Privacy Policy - Protection of Personal Data

# Privacy Policy – Protection of Personal Data

Our personal data protection policy is designed to build a relationship of trust between you and our services, in order to offer you a positive experience in a fully transparent manner.

Through this policy, we are able to take your requirements into account and meet your expectations.

In order to honour your trust, soiflex guarantees, as a matter of priority, respect for your personal data as well as the confidentiality of our customers (hereinafter "Your Data").

For complete transparency towards you, and to guarantee you a secure use of our website soiflex.com in all its available versions and related applications (hereinafter the "soiflex Site"), we make available to you the way in which we process your data, so that our services always remain consistent with respect for your rights. In this way, we ensure the security, confidentiality and integrity of your privacy and your data across all of our platforms.

Our policy and we ourselves guarantee that all necessary precautions are taken to protect all of your data against disclosure, loss or alteration. This is why we provide you with all the elements enabling you to easily understand how we process your data. This data will only be kept for the time necessary for the specified management and processing purposes. You may, of course, access and modify your data at any time, as it will be available in your personal account areas on the soiflex site.

To this end, we endeavour to take all necessary steps to comply with the applicable law on data protection.

Accordingly, the undersigned soiflex hereby undertakes, through this personal data protection policy, to comply with the essential principles of the European General Regulation and of French law on personal data protection, by providing you with information concerning the existence and terms of the data processing applied here (paragraph 3), the rights you have regarding your data, as well as by applying these rights ourselves (paragraphs 6 and 10). All information relating to possible transfers to a third country or to recipients is also made available, as well as the retention period of the data collected (paragraph 5) and the security measures (paragraph 9).

## WHO ARE YOU?

When we refer to "you" in this Personal Data Protection Policy, it is simply because it is directly related to you and concerns you as a customer of soiflex if you have placed an order on the soiflex.com site; as a customer of soiflex if you have created a customer account but have not ordered any products or services; or if you have browsed the soiflex.com site as a visitor without having created a customer account or placed an order.

## WHO ARE WE?

soiflex is an LTD, registered under number 2280866494, represented by Sandra Auger, in her capacity as Chief Executive Officer, and whose registered office is located at 117 de la Renaissance, Sainte-Sophie, Québec, Canada.

soiflex publishes the soiflex.com Site and, in this capacity, carries out various processing operations on your Data as data controller.

## FOR WHAT PURPOSES DO WE PROCESS YOUR DATA?

### 3.1. When do we collect your personal data?

Your personal data may be collected if you visit the soiflex.com site using cookies, if you create a customer account on the soiflex.com site, if you place an order for one of our products or services, or if you have agreed to subscribe to our newsletters (SMS, emails).

Your personal data is used to make your browsing on the soiflex.com site smoother and to offer you a more personalized experience. It enables us to process your orders as efficiently as possible, offer payment in instalments, prevent fraud, carry out any necessary refunds, and manage your customer reviews.

### 3.2. Your browsing on the soiflex.com Site

In order to enable you to browse the soiflex.com site, we process your data, with your consent as the legal basis for doing so.

### 3.3. Processing of your orders

In order to handle and process your orders, we use your data.

We use it to manage mediation, customer relations (including via social media), our after-sales and distance-selling services, our marketing and commercial prospecting activities for the soiflex.com site, as well as for the management, delivery and transport of orders.

The performance of the contract between the two parties (you and us) is the legal basis for the processing of this data.

soiflex's legal obligation is the legal basis for processing with regard to the management of product recalls. Your consent or our legitimate interest is, depending on the case, the legal basis for processing for marketing and commercial prospecting activities. Your consent is the legal basis for the implementation of "flash" payment.

### 3.4. Payment in instalments

For orders eligible for payment in instalments and for certain customers, your data is processed in order to offer you this type of payment. The performance of the contract between the two parties is the legal basis for the processing of the data. However, your consent remains the basis for the processing of your banking data.

#### 3.4.1 Klarna

In order to offer you Klarna's payment options, we may transmit to Klarna your personal data, including your contact details and the details of your order, so that Klarna can assess whether you meet the conditions required to benefit from them and adapt these options to your needs. Your transferred personal data will be processed in accordance with Klarna's privacy policy.

### 3.5. Customer reviews

In order to share your reviews with our customers and visitors, and to allow you to leave your review on the soiflex.com site, we use your data on the legal basis of your consent or legitimate interest.

### 3.6. Payment collection and fraud prevention

In order to enable the collection of payments and the fight against fraud, we use your data.

This also enables us to guarantee the security of payments.

The performance of this contract between the two parties, as well as the legitimate interest of soiflex, in its capacity as data controller, are the legal bases for this processing.

### 3.7. Management of soiflex's advertising operations

soiflex's advertising operations are managed through the use of your data.

This allows us to grow our customer and prospect data; to manage the maintenance and technical activities relating to prospects, commercial statistics and advertising campaign studies; to update the prospecting files of the organization in charge of managing objections to telephone canvassing; to manage solicitations; and to set up our contests and prize draws or any other promotional operation, excluding online gambling and games of chance.

The legal bases for the above are the user's consent or the legitimate interest of soiflex.

## WHERE DOES YOUR DATA GO?

Your data is transmitted to several internal departments of soiflex.

It is not sent to third parties, except in the situations specified below:

In order to process your orders, your personal data may be transmitted to several service providers specializing in banking transactions, customer relations, after-sales service, delivery, IT development, site management, or the provision of warranties or insurance.

For the implementation of payment in instalments, your data may be shared with service providers such as payment and transaction centres (banks, etc.), or call centres for the management of business processes or customer experience, or, for customer reviews, with a provider responsible for collecting and processing customer reviews.

soiflex's advertising operations are, for their part, managed, through your data, with the advertising department's clients and advertisers.

## DATA RETENTION

The data collected by soiflex is kept only for the time and purposes necessary for the implementation and completion of the operations set out in paragraph 3 of our personal data policy.

We retain certain data collected by soiflex for a certain period of time:

In active archives for prospects, for 3 years from the customer's last contact (they can therefore be consulted by soiflex's departments). We do not carry out intermediate archiving of this data (with regard to data of administrative interest for certain departments, such as litigation, the retention periods are set by the applicable limitation rules).

Concerning our orders, your data will be archived in active archives for 5 years from the end of the customer's use of the orders, and in intermediate archives for 5 years from the end of retention in active archives. The same applies to customers.

With regard to banking data, it is archived in active archives for the entire validity period of the bank card (plus one day). No intermediate archiving is carried out for banking data.

Cookies, their use and their retention periods are detailed in paragraph 7 of our policy.

## EXERCISING YOUR RIGHTS

### 6.1.
You have the right to request access to, modification of, and rectification of your Data.

### 6.2.
You have the right to request the restriction of the processing of your Data.

Important clarification: to do so, you must contest the accuracy of your personal data during the time required for us to verify its accuracy. Alternatively, where you consider that our use of your personal data is unlawful and you request a restriction of its use rather than its erasure; where we no longer need to use your data for the purposes set out in paragraph 3 but your data is still needed for the establishment, exercise or defence of your legal claims; or where you decide to exercise your right to object, during the time required for verification in order to determine whether the legitimate grounds we pursue prevail over yours.

### 6.3.
You have the right to request the erasure of your Data.

If you require the erasure of your personal data, soiflex will nevertheless be able to keep it in intermediate archive format for the time necessary to satisfy its legal, accounting and tax obligations.

### 6.4.
You have the right to exercise your right to object to processing carried out for commercial prospecting purposes.

In the case of prospecting by email, you have the right to request modification or unsubscription from the newsletters by clicking on the "unsubscribe" hyperlink available in all newsletters, or by going directly to the contact page of the soiflex site.

In the case of prospecting by SMS, you can unsubscribe by sending the words "STOP SMS" by SMS to 36007, or by going to the contact page of the soiflex site.

### 6.5.
You have the right to issue post-mortem directives concerning the retention, erasure and communication of your personal data.

In the absence of such directives, your successors and heirs may contact soiflex in order to gain access to the uses of this data and to allow the "organization and settlement of the deceased's estate" and/or to close the account on the site and/or to request that the processing of personal data be discontinued.

You may also request that your data not be communicated to a third party in the event of your death.

### 6.6.
You have the right to exercise your right to data portability.

### 6.7.
You have the right to withdraw your consent regarding processing carried out on this legal basis.

Important clarification: If you decide to withdraw your consent, this will not affect the lawfulness of the uses carried out before your withdrawal of consent.

### 6.8.
You have the right, at any time, to lodge a complaint with the competent supervisory authority (in France, the CNIL: www.cnil.fr).

In order to exercise your rights, please send your request (accompanied by your email, surname, first name, a copy of your identity document and postal address) to soiflex's data protection office by email at contact@soiflex.com and/or by post to soiflex, 117 de la Renaissance, Sainte-Sophie, Québec, Canada J5J 0J8.

We will send you a response within a maximum of one (1) month from the date of receipt of the request.

## COOKIES

### 7.1. What is a cookie?

When you browse a website such as the soiflex site, the site may, depending on your choice, place a text file on your device (computer, phone or tablet) via your browser.

This text file is called a COOKIE. This cookie then allows the website, such as soiflex.com, during the prescribed validity or storage period of the cookie, to identify the device you used when you make another visit.

Only the issuer of a cookie is able to read or modify the information contained in that cookie.

### 7.2. What are cookies used for on soiflex?

Different types of cookies can be classified into categories. Some are issued directly by soiflex and its service providers, but some sometimes come from third-party companies.

#### 7.2.1. Cookies issued by soiflex and its service providers

There are several categories of cookies that may be found on your device when you browse our website:

##### 7.2.1.1. "Essential" cookies

"Essential" cookies are necessary in order to access our site; they are used, for example, to enable you to place an order.

Without them, you might experience browsing problems on the site and be unable to place an order.

"Essential" cookies also allow soiflex to monitor its activity.

They may be placed on your device by soiflex or by its service providers.

##### 7.2.1.2. "Analytics and Personalization" cookies

"Analytics and personalization" cookies are not mandatory; they enable us to facilitate your searches and optimize your experience with us. Thanks to them, we can better target your expectations, adapt our offers and maximize the organization of our site.

##### 7.2.1.3. "Advertising" cookies

Advertising cookies are displayed in the spaces reserved for advertising on our site. The benefit for you is that your browsing time is improved and optimized through the presentation of offers and advertisements that are relevant to you.

To this end, "advertising" cookies target your expectations in real time and offer you advertising content adapted to your current wishes and interests, based on your recent browsing history on other sites.

This avoids presenting you with advertising content that is of no interest to you. At the same time, soiflex prefers to see its offers and advertisements presented to users who will be interested in them.

The advertising content offered may contain cookies issued by soiflex or by its service providers, or by third parties through the association of a cookie with an advertiser's advertising content.

#### 7.2.2. Cookies issued by third-party companies

Third parties using cookies on our site apply their own privacy protection policies. These cookies are not necessary for the use of our site.

#### 7.2.3. Cookies issued by third-party applications integrated into our site

While you browse our site, we may include third-party computer applications, in order to give you the opportunity to share content and/or your opinion from our site with other people, for example when you click on the "share" or "like" buttons from social networks.

These social networks may then identify you through these buttons even if you did not use them while browsing the site. They are able to do this if, during your last visit to the site, you were simultaneously logged in or active on your social network on your device. We have no control over the uses they make of this, nor over the data they hold.

To find out more about the use of your data and advertising content, you can visit your social networks and consult their personal data protection policies. These policies should then enable you to manage your settings according to your preferences on the user accounts of each of the social networks on which you are registered.

Privacy protection policies of the aforementioned social networks — click on the social network of your choice:

- Facebook: https://www.facebook.com/privacy/policy
- Twitter: https://twitter.com/en/tos
- Google: https://policies.google.com/terms?hl=en

Concerning our advertising operations, we remind you, as mentioned above, that all our advertising spaces may contain cookies from third parties (the advertiser behind the advertisement displayed, the advertiser's third-party service providers, etc.).

With these cookies, and during their prescribed validity period, they can therefore display advertisements in the spaces made available for third-party advertising, count the number of pieces of content they display in our spaces, measure the audience of these advertisements and the number of clicks; this enables them to claim the sums owed to them and to compile their statistics. They can also know that your device is one that previously visited another site containing one of their advertisements, and therefore target you and personalize their content where applicable.

### 7.3. The options offered by your browser software (Internet Explorer, Firefox, Google Chrome, etc.)

Your browser software contains numerous options that you can adjust according to your preferences. In this way, you can choose whether or not to accept cookies on your device.

However, if you choose to accept the storage of these cookies on your device, then, when you visit sites or content containing cookies, these will be automatically stored on your device.

Depending on your preferences, you can choose to activate a reminder asking you whether you accept or refuse cookies before they are potentially stored, or to refuse the storage of cookies on your device each time.

However, it is important to point out that the choices you make in these settings may modify or affect your browsing on the Internet or on certain sites or services that require the use of these cookies (such as placing an order on our site, for example).

In the event that you prefer to refuse these cookies on your device or to delete those already stored, we decline all responsibility for the consequences of any impairment in the functioning of our services resulting from the inability of our services to store or access the cookies necessary for their operation.

#### 7.3.1. How to choose your options depending on your browser?

You have different options and choices available depending on your browser. To find out more, you can consult its help menu.

- Microsoft Edge™: https://support.microsoft.com/en-us/windows/manage-cookies-in-microsoft-edge-view-allow-block-delete-and-use-168dab11-0753-043d-7c16-ede5947fc64d
- Safari™: https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac
- Chrome™: https://support.google.com/chrome/answer/95647?hl=en
- Firefox™: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox
- Opera™: https://help.opera.com/en/latest/web-preferences/#cookies

## TRANSFERS OUTSIDE THE EUROPEAN UNION

Most of the time, your data is stored within the European Union.

However, when our service providers are located in countries outside the European Union, we share some of your data with third countries, including third countries for which the European Commission has not carried out an adequacy assessment.

In this case, we take the necessary steps to ensure that this data sharing is carried out in compliance with the relevant regulations and that the protection of your privacy and fundamental rights is guaranteed (for example, through the use of the European Commission's standard contractual clauses).

The data protection office can, upon request, provide you with more information about data transfers.

 

CUSTOMERS LOCATED IN CANADA — QUEBEC AND CANADIAN PRIVACY LAWS

soiflex is established in Québec, Canada. For customers located in Canada, your personal information is collected, used and disclosed in accordance with Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and, where applicable, the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

Your personal information may be communicated outside Québec, in particular to service providers located in the United States or the European Union (such as our hosting provider Shopify Inc. and our payment providers). Before communicating personal information outside Québec, we ensure that it will receive protection equivalent to that required by applicable law, in particular through contractual safeguards.

You have the right to access and rectify your personal information, to withdraw your consent, and to request the cessation of dissemination of your information. The person in charge of the protection of personal information at soiflex can be reached at contact@soiflex.com.

If you are not satisfied with how your request has been handled, you may file a complaint with the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca) or, for customers elsewhere in Canada, with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).

Version française :

CLIENTS SITUÉS AU CANADA — LOIS QUÉBÉCOISES ET CANADIENNES SUR LA VIE PRIVÉE

soiflex est établie au Québec, Canada. Pour les clients situés au Canada, vos renseignements personnels sont recueillis, utilisés et communiqués conformément à la Loi sur la protection des renseignements personnels dans le secteur privé du Québec (modifiée par la Loi 25) et, le cas échéant, à la Loi sur la protection des renseignements personnels et les documents électroniques (LPRPDE) du Canada.

Vos renseignements personnels peuvent être communiqués à l'extérieur du Québec, notamment à des prestataires situés aux États-Unis ou dans l'Union européenne (comme notre hébergeur Shopify Inc. et nos prestataires de paiement). Avant toute communication hors Québec, nous nous assurons que ces renseignements bénéficieront d'une protection équivalente à celle exigée par la loi applicable, notamment par des garanties contractuelles.

Vous avez le droit d'accéder à vos renseignements personnels, de les faire rectifier, de retirer votre consentement et de demander la cessation de leur diffusion. Le responsable de la protection des renseignements personnels de soiflex peut être joint à contact@soiflex.com.

Si vous n'êtes pas satisfait du traitement de votre demande, vous pouvez déposer une plainte auprès de la Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca) ou, pour les clients ailleurs au Canada, auprès du Commissariat à la protection de la vie privée du Canada (www.priv.gc.ca).

## SECURITY MEASURES

Thanks to the technical and organizational measures we take, we can guarantee a level of security appropriate to the risks to the rights and freedoms of natural persons with regard to the points mentioned in point 2. To this end, we take into account the origin, scope, context, costs and state of the art, the purposes of the processing, as well as the identified risks.

In addition, we comply with the Payment Card Industry Data Security Standard (PCI DSS), which reflects our commitment to security.

## PROFILING AND AUTOMATED DECISION-MAKING

Through the automated processing we use (profiling, for example), you are subject to legal effects that affect you.

All of this is essential for the conclusion or performance of the contract between you and us.

This is how we can offer and carry out the automated identification of customers and "payment in 4 instalments". The basis of this operation relates to the analysis of different variables concerning the type of products, the services ordered, or the customer profile.

If the risk is assessed through these statistics as being too high (fraud/non-payment), then this payment method will not be offered.

However, if you wish, you can obtain human intervention even though the decisions are automated; you can thus express your point of view and/or contest the automated decision.

## POLICY UPDATES AND REVISION

Our personal data policy will be updated whenever necessary in order to remain consistent with the regulations applicable to the protection of your data (at least every three (3) years).

All rights reserved – 1 July 2022