Privacy Statement

1. Person in Charge of Processing

This privacy policy applies to Chalets des Pins (referred to in this document as
“we,” “us,” or “our”), a business operating in Quebec, Canada. We are subject to
Quebec Law 25 — formally known as An Act to modernize legislative provisions as
regards the protection of personal information (S.Q. 2021, c. 25) — which governs how we collect,
use, communicate, and protect the personal information of anyone who visits or transacts through our
website.

This policy explains what personal information we collect, why we collect it, who we share it with,
how long we keep it, and what rights you have over it. By using our website, you acknowledge that you
have read and understood this policy.

2. Personal Information Collected

We collect personal information only to the extent necessary for the purposes described in this policy.
The categories below reflect what is actually collected through our website and its integrated services.

2.1 Identification and Contact Information

• Full name
• Email address
• Phone number
• Mailing or billing address

2.2 Transaction and Commerce Information

• Purchase history and booking details
• Payment information (processed through our payment provider; we do not store full card numbers)
• Order and transaction identifiers

2.3 Technical and Navigation Information

• IP address
• Device and browser identifiers
• Pages visited and time spent on each page
• Navigation behavior and click patterns
• Approximate geographic location (derived from IP address)
• Session duration

2.4 Advertising and Conversion Information

• Advertising identifiers
• Social network identifiers (when you interact with our ads on Meta platforms)
• Conversion events (e.g., completed bookings or purchases attributed to an ad)

2.5 Consent Preferences

• Your cookie consent choices, recorded and stored by our consent management platform

3. Purposes of Processing

We process your personal information only for the purposes listed below. Where we rely on your
consent, you may withdraw it at any time (see Section 7).

3.1 Operating the Website — Essential Functions

Purpose: Keeping the website functional, secure, and accessible — including managing
your session, your shopping cart, and recording your consent choices.
Services involved: Moelleux (par Horizon-Cumulus) — consent management and privacy
policy hosting, operated by Horizon-Cumulus (9322-8310 Québec inc.), Joliette, Quebec. Consent records
and this policy are hosted in Quebec (OVH Beauharnois). A preference cookie named
moelleux_{site_key} is stored in your browser for 13 months to remember your choices.
Legal basis: Legitimate interest (strictly necessary for the site to function); no
consent toggle is required for essential services.

3.2 Processing Online Transactions

Purpose: Completing your bookings or purchases, issuing confirmations, and managing
your order history through our WooCommerce-powered store.
Services involved: WooCommerce Analytics (Automattic Inc., United States) — analyzes
sales performance and customer behavior in the online store.
Legal basis: Performance of a contract (processing your transaction); consent for
analytics beyond what is strictly necessary.

3.3 Audience Measurement and Site Improvement

Purpose: Understanding how visitors use our website so we can improve content,
navigation, and performance.
Services involved: Google Analytics 4 (Google LLC, United States) — measures
audience size and analyzes visitor behavior using device identifiers, IP address, pages visited,
session duration, navigation behavior, and approximate location.
Legal basis: Consent. Analytics cookies are only activated after you give your
consent through our cookie banner.

3.4 Targeted Advertising and Remarketing

Purpose: Measuring the effectiveness of our advertising campaigns and showing
relevant ads to people who have visited our site.
Services involved: Meta Pixel (Facebook) (Meta Platforms Inc., United States) —
tracks conversions and enables remarketing by collecting device identifiers, IP address, pages
visited, transaction data, advertising identifiers, and social network identifiers.
Legal basis: Consent. Marketing cookies are only activated after you give your
explicit consent.

3.5 Website Display — Functional Tools

Purpose: Rendering the website correctly by loading web fonts that ensure optimal
text display.
Services involved: Google Fonts (Google LLC, United States) — delivers typeface
files; your IP address and device identifier are transmitted to Google’s servers in the process.
Legal basis: Consent. Although Google Fonts serves a functional purpose, because it
transmits your IP address to a U.S. server, we request your consent before loading it.

4. Third Parties and Processors

The table below lists every third-party service integrated into our website, its purpose, its
service category, and whether it involves a transfer of personal information outside Quebec.

We do not sell your personal information to any third party. We share personal information with
processors only to the extent necessary for the purposes described in Section 3, and we require
those processors to protect it in a manner consistent with this policy and applicable law.

5. Transfers Outside Quebec

Several services we use transfer personal information to the United States. Under
section 17 of Quebec Law 25, we are required to disclose these transfers and to conduct a Privacy
Impact Assessment (PIA — also called an évaluation des facteurs relatifs à la vie privée,
or EFVP) before any such transfer takes place, to ensure that the personal information receives
adequate protection in the destination jurisdiction.

The following services involve cross-border transfers:

• Google Analytics 4 (Google LLC, United States) — Your device identifiers, IP
  address, pages visited, session duration, navigation behavior, and approximate location may be
  processed on Google’s servers in the United States. Google LLC participates in the EU-U.S. Data
  Privacy Framework and applies standard contractual clauses for international data transfers.
• Meta Pixel (Facebook) (Meta Platforms Inc., United States) — Your device
  identifiers, IP address, pages visited, transaction data, advertising identifiers, and social
  network identifiers may be processed on Meta’s servers in the United States. Meta Platforms Inc.
  applies standard contractual clauses and participates in applicable cross-border transfer
  frameworks.
• Google Fonts (Google LLC, United States) — Your IP address and device identifier
  are transmitted to Google’s servers in the United States each time a font file is requested.
  Google applies standard contractual clauses for this processing.
• WooCommerce Analytics (Automattic Inc., United States) — Transaction data,
  device identifiers, IP address, pages visited, session duration, and navigation behavior may be
  processed on Automattic’s servers in the United States. Automattic applies standard contractual
  clauses for international transfers.

We have conducted or are in the process of conducting a Privacy Impact Assessment (PIA) for each
of these transfers, as required by section 17 of Quebec Law 25, to confirm that the personal
information transferred will receive protection equivalent to what Quebec law requires. If you
would like more information about these assessments, please contact our Person responsible for the
protection of personal information (see Section 8).

Our website infrastructure, consent records, and privacy policy are hosted in Quebec, Canada,
through Horizon-Cumulus (Joliette, Quebec) and OVH Beauharnois. No data related to those
components leaves Quebec.

6. Retention Period

We keep your personal information only as long as necessary for the purpose for which it was
collected, or as required by law. The table below summarizes our retention practices.

Once the applicable retention period expires, personal information is securely deleted or
anonymized so that it can no longer be linked to an identifiable individual.

7. Rights of Visitors

Quebec Law 25 gives you the following rights regarding your personal information. To exercise any
of these rights, please contact our Person responsible for the protection of personal information
using the details in Section 8. We will respond within 30 days of receiving your
request.

7.1 Right of Access

You have the right to ask us whether we hold personal information about you, to receive a copy of
that information in a clear and understandable format, and to be told the source of the information,
the purposes for which it is used, and the categories of third parties to whom it has been
communicated.

7.2 Right of Rectification

If any personal information we hold about you is inaccurate, incomplete, ambiguous, or outdated,
you have the right to ask us to correct it. You may also ask us to delete information that is not
necessary for the purpose for which it was collected.

7.3 Right of Erasure

You have the right to ask us to delete your personal information when it is no longer necessary
for the purposes for which it was collected, when you withdraw your consent and there is no other
legal basis for processing, or when the information was collected unlawfully. Erasure requests are
subject to our legal retention obligations (see Section 6).

7.4 Right of Portability

You have the right to receive the personal information you provided to us in a structured,
commonly used, and machine-readable format, and to ask us to transmit it to another organization
where technically feasible. This right applies to information you actively provided to us and that
is processed by automated means.

7.5 Right to Withdraw Consent

Where we process your personal information based on your consent — including analytics cookies,
marketing cookies, and functional cookies — you may withdraw that consent at any time without
penalty. You can do so by clicking the cookie preferences link in the footer of our website or by
contacting us directly. Withdrawing consent does not affect the lawfulness of processing that
occurred before the withdrawal.

7.6 Right to File a Complaint

If you believe we have not handled your personal information in accordance with Quebec Law 25, you
have the right to file a complaint with the Quebec Information Access Commission (CAI)
at www.cai.gouv.qc.ca.
We encourage you to contact us first so we can try to resolve your concern directly.

8. Person Responsible for the Protection of Personal Information

In accordance with section 8.1 of Quebec Law 25, Chalets des Pins has designated a
Person responsible for the protection of personal information. This person oversees
compliance with Quebec Law 25, handles requests related to your rights, and acts as the point of
contact for any privacy concern.

• Name: Sabrina Vigneau-Courchesne
• Title: Propriétaire
• Email: nfo@chaletsdespins.ca
• Phone: 450-834-3401

We will acknowledge your request promptly and provide a substantive response within
30 days, as required by Quebec Law 25. If your request is complex or involves a
large volume of information, we may extend this period by an additional 30 days and will notify
you of the extension.

9. Effective Date and Versioning

This privacy policy takes effect on 10 juin 2026 and supersedes any
previous version. It is published in version 1.

We may update this policy from time to time to reflect changes in our practices, the services we
use, or applicable law. When we make material changes, we will update the effective date above and,
where appropriate, notify you by email or through a notice on our website. We encourage you to
review this policy periodically.

The current version of this policy is always available on our website and is managed through the
Moelleux platform operated by Horizon-Cumulus (Joliette, Quebec). Policy records are hosted in
Quebec (OVH Beauharnois).