Privacy statement (CA)

1. Person in Charge of Processing

This privacy policy applies to the website and online store operated by Norseco (referred to in this policy as “we,” “us,” or “our”). We are subject to Quebec Law 25 (An Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25), which governs how we collect, use, disclose, and retain personal information about visitors and customers.

We are committed to handling your personal information responsibly, transparently, and in accordance with the rights and obligations established under Quebec Law 25. This policy explains what personal information we collect, why we collect it, who we share it with, and how you can exercise your rights.

2. Personal Information Collected

We collect personal information about you in the course of operating our website and processing your orders. The categories below reflect what is actually collected through our site and its integrated services.

• Identity and contact information: Your name, billing and shipping address, email address, and phone number — collected when you place an order or create an account.
• Transaction and purchase data: Order details, products purchased, order history, and payment confirmation information — collected through our WooCommerce-powered store. Note: full payment card details are processed directly by your payment provider and are not stored by us.
• Device and browsing information: IP address, device identifiers, pages visited, session duration, navigation behavior, and approximate geographic location — collected automatically through analytics services when you browse our site.
• Consent preferences: Your cookie consent choices, recorded by our consent management platform (Moelleux by Horizon-Cumulus), along with your IP address at the time of consent.

We do not knowingly collect sensitive personal information such as health data, financial account credentials, or government-issued identification numbers beyond what is strictly necessary to process your transactions.

3. Purposes of Processing

We collect and use your personal information only for the purposes described below. Where we rely on your consent, you may withdraw it at any time (see Section 7).

• Processing and fulfilling your orders — We use your identity, contact, and transaction data to process purchases, arrange delivery, issue invoices, and handle returns or exchanges. Legal basis: performance of a contract.
• Operating and improving our website — We use device and browsing data collected through Google Analytics 4 (operated by Google LLC, United States) and WooCommerce Analytics (operated by Automattic Inc., United States) to measure site traffic, understand how visitors interact with our pages, and improve the shopping experience. Legal basis: consent (you may opt out via our cookie consent banner).
• Displaying our website correctly — We use Google Fonts (operated by Google LLC, United States) to render text on our site. Your IP address is transmitted to Google’s servers to load the font files. Legal basis: legitimate interest in presenting a functional, readable website.
• Recording and managing your consent choices — We use Moelleux by Horizon-Cumulus (9322-8310 Québec inc., Joliette, Quebec) to display our cookie consent banner, record your preferences, and host this privacy policy. A cookie named moelleux_{site_key} is stored in your browser for up to 13 months to remember your choices. Consent records and this policy are hosted in Quebec (OVH, Beauharnois). Legal basis: legal obligation under Quebec Law 25.
• Complying with legal obligations — We may retain certain transaction records to meet our obligations under applicable tax, accounting, and consumer protection laws. Legal basis: legal obligation.

4. Third Parties and Processors

We work with the following third-party service providers who may access your personal information in the course of providing their services to us. We require each provider to handle your information only as directed by us and in a manner consistent with applicable privacy law.

We do not sell your personal information to third parties, and we do not share it for purposes other than those described in this policy.

5. Transfers Outside Quebec

Some of the services we use transfer your personal information to servers located outside Quebec, specifically to the United States. These transfers involve the following services:

• Google Analytics 4 — Device identifiers, IP address, browsing behavior, and approximate location are processed by Google LLC in the United States.
• WooCommerce Analytics — Device identifiers, IP address, browsing behavior, and transaction data are processed by Automattic Inc. in the United States.
• Google Fonts — Your IP address is transmitted to Google LLC servers in the United States to load font files.

Before authorizing these transfers, we assess whether the personal information will receive adequate protection in the destination jurisdiction, as required by section 17 of Quebec Law 25. This assessment takes the form of a Privacy Impact Assessment (PIA) that considers the sensitivity of the information transferred, the legal framework of the destination country, and the contractual safeguards in place with each provider (including, where applicable, Google’s and Automattic’s standard data processing agreements and privacy commitments).

By contrast, your consent records and this privacy policy are managed by Moelleux (Horizon-Cumulus) and hosted entirely in Quebec (OVH, Beauharnois). No personal information processed by Moelleux leaves Quebec.

6. Retention Period

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.

When personal information is no longer needed, we destroy or anonymize it in a secure manner.

7. Rights of Data Subjects

Under Quebec Law 25, you have the following rights with respect to your personal information. To exercise any of these rights, please contact us using the information in Section 8. We will respond within 30 days of receiving your request.

• Right of access: You may request a copy of the personal information we hold about you, along with information about how it is used and with whom it has been shared.
• Right of rectification: If any personal information we hold about you is inaccurate, incomplete, or ambiguous, you may ask us to correct it.
• Right of erasure (de-indexing): In certain circumstances — for example, if the information was collected unlawfully or is no longer necessary for the purpose for which it was collected — you may ask us to delete your personal information.
• Right to data portability: You may request that we provide you with the personal information you have given us in a structured, commonly used technological format, so that you can transfer it to another organization.
• Right to withdraw consent: Where we rely on your consent to process your personal information (for example, for analytics cookies), you may withdraw that consent at any time by updating your preferences through our cookie consent banner or by contacting us directly. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

If you believe your rights have not been respected, you have the right to file a complaint with the Quebec Information Access Commission (CAI) at https://www.cai.gouv.qc.ca.

8. Person Responsible for the Protection of Personal Information

In accordance with section 3.1 of Quebec Law 25, Norseco has designated a Person responsible for the protection of personal information. This person oversees our compliance with Quebec Law 25, handles requests relating to personal information, and serves as your point of contact for any privacy-related question or concern.

• Name: Benoit Plante
• Title / Role: —
• Email: responsable.loi.25@norseco.com
• Phone: 514-332-2275

We will acknowledge your request promptly and provide a substantive response within 30 days, as required by Quebec Law 25. If your request is complex or involves a large volume of information, we will notify you if additional time is needed.

9. Effective Date and Versioning

This privacy policy takes effect on 9 juin 2026 and supersedes any previous version.

Current version: 1

We review this policy periodically and update it whenever our practices change, when new services are added to our site, or when required by changes in applicable law. When we make material changes, we will update the effective date above. We encourage you to review this policy from time to time to stay informed about how we protect your personal information.

This policy was generated and is hosted by Moelleux, a consent management and privacy policy platform operated by Horizon-Cumulus (9322-8310 Québec inc.), Joliette, Quebec.