PRIVACY POLICY

Last modified: 2024-03-28

1. INTRODUCTION

LUFA FARMS INC. and our affiliates and subsidiaries (“Company” or “We” or “our”) respect your privacy and are committed to protecting it by complying with this policy (our “Policy”).

This Policy describes:

• How we use, collect, hold, and disclose the personal information of our customers, suppliers, subcontractors, employees, applicants for employment, and website users (“you”).
• Our policies and practices regarding the governance of personal information, including the framework applicable to the retention and destruction of such information, the roles and responsibilities of our employees throughout the life cycle of such information, and our process for handling privacy complaints;
• The types of information we may collect from you or that you may provide when you visit the website montreal.lufa.com and its sub-domains (our “Website”).

We will only use your personal information in accordance with this Policy, unless otherwise required by applicable law.

2. PERSONAL INFORMATION

The term “personal information” refers to any information which relates to a natural person and makes it possible, directly or indirectly, to identify that person. It should be noted that our Policy does not generally apply to the collection and confidentiality of information related to an individual’s performance of his or her duties within an organization, such as name, title, or position, as well as the address, email address, and telephone number associated with his or her place of employment, but we handle such information at all times in strict compliance with applicable law. During your relationship with the Company, you may be asked to provide certain personal information concerning you and/or other individuals.

3. PURPOSES FOR WHICH WE COLLECT PERSONAL INFORMATION

The Company uses, collects, holds, and communicates personal information for the purposes identified at the time of collection, or as otherwise permitted or required by applicable law, including for the following purposes:

• To provide services, products, and other related services, and to process payments, shipping, and billing for them;
• To establish and manage client and service provider relationships, including considering whether to establish a relationship;
• To reply to information enquiries made through the Website and ensure appropriate follow-ups;
• To send updates on our services or products and those of our affiliates, when applicable;
• To manage our human resources;
• Administrative, management, and business purposes, such as to issue invoices, administer accounts, sales, collect and process payments; and
• Any other purpose for which you have consented.

INFORMATION ABOUT EMPLOYEES AND JOB APPLICANTS

In the course of its activities as an employer, the Company collects, uses, and discloses personal information. For our employees, this collection falls within the essential management of labour relations. As for job applicants, their information is collected and used to assess their suitability for available positions, which may involve information obtained from third parties for background checks or professional references. If an applicant is not selected, his or her information is retained for a reasonable period of time for future opportunities, if applicable, unless a request for deletion is made. In addition, we maintain certain personal information on our former employees, including their names and contact details, for possible professional or regulatory requirements.

4. LIMITATION

The Company aims to limit the amount of personal information we collect to that necessary and appropriate for the identified purposes. We will not use or communicate your personal information for purposes other than those for which it was collected, except with your consent or as permitted or required by applicable law.

5. CONSENT

We use, hold, and communicate personal information only for the purposes for which it was collected, except with the consent of the person concerned. If personal information about a third party is provided to us, the person providing the information must represent having obtained the necessary consent from that third party, or be otherwise authorized to allow us to collect, use, hold, and communicate that information in accordance with this Policy. In the case of sensitive personal information, consent must be expressly provided by the individual concerned. Exceptions to this consent requirement may arise, for example, when a medical or security emergency makes it impractical to obtain consent, or when information is collected for the detection and prevention of fraud or to meet a legal obligation. For a more exhaustive list of exceptions, please contact our Privacy Officer (identified below).

6. WITHDRAWAL OF CONSENT

You may vary or withdraw your consent to the use and communication of your personal information, or opt out of certain uses and communications, subject to legal and contractual restrictions. To modify or withdraw your consent, please contact our Privacy Officer (identified below).

7. INFORMATION WE COULD COLLECT ABOUT YOU

We could collect and use several types of information from and about you, including:

• Personal information such as name, physical address, email address, social media profiles, payment information, IP address, and telephone number;
• For job applicants, work history and curriculum vitae;
• Biographical information such as job titles, name of employer;
• Personal information that you provide to us to describe you or your business needs and requirements;
• Website usage and other technical information such as details of visits to our Website or information collected through cookies, your interaction with our online advertising and content, and other tracking technologies; and
• Any other personal information provided by you.

8. HOW WE COLLECT PERSONAL INFORMATION ABOUT YOU

We use different methods to collect your personal information, including through:

• Direct interactions with you when you provide it to us, for example, by filling in forms or corresponding with us by phone, email, when you register to receive our newsletter, or otherwise (if we have sent you a promotional email such as a newsletter, you may unsubscribe by clicking the unsubscribe link we have included in the email);
• Automated technologies or interactions, as you navigate through our Website. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies;
• Third parties whom you have authorized to communicate such information to us; and
• Publicly available sources.

10. COOKIES

Cookies are small text files which a website may put on your computer or mobile device when you first visit a site or page. Cookies do not cause any damage to the terminal, but make it easier, for example, to find preferences, pre-fill certain fields, and adapt the content of the services on the site visited. Such data allows the improvement of ergonomics and services, according to your interests.

We use the following types of cookies on our Website:

• Functional cookies. Functional cookies are used to remember the selections you make while on our site in order for your selections to be saved for your next visit, for example the language of the Website.
• Analytical cookies. Analytical cookies allow us to improve the design and functionality of our Website by collecting data on how you access our Website, data on how long you stay on our Website, etc.

If you have any concerns about our use of cookies, you can take action to prevent them from being set, such as by changing your browser settings to block certain types of cookies. You may also delete cookies held on your device at any time by going to the appropriate settings within your web browser. You have the option to configure your devices to accept all cookies, to notify you when a cookie is issued or to never accept cookies. However, the latter option may result in some personalized services not being provided and, as a result, you may not be able to take full advantage of all the features offered by the Website. If you do not wish to receive cookies in general or only to refuse certain cookies, you can change your browser settings accordingly. Visit the website of your web browser provider (for example, visit Google’s website for Google Chrome, or Microsoft’s website for Microsoft Edge) to learn how to manage your cookies preferences.

11. EXTERNAL LINKS

Our Website may occasionally contain links to and from the websites of our partner networks, advertisers, and affiliates. If you follow a link to one of these websites, please note that these websites are governed by their own privacy policies and that we are not responsible for these policies. Please check these policies before submitting any personal data to these websites.

12. HOW WE USE YOUR INFORMATION

We use the personal information that we collect about you or that you provide to us:

• To provide our services, products, and other related services, to conduct our business, for payment and billing processing, for shipping, to administer and perform our services, including to carry out our obligations arising from any agreements entered into between you and us;
• To create your account, to manage it, and to manage your orders;
• In the case of job applicants, to contact the applicant and assess whether we will hire them;
• To respond to requests for information or enquiries from visitors to our Website;
• To assess whether we will retain your services and to keep in touch with you if necessary;
• To facilitate the use of our Website and to ensure content from our Website is presented in the most effective manner for you and your device;
• For marketing and business development purposes – to provide details of new services or products, updates, or newsletters when an individual has chosen to receive these. You may require that we stop doing any of the foregoing at any time; and
• To fulfill our legal, regulatory, or risk management obligations – to comply with our legal obligations.

13. COMMUNICATION OF YOUR INFORMATION

We may communicate personal information that we collect or that you provide us as described in this Policy:

• To third parties in the context of legal proceedings, contractors, service providers, and other third parties we use to support the performance of our services (such as administrative service providers) and who are contractually obligated to keep personal information confidential, use it only for the purposes for which we disclose it to them, and to process the personal information with the same standards set out in this Policy;
• To fulfill the purpose for which you provided the personal information;
• For any other purpose disclosed by us when you provided the personal information; With your consent; and
• To comply with any court order, law, or legal process, including to respond to any government or regulatory request, in accordance with applicable law.

The Company does not sell or lease any personal information it holds.

14. THIRD-PARTY SERVICE PROVIDERS

To the extent the Company employs third-party service providers to store, handle, or process personal information on our behalf (such as to store and process data, cloud computing), we use contractual and other means to provide a comparable level of protection while the information is being stored, handled, or processed by those service providers.

Our service providers are committed by contractual agreements with us to protect your personal information from unauthorized access, collection, use, or communication. We limit the personal information we disclose to them to what is reasonably necessary for the performance of their duties and only for the purposes for which we are authorized.

15. TARGETED ADVERTISING

In order to provide you with targeted advertising or marketing communications that may be of interest to you, we use and share with our advertising partners certain personal information relating to your use of the Website, your purchases, and your interaction with our advertisements on other websites. We collect and share some of this personal information directly with our advertising partners and, in some cases, through the use of cookies or other similar technologies.

By accessing our Website, you consent to this collection, use, and disclosure of your personal information, therefore, to exercise your rights or opt out of certain uses or disclosures by these advertising partners, you must opt out of these services directly with these third parties by following the instructions below.

We use Google Analytics to help us understand how our customers use the Website. To learn more about how Google uses your personal information, click here.

We also use applications from Meta Platforms, Inc., X Corp., Linkedin Corporation (Microsoft), and Bytedance (TikTok) to help us understand how our customers interact with social media and to contact them on these platforms, where applicable. You may also object to targeted advertising by following the procedures provided at the following links, however we are not responsible for any failure by these companies to respect or comply with your request:

META - https://www.facebook.com/settings/?tab=ads

X - https://twitter.com/en/privacy

GOOGLE - https://www.google.com/settings/ads/anonymous

LINKEDIN - https://www.linkedin.com/legal/privacy-policy

TIKTOK - https://www.tiktok.com/privacy/ads-and-your-data/en

In addition, you can opt out of some of these services by visiting the Digital Advertising Alliance’s opt-out portal at http://optout.aboutads.info/.

16. COMMUNICATION OUTSIDE OF QUEBEC OR CANADA

When personal information is located outside of Canada, it may be accessible by foreign governments, courts, and other governmental authorities, if required by law or court order. We will only communicate or transfer personal information outside Canada in compliance with applicable Canadian laws and for lawful purposes.

When we communicate personal information outside Quebec, and sometimes outside Canada, we do so only for the purpose of providing the services, or to support our business so that we can offer our services reasonably efficiently and at commercially reasonable costs.

Before communicating personal information outside Quebec, we conduct a privacy impact assessment in accordance with applicable Quebec law. This assessment takes into account: (i) the sensitivity of the information; (ii) the purpose for which it is to be used; (iii) the safeguards, including contractual safeguards, from which the information would benefit; and (iv) the legal regime applicable in the jurisdiction to which the information would be communicated, including generally accepted privacy principles applicable therein. Personal information is only communicated if the assessment demonstrates that it would benefit from adequate protection. If you would like more information about the service providers that we use and to whom personal information is communicated outside Quebec, please contact our Privacy Officer (identified below). We confirm that we may, strictly in accordance with this Policy, communicate your personal information outside Quebec or Canada to third parties we retain to provide us with services involving the use, communication, or retention of your personal information on our behalf. You consent to any such communication, use, or retention.

17. FOREIGN LAWS AND RESTRICTIONS

The Company is established and operates under the laws of the Province of Quebec, Canada. Privacy laws may differ depending on your jurisdiction of residence. If you reside or are established outside the province of Quebec, you are responsible for ensuring that the transmission of your personal information to the Company is permitted by the local or national laws applicable to you. By transmitting your personal information to the Company, you acknowledge and agree that such information will be subject to the laws of the Province of Quebec, Canada, and that the Company cannot be held responsible for non-compliance with the privacy laws of your jurisdiction.

18. PERSONAL INFORMATION GOVERNANCE POLICIES AND PRACTICES AND INFORMATION SECURITY

Our commitment to your privacy. We take the security and responsible management of your personal information very seriously. Our privacy governance policies have been formally approved by our Privacy Officer. These policies and practices are designed to match the scope and complexity of our various business activities. The following subsections provide detailed information, in simple and clear terms, to inform you about our personal information governance policies and practices.

Data life cycle management. Our policies cover the entire life cycle of your personal information. We retain your personal information only as long as necessary to fulfill the purposes for which it was originally collected, except as otherwise permitted or required by applicable law or regulation, such as tax laws. Once personal information has served its purpose, we ensure its secure and responsible destruction or anonymization, following strict guidelines.

Responsibilities of employees and service providers. Within our organizational structure, roles and responsibilities regarding the handling and management of personal information are clearly defined for our employees. All employees undergo regular training and are held accountable for compliance with our privacy standards. As far as service providers are concerned, we establish contractual relationships exclusively with entities that undertake to respect industry-standard security measures and comply with the law. These agreements have been carefully reviewed to ensure that they comply with applicable laws and the principles set out in this Policy.

Security and compliance assessments. To ensure ongoing compliance with our policies and practices, we conduct periodic internal assessments. These assessments examine how personal information is collected, stored, processed, and disposed of, and involve a thorough review of our processes and procedures. The assessments help us to determine the effectiveness of our existing security measures and to propose ongoing improvements.

Complaints handling. In keeping with our commitment to the protection of personal information, we have established a formal process for receiving, investigating, and resolving any complaints about the safeguarding of your personal information.

Security measures. To protect your personal information, we use a multi-layered security approach that includes physical, electronic, and administrative measures to prevent unauthorized access, use, alteration, or disclosure of your personal information.

While these policies and measures are aligned with generally recommended practices, it is important to recognize that the absolute security of your personal information when transmitted online or when using online services cannot be unconditionally guaranteed. Such transmissions are therefore at your own risk.

We strive to present this Policy in a simple and easily understandable manner, to ensure that you are fully informed of how we treat your personal information.

19. DATA RETENTION

Except as otherwise permitted or required by applicable law or regulation, we will only retain your personal information for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Under some circumstances we may anonymize your personal information so that it can no longer be associated with you. We reserve the right to use such anonymous and de-identified data for any legitimate business purpose without further notice to you or your consent. We further inform you that we will retain your personal information after you request deletion of your account for as long as we need it to fulfill the purposes for which it was collected, as set out in this privacy Policy. We may need to retain certain personal information for longer periods, for example for record keeping or reporting purposes in accordance with applicable legislation or for other legitimate reasons, such as the enforcement of legal rights, accounting, tax reporting, fraud prevention, etc.

20. PRIVACY OFFICER

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes. By law you have the right to request access to and to correct the personal information that we hold about you.

If you want to review, verify, correct, or withdraw consent to the use of your personal information, you may send us an email at the email address of the Privacy Officer to request access to, correct, or delete any personal information that you have provided to us.

Privacy Officer

Lionel Trombert

l.trombert@lufa.com

514-669-3559, ext.137

We may not accommodate a request if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

21. CHANGES TO OUR PRIVACY POLICY

Privacy laws are rapidly evolving and, as a result, this Policy may be changed by the Company from time to time in the Company’s full discretion without any prior notice or liability to you or any other person. The collection, use, and disclosure of your personal information by the Company will be governed by the version of this Policy in effect at that time. If we are authorized to communicate with you for this purpose, we reserve the right to notify you by email or any other means of communication to which we are authorized, of any material changes to this Policy. This communication will be made in addition to updating the last modification date displayed at the top of this page.

22. COMPLAINTS

The Company will respond to complaints from individuals or questions about our compliance with this Policy and with applicable privacy laws. We will investigate and attempt to resolve all complaints. To challenge our compliance with this Policy please contact our Privacy Officer at the coordinates listed above.