1. Person in Charge of Processing

Forage CBF ("we," "us," or "our") operates this website and is responsible for the personal information collected through it. We are subject to Quebec Law 25 — formally known as An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25) — which governs how we collect, use, disclose, and protect your personal information.

This policy explains what personal information we collect, why we collect it, who we share it with, and what rights you have under Quebec Law 25.

2. Personal Information Collected

We collect personal information only to the extent necessary for the purposes described in this policy. The categories below reflect the information collected through our website and the third-party services we use.

• Device and network identifiers: IP address, device identifiers, and advertising identifiers collected automatically when you visit our site.
• Browsing behavior: Pages visited, session duration, navigation patterns, and approximate geographic location derived from your IP address.
• Consent preferences: Your cookie and tracking consent choices, recorded by our consent management platform.
• Transaction data: Information related to interactions tracked for advertising purposes (collected only if you engage with marketing-related features on the site).
• Social identifiers: Identifiers associated with your social media accounts, collected only if you interact with embedded social advertising tools.

We do not knowingly collect sensitive personal information such as health data, financial account numbers, or government-issued identification numbers through this website.

3. Purposes of Processing

We collect and use your personal information for the following purposes. Where we rely on your consent, you may withdraw it at any time (see Section 7).

• Consent management (Essential — legal basis: legal obligation and legitimate interest): We use Moelleux, operated by Horizon-Cumulus (9322-8310 Québec inc.) of Joliette, Quebec, to record and manage your cookie consent choices. A preference cookie named moelleux_{site_key} is stored in your browser for up to 13 months to remember your selections. Consent records and this policy are hosted in Quebec (OVH, Beauharnois). No data is transferred outside Canada for this purpose.
• Audience analytics (Analytics — legal basis: consent): We use Google Analytics 4, operated by Google LLC (United States), to measure website traffic, understand how visitors interact with our pages, and improve site performance. This service collects device identifiers, IP address, pages visited, session duration, navigation behavior, and approximate location. Data is transferred to the United States (see Section 5).
• Targeted advertising and remarketing (Marketing — legal basis: consent): We use Meta Pixel (Facebook), operated by Meta Platforms, Inc. (United States), to track conversions, measure the effectiveness of our advertising campaigns, and serve you relevant ads on Facebook and Instagram. This service collects device identifiers, IP address, pages visited, navigation behavior, advertising identifiers, transaction data, and social identifiers. Data is transferred to the United States (see Section 5).
• Embedded video playback (Functional — legal basis: consent): We embed videos hosted on YouTube, operated by Google LLC (United States). When you play an embedded video, YouTube may collect device identifiers, IP address, pages visited, session duration, and navigation behavior. Data is transferred to the United States (see Section 5).

4. Third Parties and Processors

The table below lists every third-party service active on this website, its purpose, its category, and whether it involves a transfer of personal information outside Quebec.

We also use Microsoft 365, operated by Microsoft Corporation (United States), for our business email communications. When you contact us by email, your message and contact details may be processed on Microsoft's servers located in the United States. Please see Section 5 for details on cross-border transfer safeguards.

5. Transfers Outside Quebec

Quebec Law 25 (section 17) requires us to tell you when your personal information is communicated to a person or organization outside Quebec, and to ensure an adequate level of protection before doing so.

The following transfers outside Quebec occur in connection with our website and operations:

• Google Analytics 4 — United States: Device identifiers, IP address, browsing behavior, and approximate location are transferred to Google LLC in the United States for audience analytics. Google participates in the EU-U.S. Data Privacy Framework and offers standard contractual clauses as a safeguard. IP anonymization is enabled where technically available.
• Meta Pixel (Facebook) — United States: Device identifiers, IP address, browsing behavior, advertising identifiers, transaction data, and social identifiers are transferred to Meta Platforms, Inc. in the United States for advertising and remarketing purposes. Meta relies on standard contractual clauses and its participation in applicable cross-border data transfer frameworks.
• YouTube (embedded videos) — United States: Device identifiers, IP address, and browsing behavior may be transferred to Google LLC in the United States when you interact with embedded video content. The same safeguards described for Google Analytics 4 apply.
• Microsoft 365 (business email) — United States: When you contact us by email, your personal information may be processed by Microsoft Corporation in the United States. Microsoft relies on standard contractual clauses and its participation in applicable cross-border data transfer frameworks.

Before communicating personal information outside Quebec, we conduct or rely on a Privacy Impact Assessment (PIA — also called an évaluation des facteurs relatifs à la vie privée, EFVP) to confirm that the receiving jurisdiction offers an adequate level of protection, or that appropriate contractual safeguards are in place, as required by section 17 of Quebec Law 25.

Our website infrastructure and consent records are hosted in Quebec by Horizon-Cumulus (OVH, Beauharnois), and no personal information collected for consent management purposes leaves Quebec.

6. Retention Period

We keep your personal information only as long as necessary for the purpose for which it was collected, or as required by law. The table below summarizes our retention practices.

Once the applicable retention period expires, personal information is securely deleted or anonymized so that it can no longer identify you.

7. Your Rights

Under Quebec Law 25, you have the following rights with respect to your personal information. To exercise any of these rights, please contact our Person responsible for the protection of personal information (see Section 8). We will respond within 30 days of receiving your request.

• Right of access: You may ask us to confirm whether we hold personal information about you and to receive a copy of that information in a clear and understandable format.
• Right of rectification: If the personal information we hold about you is inaccurate, incomplete, or ambiguous, you may ask us to correct it.
• Right of erasure (de-indexing): In certain circumstances — for example, if the information was collected unlawfully or is no longer necessary for the purpose for which it was collected — you may ask us to delete your personal information.
• Right to data portability: You may ask us to provide you with the personal information you have provided to us in a structured, commonly used technological format, so that you can transmit it to another organization.
• Right to withdraw consent: Where we process your personal information based on your consent (for example, analytics or marketing cookies), you may withdraw that consent at any time by adjusting your preferences through our consent banner or by contacting us directly. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

If you believe your rights have not been respected, you have the right to file a complaint with the Quebec Information Access Commission (CAI) at https://www.cai.gouv.qc.ca.

8. Person Responsible for the Protection of Personal Information

In accordance with section 3.1 of Quebec Law 25, Forage CBF has designated a Person responsible for the protection of personal information. This person oversees compliance with Quebec Law 25, handles requests related to your rights, and acts as the point of contact for any privacy-related questions or concerns.

You may reach our Person responsible for the protection of personal information using the contact details below. We are committed to responding to all requests within 30 days, as required by Quebec Law 25.

• Name: David Blais
• Title: Président
• Email: info@foragecbf.com
• Phone: 418 248-1438

9. Effective Date and Versioning

This privacy policy takes effect on 10 juin 2026 and supersedes any prior version.

Version: 1

We may update this policy from time to time to reflect changes in our practices, the services we use, or applicable law. When we make material changes, we will update the effective date above and, where appropriate, notify you through our website. We encourage you to review this policy periodically.