1. Person in Charge of Processing

This privacy policy applies to Dispomed Ltée. (hereinafter "we," "us," or "our"), a company subject to Quebec Law 25 (An Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25) and to any other applicable privacy legislation in Canada.

We collect, use, and disclose personal information in the course of operating our website and online store. This policy explains what personal information we collect, why we collect it, with whom we share it, and how you can exercise your rights under Quebec Law 25.

Our website is hosted in Quebec by Horizon-Cumulus (Joliette, Quebec) on OVH infrastructure located in Beauharnois, Quebec. Your consent choices and this privacy policy are managed and stored in Quebec through Moelleux, a consent management platform operated by Horizon-Cumulus (9322-8310 Québec inc.).

2. Personal Information Collected

We collect personal information in several ways depending on how you interact with our website and online store. Below is a summary of the categories of personal information we may collect.

• Identification and contact information: Your name, email address, phone number, billing address, and shipping address — collected when you place an order, create an account, or contact us.
• Transaction and order information: Details about the products you purchase, order history, payment method type (we do not store full card numbers), and invoice data.
• Device and technical identifiers: IP address, browser type, operating system, device identifiers, and cookie identifiers — collected automatically when you visit our site.
• Browsing behavior: Pages visited, session duration, navigation paths, and interactions with our site content — collected through analytics and marketing tools when you consent to those categories.
• Approximate location: Derived from your IP address for audience measurement purposes — collected through analytics tools when you consent.
• Advertising identifiers: Identifiers used to measure ad conversions and support retargeting campaigns — collected through marketing tools when you consent.
• Social identifiers: Identifiers associated with your social media profiles (e.g., Meta, LinkedIn) — collected through marketing pixels when you consent.
• Form data and communications: Information you submit through contact forms, quote requests, or lead generation forms, including any messages you send us — collected through our website forms and HubSpot when you consent.
• Consent preferences: A record of the cookie and tracking choices you make on our site — stored locally in your browser via a cookie named moelleux_{site_key} for a period of 13 months.

3. Purposes of Processing

We process your personal information only for the purposes described below. For each purpose, we identify the legal basis we rely on under Quebec Law 25.

• Operating the website and ensuring security (Essential): We use device identifiers and IP addresses to serve web pages, protect the site against bots and abuse (via Cloudflare and Google reCAPTCHA), and load web fonts (via Adobe Fonts / Typekit). These operations are strictly necessary for the site to function. Legal basis: legitimate interest in maintaining a functional and secure website.
• Processing orders and managing your account (E-commerce): We use your identification, contact, and transaction information to process purchases, manage your account, issue invoices, arrange delivery, and handle returns or disputes through WooCommerce. Legal basis: performance of a contract to which you are a party.
• Audience measurement and store performance analytics (Analytics): With your consent, we use Google Analytics 4 and WooCommerce Analytics to understand how visitors use our site and how our online store performs, so we can improve the experience. These tools collect device identifiers, IP addresses, pages visited, session duration, browsing behavior, transaction data, and approximate location. Legal basis: your consent.
• Targeted advertising and retargeting (Marketing): With your consent, we use Meta Pixel (Facebook), Google Ads / Conversion, LinkedIn Insight Tag, and HubSpot to measure the effectiveness of our advertising campaigns, run retargeting ads, and generate and nurture leads. These tools collect device identifiers, IP addresses, pages visited, browsing behavior, transaction data, advertising identifiers, social identifiers, and form data. Legal basis: your consent.
• Managing consent records (Essential): We record your cookie and tracking preferences through Moelleux (Horizon-Cumulus) to comply with our obligations under Quebec Law 25 and to ensure we activate only the tools you have authorized. Legal basis: legal obligation.
• Business email communications: We use Microsoft 365 (United States) for general business email and Horizon-Cumulus Email (Quebec) for certain operational communications. Your email address may be processed in the United States when you correspond with us via our Microsoft 365 mailbox. Legal basis: legitimate interest in conducting business communications, or your consent where applicable.

4. Third Parties and Processors

We share personal information with the following third-party service providers acting as our processors or independent controllers. We require that all processors provide sufficient guarantees regarding the protection of personal information.

We do not sell your personal information to third parties. We do not share your personal information with third parties for their own marketing purposes without your explicit consent.

5. Transfers Outside Quebec

Several of the third-party services we use are operated by companies based in the United States. When you consent to analytics or marketing cookies, or when you correspond with us by email through our Microsoft 365 mailbox, your personal information may be transferred to and processed in the United States. The following services involve such transfers:

• Adobe Fonts (Typekit) — United States (Typekit / Adobe Inc.)
• Google Analytics 4 — United States (Google LLC)
• WooCommerce Analytics — United States (Automattic Inc.)
• Meta Pixel (Facebook) — United States (Meta Platforms, Inc.)
• Google Ads / Conversion — United States (Google LLC)
• LinkedIn Insight Tag — United States (LinkedIn Corporation)
• HubSpot — United States (HubSpot, Inc.)
• Google reCAPTCHA — United States (Google LLC)
• Microsoft 365 — United States (Microsoft Corporation)
• Cloudflare — International network of data centers

In accordance with section 17 of Quebec Law 25, before communicating personal information outside Quebec, we assess whether the destination jurisdiction offers an adequate level of protection. For transfers to the United States, we rely on contractual safeguards such as data processing agreements and, where applicable, standard contractual clauses, to ensure your personal information receives a comparable level of protection to that required under Quebec Law 25.

A Privacy Impact Assessment (PIA) is conducted or reviewed for transfers involving sensitive personal information or large volumes of data, as required by Quebec Law 25. These assessments are kept on file and are available to the Quebec Information Access Commission (CAI) upon request.

Our website hosting and consent management infrastructure remain in Quebec. Your consent records are stored in Quebec by Horizon-Cumulus (OVH Beauharnois). A portion of our business email is handled by Horizon-Cumulus Email, also based in Quebec. However, because we also use Microsoft 365 (United States) for business email, we cannot represent that all email communications remain within Quebec.

6. Retention Period

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. The table below summarizes our retention practices by data type.

Once the applicable retention period has expired, personal information is securely deleted or anonymized so that it can no longer be associated with an identifiable individual.

7. Your Rights

Under Quebec Law 25, you have the following rights with respect to your personal information. To exercise any of these rights, please contact our Person responsible for the protection of personal information using the details provided in Section 8.

• Right of access: You have the right to ask us whether we hold personal information about you and, if so, to receive a copy of that information in a clear and understandable format. We will respond to your request within 30 days.
• Right to rectification: If the personal information we hold about you is inaccurate, incomplete, or ambiguous, you have the right to ask us to correct it. You may also ask us to add a note to your file if a dispute about accuracy cannot be resolved.
• Right to erasure (de-indexing): In certain circumstances — for example, if the information was collected without a valid legal basis, or if the purpose for which it was collected has been fulfilled — you may ask us to delete your personal information. We will assess your request in light of our legal obligations (such as tax record-keeping requirements) before acting on it.
• Right to portability: You have the right to receive the personal information you have provided to us in a structured, commonly used, and machine-readable format, and to have it transmitted to another organization where technically feasible.
• Right to withdraw consent: Where we process your personal information on the basis of your consent (for example, analytics cookies or marketing cookies), you may withdraw that consent at any time by updating your preferences through our consent management tool (Moelleux) available on our website. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

If you believe that we have not handled your personal information in accordance with Quebec Law 25, you have the right to file a complaint with the Quebec Information Access Commission (CAI) at www.cai.gouv.qc.ca. We encourage you to contact us first so we can try to resolve your concern directly.

8. Person Responsible for the Protection of Personal Information

In accordance with section 3.1 of Quebec Law 25, we have designated a Person responsible for the protection of personal information who oversees our compliance with privacy obligations and handles requests and complaints related to personal information.

• Name: Jonathan Chenevert
• Title: Propriétaire
• Email: info@dispomed.com
• Phone: 1 800 363-1746

You may contact our Person responsible for the protection of personal information at any time to exercise your rights, ask questions about this policy, or raise a concern about how your personal information is handled. We are committed to responding to all requests within 30 days, as required by Quebec Law 25.

9. Effective Date and Versioning

This privacy policy takes effect on 25 mai 2026 and replaces any prior version.

Current version: 2

We may update this policy from time to time to reflect changes in our practices, the services we use, or applicable law. When we make material changes, we will update the effective date above and, where appropriate, notify you through our website or by email. We encourage you to review this policy periodically.

This policy was generated and is hosted by Moelleux, a consent management and privacy policy platform operated by Horizon-Cumulus (9322-8310 Québec inc.), Joliette, Quebec.