ARCUS

PROTECTION OF EMPLOYEE PERSONAL INFORMATION

Arcus is committed to protecting the privacy of every employee. We recognize the importance of maintaining the privacy and security of employee data and have outlined measures and staff obligations regarding the collection, use, storage, and disposal of privileged/confidential information.

To promote consistent organizational practices and measurable quality standards; To establish guidelines for the proper handling of employee personal information to protect against unauthorized access,

disclosure, alteration, or destruction, and; To comply with applicable privacy codes, laws and standards including Arcus' Ethical Code of Conduct, Personal Information Protection and Electronic Documents Act (PIPEDA), and Personal Information Protection Act (PIPA

Employees are required to follow all procedures regarding the collection, use, disclosure and retention of personal information as set out in this policy. All employees who at one time or another receive personal, privileged and/or confidential information which may concern other employees, company operations and who collect, maintain and/or use personal information of employees, are responsible for ensuring that the collection, use and disclosure of this information is carried out in accordance with the provisions of this policy. In certain circumstances personal information may be collected, used, or disclosed without the knowledge and consent of the individual. Exemptions include, but are not limited to, personal information gathered for: Legal, medical, security or other emergencies. Detection and prevention of fraud or for law enforcement procedures.

Responsibilities Employees are responsible for: Keeping their own employee files current when there is any change to their personal information; Obtaining the proper consents and authorizations prior to disclosure of personal, privileged and/or confidential information. Immediately reporting any breaches of confidentiality to the Team Leader or the Director of Quality Assurance. Keeping passwords private and access to personal information privileged and confidential; Relinquishing any personal, privileged and/or confidential information in their possession before, or immediately upon termination of employment.

Supervisors, Human Resources and/or payroll personnel are responsible for: Obtaining consent and/or verifying that consent has been obtained for the collection, use and disclosure of personal information from employees; Ensuring that the procedures regarding collection, use and disclosure of personal information stated below are consistently

Maintaining the existing system of employee records privacy; Responding to requests for disclosure after the appropriate

Responding to employees' requests for access to their files; Ensuring proper disposal of unnecessary files/information; Cooperating with the Director of Human Resources to investigate complaints or breaches of policy; Obtaining from employees before their terminations any personal, privileged, confidential information in their possession; Ensuring that disclosure of personal information of personal health information to a third party is done with the approval of

the Director of Human Resources in order to minimize risk of

non-compliance with applicable legislative or regulatory regimes;

Maintaining separate files for confidential information to ensure that personal health or other sensitive data is protected.

The Director of Human Resources and Director of Quality Assurance are responsible for: Ensuring policies and internal processes are compliant with applicable standards and legislations. Cooperating with supervisors, human resources and/or payroll personnel to develop internal policies for the collection, use and disclosure of personal information, personal health information and other confidential data of employees and clients; Monitoring the responses to Third Party requests for personal information or other personal/confidential information; Ensuring appropriate consents are obtained for the collection, use and disclosure of personal and other confidential information through a periodic review process; Where collection, use or disclosure is permitted without prior consent, notifying individuals of the collection, use and disclosure or personal information and/or other personal confidential

information after such occurrence.

Legal Requirements Accountability: Arcus Community Resources is responsible for personal information under its control. Identifying Purposes: The purposes for which personal information is collected shall be identified by Arcus Community

Resources at or before the time the information is collected.

Consent: The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information. Any changes in the use of personal information must be communicated and consent must be sought to accommodate the change. Limiting Collection: The collection of personal information must be limited to information necessary for the purposes identified by Arcus Community Resources. Limiting Use, Disclosure, and Retention: Personal information shall not be used or disclosed for purposes other than those for which it

was collected, except with the consent of the individual or as permitted by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes. Accuracy: Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be

Safeguards: Arcus has developed continuously enhanced security procedures to safeguard and protect personal information against loss, theft, unauthorized disclosure, copying, and unauthorized use or modification. Personal information shall be protected by security measures appropriate to the sensitivity of the information including, password protected cloud storage systems, locked file cabinets, limiting access to a need-to-know basis etc. Individual Access: Upon request an individual shall be informed of the existence, use, disclosure of his/her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

Collection, Use and Disclosure of Personal Information Arcus Community Resources collects, uses and discloses employee personal information in order to establish, manage or terminate an employment relationship. Once hired, an employee's personal information is obtained and used only with their consent. Consent provided at this time allows the administration of all aspect of the employee's employment

Consent can be either express or implied. Where practical, we will obtain your express consent. Additional information may be requested as it becomes necessary at future times. For example, additional information may be requested for group benefit planning. We will continue to use and disclose your personal information previously collected in accordance with our current privacy policy, unless you inform us otherwise. We will infer that consent has been obtained for the continued use or disclosure of your personal information by the continuation of your employment with the

Consent may be withdrawn subject to legal or contractual obligations and on a reasonable notice. To withdraw consent already granted, staff must first contact the

Director of Human Resources in other to understand the

implication of such withdrawal. If the staff chooses to withdraw consent, they may proceed to do so with requisite notice.

Retention/Destruction of Personal Information

Arcus keeps employee personal information only as long as it is needed to administer the employment relationship, and for a reasonable time thereafter in other to meet any legal, regulatory, or tax requirements. Employee Personal Information is destroyed when it is no longer needed for the performance of contractual employment obligations. Alternatively, the employees name or identifiers may

The above notwithstanding, personal information that is the subject of a request by an individual or privacy commissioner shall be retained for as long as it is necessary to allow the individual(s) to exhaust any recourse they may have under federal and/or privacy legislations.

Access to Personal Information:

Employees who have access to the personal information of other employee are trained on confidentiality. An employee's access to the personal information of applicants, current or former employees, or contractors will be allowed if the information is necessary for the performance of their duties. Employees may request access to review their own file through arrangements with the Director of Human Resources. Employees shall provide at least twenty-four (24) hours written notice for this. Response to the request will b provided within five (5) days or advise an employee if additional time is required within this time

Employees may obtain a copy of any document in their file which they have previously signed. No material contained in an employee file may be removed. A representative of the company will be present during viewing of the file.

Situations may arise where an employer is legally prohibited from allowing you access to your personal information. For example, Arcus would be so prohibited if allowing an employee access to their personal information would likely reveal personal information about another person or other confidential information. If this is the case, we will advise the employee on the reason for this. Other exceptions are as follows: Evaluating information collected in a reference check if the disclosure reveals the identity of the information source, and if the source expected that his or her identity would be held in

The right of access does not extend to information exempted from disclosure under PIPEDA and/or PIPA. However, if that information can be redacted from a record, an applicant has the right of access to the remainder of that record.

Correcting Personal Information An employee has the right to request the correction of their personal information if there is an error or omission, or, alternatively, if the employee may request that a statement of disagreement is attached. We will amend/correct personal information if it is demonstrably inaccurate or incomplete.

Third Party Access to Employee Personal Information Employee personal information under Arcus' control is not made available to third parties - individual or organisation - without the consent of the owner of the information. Exceptions are: If third part access is in line with the purpose for which it was

If it is required by law in instances such as for reporting an employee accident to the Worker's Compensation Board or to a law enforcement agency. In compelling circumstances under which a delay in obtaining information may be injurious to an individual's health and safety; and

In compassionate circumstances in order to facilitate contact with next-of-kin or a friend of an individual who is injured, ill or

An employee may request that a third party should have access to their personal information. The request is made by completing a signed and dated Authorization to Release Information Form. If an organization contacts Arcus for reference information on an employee or former employee, the information is only disclosed if the organization has the written authorization of the employee whose information is being requested. Third party access requests are handled by the Director of Quality Assurance and must be in writing.

Breach of Company Policy on Information Privacy and Confidentiality Any employee found in breach of this policy will be subject to disciplinary action up to discharge for cause.

Contacting the Privacy Officer If you have questions, concerns, or requests regarding your personal information or this Privacy Policy, you may contact our designated Privacy Officer using the following methods: Name: Arlene Lagerstrom Title: Privacy Officer Email: privacy@arcus.email

Mailing Address: Privacy Officer Arcus Community Resources 25598 100th Ave., Maple Ridge, BC V2W 1Y5

Policy Section Policy Sub Section

Date of Review Reviewer External References

1D. Legal Requirements 2024-07-12; 1 August 2025 Arlene Lagerstrom, Director, Quality Assurance Personal Information Protection and Electronic Documents Act (PIPEDA, 2000) Personal Information Protection Act (PIPA, 2000)