Privacy policy

Last update: January 24, 2024

PRIVACY AND COOKIES POLICY OF
DAA BRANDS COMPANY

DAA Brands Company (“DAAB”, “we” or “our”) is committed to protecting the personal information we collect in the course of our business in accordance with Privacy Laws. This privacy and cookies policy (the “Policy”) describes in clear and simple terms the manner in which we respect our obligations in terms of protection of personal information and more specifically our practices regarding the collection, use, disclosure, retention and destruction of your personal information when you visit our website at www.daabrands.com (hereinafter our “Website”). Our person in charge of the protection of personal information (the “Privacy Officer”), whose full contact details can be found in Article 13, ensures compliance and implementation of the Policy.

In compliance with applicable privacy laws, we have put in place internal practices concerning the management of your personal information. These practices include a framework on:

• The confidentiality and the security of your personal information
• Management and prevention of Confidentiality Incidents
• Performing privacy impact assessments
• Retention of your information throughout its life cycle

Policy content

1. TO WHOM OUR POLICY IS AIMED AT?
2. WHAT PERSONAL INFORMATION DO WE COLLECT AND FOR WHAT PURPOSES?
3. HOW DO WE COLLECT YOUR PERSONAL INFORMATION?
4. HOW DO WE PROTECT YOUR PERSONAL INFORMATION?
5. TO WHOM MAY WE COMMUNICATE YOUR PERSONAL INFORMATION?
6. CAN YOUR PERSONAL INFORMATION BE COMMUNICATED OR STORED OUTSIDE QUEBEC OR CANADA?
7. HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?
8. WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL INFORMATION?
9. CONFIDENTIALITY INCIDENT
10. COOKIES WE USE
11. COOKIES USED BY OUR SERVICE PROVIDERS
12. MANAGEMENT OF COOKIES
13. HOW TO CONTACT OUR PERSON IN CHARGE OF THE PROTECTION OF PERSONAL INFORMATION?
14. APPLICABLE LAW AND JURISDICTION
15. POLICY UPDATE

1.   TO WHOM OUR POLICY IS AIMED AT?

The Policy applies to personal information collected when you visit our Website. The Policy therefore applies all users of our Website, even if you do it on behalf of your organization.

Please note, however, that you are still responsible for protecting your personal information when you visit other third-party websites. Our Policy does not apply to the collection, use, disclosure or retention of your personal information by other websites, and we are not responsible for their policies regarding the protection of personal information.

2.   WHAT PERSONAL INFORMATION DO WE COLLECT AND FOR WHAT PURPOSES?

Personal information is any information which relates to a natural person and allows directly or indirectly that person to be identified, whether taken separately or in combination with other information, but excludes information not considered as personal information under applicable Privacy Laws. For greater clarity, personal information is any information which allows you to identify:

• a person directly, for example an identifier such as a name, location data, government ID; or
• indirectly through the combination of several specific elements specific to its physical, physiological, genetic, psychic, economic, cultural or social identity.

Please note that we collect only the personal information necessary to operate and upgrade our Website and to make it available to you. Below are the categories of personal information we collect and examples for each category. We may collect personal information about you through automated interactions or technologies as you browse the Website, such as automatically collecting your technical and usage information through Cookies or otherwise. This information is all collected for a specific purpose detailed in the following table.

Please note that we do not collect, and it is not our intention to collect any personal data of minors under 14 years old nor sensitive personal information about you, i.e. information which, due to its nature, in particular its medical, biometric or otherwise intimate nature, or the context of its use or communication, it entails a high level of reasonable expectation of privacy.

When you communicate with us through the Website on behalf of your organization, we will collect personal information about you and associate such information to the file of your organization. In such instance, this Policy refers to your organization even if we use the terms “you” or “yours”, as applicable. Note that information about your organization is not personal information and therefore not subject to this Policy. Only the information about the individuals who represent the organization is considered personal information subject to this Policy.

In general, we collect your personal information in order to operate and upgrade our Website and to make it available to you. Except as provided by law, if we need to use your personal information for purposes other than those set out in this Policy, we will obtain your consent before using this information.

The types of personal information we collect includes the following:

• First and last name
• Email address
• Information about your devices
• IP address
• Connection and web log data
• Language preferences
• Content of any interactions with you through the Website
• Duration of visits

We collect your personal information, to the extent permitted by law, for:

2.1.   Identification or authentication purposes

When we wish to register you as a new customer, we require certain information to identify you. This information will be used in particular to find your file and to ensure that your information is associated with your account when you wish to benefit from our products and services.

In general, we collect identity and contact information to fulfill this purpose. Your information may also be used in certain cases to authenticate you, for example to ensure that you are the right person when you wish to access your file.

2.2.   Providing you with information about our products and services

When you do business with us, it is necessary for us to process some of your information in order to determine your eligibility for our products and services, to advise you appropriately based on your needs, to answer any questions you may have, to handle your complaints and to assist you in all your dealings.

2.3.   Contacting you

As part of our business relationship with you, we may need to contact you from time to time to:

• Inform you of important changes applicable to products and services you have purchased from us; or
• Inform you of changes to our Terms of Use at https://www.daabrands.com/policies/terms-of-use or this Policy.

2.4.   Send you advertising offers, promotions or any other communications by email

In order to offer you a more personalized service, we may use your personal information to communicate offers likely to meet your needs, our latest promotions, newsletters or surveys, for example.

We may analyze your personal information for profiling purposes in order to adequately personalize these communications. This allows us to avoid sending you communications that do not correspond to your expectations.

Please note that we will only send you these communications if you have, where required by law, chosen to receive them, and that you may withdraw your consent at any time.

3.   HOW DO WE COLLECT YOUR PERSONAL INFORMATION?

We collect your personal information directly from you, based on your use of our Website or when you contact us through a dialog box or when you subscribe to our marketing communications.

4.   HOW DO WE PROTECT YOUR PERSONAL INFORMATION?

We are committed to protecting personal information in our possession in accordance with industry standards. To this end, we implement reasonable security measures to protect your personal information against loss, theft, unauthorized access, disclosure and unauthorized use. Our security measures are adapted to the amount and sensitivity of personal information. Please note however that despite the measures we take, we cannot guarantee the security of personal information transmitted over the Internet.

TYPES OF MEASURES	EXAMPLES OF MEASURES
Technical measures	Use of strong internal passwords Two-factor authentication Data encryption Access logs Data leakage detection tools (DLP) Encryption at rest Depersonalization
Administrative measures	Access management on a “need-to-know” basis Internal policies and training on the protection of personal information Our employees are bound by confidentiality undertakings that survive the end of their employment
Material measures	Locking of filing cabinets Access to offices limited by access cards;

If you believe that your personal information has been compromised or if you have any concerns in this regard, we invite you to contact our Privacy Officer at the contact details provided in Article 13.

5.   TO WHOM MAY WE COMMUNICATE YOUR PERSONAL INFORMATION?

Within our enterprise, access to your personal information is limited to those employees who require access in order to perform their duties. These employees are made aware of the need to protect personal information, and policies are in place to ensure their protection.

However, in order to offer you affordable, quality products and services, we may communicate some of your personal information outside our enterprise to our third-party brand partners. Rest assured that we require our brand partners to whom we disclose your personal information to respect the standards set by law and the security measures required to protect your personal information. We never sell your personal information and will only disclose it where required by law or with your consent.

5.1.   To our service providers

In order to carry out certain purposes described in the Policy, we do business with service providers to whom we may communicate or give access to your personal information when necessary for the performance of their service contract.

However, rest assured that we put in place written contracts with our service providers in order to, namely:

• Guarantee the confidentiality of your personal information.
• Ensure that the information is used only to perform the service.
• Ensure that the service provider does not retain any personal information when it is no longer required for the performance of the service, with the exception of information contained in backup systems, which will be deleted according to the deletion cycle predetermined by the service provider.
• Ensure that the service provider communicates with us with diligence in the event of a Confidentiality Incident or any attempt to do so.

The categories of service provider with whom we do business include the following:

• Computer and technical services
• Communication and marketing firms
• Application developer
• Cloud hosting service

5.2.   To our various affiliates and entities within our own group

We may share some of your personal information with other legal entities within our group where necessary to provide you with our products and services.

For example, certain entities belonging to our group specialize in offering certain products and services and other entities provide management and administrative support to all members of the group. In this context, the communication of your personal information is necessary in order to offer you the products and services required.

5.3.   To courts, law enforcement authorities, regulators, governmental officials or prosecutors

More specifically, we may disclose your personal information to comply with a search warrant, to respond to an investigative body, to comply with a court order, if we believe disclosure is necessary to comply with applicable laws, if required by law, to pursue a legal claim or to assert a defence.

5.4.   To other third parties

We may need to disclose your personal information to other third parties in certain specific circumstances, always within the limits permitted by law or after obtaining your consent, for example:

• As part of a business transaction (a merger, an acquisition by another enterprise, obtaining a loan or financing, for example)
• In the event of insolvency or bankruptcy

6.   CAN YOUR PERSONAL INFORMATION BE COMMUNICATED OR STORED OUTSIDE QUEBEC OR CANADA?

Yes. The subcontractors and service providers with whom we do business and other third parties to whom we disclose your personal information may operate outside Quebec or Canada.

In all cases where we disclose your personal information outside Quebec or Canada, we ensure that your personal information is handled securely and in compliance with this Policy, and that a written agreement exists with the third party regarding the handling of your personal information. In addition, before disclosing your personal information outside Quebec, we always conduct a privacy impact assessment to evaluate, among other things, the risks inherent in the disclosure as well as the applicable legal regime of the state where your information would be disclosed.

We will not disclose your personal information unless we are satisfied that it will be adequately protected.

We also put in place agreements as mentioned in Section 5.1.

7.   HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?

The personal information we collect is retained only as long as necessary to fulfill the purposes set out in Article 2 of the Policy and to comply with our legal and regulatory obligations. We have internal procedures and policies in place to ensure that your personal information is subject to a specified retention schedule, and that it is securely destroyed once this period has elapsed.

If you have any questions concerning the retention of your personal information, please contact our Privacy Officer using the contact details provided in Article 13.

As mentioned in the previous section, your personal information may be stored outside Quebec and Canada. We assure you that the location where your personal information is stored does not affect its protection and security. Please refer to Article 4 for further details.

8.   WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL INFORMATION?

8.1.   Access to your personal information

Subject to the exceptions provided by law, you have the right to request a copy of, or access to, the personal information we hold about you. You may exercise your right of access by contacting our Privacy Officer at the coordinates provided in Article 13. Also note that:

• We may not transmit certain types of information to you due to exceptions provided for in Privacy Laws (for instance, when DAAB’s files contain personal information on another person, if the information was generated as part of a dispute resolution process, if the information was collected to investigate a breach of an agreement or a contravention to applicable law, or if the information is subject to a legal privilege). Wherever possible, DAAB will redact information that will not be communicated and will provide you with the remaining information. If DAAB were unable to provide access to or disclosure of personal information to you, DAAB will provide you an explanation, subject to restrictions.
• Access to your personal information is free of charge. However, in certain circumstances, such as if the request is excessive or unfounded, we may charge an administration fee for transcribing, reproducing, transmitting or requesting additional copies of your personal information. We will inform you of any such charges before processing your request.
• We generally respond to all requests for access within 30 days of receipt of any necessary information. When we are unable to grant access, or if additional time is required to fulfill a request, we will notify you in writing.

8.2.   Rectification of your personal information

If you consider that your personal information is inaccurate or incomplete, you may rectify it by contacting our Privacy Officer at the coordinates provided in Article 13. It is your responsibility to inform us of any changes to your personal information so that we can ensure that your personal information is kept up to date.

8.3.   Obtain information on the processing of your personal information

You have the right to obtain additional information relating to the processing of your personal information. Specifically, you can ask what personal information has been collected, how it is processed, the categories of people who have access to your personal information within DAAB, the applicable retention period and the source of the personal information if it was collected from third parties. If you cannot find the answer to your questions in the Policy, you can contact our Privacy Officer using the contact details provided in Article 13.

8.4.   Being informed if you are the subject of a decision based exclusively on automated processing

If we use your personal information to make a decision based exclusively on automated processing, we will notify you no later than the time we inform you of the decision. In such a case, you also have the right, upon request:

• to be informed of the information used to make the decision.
• the reasons as well as the main factors and parameters that led to the decision.
• to have the personal information used to make the decision rectified; and
• to present your observations to a member of our team able to review the decision if necessary.

You may exercise this right by contacting our Privacy Officer at the coordinates provided in Article 13.

8.5.   Withdraw your consent

When you give your consent for secondary purposes, in other words, purposes that are not essential to offer you our products and services, you may withdraw it at any time, without any consequence.

However, if you refuse to provide us with personal information that is necessary for us to offer you our products and services or that is required by law, we may no longer be able to provide you with some of our services. You will, however, be informed of the occurrence of such a situation.

8.6.   Right to data portability

Where permitted by law on or after September 22, 2024, in certain circumstances you will have the right to request that certain of your personal information be provided to you, or to another data controller, in a structured, commonly used, machine-readable technological format. To do so, you may contact our Privacy Officer at the contact details provided in Article 13.

8.7.   Complaint

If you are of the opinion that your rights to the protection of personal information may have been infringed, you have the right to file a complaint with the Commission d’accès à l’information, the Privacy Commissioner of Canada or any other applicable supervisory authority or to have recourse to the courts. You may contact our Privacy Officer at the contact details provided in Article 13. Our Privacy Officer may inform you how to contact such authority.

8.8.   Dissatisfaction with the management of your personal information

If you have any questions, concerns or dissatisfaction with this Policy or with the management of your personal information, you may contact our Privacy Officer at the coordinates provided in Article 13. We are committed to settle your dissatisfaction in the best way possible for both parties.

9.   CONFIDENTIALITY INCIDENT

DAAB takes seriously any breach or attempted breach of confidentiality obligations, whether potential or actual. For the purposes of this Policy, a “Confidentiality Incident” means any unauthorized access, use or disclosure of personal information as well as the loss of personal information or any breach of the protection of such information. Any Confidentiality Incident is taken seriously and communicated to the appropriate supervisory authorities and persons as provided for in Privacy Laws. The Privacy Officer will call on the appropriate higher authorities to help resolve the problem.

The people concerned may raise their concerns about the collection, use, disclosure, retention or destruction of their personal information directly to our Privacy Officer at the coordinates provided in Article 13.

10.   COOKIES WE USE

• A first party Cookie used to track your acceptance of our policies.
• By continuing to use this website, you agree to our Terms and Conditions.

11.   COOKIES USED BY OUR SERVICE PROVIDERS

Our service providers use Cookies which may be stored on your computer or device when you navigate our Website.

We use Google Analytics as the service use analysis tool. Google Analytics uses Cookies to collect information about Website use. Information collected is used to make reports about the use of our Website. The Google Analytics protection of privacy policy may be accessed at the following address: https://policies.google.com/technologies/partner-sites?hl=en.

More information on Google Analytics can be found here:

https://support.google.com/analytics/topic/2919631?hl=en&ref_topic=1008008, and more information about the use of Cookies by the advertising features of Google Analytics can be found here: https://policies.google.com/technologies/ads?hl=en&ref_topic=6089781&visit_id=637025130290950161-2203276537&rd=1.

12.   MANAGEMENT OF COOKIES

External Sources of Information Regarding Cookies

You may block receipt of third-party Cookies used to send you personalized publicity based on your interests by logging onto the following websites: www.aboutads.info/choices/ or https://www.networkadvertising.org/choices/.

Using Your Browser

Most browsers allow you to refuse to receive Cookies and to delete them. Each browser and each version operate differently. Please refer to the browser you use on how it allows you to manage Cookies.

13.   HOW TO CONTACT OUR PERSON IN CHARGE OF THE PROTECTION OF PERSONAL INFORMATION?

The protection of your personal information is important to us. We have appointed a Privacy Officer who oversees compliance with and implementation of applicable Privacy Laws. You can reach him using the following contact details:

Privacy Officer – DAA Brands Company
1090-1092 Rue Des Forges
Terrebonne, QC J6Y 0P6, Canada

Phone number: 450-965-3222
Email: contact@daabrands.com

14.   APPLICABLE LAW AND JURISDICTION

This Policy shall be governed under and interpreted in compliance with the applicable laws of the province of Quebec and Canada, without taking into consideration the principles of conflict of laws and notwithstanding your domicile, your residence or your physical location.

Any legal proceedings or procedures resulting from this Policy or concerning it and/or these Terms of Use shall be undertaken before the courts of the province of Quebec, in the judicial district of Terrebonne and/or in the Federal Court of Canada and each party irrevocably submits to the exclusive jurisdiction of these courts for any such type of proceedings or procedure. You waive any objection to the exercise of jurisdiction over you by these courts and to their jurisdiction.

15.   POLICY UPDATE

This Policy takes effect on the date mentioned at the top of the page and replaces all previous versions. The history of previous versions of the Policy can be obtained by request to our Privacy Officer. The collection, use, disclosure, and any other processing of your personal information by DAAB are governed pursuant to the version of the Policy which is in force at that time.

The Policy may be updated at our sole discretion based on changes in our practices and Privacy Laws. When the Policy is updated, the changes will be specifically brought to your attention and a notice will be available on the home page of our Website. When the changes are of a material nature or require your consent, we will notify you by email if we have your email address.

* * *