Privacy Statement (CA)

1. Person in Charge of Processing

This privacy policy applies to the website operated by JS Daoust (referred to in this policy as "we," "us," or "our"). We are subject to Quebec Law 25 — formally known as An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25) — which governs how we collect, use, disclose, and retain personal information about visitors and customers who interact with our website.

By using our website, you acknowledge that your personal information may be collected and processed in accordance with this policy. We are committed to handling your personal information responsibly and transparently.

2. Personal Information Collected

We collect personal information about you in the following categories, depending on how you interact with our website:

• Identification and contact information: Information you provide directly through forms on our website, such as your name, email address, and phone number.
• Device and technical identifiers: Device identifiers, IP address, browser type, and operating system, collected automatically when you visit our site.
• Browsing behavior: Pages visited, session duration, navigation patterns, and approximate geographic location, collected through analytics and session-recording tools.
• Advertising identifiers: Advertising and social identifiers used to measure the effectiveness of our marketing campaigns and to serve you relevant ads on third-party platforms.
• Consent preferences: Your cookie consent choices, stored locally in your browser to remember your preferences across visits.
• Form and communication data: Any information you submit through contact or inquiry forms on our website, including messages and transaction-related details if applicable.

We do not knowingly collect sensitive personal information such as health data, financial account numbers, or government-issued identification numbers through this website.

3. Purposes of Processing

We collect and use your personal information only for the purposes described below. Where we rely on your consent, you may withdraw it at any time (see Section 7).

• Website operation and consent management (Essential — Legal basis: legitimate interest and legal obligation): We use Moelleux (operated by Horizon-Cumulus, 9322-8310 Québec inc., Joliette, Quebec) to manage your cookie consent choices and to host this privacy policy. A preference cookie named moelleux_{site_key} is stored in your browser for up to 13 months to remember your selections. Consent records and this policy are hosted in Quebec (OVH, Beauharnois). This processing is necessary to comply with Quebec Law 25 and cannot be disabled.
• Audience measurement and site performance (Analytics — Legal basis: consent): We use Google Analytics 4 (Google LLC, United States) to measure how visitors use our website — including pages visited, session duration, and approximate location — so we can improve our content and user experience. We also use Hotjar (Hotjar Ltd., United States) to record anonymized user sessions and generate heatmaps that help us understand how visitors interact with our pages. Both services are activated only with your consent.
• Marketing and advertising (Marketing — Legal basis: consent): We use the Meta Pixel (Facebook) (Meta Platforms, Inc., United States) to track conversions on our website and to enable retargeting — meaning we may show you relevant ads on Facebook and Instagram based on your visit. We also use HubSpot (HubSpot, Inc., United States) to track leads and manage marketing follow-up. These tools are activated only with your consent.
• Responding to your inquiries (Contact forms — Legal basis: consent or legitimate interest): When you submit a form on our website, we use the information you provide solely to respond to your request or inquiry.

4. Third Parties and Processors

The following third-party services are active on our website. Each acts as a processor handling personal information on our behalf or in conjunction with our operations.

We do not sell your personal information to any third party. We share personal information with the processors listed above only to the extent necessary to fulfill the purposes described in Section 3.

Our website is hosted by Horizon-Cumulus (Joliette, Quebec). Website hosting infrastructure is operated entirely within Quebec. For business email, we use Microsoft 365 (Microsoft Corporation, United States), which means email communications may be processed on servers located in the United States. We also use Horizon-Cumulus Email for certain business communications, which is operated in Quebec.

5. Transfers Outside Quebec

Several of the third-party services we use transfer personal information outside Quebec — specifically to the United States. Under Quebec Law 25 (section 17), we are required to inform you of these transfers and to ensure that personal information transferred outside Quebec receives a level of protection equivalent to what Quebec law requires.

The following services involve transfers of personal information to the United States:

• Google Analytics 4 (Google LLC, United States) — device identifiers, IP address, browsing behavior, and approximate location may be processed on Google's servers in the United States.
• Hotjar (Hotjar Ltd., United States) — device identifiers, IP address, session recordings, and navigation behavior may be processed on Hotjar's servers in the United States.
• Meta Pixel (Facebook) (Meta Platforms, Inc., United States) — device identifiers, IP address, advertising identifiers, and pages visited may be processed by Meta in the United States.
• HubSpot (HubSpot, Inc., United States) — device identifiers, IP address, form data, and communication data may be processed on HubSpot's servers in the United States.
• Microsoft 365 (Microsoft Corporation, United States) — email communications sent to or from our business address may be processed in the United States.

Before transferring personal information outside Quebec, we conduct or rely upon a Privacy Impact Assessment (PIA) — known in French as an évaluation des facteurs relatifs à la vie privée (EFVP) — to confirm that the receiving jurisdiction offers adequate protection. Each of the U.S.-based processors listed above operates under standard contractual clauses, data processing agreements, or equivalent safeguards consistent with the requirements of Quebec Law 25.

Our website hosting and consent management infrastructure remain entirely within Quebec, operated by Horizon-Cumulus (Joliette, Quebec).

6. Retention Period

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. The following table summarizes our retention practices:

When personal information is no longer needed, we destroy, delete, or anonymize it in a secure manner.

7. Rights of Data Subjects

Under Quebec Law 25, you have the following rights with respect to your personal information. To exercise any of these rights, please contact our Person responsible for the protection of personal information (see Section 8).

• Right of access: You may request a copy of the personal information we hold about you, along with information about how it is used and with whom it has been shared.
• Right of rectification: If any personal information we hold about you is inaccurate, incomplete, or ambiguous, you may ask us to correct it.
• Right of erasure (right to be forgotten): You may request that we delete personal information about you when it is no longer necessary for the purposes for which it was collected, or when you have withdrawn your consent and there is no other legal basis for retaining it.
• Right to data portability: You may request that we provide your personal information in a structured, commonly used, and technology-readable format so that you can transfer it to another organization, where technically feasible.
• Right to withdraw consent: Where we process your personal information based on your consent (for example, analytics cookies or marketing tools), you may withdraw that consent at any time by updating your preferences through our cookie consent banner or by contacting us directly. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

We will respond to your request within 30 days of receipt, as required by Quebec Law 25. In complex cases, we may extend this period and will notify you accordingly.

If you are not satisfied with our response, or if you believe we have not handled your personal information in compliance with Quebec Law 25, you have the right to file a complaint with the Quebec Information Access Commission (CAI) at https://www.cai.gouv.qc.ca.

8. Person Responsible for the Protection of Personal Information

In accordance with section 8.1 of Quebec Law 25, we have designated a Person responsible for the protection of personal information who oversees our compliance with Quebec's privacy requirements and handles requests and complaints related to personal information.

• Name: Martin Prudhomme
• Title / Role: --
• Email: info@jsdaoust.com
• Phone: (450) 691-3000

You may contact our Person responsible for the protection of personal information at any time to exercise your rights, ask questions about this policy, or raise a concern about how your personal information is handled. We will acknowledge your request promptly and provide a full response within 30 days, as required by Quebec Law 25.

9. Effective Date and Versioning

This privacy policy takes effect on 18 juin 2026 and replaces any prior version.

Current version: 1

We may update this policy from time to time to reflect changes in our practices, the services we use, or applicable law. When we make material changes, we will update the effective date above and, where appropriate, notify you through our website. We encourage you to review this policy periodically.