Effective date: 01-Jan-26

Welcome — and thanks for choosing Cannabis Supply Co. This Privacy Policy is our way of being clear (and keeping it human) about what personal info we collect, how we use it, who we share it with, and how we keep it protected when you shop with us, visit our stores, use our services, browse our websites/apps (if applicable), or reach out.

We operate only in British Columbia, Canada. Our privacy practices are designed to comply with British Columbia’s Personal Information Protection Act (PIPA).

1) What we collect

We collect what you share with us — plus what’s created when you shop or interact with us:

• Contact info: name, phone number, email, mailing address

• Profile info: customer profile details, preferences, and eligibility confirmations where applicable

• Purchase info: when/where you bought, what you bought, totals, discounts, returns/exchanges

• Messages + preferences: marketing choices, customer support conversations, feedback

• Online info (if applicable): IP address, device identifiers, browsing activity, cookies and similar tech (see Section 11)

A quick note: cannabis purchase history can be sensitive depending on the situation. We treat it with extra care and keep access limited (see Section 8).

2) The systems we use (and who helps us run them)

To keep things running smoothly, we use operational tools like point-of-sale, customer support platforms, and analytics systems. Some of these tools are provided, supported, or managed by trusted third parties.

That means your personal info in our systems may be accessed or processed by:

• our authorized team members, and

• service providers, partners, and other businesses that provide management, admin, tech, analytics, security, or operational services under a management services agreement or similar arrangement (collectively, “Service Providers”).

Why we do this: so we can process purchases, give receipts, handle returns, prevent fraud, keep our systems secure, meet legal requirements, and keep the day-to-day flowing.

Access stays tight: We limit access based on role and need-to-know (see Section 8).

3) What we use your info for

Here’s how we use personal info (and why):

A. Purchases + support

• processing transactions and payments

• providing receipts

• handling returns/exchanges and customer support

• responding to questions and requests

B. Safety + operations

• preventing/investigating fraud, theft, misuse, and security issues

• keeping our stores, systems, and customer accounts secure

• audits, internal reporting, quality checks, and meeting legal obligations

C. Better experiences

• maintaining customer profiles (where applicable) to support service and operations

• applying your stated preferences (where applicable)

D. Improving the business (with safeguards)

• understanding sales trends and planning inventory

• improving store operations, product selection, and customer experience

Less is more: Whenever we reasonably can, we use de-identified or aggregated info for analytics. If we need identifiable info, we limit access and use it only for the purposes above.

4) Consent and your choices

We use consent when the law requires it. The type depends on what’s happening:

• Implied consent may apply when info is needed to complete your purchase or give you something you asked for.

• Express consent is used where required or appropriate — especially for certain marketing messages.

You’re in control. You can update or withdraw consent any time (subject to legal/contract restrictions and reasonable notice). If you withdraw consent, some features may not work the same (like certain profile-based services).

5) Marketing messages

We only send marketing messages (like promos by email/text) when we have the right consent.

• Every message tells you who it’s from and includes an easy unsubscribe option.

• You can unsubscribe anytime using the link in the message — or by contacting us (Section 12).

Service messages

Even if you opt out of marketing, we may still send non-promotional messages tied to your transactions or account (like receipts, return confirmations, or security notices), where allowed.

6) How we share info

We don’t sell your personal information.

We may share personal info in these situations:

A. With Service Providers (including MSA-covered businesses)

We may share info with Service Providers who help us operate, like:

• point-of-sale and retail tech providers

• payment processors

• IT hosting, cybersecurity, and incident response providers

• customer support tools

• marketing and communications platforms (used only where appropriate consent exists)

• analytics providers (ideally using de-identified data)

Service Providers can access personal info only as needed to do their job for us — and they’re required to protect it with appropriate confidentiality and security safeguards.

B. Legal and safety reasons

We may disclose info where required or permitted by law — for example, to comply with lawful requests or to protect rights, property, and safety.

7) Cross-border processing

Some Service Providers may process or store personal information outside of Canada (for example, cloud hosting). If your info is processed outside Canada, it may be subject to the laws of that jurisdiction. We take steps to require appropriate safeguards through contracts and security measures.

8) How we protect your info

We use safeguards that match the sensitivity of the information, including:

• role-based access controls (people only see what they need for their job)

• authentication controls and monitoring

• audit logging of access to customer profiles within our systems

• encryption and secure transmission where appropriate

• staff training and confidentiality obligations

• vendor security requirements and oversight

Keeping purchase history locked down

We limit access to detailed purchase history (including cannabis transaction details) to authorized roles that need it for customer support, returns/exchanges, fraud prevention, compliance, and system administration.

9) How long we keep info

We keep personal info only as long as we need it for the purposes in this Policy and as required by law. Retention depends on the type of info and legal/operational requirements.

When we don’t need it anymore, we securely destroy, delete, or de-identify it.

10) Your rights

In line with BC’s privacy law, you can ask us to:

• access your personal information

• correct inaccurate or incomplete information

• understand how your info has been used and disclosed

• delete or de-identify certain info where appropriate (note: some records must be kept for legal or legitimate business purposes)

To make a request, contact us using the details in Section 12. We may need to verify your identity to keep your info safe.

11) Cookies and online tracking (if applicable)

If you use our websites or apps, we may use cookies and similar tech to help the site work properly, remember preferences, measure performance, and (where consent is provided) support marketing. You can manage cookies through your browser settings and, where available, our cookie preference tools.

12) Contact us

Need anything privacy-related — questions, requests, concerns? Reach out anytime:

CANNABIS SUPPLY CO.

info@cannabissupplyco.ca

13) Updates to this policy

We may update this Policy from time to time. If we do, we’ll post the updated version and update the “Effective date.” If a change is a big one, we’ll take extra steps to let you know where required.