PRIVACY POLICY

9327-2920 QUEBEC INC., operating under the name Image Salon (hereinafter referred to as "Image Salon," "we," or "our"), operates the website imagesalon.com (hereinafter the "Website"). We place great importance on the protection of your Personal Information (as defined below). We aim to make your experience on our Website as enjoyable as possible.

This privacy policy (hereinafter referred to as the "Policy") aims to protect the Personal Information of users of our Website (hereinafter "you" or "your"), and it outlines how we handle and safeguard Personal Information within the limits imposed by the law.

The Policy does not apply to Personal Information concerning our employees and subcontractors.

"Personal Information" refers to any information related to an individual that allows, directly or indirectly, their identification.

We only collect the necessary Personal Information about you to establish, manage, and maintain the relationships we have with you. In most cases, this collection is limited to the following Personal Information during the registration process (account opening):

• First name; 

• Last name; 

• Email address; 

• Phone / mobile number; 

• Physical address; 

• Company name; 

• Information changes to establish a Lightroom profile; 

• Timestamp; 

• Information about the operating system and user agent; 

• Login cookies.

The following Personal Information is collected during the order process:

• Order data; 

• Timestamp; 

• Payment data processed by a third party, namely Stripe or PayPal and not stored on our servers; 

• User agent; 

• Login cookies.

We may also collect Personal Information on the Website directly or during your email, phone, or in-person interactions with one of our employees or representatives.

Additionally, the following material may be collected for the provision of our services:

• Presets and editing preferences; 

• Images.

Your consent for the collection, use, or disclosure of your Personal Information must be clear, free, and informed. It must be given for the specific purposes and objectives identified in this Policy.

Depending on the nature and sensitivity of your Personal Information, your consent may be explicit (such consent can be given verbally, in writing, or electronically) or implicit (when you voluntarily provide Personal Information, for example).

BY USING OUR WEBSITE, YOU CONSENT TO THE COLLECTION, USE, DISCLOSURE, AND STORAGE OF YOUR PERSONAL INFORMATION IN ACCORDANCE WITH THIS POLICY. PLEASE READ IT CAREFULLY.

If you do not consent to these terms, please discontinue your use of the Website. Unless otherwise required by law, you may withdraw your consent at any time with reasonable notice. Please note that if you choose to withdraw your consent for the collection, use, or disclosure of your Personal Information, certain features of our Website may no longer be accessible to you, and we may not be able to provide you with certain services.

Information security is a top priority for us, but please remember that no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.

In addition to the administrative measures detailed in the following sections, we have implemented physical and technological measures that are reasonable considering the sensitivity of Personal Information, its use, quantity, distribution, and storage.

Regarding administrative measures, we have adopted policies that include the following:

On the technological front, we implement the following measures:

We use the Personal Information about you only for the following purposes:

We may also use Personal Information in accordance with our Terms and Conditions.

All of our employees who handle Personal Information are bound by confidentiality obligations and have received appropriate training. Furthermore, they can only access the Personal Information necessary for the performance of their respective duties. In case of a breach, our governance policies and practices provide for sanctions.

We only use Personal Information for the purposes stated above, unless we are authorized by law, in very limited cases, to do so without your consent.

We may disclose Personal Information to third parties in specific circumstances authorized by law. These third parties are obligated to maintain the confidentiality of your information and are prohibited from using it for any other purpose. In the table below, we summarize these circumstances as well as the measures we take to protect Personal Information.

Whenever we need to disclose Personal Information about you, we will make every effort not to disclose more information than is necessary under the circumstances.

As part of providing our services, we may disclose Personal Information outside of Quebec, particularly in the following regions:

• United States; 

• Canada.

Before disclosing Personal Information outside of Quebec, we will conduct a privacy impact assessment that takes into account:

• The sensitivity of the Personal Information; 

• The purpose of its use; 

• The protection measures it will receive; and 

• The legal framework applicable in the state where this Personal Information will be disclosed.

We will only proceed with such disclosure if this assessment demonstrates that the Personal Information will receive adequate protection in accordance with generally recognized principles of Personal Information protection. Furthermore, this disclosure must be subject to a written contract that takes into account all the findings of the assessment.

We retain Personal Information only for the duration necessary to achieve the purposes for which it was collected unless legal requirements or contractually recognized interests under the law require us to retain it for a longer period. We reserve the right to establish Personal Information destruction policies from time to time. Upon request, we can inform you of the retention period for your Personal Information. Please note that your data may remain in our backups after the account deletion but will no longer be accessible through the Website. Our backups are periodically rotated and deleted, and your information will not remain indefinitely in our backups. If you request the deletion of your Personal Information, we will make reasonable efforts to comply with this request as soon as possible. The deletion of your Personal Information is completed within 30 days following the request.

The files you have submitted to us for processing are stored as needed to provide the service. These files are periodically deleted once the service is completed.

Users of the Website have the following rights:

• The right to be informed about their use, disclosure, retention, and destruction, as outlined in this Policy; 

• The right to access your Personal Information and obtain, if applicable, additional details on how we use, disclose, retain, and destroy it; 

• In certain cases, the right to object, restrict, or withdraw your consent to these operations by providing reasonable notice sent to the email address provided at the end of this Policy; 

• The right to have your Personal Information corrected if it is inaccurate or unclear and to have it completed when it is incomplete; 

• The right to have your Personal Information deleted, subject to our legal obligations; 

• The right to be informed of a privacy incident concerning your Personal Information that may cause you serious harm. For this purpose, we maintain a record that lists all privacy incidents, and we assess the harm they may cause.

You can exercise these rights by logging into your account and accessing the account page or by sending an email to the email address provided at the end of this Policy. Your request must contain sufficient details to identify your Personal Information and the correction you are seeking. We will respond to your requests within 30 days of receiving them, unless the law permits an extension of this timeframe.

Subject to legal restrictions, if we refuse to provide or correct your Personal Information, we will provide you with the reasons for this refusal, information about your recourse, and the applicable provisions of the law.

If we refuse to correct your Personal Information, we will allow you to attach written comments to your record regarding the Personal Information that has been refused for correction. We will also retain the Personal Information that was subject to an access request for as long as necessary to allow you to exhaust the remedies provided by law.

Our website uses cookies and similar tracking technologies to enhance user experience, analyze site traffic, and improve our services. You can manage your cookie preferences by adjusting your browser settings or visiting the 'Cookie Settings' section on our website. Your use of the Website allows us to automatically collect certain information, including cookies, which may include:

• The Internet Protocol (IP) address of your computer; 

• Your geolocation zone; 

• The operating system you are using; 

• Your preferred language; 

• The identity of your Internet service provider; 

• The date and time when you accessed the Website; 

• The previous website you visited that provided a link to our Website; and 

• The content viewed and downloaded on our Website or the number of visits.

Generally, the cookies we use are grouped into three (3) categories:

• Technical cookies: Technical cookies are used throughout navigation to facilitate the use of our Website. For example, a technical cookie may be used to remember your username to facilitate your login, or to remember your preferences or chosen options;

• Analytical cookies: These cookies are anonymous and are used to collect usage statistics for our Website;

• Advertising cookies: These cookies may be added by the Website or by other sites that display advertisements or announcements. These cookies collect information anonymously and create your visitor profile.

If you wish, you can configure your browser to notify you when you receive cookies or to reject them. It is possible to delete cookies from your computer's hard drive, block the creation of cookies, or receive a warning before a cookie is stored.

By doing so, your use of our Website may be affected, and you may no longer have access to all its functions. We encourage you to consult the Ads Setting and Network Advertising Initiative websites, as well as the instructions or help section of your browser, for more information on cookies.

Our service is not intended for individuals under the age of 18. Therefore, we do not knowingly collect personally identifiable information from minors. If you are a parent or guardian and you are aware that your minor child has provided us with Personal Information, please contact us. If we learn that we have collected Personal Information from minors without verification of parental consent, we will take steps to remove that information from our servers.

We may update the Policy from time to time. Any changes made will be posted on our Website and brought to your attention when you log in. Changes to this Policy take effect when they are posted on this page. The date of the last version of this Policy appears at the bottom of the page. We recommend printing a copy of the Policy for your records and periodically checking this section of our Website to stay informed of any changes. If we make significant changes to the Policy, we will notify you via the email address you have provided.

The Privacy Officer for Image Salon is VICTORIA DIMAANO.

For any questions or requests related to the Policy, you can send an email to the following address: info@imagesalon.com.

The Policy is intended to comply with Canadian and Quebec laws regarding the protection of Personal Information and, when applicable, California laws and the European General Data Protection Regulation “GDPR” (EU/2016/679) relating to such information. Depending on the constraints applicable in these jurisdictions, which you have informed us of, we will adapt, when necessary, our practices that may be complementary to this Policy. Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) governs processing of personal information received from foreign countries, in addition to stringent provincial laws applicable in Quebec. The European Union recognizes Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) as providing adequate protection. This means a Canadian organization need not enter into the European Standard Contractual Clauses when entering into an agreement with a European organization.