered by Google.
• Google Ads / Remarketing: we use cookies to show targeted ads to previous visitors. You can manage your preferences through Google’s ad settings.
• RB2B: as stated in section 4, we integrate an RB2B script to identify certain business visitors and optimize our B2B communications.

8.5 - Mobile applications

If you download or use one of our applications, we may require certain data for your authentication and for the application to work properly.

• We may also collect your IP geolocation in order to restrict access in certain territories.
• The information collected is limited to what is necessary to provide the application’s features and security.

8.6 - Your choice and control

You can manage your preferences regarding cookies and targeted advertising:

• By adjusting your browser settings;
• By using the consent banner on your first visit;
• By opting out of ad personalization on the platforms concerned.

8.7 - Third-party policies

This Policy applies only to the use and disclosure of information by Sourcinc. Third-party sites accessible through our services apply their own privacy policies, which we encourage you to review before providing them with your data.

Security of personal information

9.1 - Safeguards

Sourcinc implements appropriate physical, organizational and technological security measures to protect your personal information against:

• Unauthorized access, use or disclosure;
• Accidental loss, theft or destruction;
• Unauthorized modification or alteration.

These measures include:

• Encryption of data in transit (e.g. SSL/TLS protocol);
• Secure storage of information in protected environments restricted to authorized persons;
• Firewalls, intrusion detection systems and strict access controls;
• Regular backups and recovery procedures in case of an incident.

9.2 - Restricted access

Only employees, consultants, subcontractors or trusted third parties with a legitimate business need have access to your personal information.

• This access is granted on a limited basis and governed by contractual confidentiality and security obligations.
• Our teams receive regular data protection training.

9.3 - Secure retention

Information is kept only for as long as necessary (see section 7). At the end of that period, it is securely destroyed or anonymized to prevent any re-identification.

9.4 - Incident management and notification

In the event of a confidentiality incident likely to cause a risk of serious injury, Sourcinc undertakes to:

• Immediately take the necessary steps to limit the impact;
• Keep a documented register of every incident;
• Notify without delay the Commission d’accès à l’information du Québec (CAI), the Office of the Privacy Commissioner of Canada (OPC) or any other competent authority;
• Inform the individuals concerned when the incident presents a risk of serious injury.

9.5 - Ongoing responsibility

Securing personal information is an ongoing process. We regularly review and update our security policies, practices and systems to take into account:

• Technological developments;
• New cybersecurity threats;
• Applicable legislative changes.

Personal information stored or processed outside Canada and France

10.1 - Storage and processing

Your personal information may be stored and processed:

• In Canada and France, where Sourcinc maintains its main operations and infrastructure;
• In other jurisdictions where our service providers, affiliates or trusted partners have facilities.

As a general rule, we choose storage locations that support:

• The operational efficiency and performance of our services;
• Redundancy and resilience;
• Compliance with applicable data protection laws.

10.2 - Contractual safeguards

When personal information is transferred to another country, it may be subject to local laws and accessible to the competent government authorities.

Sourcinc nevertheless takes steps to ensure your data receives an equivalent level of protection, in particular by contractually requiring our providers to meet strict confidentiality, security and protection standards.

10.3 - Notification of sensitive transfers

Where required by law, we will inform you in advance if your personal information is to be transferred to a jurisdiction with a different level of protection, and we will obtain your consent where required.

Your rights

11.1 - Access and correction

You have the right to ask whether we hold personal information about you and, if so:

• To obtain a copy of that information;
• To request its correction if it is incomplete, inaccurate or out of date.

11.2 - Right to erasure (“right to be forgotten”)

You may request the deletion of your personal information when:

• It is no longer needed for the intended purposes;
• You withdraw your consent and no other legal basis justifies keeping it;
• Its processing is unlawful.

11.3 - Withdrawal of consent

You may withdraw your consent to the use of your personal information, in whole or in part, subject to applicable legal or contractual restrictions.

11.4 - Right to portability

You may request that your personal information be provided to you in a structured, machine-readable format, or transferred directly to another organization, where technically feasible.

11.5 - Restriction and objection

You may request:

• That we restrict the processing of your information (e.g. while its accuracy is being verified);
• To object to the processing of your data for prospecting, marketing or profiling purposes.

11.6 - Automated decisions

If we use an automated decision-making process that produces significant legal effects concerning you, you have the right:

• To obtain information about the logic behind that decision;
• To request human intervention;
• To contest the decision.

11.7 - Complaint to an authority

You may file a complaint with:

• The Commission d’accès à l’information du Québec (CAI);
• The Office of the Privacy Commissioner of Canada (OPC);
• The competent supervisory authority in your country of residence (EEA or Switzerland).

11.8 - Exercising your rights

To exercise your rights, please contact us using the details provided in section 12. We will process your requests within the time limits set by law and may ask you to confirm your identity before acting on them.

Person in charge of the protection of personal information and contact details

12.1 - Person in charge

Sourcinc has designated a person in charge of the protection of personal information (also called the Data Protection Officer, “DPO”). She ensures Sourcinc’s compliance with data protection laws and the application of this Policy.

12.2 - How to contact us

For any question, concern, complaint or request related to this Policy or to exercising your rights, you can contact us:

Email: privacy@sourcinc.com

Mailing addresses:

• Sourcinc Canada 85 Saint-Paul Street West, Montréal, Quebec, H2Y 3V4 Canada

12.3 - Response times

We will respond to your requests within the time limits set by law. In some cases, we may ask you for additional information to confirm your identity.

Additional terms for users located in the European Economic Area (EEA) and Switzerland

Last updated: September 10, 2025

If you are located in the EEA or Switzerland, the following provisions apply in addition to this Policy. In the event of a conflict, the provisions of this section prevail.

13.1 - Legal bases for processing

We process your personal information only when we have a legal basis under the GDPR, including:

• Consent: when you have given us your explicit agreement for a specific processing activity;
• Contract: when processing is necessary to perform a contract with you or to take pre-contractual steps at your request;
• Legal obligation: when processing is required to comply with a law of the EU, Switzerland or a Member State;
• Legitimate interests: when processing is necessary to pursue our legitimate interests (e.g. fraud prevention, IT security, improving our services, managing client and business relationships), provided that your fundamental rights and freedoms do not override them.

For any question about the legal basis for a processing activity, you can contact our person in charge of the protection of personal information (see section 12).

13.2 - Transfer of your personal information outside the EEA or Switzerland

Your personal information may be transferred and processed outside your country of residence, including in Canada (where Sourcinc is established) and, in some cases, in the United States or other countries where our service providers are located.

We put appropriate legal mechanisms in place to ensure an adequate level of protection, for example:

• Standard contractual clauses approved by the European Commission;
• Assessment of our providers’ compliance and security;
• Additional technical and organizational security measures.

13.3 - Additional rights

In addition to the rights described in section 11, you have the following rights under the GDPR:

• To restrict the processing of your data when you contest its accuracy, the lawfulness of its processing or the need to keep it;
• To object at any time to the processing of your data based on our legitimate interests, unless we have compelling grounds;
• To request the deletion of your data, subject to exceptions provided by law;
• To request the portability of your data, meaning to obtain a copy of your information in a machine-readable format or to request its transfer to a third party.

13.4 - Exercising your rights and complaints

To exercise your rights, you can contact our person in charge of the protection of personal information at: privacy@sourcinc.com. If you believe your rights have not been respected, you may also file a complaint with the competent data protection authority, including:

• The Commission nationale de l’informatique et des libertés (CNIL) in France;
• The supervisory authority of your country of residence in the EEA;
• The Federal Data Protection and Information Commissioner (FDPIC) in Switzerland.

Updates to and effective date of the Policy

14.1 - Updates

Sourcinc reserves the right to amend this Privacy Policy to reflect:

• Changes in our internal practices;
• Applicable legislative or regulatory changes (e.g. Law 25, PIPEDA, GDPR);
• New technologies or solutions we deploy.

Any update will be posted on our website, and the date of the latest revision will appear at the top of this page.

14.2 - Notice of material changes

If we make material changes that would affect your rights or the way we process your personal information, we will inform you directly (for example by email or a notification in your account) and, where required, ask for your consent again.

14.3 - Effective date

This Policy takes effect on September 10, 2025 and replaces any previous version.