MacLean-Fogg Privacy Policy

“Controller” means the person or organization that, alone or jointly, determines the purposes for which and the manner in which, personal information is or is likely to be processed. This policy is issued on behalf of MacLean-Fogg Company, 1000 Allanson Road, Mundelein, IL 60060. Unless we notify you otherwise, MacLean-Fogg Company is the controller of your personal information.

The types of personal information we may collect from you depends on the nature of your relationship with MacLean-Fogg and the requirements of applicable law. The personal information we generally collect from you includes:

• General data. We may collect your first name, middle name, maiden name, last name, marital status, title, date of birth, and gender.
• Contact Information. For example, we may collect your name, home address, phone number and email address.
• Billing Information. For example, we may receive your billing and shipping addresses, as well as financial information relevant to your purchases such as payment information and accounts payable information.
• Information You We may collect information when you send us a message through the “Contact Us” page or similar features on our Platform. We may also collect other information you submit through an online comment or when you contact our sales or support teams. This also includes any information that you may submit while leaving a review.
• Business or Work-Related Information. For example, we may collect your business contact information. We may also collect information about your employer and your job title, your job status, work phone number, and work physical and email addresses.
• Device Information. For example, we may collect the type of device you use to access our We may also collect your device identifier, IP address or mobile operating system.
• Account Information. Certain portions of the Platform allow you to create a user account. In connection with that account, we may collect your username and
• Marketing and Communications Information. Such as details about your preferences in receiving marketing communications from us and, where relevant, our third parties, and your communication preferences.
• Commercial Information. We may collect personal information that could identify you and relates to the products or services in which you are interested, or have considered or purchased. We may also collect information about your purchasing habits, or consuming history or tendencies.
• Automatically and Indirectly Collected Information. We may collect information regarding how you use the For example, we may collect information regarding what Platform features are useful or most frequently used.
• Technical If you use our website, we may collect information about the browser you are using. We might also look at things like what site you came from or what site you visit when you leave us.
• Other Information You Choose to Share with Us. For example, we may receive personal information relating to feedback and survey responses you share with us; instructions, comments and opinions you provide when you contact us directly via email, through online forms, through telephone or mail; and any other information you may provide to us when you interact with us such as when you register for events, interact with us at trade shows, or subscribe to our publications.

We collect your personal information in different ways. Below are some examples of how we may collect your personal information.

• Directly From You. For example, when you:
  • Register for an account
  • Purchase our products and services.
  • Submit an inquiry to us.
  • Complete an online form on the Platform.
  • Contact our sales or support team.
  • Submit a product design.
  • Leave a review.
  • Otherwise interact with us.
• Automatically and Indirectly. We may receive your personal information automatically and indirectly from you, such as through logging and analytics tools, cookies, pixel tags, and other similar technologies on our Platform.
• From Third Parties. We may receive personal information about you from other sources. For example, this may include receiving personal information from our service providers, business partners, and other customers who think you may be interested in our products and services, or who want to share a product or service with you.

We process your personal information for the following purposes:

• To Provide Our Products and Services. This includes fulfilling your requests for our products and services, including samples, premiums, products, orders and information (contractual requirement, consent, or legitimate business interests). This also includes processing payments for products or services you purchase (contractual requirement, legal obligation, or legitimate business interests).
• To Customize Your Experience With This may include displaying products that may be of interest to you (consent or legitimate business interests).
• To Run and Improve Our Platform and We may use your information to make our Platform and business better, to develop new products, processes, services, and business relationships (contractual requirement, consent, or legitimate business interests). We may also use your information to provide you with information about our business or to otherwise provide access to areas and features of our Platform (contractual requirement or legitimate business interests).
• To Provide Customer Support. This includes responding to customer service and support requests (contract requirement, legal obligation, or legitimate business interests).
• To Respond to Your Requests or Questions. This may include responding to your feedback (contract requirement, legal obligation, or legitimate business interests).
• To Communicate With We may communicate with you about your account or our relationship (contractual requirement or legitimate business interests). We may also contact you about this Policy or our Platform terms and conditions (contractual requirement or legitimate business interests).
• For Marketing Purposes. We may provide you with information about our company and our business This includes using your information to personalize your experience on our Platform and with our products, including by tailoring the content, advertisements, and offers we serve to you (consent or legitimate business interests). This may include advertising to you through periodic emails, mailings, or phone calls, or through social media platforms, as well as conducting research and surveys to learn more about market and industry trends (consent or legitimate business interests). We may also engage in online behavioral advertising and retargeting (consent or legitimate business interests). For more information about your choices related to these communications, see the Choices Regarding Your Information section below.
• For Administrative Purpose This includes using your information for accounting, recordkeeping, backup, and administrative purposes, and to otherwise manage your personal information (contractual requirement or legitimate business interests).
• For Security Purposes. This could include protecting our company and consumers who use our products and services (legitimate business interests). It may also include protecting and securing our Platform and systems (legitimate business interests).
• For Our Legal Interests. This could include legal and regulatory requirements and requests (like handling complaints and recalls) or establishing and defending legal claims (legal obligation or legitimate business interests). We may also use your personal information to pursue a corporate transaction, such as a sale, merger, restructure, joint venture, or similar disposition of our business, assets, or stock, or similar proceedings (legal obligation or legitimate business interests).
• As Otherwise Permitted By Law or As We May Notify You. This includes using personal information for activities in which we have a legitimate business interests, such as processing for research purposes, processing for historical, scientific, or statistical purposes, fraud prevention, network and information security, or for purposes otherwise disclosed at the time you provide the personal information or otherwise with your consent (contractual requirement, legal obligation, or legitimate business interests).
• As Otherwise Requested or Directed By You.

MacLean-Fogg may anonymize your personal information. Anonymized personal information is not subject to this Policy.

We may share your information in the following ways:

• Internally. Given MacLean-Fogg’s international organizational structure, we may share your information with our parent, subsidiary, and affiliate entities on a need-to-know basis. We may transfer your personal information to other MacLean-Fogg entities globally. Subject to local requirements, this information may be used to provide products and services offered by our other legal entities and for all the purposes outlined in this Policy.
• With Our Service Providers and Trusted Business Partners to Facilitate Services They Provide to Us. We may share your information with third parties who perform services on our behalf. For example, this may include companies that send emails on our behalf or help us run our Platform, as well as providers of website hosting, targeted advertising services, products and services-related consulting and monitoring, data analysis, IT infrastructure, customer service, email delivery, auditing, order fulfillment, payment/billing service providers, fraud prevention, logistics, sales, event management, survey, and other related services.
• With Any Potential Buyers of or Successors to All or Part of Our Business. For example, if we propose to or do merge with, acquire or be acquired, or sell part of our business to another entity. This may include an asset sale, corporate reorganization or other change of control.
• To Comply With Law or Regulation or To Protect Ourselves. For example, this could include responding to a court order or subpoena, or any other form of legal process or other legal reporting requirement. It could also include sharing information if a government agency or investigatory body requests it. We might share information when we are investigating a potential fraud, or to establish and defend against legal claims.
• With Other Third Parties. For example, where disclosure is required for an ordinary business purpose in connection with our provision of products or services.

The Platform is meant for adults. We do not knowingly collect personally identifiable data from persons under the age of 18. If you are a parent or legal guardian and think your child has provided us with personal information, please contact us at privacy@macleanfogg.com. You can also write to us at the address listed at the end of this Policy. Please mark your inquiries “Children’s Information Request.” If we learn that we have collected any personal information from individuals under 18, we will promptly take steps to delete such information.

Depending on your jurisdiction of residence, you may have certain choices about how we use your personal information. Certain choices you make are browser and device specific.

Marketing Communications:

In jurisdictions where express consent is legally required, marketing communications will only be sent where the data subject has provided their express consent. Please note that our marketing-relating communications may contain tracking technologies, such as pixels, so we can tailor the content of our marketing communications more closely to the personalized needs of our recipients, understand which emails were opened, and know which linked contained in the emails were followed.

You can opt out of receiving our marketing communications by using the unsubscribe link within each email. Note that, as long as you maintain an account with us, purchase products or receive services, you will continue to receive administrative (i.e., non-promotional) and transactional messages from us regarding things like your account, our Terms or Service or our Privacy Policy, and the products and/or services you order.

You may also be able to change your email settings to block the automatic download of images in email messages, as such images may contain technologies that help us understand how you interact with the message.

Cookies & Other Tracking Technologies:
We and our third-party service provider partners use cookies and similar technologies (“Cookies”) when you use our Platform. Cookies are small text files that web servers place on a user’s hard drive. When you visit the Platform, third parties with whom we work may use cookies and other similar technologies to collect information, including information about your online activities over time and across third-party websites or online services. For example, we may use Google Analytics to learn more about how visitors use our online services. The information generated by cookies about your use of the website includes your IP address. For more information about Google Analytics, including how Google Analytics collects, uses, and discloses information, please review https://policies.google.com/technologies/partner-sites.

Our third-party providers may use the cookies and information collected through them to recognize your end device on other websites. We can instruct the respective third-party providers to display advertising that is based on the visit or use of our websites, platforms, applications or other products and services. If you register with the third-party provider using your own user data, the respective recognition characteristics of different browsers and end devices can be aligned with each other. If the third-party provider generated a separate characteristic for the laptop, desktop, smartphone or tablet you use, these individual characteristics can be associated with each other as soon as you use a service of a third-party provider with your login information. This way, the third-party provider can effectively manage our advertising campaigns across different end devices.

Through our consent management system, you can determine whether you consent to the setting of certain cookies or not. You can adjust your browser to control cookies to require your affirmative acceptance for new cookies, automatically reject cookies and/or delete or disable existing cookies.

Note that deleting or blocking cookies may impact your experience on our Platform, as some features may not be available. Certain options you select are browser and device specific.

Do Not Track:
Some browsers have “do not track” features that allow you to tell a website not to track you and collect certain information about your website visits over time and across websites or online services. These features are not all uniform. Accordingly, we do not currently respond to browser-initiated “do not track” signals.

Depending on your jurisdiction of residence, you may have certain rights regarding your personal information. Those rights may include the following:

• Right to Know/Right of Access: You may have the right to seek confirmation regarding whether we process personal information about you and to obtain information about how, what, when, why, and for how long your personal information is processed. You may have the right to request access to your personal information and to receive a copy of the data.
• Right to Rectification: You may have the right to ask that we correct or amend information where it is inaccurate or incomplete.
• Right to Erasure (Right to be Forgotten): You may have the right to request we delete personal information that is no longer needed for the purposes for which it was collected or has otherwise been improperly processed.
• Right to Object: You may have the right to object to the processing of your personal information if the processing is based upon our legitimate interest, including any profiling based on such processing.
• Right to Restrict Processing: You may have the right to obtain a restriction on the processing of your personal information in certain circumstances.
• Right to Portability: You may have the right to receive personal information that you have provided to us and transmit such information to another controller in certain circumstances. Additionally, you may have the right to require us to transmit such personal information directly to another controller, where technically feasible.
• Right to Lodge a Complaint: You may have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal information infringed on applicable data protection regulations.
• Right to Withdraw Consent: You may have the right to withdraw your consent where the processing of your personal information is based upon that consent, with effect for the future.

To make a data subject request or to inquire whether these rights may be available to you in your jurisdiction, please contact us by email at privacy@macleanfogg.com. Such requests will be processed in-line with applicable local law.

Although we use appropriate security measures once we have received your personal data, the transmission of information over the Internet is not 100% secure. We cannot promise that your use of our Platform will be completely secure in all circumstances. We encourage you to use caution when using the Internet. We use physical, technical, and organizational means to help safeguard personal information under our control. A username and password are needed to access certain areas of the Platform. It is your responsibility to protect your username and password. Personal Information may be accessed by persons within our organization, or our third-party service providers, who require such access to carry out the purposes described in this Privacy Policy, or otherwise permitted or required by applicable law.

We use payment card processors during payment processing. Your payment data is delivered directly from the browser to payment card processors, who handle your payment card data subject to industry standards regarding security. It is important for you to protect against unauthorized access to your account, purchase history, and device.

MacLean-Fogg retains personal information for as long as necessary to carry out the processing activities described in this Privacy Policy, including but not limited to providing and administering the Platform, providing you with customer service, answering your queries, complying with applicable laws, regulations, rules, and requests of relevant law enforcement and/or other governmental agencies, and protecting our, our employees’, and our business partners’ and customers’ rights, property, or safety and the rights, property and safety of others. We may retain personal information for a longer period of time if a longer retention period is required or permitted by applicable law. In specific circumstances, we may also retain your personal information for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges.

Personal Information we maintain may be stored in or outside of the United States. If you live outside of the United States, you understand and agree that we may transfer your personal information to the United States, which may not provide the same level of protections as in your own country. By using our Platform or by providing us with personal information, you consent to any such transfer of information outside of your country.

Our Platform may contain links to other third-party sites that are not governed by this Policy. If you click on a link to a third-party site, you will be taken to a site we do not control. We are not responsible for the privacy practices used by third-party sites. We suggest that you read the privacy policies of those sites carefully. We are not responsible for these third-party sites.

If you have any questions, comments or concerns with respect to our privacy practices or this Policy, please feel free to contact us at privacy@macleanfogg.com. You may also write to us at the following address:

MacLean-Fogg
1000 Allanson Road
Mundelein, IL 60060

Re: MacLean-Fogg Company Privacy Policy

From time to time, we may change our Policy. We will notify you of any material changes to our Policy as required by law. We will also post an updated copy on our Platform. Your continued relationship with MacLean-Fogg after the posting or notification of any amended Privacy Policy shall constitute your agreement to be bound by any such changes. Please check our Platform periodically for updates as any changes take effect immediately after being posted or otherwise provided by MacLean-Fogg.

The California Consumer Privacy Act (“CCPA”) requires us to make specific disclosures about how we collect, use and share the personal information of California residents who are subject to CCPA. State privacy law in jurisdictions like California, Nebraska, and Texas may also grant specific rights regarding the personal information of state residents related to their personal information.

Personal Information We Collect: Depending on your interactions with us, we may not have collected each of these categories of personal information from California residents. However, we may collect, and in the past 12 months, we may have collected the following categories of personal information from California residents:

• Identifiers, such as name, address, telephone number, or e-mail address, unique personal identifier (e.g., device identifier, unique pseudonym, or user alias/ID), online identifiers, login information, IP addresses, and other similar identifiers;
• Categories of personal information described in California Civil Code Section 1798.80, such as name, signature, telephone number, financial information such as bank account number, credit card number or debit card number, or other financial information;
• Commercial information, such as records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;
• Internet or other electronic network activity information, such as information about your device(s) when accessing our website and your usage details of our website, you provide when filling in forms on our website, the type of browser you use, the files you request, and the domain name and country from which you request information, or information you provide when requesting further information, products, or services from us;
• Geolocation information, such as time and physical location related to use of an internet website, application, device, or physical access to an office location;
• Professional or employment-related information, such as information relating to your position, (e.g., job title, job description, or department), employment status, employment history, or business email address;
• Sensory or surveillance information, such as time and physical location related to use of an internet website, application, device, or physical access to an office location;
• Inferences drawn from the categories in this paragraph and profiles, such as behavior about your behavior, preferences, characteristics, or predispositions; and
• Other information you choose to provide.

We do not collect or process “sensitive personal information” (as that term is defined by the CCPA) for the purpose of inferring characteristics about individuals.

Sources of Personal Information. We collect and receive, and during the 12 months preceding the effective date of the Privacy Policy, may have collected and received personal information from the sources identified at “How We Collect Your Information.”

Purposes for Using, Disclosing, and Otherwise Processing Personal Information. We may use, disclose, or otherwise process, and may have used, disclosed, or otherwise processed in the 12-month period prior to the effective date of this Policy, personal information for the purposes described in “How We Use Your Information.”

“Sales,” “Sharing,” and Disclosures of Personal Information for a Business Purpose. We do not:

• share or disclose your sensitive information for purposes other than those permitted by the CCPA as set out in Cal. Code Regs. tit. § 7072(m); or
• sell or share personal information of individuals under the age of 16.

We generally disclose, and in the preceding 12 months we may have disclosed, the categories of personal information listed above in “Types of Information We Collect” to the categories of entities described in “How We Share Your Information” for business or commercial purposes as described in “How We Use Your Information.”

Our business model does not include selling your personal information to third parties in exchange for money. However, we do share online activity, such as cookies and the advertising identifier associated with your computer or mobile device, with our advertising partners to show ads that are targeted to your interests. Under certain state laws, sharing personal information with partners in exchange for some benefit, such as providing more relevant ads, can be considered a “sale” or “sharing” (as those terms are defined in the CCPA) in some circumstances. As such, we may be considered to “sell” or “share” or otherwise process your personal information for targeted or cross-contextual behavioral advertising. We generally “sell” or “share,” and in the preceding 12 months we may have “sold” or “shared,” the following categories of personal information:

• Identifiers
• Internet or other electronic network activity information
• Commercial information
• Inferences

These categories of information have been and may be disclosed to our marketing and advertising partners, including the following platforms that enable or participate in targeted and cross-context behavioral advertising, and social media platforms.

Depending on your state of residence, you may be able to opt out of the “sale” or “sharing” of your personal information as described in “Your Privacy Rights and Choices,” below. Please note that the right to opt out applies only to “sales” or “sharing” of personal information and does not restrict our ability to disclose information to third parties for valid business purposes.

Your Privacy Rights and Choices. Depending on your state of residence, you may have specific legal rights regarding your personal information. This section describes the legal rights that are available to some individuals and explains how to exercise them.

• Know and Access: Residents of certain states may have the legal right to request, subject to certain limitations, that we disclose the personal information we have collected about them, such as the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about them.
• Correction: Residents of certain states may have the legal right to request that we correct the personal information we maintain about them, if that information is inaccurate.
• Deletion: Residents of certain states may have the legal right to request that we delete certain personal information we have collected about them, subject to certain exceptions.
• Portability: Residents of certain states have the legal right of portability, or the right to have us transfer their personal information to other persons or entities upon their request, subject to certain exceptions.
• Opt-Out of Sale or Sharing: Residents of certain states have the legal right to opt out of the sale of their personal information or disclosure of their personal information for targeted or behavioral advertising.
• Non-Discrimination: Residents of certain states have the legal right to not be discriminated against for exercising their privacy rights.

How to Submit a Request. Residents of states that provide the specific legal rights listed above, may exercise their privacy rights by submitting a request to us at privacy@macleanfogg.com or calling us at 847-837-3522. The verifiable request must provide sufficient information that allows us to reasonably verify they are the person about whom we collected personal information or an authorized representative. The verifiable request must also describe their request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Verifying Requests. To help protect the privacy of individuals requesting to exercise their privacy rights (“Requestors”) and maintain security, we will take steps to verify the Requestors’ identity before granting access to their personal information or complying with their request. If a Requestor asks us to provide them with specific pieces of personal information, we may require they sign a declaration under penalty of perjury that they are the individual whose personal information is the subject of the request and provide appropriate proof of identity.

For requests to know or delete information about a child under the age of 13, we accept requests for information regarding minors under the age of 13 if we can determine that such requests were submitted by a parent or guardian.

Authorized agents may initiate a request on behalf of an individual using the same methods described above. Authorized agents will be required to provide proof of their authorization, and we may also require that the individual directly verify their identity and the authority of the authorized agent. Individuals may also provide us with a signed and dated power of attorney naming the authorized agent as their representative.

Responding to Requests. Within 10 days of receiving a request to delete, to correct, or to know, we will confirm receipt of the request and provide information about how we will process the request. We endeavor to respond to a verifiable request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform the Requestor of the reason and extension period in writing. We may deny the request if we cannot verify the individual’s identity or are legally permitted to deny the request, such as if doing so proves impossible or would involve disproportionate effort.

If we deny the request, we will explain the basis for the denial, provide or delete any personal information that is not subject to the denial, and refrain from using the personal information retained for any purpose other than permitted by the denial. Where required by law, we will also provide instructions on how the Requestor may appeal our decision or submit a complaint. We will maintain a record of the request and our response for 24 months. We do not charge a fee to process or respond to verifiable requests unless they are excessive, repetitive, or manifestly unfounded or if we are allowed to do so by law. If we determine that the request warrants a fee, we will tell the Requestor why we made that decision and provide them with a cost estimate before completing the request. If applicable state law grants the Requestor the right to appeal our denial of their request to exercise their privacy rights, they may appeal our denial by contacting us at privacy@macleanfogg.com or calling us at 847-837-3522.

Do Not Sell or Share My Personal Information. To the extent we “sell” your personal information or disclose your personal information for targeted or behavioral advertising, you may have the right to opt out of those “sales” or disclosures on a going-forward basis at any time. To exercise this right, visit the “Do Not Sell or Share My Personal Information” link on our webpages.

You may also be able to restrict the collection of personal information through your device’s operating system or by disabling cookies, but doing so may prevent you from using the functionality of the websites. If your browser supports it, you can turn on the Global Privacy Control (GPC) to opt out of the “sale” or “sharing” of your personal data. We honor the GPC and other universal opt out signals where we are required to do so by applicable law. These are signals you can send from your browser to a website to convey your choice to exercise certain opt-out rights granted by individual states.

Even if you opt out of the sharing or processing of your personal information for targeted or cross-context behavioral advertising, you may still see our ads online at other sites and apps, and we may still base aspects of ads on your interactions with us and the websites.

This Privacy Policy Addendum for Canadian Residents (the “Canadian Privacy Addendum”) complies with the Personal Information Protection and Electronic Documents Act SC 2000 c-5 (“PIPEDA”) and relevant provincial laws: British Columbia’s Personal Information Protection Act SBC 2003, 63 (“BC PIPA”) and Alberta’s Personal Information Protection Act SA 2003, c P-6.5, (“Alberta PIPA”), collectively referred to as PIPA. Special provisions specific to residents of Quebec that are intended to ensure compliance with Quebec’s Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1 (the “Quebec Act”) can be found below in the “Additional Information for Residents of Quebec,” section below. This Canadian Privacy Addendum supplements the Company’s Privacy Policy and applies to customers, clients, sub-contractors, and others residing in Canada. Except where specified, terms used in this addendum have the same definitions as in applicable Canadian law. If there is a conflict between this addendum and the Privacy Policy, this addendum takes precedence.

The Canadian Privacy Addendum applies to Personal Information that we collect about you and refers to any information about an identifiable individual. Depending on your province of residence, you may have the right to refuse the collection of your personal information, however should you refuse the collection there are some elements of our services and functionality of our website that will not be possible.

BY SUBMITTING PERSONAL INFORMATION TO THE COMPANY, AND/OR BY ACCESSING AND USING THE WEBSITE, YOU CONSENT TO THE COLLECTION, USE, AND DISCLOSURE OF SUCH PERSONAL INFORMATION IN ACCORDANCE WITH THIS PRIVACY NOTICE AND THE CANADIAN PRIVACY ADDENDUM, EXCEPT IN LIMITED CIRCUMSTANCES AS PERMITTED OR REQUIRED BY LAW. UNLESS WE HEAR OTHERWISE, YOUR RECEIPT OF OUR PRIVACY NOTICE AND THE CANADIAN PRIVACY ADDENDUM INDICATES YOUR CONSENT TO THE COLLECTION, USE, AND DISCLOSURE OF YOUR PERSONAL INFORMATION AS DESCRIBED.

Privacy Officer and Contact Information

The Company has appointed the Stephen Young to be responsible for protecting personal information in the Company’s possession in compliance with applicable Canadian law. The Privacy Officer can be reached at privacy@macleanfogg.com.

Identifying Purposes

The purposes for which personal information is collected is identified in “How We Use Your Information,” above.

Types of Information We Collect
The categories of personal information we collect about you is identified in “Types of Personal Information We Collect,” above.

Your Privacy Rights

The Applicable Canadian Privacy Legislation provides residents with specific rights regarding their Personal Information. This sub-section describes those rights and explains how to exercise them.

• Access: Canadian residents have the right to request, at any time that we disclose the Personal Information we have collected about them, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, and the specific pieces of Personal Information we have collected about them as well as how the information is used.

• Accuracy and Correction: If Personal Information is inaccurate, Canadian residents have the right to request that we correct an error or omission to the Personal Information we maintain about them.

• Right to Withdraw Consent: Canadian residents have the right to withdraw consent to the use, collection or dissemination of Personal Information we have collected about them, subject to certain exceptions. In the event you withdraw your consent we will inform you of the likely consequences of this withdrawal and we will immediately stop collecting, using or disclosing this Personal Information immediately.

Quebec’s applicable legislation provides residents with additional specific rights regarding their Personal Information. The following portion of this section describes those additional rights and explains how to exercise them.

• Portability: Residents of Quebec have the legal right of portability, or the right to have us transfer their computerized personal information to other persons or to the individual or entities upon their request, in a structured, commonly used technological format subject to certain exceptions.

• Right to de-indexation: Residents of Quebec have the right to request that the Company stop disseminating their Personal Information or deindex a hyperlink associated with their name that provides access to their information, if such dissemination causes harm or violates the law or a court order. Once we receive and confirm their privacy request, we will evaluate the circumstances and based on this evaluation inform you whether we will de-index, re-index or delete the information.

Please note that we may not be able to de-index, re-index or delete your personal information entirely in the following cases:

• If doing so the information would violate any law, legal requirement, or make the information incorrect.
• If the information is necessary for servicing or collecting on an active account.
• Some data may remain in backups, which are retained per our disaster recovery policies.
• Additionally, deleting your personal information may result in the deletion of your user account if there is no current balance or ongoing service and reactivation of this account may not be possible and you may be required to create a new account.
• Our evaluation determines that de-indexation or re-indexation is not possible in the circumstances.

How to Submit a Request. Canadian residents can exercise their privacy rights by submitting a request to us at privacy@macleanfogg.com.

Verifying Requests. To help protect the privacy of Canadian residents requesting to exercise their privacy rights (“Requestors”) and maintain security, we will take steps to verify the Requestors’ identity before granting access to their Personal Information or complying with their request. If a Requestor asks us to provide them with specific pieces of Personal Information, we may require the Requestor provide appropriate proof of identity.

Responding to Requests.

For residents of Alberta:

Upon receiving a request to access, delete, or to correct an error or omission, we will respond within forty-five (45) days of its receipt. If we require more time (up to an additional 30 days for a total of 75 days), we will inform the Requestor of the reason and extension period in writing.

For residents of Quebec:

Upon receiving a request to access, delete, or correct an error or omission, we will respond within thirty (30) days of its receipt.

For residents of Canadian Provinces other than Alberta and Quebec:

Upon receiving a request to access, delete, or to correct an error or omission, we will respond within thirty (30) days of its receipt. If we require more time (up to an additional 30 days for a total of 60 days), we will inform the Requestor of the reason and extension period in writing.

For all residents of Canada:

We may deny the request if we cannot verify the individual’s identity or are legally permitted to deny the request, such as if processing it proves impossible or would involve disproportionate effort.

If we deny the request, we will explain the basis for the denial, provide or delete any Personal Information that is not subject to the denial, and refrain from using the Personal Information retained for any purpose other than permitted by the denial. We will maintain a record of the request and our response for 24 months. We do not charge a fee to process or respond to verifiable requests unless they are excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell the Requestor why we made that decision and provide them with a reasonable cost estimate before completing the request.

Other provisions pertaining to requests for Personal Information of minors or requests made by authorized agents shall apply as outlined in the Privacy Policy, above.

Sharing of Personal Information

We may disclose the categories of Personal Information identified in Types of Information We Collect, above, to the categories of entities listed below for our business or commercial purposes as further described in How We Share Your Information, in the Privacy Policy. Except as described in the Privacy Policy and this Addendum, we will not share Personal Information with a third party unless a customer requests the disclosure, consents to such disclosure, or the disclosure is required or allowed by law.

We may share your Personal Information with the below categories of individuals who may be located outside of Canada. If you are a resident of Quebec, we may transfer your Personal Information with the below categories of individuals who may be located outside of Quebec:

• Subsidiaries or affiliates located in the US.

• Service providers who act for or on behalf of the Company in connection with the business of the Company, such as our IT operating system and platform vendors, security vendors, monitoring and data analytics providers, and payment service providers located in the US.

• Other third parties, located in the US, such as potential buyers in the event of a proposed or actual purchase, sale, lease, merger, amalgamation or any other type of acquisition, disposal, or financing of all or any portion of the Company or of any of the business assets or shares of the Company or a division thereof; to regulatory authorities or other third parties to comply with a law, regulation, search warrant, subpoena, judicial proceeding, a court order, or as otherwise may be required by law; to enforce our policies or contracts; to collect amounts owed to us; during emergencies when safety is at risk, as determined by the Company; otherwise where necessary for the establishment, exercise or defense of legal claims; and to other similar third parties where disclosure is required for an ordinary business purpose in connection with our provision of products or services.

Data Storage, Cross-Border Transfers, and Protection

The Company may store your personal information on servers and systems under its control or on servers and system that it licenses. To carry out the purposes described in our Privacy Policy and this Addendum your personal information may be transferred and stored outside of Canada, including in the United States. If you are a resident of Quebec, please note that your Personal Information may be transferred and stored outside of Quebec, including in the United States, for these purposes. This means your data may be subject to the laws of other jurisdictions, which may not provide the same level of protection as in your province or in Canada generally. U.S. government or law enforcement agencies may access your data in accordance with U.S. law.

When the Company transfers personal information across borders to a third party, it will take all reasonable steps to protect the data from unauthorized use and disclosure. The Company will only engage third-party processors that have adequate security measures, policies, and staff training in place to safeguard personal information. The Company will proceed with a Privacy Impact Assessment as defined in the Quebec Privacy Act when required to ensure the safety of your personal information. The Company may audit and inspect the third party’s data handling and storage practices when necessary to ensure compliance with these protective measures.

Changes to this Canadian Privacy Addendum

The Company will update this Canadian Privacy Addendum occasionally. When the Company posts changes to this Canadian Privacy Addendum, we will also revise the “Addendum Last Updated” date below. The Company encourages you to review this Canadian Privacy Addendum periodically to be informed of how the Company is protecting your information and to be aware of any changes. Your continued use of the site after the posting of any amended Canadian Privacy Addendum shall constitute your agreement to be bound by any such changes. Any changes to this Canadian Privacy Addendum are effective immediately after being posted by the Company.

Addendum Last Updated: April 9, 2025