Privacy Policy

1. General Information

a) Introduction

Privacy is important to 2975131 Canada Inc. (Spinelli Group) (hereinafter "Entity", "We", "Us", "Our"). For this reason, We have implemented safeguards and sound management practices for your Personal Information in accordance with applicable laws in Quebec and Canada.

This Privacy Policy (the "Policy"), which should be read in conjunction with our Terms and Conditions, describes our practices regarding the collection, use, processing, disclosure, and retention of the Personal Information of our clients, visitors, and users.

By using our website https://www.spinellimazda.com/ or any of our associated websites (as listed below) (hereinafter collectively referred to as the "Website"), you agree that We may collect, use, process, disclose, and retain your Personal Information in accordance with the terms and conditions described herein. If you do not agree to comply with and be bound by this Policy, you are not authorized to visit, access, or use Our Website or Services, or share your Personal Information with Us.

This Policy also applies to Our affiliated websites:

https://www.spinellivw.com/ (Volkswagen dealership);
https://www.spinellihonda.com/ (Honda dealership);
https://www.spinelliinfiniti.com/ (Infiniti dealership);
https://www.spinellikia.com/ (Kia dealership);
https://www.spinellilexuslachine.com/ (Lexus Lachine dealership);
https://www.spinellilexuspointeclaire.com/ (Lexus Pointe-Claire dealership);
https://www.spinelli.com/ (Spinelli dealerships);
https://www.spinellinissan.com/ (Nissan dealership);
https://www.spinellitoyotalachine.com/ (Toyota Lachine dealership);
https://www.spinellitoyotapointeclaire.com/ (Toyota Pointe-Claire dealership);
https://monspinelli.com/ (Mon Spinelli).

This Policy does not apply to the Personal Information of employees, representatives, and consultants of the Entity, or any other person affiliated with the Entity, as well as any information that does not constitute Personal Information as defined by applicable laws in Quebec and Canada.

b) Data Protection Officer

Questions, comments, and complaints regarding the Entity's Privacy Policy and practices may be directed to our Data Protection Officer at:

Phone: 514-634-7171

Email: rprp@spinelli.com

Address: 200 Montreal-Toronto Blvd., Montreal (Quebec) H8S 1B8

Data Subject access request

2. Definitions

The following words and expressions, when appearing with a capital letter in the Policy, have the meanings assigned to them below, unless there is an implicit or explicit exception in the text:

"Service Provider": any natural or legal person who processes Personal Information on behalf of the Entity. These are third-party companies or individuals employed by the Entity to facilitate the Services, provide the Services on behalf of the Entity, perform services related to the Services, or assist the Entity in analyzing the use of the Services.

"Personal Information": any information that relates to a natural person and allows that person to be identified, i.e., that directly or indirectly reveals something about the identity, characteristics (e.g., skills, preferences, psychological tendencies, predispositions, mental abilities, character, and behavior of the data subject) or the activities of that person, regardless of the nature of the medium and regardless of the form in which this information is accessible (written, graphic, audio, visual, computerized, or other).

"Data Protection Officer": the person responsible for enforcing this Policy, whose contact details are provided in Section 1 of this Policy.

"Services": Services refers to the Website and Our social media pages, as well as the Services and products provided to You, such as the online purchase of a vehicle.

3. Processing of Personal Information

3.1 Collection of Personal Information

During Our activities, We may process various types of Personal Information, including the information listed below:

contact information, such as Your first and last name, address, email address, phone number, photo, date of birth, age, legal status, and information used to verify Your identity;
Your consent to the use of cookies;
information collected by Our surveillance cameras on Our property;
information You choose to provide or send to Us, for example, when You fill out a form, make an appointment online, respond to surveys, apply for a job, or communicate with one of Our employees or representatives;
transaction and payment information, such as the payment method used, the date and time, the payment amount, the billing zip code, Your address, and other related information;
information collected automatically when You use the Website and Our Services, including:

connection information and other information about Your activities on the Website, such as Your IP address, the pages You have visited, the time and date of Your visits, the number of connections, the type of browser You use, Your device's operating system and other hardware and software information, etc.;
demographic data and geolocation data, such as Your IP address, a precise or approximate location determined from Your IP address or the GPS of Your mobile device (depending on Your device settings).

In each case, this Personal Information is processed in accordance with the legitimate and necessary purposes listed in Section 3.2 below.

3.2 Use of Personal Information

Purposes of Personal Information. We may use Your Personal Information for the purposes described below:

Management and improvement of Our services and Website: We use Your Personal Information to operate, maintain, monitor, develop, improve, and offer the features of Our Website, as well as to develop and offer new Services. We also manage Your cookie preferences and Your consents related to their installation and use.
Access to services and transaction management: Your personal information allows Us to present and provide You with Our services as defined in Section 2 – Definitions, to enable You to purchase Our Services and carry out transactions related to them, to make payments and prepayments, to facilitate and carry out credit applications, to initiate a financing application, and to assess the value of a vehicle.
Security and protection: We use the information We collect, including from Our surveillance cameras, to protect and secure Our employees, workplaces, and property. We also use it to detect and prevent fraud, errors, spam, abuse, security incidents, and other harmful activities.
Customer service and interaction management: We collect and use Your information to enable You to create an online account, apply for job openings and evaluate Your application, interact with Our instant messaging module, collect Your opinions, testimonials, and comments about Our services, and respond to Your questions and provide You with assistance as needed.
Marketing and business development: Subject to Your prior consent, We use Your personal information for customer prospecting, marketing, and business development purposes, as well as to manage Our loyalty and reward programs. We may also send You messages, emails, surveys, updates, and security alerts.
Compliance with legal and contractual obligations: We use Your information to fulfill Our contractual obligations to You and for any other purpose permitted or required by law.

3.3 Disclosure of Personal Information

We may disclose Your Personal Information to Our employees (including marketing and sales departments), contractors, consultants, agents, service providers, suppliers, and other trusted third parties (collectively, "Service Providers"), who need this information to help Us operate Our Website, conduct Our business, or serve You, provided that these Service Providers have first agreed in writing to keep Your Personal Information confidential in accordance with applicable laws and Our Information Governance Program.

We do not sell, trade, or otherwise disclose Your Personal Information to third parties.

3.3.1 Service Providers and Other Third Parties

Although We try to avoid sharing Your Personal Information with third parties, We may use Service Providers to perform various services on Our behalf, such as IT management and security, marketing, data analysis, hosting, and storage.

We have defined below the categories of third parties with whom such sharing may occur:

Our cookie providers;
Our cookie manager;
Our website developers and managers;
Our website and domain name hosting Service Providers;
Our data hosting Service Providers;
Our social media networks;
Our online security software and Service Providers;
Our software, platforms, and applications for managing vehicle purchases, sales, exchanges, and evaluations;
Our service and parts management software and applications;
Our financing, credit, and tax calculation software, platforms, and applications;
Our customer service management software, platforms, and applications;
Our advertising and marketing software, platforms, and applications;
Our software, platforms, and Service Providers for recruiting;
Our newsletter management service;
Our task and administration management software, platforms, and applications;
Our online messaging module;
Our payment processors;
Our financial institutions;
Our insurers;
Our financial and legal advisors;
Our manufacturers and our agents to manufacturers.

Disclosure of Personal Information Outside of Quebec. We may disclose Your Personal Information outside Quebec and hire an entity located outside Quebec to collect, use, or retain Your Personal Information on Our behalf.

Protections When Disclosing Information Outside of Quebec. Before disclosing Your Personal Information to third parties outside Quebec, We conduct a privacy impact assessment to evaluate the risks that may affect the security of Your Personal Information. This assessment also identifies the appropriate security measures that will mitigate or eliminate these risks. The communication will then be subject to a written agreement binding these third parties to comply with such measures.

3.3.2 Compliance with Legislation, Response to Legal Requests, Prevention of Harm, and Protection of Our Rights

We may disclose Your Personal Information when We believe that such disclosure is authorized, necessary, or appropriate, including:

to respond to requests from public and government authorities, including public and government authorities outside Your country of residence;
to protect Our business;
to comply with legal proceedings;
to protect Our rights, privacy, safety, property, or that of You or others;
to enable Us to pursue available remedies or limit the damages We may sustain;
in accordance with applicable laws, including laws outside Your country of residence;
in accordance with applicable automotive industry standards or requirements imposed by Our partners and/or manufacturers.

3.3.3 Commercial Transaction

We may share, transfer, or disclose, in strict compliance with this Policy and the provisions of the Act respecting the protection of personal information in the private sector, RLRQ c P-39.1 (the "Private Sector Act") and the Act to modernize legislative provisions as regards the protection of personal information, LQ 2021, c 25 (the "Law 25", assented to on September 22, 2021), your Personal Information in the event of a sale, transfer, or assignment, in whole or in part, of the Entity or Our assets (e.g., as a result of a merger, consolidation, change of control, reorganization, bankruptcy, liquidation, or any other business transaction, including in connection with the negotiation of such transactions). In such cases, We will notify You before Your Personal Information is transferred and becomes subject to a different privacy policy.

3.4 Consent for Personal Information

Where possible, the Entity obtains consent directly from the individual concerned to collect, use, and disclose their Personal Information. However, if You provide Us with Personal Information about other individuals, You must ensure that You have duly notified them that You are providing Us with their information and have obtained their consent to such disclosure.

We will seek Your explicit, clear, free, informed consent for specific purposes before using or disclosing Your Personal Information for purposes other than those set out herein. We will also seek Your explicit consent whenever sensitive Personal Information is involved in any of the Entity's processing activities. We will ask for Your consent for each specific purpose in simple and clear terms, separately from any other information that will be communicated to You.

BY USING OUR WEBSITE, BY TRANSMITTING YOUR PERSONAL INFORMATION BY EMAIL, YOU CONSENT TO THIS PRIVACY POLICY AND TO THE COLLECTION AND PROCESSING OF YOUR PERSONAL INFORMATION IN ACCORDANCE WITH THE PRIVACY POLICY.

If You do not agree, please stop using the Website. Except where otherwise provided by law, You may withdraw Your consent at any time by giving reasonable notice. Please note that if You choose to withdraw Your consent to the collection, use, or disclosure of Your Personal Information, certain features of Our Website may no longer be available to You, or we may no longer be able to offer You certain Services.

3.5 Retention of Personal Information

Subject to applicable laws, We retain Your Personal Information only for as long as necessary to fulfill the purposes for which it was collected, unless You consent to the use or processing of Your Personal Information for another purpose. For information purposes, the retention period for certain information may vary depending on the end of the Services provided by the Entity to You. In addition, Our retention periods may be modified from time to time due to legitimate interests (for example, to ensure the security of Personal Information, to prevent abuse and violations, or to prosecute criminals or comply with applicable laws to which We are subject).

For more information on the periods during which Your Personal Information is retained, please contact our Data Protection Officer using the contact details provided in Section 1b) of this Policy.

4. Your Rights

As a data subject, You may exercise the rights set out below by contacting Our Data Protection Officer in writing at the contact information provided in Section 1b) of the Policy. Please note that We may ask You to verify Your identity before responding to any of these requests.

You have the right to be informed of the Personal Information We hold about You, its use, disclosure, retention, and destruction, subject to the exceptions provided for by applicable law;
You have the right to access Your Personal Information, request a copy, including a paper copy, of the documents containing Your Personal Information, subject to the exceptions provided for by applicable law, and obtain, where applicable, additional details on how We use, disclose, retain, and destroy it;
You have the right to have the Personal Information We hold about You corrected, amended, and updated if it is incomplete, ambiguous, outdated, or inaccurate;
You have the right to withdraw or modify Your consent to the Entity collecting, using, disclosing, or retaining Your Personal Information at any time, subject to applicable legal and contractual restrictions;
You have the right to ask Us to stop disseminating Your Personal Information and to de-index any link attached to Your name that gives access to this information if such dissemination contravenes the law or a court order;
You have the right to request that Your Personal Information be disclosed to You or transferred to another organization in a structured and commonly used technological format;
The right to be informed of a privacy incident involving Your Personal Information that may cause You serious harm. To this end, we maintain a register of all privacy incidents and assess the harm they may cause;
You have the right to file a complaint with the Commission d'accès à l'information, subject to the conditions set out in applicable law.

To respond to Your request, You may be asked to provide appropriate identification or to identify yourself in another manner. Please direct any requests or inquiries to the Data Protection Officer at the contact information provided in Section 1b) of this Policy.

5. Cookies and Other Tracking Technologies

We use cookies and other similar technologies (collectively, "Cookies") to help Us operate, protect, and optimize the Website and the Services We offer. Cookies are small text files that are stored on Your device or browser. They allow Us to collect certain information when You visit the Website, including Your preferred language, the type and version of Your browser, the type of device You are using, and Your device's unique identifier. While some of the Cookies We use are deleted after the end of Your browser session, other Cookies are stored on Your device or browser to enable Us to recognize Your browser the next time You visit the Website. The Personal Information collected through these Cookies is not intended to identify You. They ensure the functioning of the Website, improve the browsing experience of users, and provide certain data that allows Us to better understand the traffic and interactions that take place on Our Website, as well as to detect certain types of fraud. Cookies do not cause any damage to Your device and cannot be used to extract Your Personal Information. We collect Your IP address, information about Your device and operating system or browser, Your browsing history and history on Our Website, as well as Your queries, browsing preferences (languages used), etc.

You can configure Your collection preferences on Our Website under the "Consent Choices" tab or from Your browser so that You are informed of the use of Cookies when You visit the Website, allowing You to decide, in each case, whether to accept or refuse the use of some or all Cookies. Please note that disabling cookies on Your browser may affect Your browsing experience on the Website and prevent You from using some of its features.

To learn more about how We use cookies, You can visit the "Consent Choices" tab on Our Website.

6. Security Measures

The Entity has implemented physical, technological, and organizational security measures to adequately protect the confidentiality and security of Your personal information against loss, theft, or unauthorized access, disclosure, reproduction, communication, use, or modification. These measures include:

At the administrative level, the adoption of a series of policies and procedures as part of the implementation of Our information governance program, which in particular:

regulate access, communication, retention, depersonalization, including anonymization and/or, where applicable, destruction of Personal Information;
determining the roles and responsibilities of Our employees throughout the life cycle of Personal Information and documents;
establish procedures for responding to and addressing privacy incidents;
govern the process for requests and complaints relating to the protection and processing of Personal Information.

On a technical level, the use of several means such as:

the use of a secure server. All sensitive or credit information provided is transmitted via Secure Socket Layer (SSL) technology and then encrypted in Our payment gateway provider database, accessible only by authorized persons with special access rights to these systems, who are required to keep the information confidential;
the use of backup systems, network monitoring software, etc.;
the use of encryption and separation of duties, access controls, and internal audits.

Despite the measures described above, We cannot guarantee the absolute security of Your Personal Information. If You have reason to believe that Your Personal Information is no longer secure, please contact Our Data Protection Officer immediately using the contact details provided in Section 1b) above.

7. Changes to this Privacy Policy

We reserve the right to modify this Policy at any time in accordance with applicable law. In the event of a change, We will publish the revised version of the Privacy Policy and update the date of the update in the footer of the Policy. We will notify You reasonably in advance of the effective date of the new version of Our Policy. If You do not agree to the new terms of the Privacy Policy, We encourage You to stop using Our Website and Services. If You continue to use Our Website or Services after the new version of Our Policy takes effect, Your use of Our Website and Services will be governed by that new version of the Policy.

8. Links to Third-Party Websites

We may occasionally include references or links on Our Website to Our Facebook page, websites, products, or services provided by third parties (the "Third-Party Services"). These Third-Party Services, which are not operated or controlled by the Entity, are governed by privacy policies that are entirely separate and independent from Ours. We therefore assume no responsibility for the content and activities of these sites. This Policy applies only to the Website and the Services We offer. The Policy does not extend to Third-Party Services such as Our Facebook, LinkedIn, and YouTube pages.

9. Invisible reCAPTCHA

Invisible reCAPTCHA analyzes activity on a web page feature (e.g., mouse movements and typing patterns) to determine whether a user is a robot.

The invisible reCAPTCHA service may collect information from Your device. Information collected by reCAPTCHA is retained in accordance with its privacy policy.

10. Payment Details

Regarding credit card details or other payment information You have provided to Us, we are committed to storing this confidential information in the most secure manner possible.

11. Individuals Under the Age of 14

We do not knowingly collect or use Personal Information from individuals under the age of 14. If You are under the age of 14, You should not provide us with Your Personal Information without the consent of Your parents or guardian. If You are a parent or guardian and learn that Your child has provided Us with Personal Information without consent, please contact Us by using the contact details provided in Section 1b) above to request that We delete that child's Personal Information from Our systems.

12. Applicable Laws

The laws of Canada and Quebec, excluding its conflict of law rules, will govern this agreement and Your use of the Website. Your use of the Website may also be subject to other local, provincial, national, or international laws.