VenueWorks Privacy Policy

1. About This Policy

VenueWorks is a workforce-management platform operated by Cohere Centre.

VenueWorks is used to support workplace functions such as employee administration, scheduling, availability, time and attendance, time off, timesheets, payroll preparation, onboarding, employee documents, certifications, notifications, performance management and related workplace operations.

This Privacy Policy explains the types of personal information that may be collected or processed through VenueWorks, why that information is used, how it may be disclosed and protected, and the choices or rights individuals may have regarding their information.

Cohere Centre is responsible for the personal information under its control and seeks to handle personal information in accordance with applicable Canadian privacy requirements and recognized privacy principles.

2. Personal Information We May Process

The information processed through VenueWorks depends on the features being used and the individual's relationship with the organization.

It may include:

• Identity and contact information, such as name, preferred name, email address, telephone number, mailing address and profile photograph.
• Employment information, such as employee number, department, position, manager, employment type, employment status, hire date and work assignments.
• Scheduling information, including assigned shifts, open shifts, availability, schedule changes and confirmations.
• Time and attendance information, including clock-in and clock-out records, timesheets, attendance exceptions, corrections and approvals.
• Time-off information, including requests, leave types, dates, balances, approvals and cancellations.
• Location verification information, where an eligible employee uses VenueWorks Time Clock and location verification is enabled.
• Payroll-related information, such as hours worked and information used to prepare payroll exports.
• Certifications and qualification information, including certification names, issue and expiry dates and supporting documents.
• Onboarding and employee documents, including forms, policies, acknowledgements, workplace documentation and employee-uploaded records.
• Performance information, including performance reviews, goals, recognition, manager notes, corrective actions, performance improvement plans and related supporting documents.
• Emergency-contact information entered for workplace emergency purposes.
• Account, security and technical information, such as authentication events, browser or device information, IP information, system activity, security events and audit records reasonably required to operate and protect VenueWorks.

3. How Information Is Collected

Information may be collected:

• directly from the individual;
• from Cohere Centre or another authorized employer or organization;
• from authorized managers or administrators;
• through the individual's use of VenueWorks;
• automatically through authentication, audit, security and technical processes; or
• through device functionality authorized by the user, such as location access associated with a Time Clock action.

4. Why Personal Information Is Used

Personal information processed through VenueWorks may be used to:

Personal information should not be collected, used or disclosed for purposes that are materially different from the purposes for which it was obtained unless appropriate notice, authorization or another lawful basis exists.

• create and administer user accounts;
• maintain employee and workplace records;
• manage departments, positions and reporting relationships;
• prepare, publish and communicate work schedules;
• manage availability and open shifts;
• administer vacation and other time-off requests;
• operate Time Clock and location verification;
• maintain and review timesheets;
• prepare payroll information and exports;
• administer onboarding;
• maintain employee documents;
• track certifications and expiry dates;
• administer workplace performance processes;
• send operational notifications;
• manage workplace access and permissions;
• maintain security and audit records;
• investigate errors, misuse or security incidents;
• provide technical or administrative support;
• maintain and improve the reliability and security of VenueWorks; and
• comply with legal, regulatory and employment-related obligations.

5. Time Clock and Location Verification

Some employees may be eligible to use VenueWorks Time Clock.

Where location verification is enabled, VenueWorks may request the device's location when the employee attempts to clock in or clock out.

The purpose is to determine whether the Time Clock action is being attempted from within an authorized workplace location or geofence.

VenueWorks is not designed to continuously track an employee's location in the background.

Location information associated with a Time Clock attempt may include information reasonably required to determine the device's location, accuracy and relationship to the authorized work location.

Accepted and rejected Time Clock attempts may be recorded for attendance, security, troubleshooting and audit purposes.

6. Access to Information

VenueWorks uses role, organization, management-scope and record-specific permissions to restrict access to personal information.

Depending on the record and workplace responsibility, information may be available to:

Sensitive records, including certain employee documents, manager notes and performance information, may have more restrictive access controls.

VenueWorks is designed to enforce material access restrictions through server-side authorization and not solely by hiding information in the user interface.

• the employee;
• an authorized manager;
• department managers;
• payroll or administrative personnel;
• the General Manager;
• authorized organization administrators; or
• authorized service providers acting on Cohere Centre's behalf.

7. Service Providers

Cohere Centre may use service providers to operate VenueWorks and related workplace technology.

These may include providers of:

Service providers should receive or access personal information only to the extent reasonably required to provide their services or support legitimate operational requirements.

• cloud hosting;
• databases and file storage;
• authentication;
• email and communications;
• security and monitoring;
• Microsoft 365;
• network services; and
• technical support.

8. Processing Outside Canada

Some technology and service providers may process or store personal information in Canada or in other jurisdictions.

Where information is processed outside Canada, it may be subject to the laws of the jurisdiction in which it is processed and may be accessible to courts, law-enforcement agencies or government authorities where permitted by applicable law.

Cohere Centre seeks to use appropriate contractual, administrative and technical safeguards when personal information is handled by service providers.

9. Sale and Advertising

Cohere Centre does not sell or rent employee personal information collected through VenueWorks to advertisers or data brokers.

Personal information collected for workplace-management purposes is not intended to be used for third-party behavioural advertising.

10. Retention

Personal information is retained for as long as reasonably necessary for the workplace or business purpose for which it was collected and to satisfy applicable legal, employment, audit, security and recordkeeping requirements.

Different categories of information may have different retention periods.

When personal information is no longer reasonably required, it should be securely deleted, anonymized or otherwise disposed of in accordance with applicable requirements and established retention practices.

11. Safeguards

Cohere Centre and VenueWorks use administrative, technical and organizational safeguards appropriate to the nature and sensitivity of the information being handled.

Safeguards may include:

No information system can guarantee absolute security, but reasonable safeguards are used to reduce the risk of unauthorized access, use, disclosure, modification or loss.

• authenticated access;
• role-based and organization-scoped permissions;
• server-side authorization;
• private file storage;
• encrypted communications;
• audit logging;
• tenant isolation;
• restricted administrative access;
• security monitoring; and
• backup and recovery controls.

12. Privacy and Security Incidents

Cohere Centre maintains procedures to respond to suspected privacy or security incidents.

Incidents will be investigated and addressed based on their nature, sensitivity and applicable legal requirements.

Where notification or reporting is legally required, Cohere Centre will take the steps required by applicable law.

13. Access and Correction

Individuals may ask to review personal information about them and request correction of information that is inaccurate or incomplete, subject to applicable legal limitations.

Where employee self-service is enabled, some information may be reviewed or corrected directly through VenueWorks.

Other employment records may require the employee to contact their manager or an authorized Cohere Centre administrator.

14. Cookies and Essential Technologies

VenueWorks may use cookies or similar technologies necessary to authenticate users, maintain secure sessions, preserve essential application state and protect the service from misuse.

VenueWorks does not require third-party behavioural advertising cookies to provide its workforce-management functions.

If optional analytics or non-essential tracking technologies are introduced in the future, privacy notices and consent mechanisms will be reviewed and updated where appropriate.

15. Electronic Monitoring

Certain VenueWorks functions form part of Cohere Centre's electronic workplace monitoring practices, including Time Clock, location verification associated with Time Clock actions, attendance and timesheet records, and system audit activity.

More information is available in the Cohere Centre Electronic Monitoring Policy at /electronic-monitoring.

16. Changes to This Policy

Cohere Centre may update this Privacy Policy as VenueWorks, workplace practices or legal requirements evolve.

Material changes will be reflected in a new policy version and updated effective and revision dates.

Previous versions required for legal or operational purposes will be retained.

17. Privacy Questions and Requests

Questions, access or correction requests, and privacy concerns may be directed to:

Cohere Centre

Attention: Privacy Officer / General Manager

4899 Uplands Drive

Ottawa, Ontario K1V 2N6

Canada

Email: info@coherecentre.ca

Telephone: 613-822-8800