1. Person in Charge of Processing

This privacy policy applies to the website operated by Flaura - plant based leather (hereinafter "we," "us," or "our"). As a Quebec-based business, we are subject to Quebec Law 25 - formally known as An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25) - and we handle all personal information in accordance with its requirements.

Personal information means any information that identifies, or could reasonably be used to identify, a specific individual. We collect, use, and disclose personal information only for the purposes described in this policy, and only to the extent necessary to fulfill those purposes.

This policy applies to all visitors to our website, including customers, prospective customers, and newsletter subscribers.

2. Personal Information Collected

We collect personal information in the following categories, depending on how you interact with our website:

• Identification and contact information: Your name, email address, mailing address, and phone number - collected when you place an order, create an account, or subscribe to our newsletter.
• Transaction and purchase data: Order details, products purchased, billing and shipping addresses, and payment-related information - collected when you complete a purchase through our online store.
• Technical and browsing information: Your IP address, device identifiers, browser type, pages visited, session duration, navigation behavior, and approximate geographic location - collected automatically when you visit our website through cookies and similar technologies.
• Advertising identifiers: Advertising and social identifiers associated with your device or social media accounts - collected through marketing tools when you interact with our site or our ads.
• Consent preferences: Your cookie consent choices - recorded by our consent management platform to respect your preferences on future visits.
• Form data: Any information you voluntarily submit through contact forms or checkout forms on our site.

We do not knowingly collect sensitive personal information such as health data, financial account credentials, or government-issued identification numbers beyond what is strictly necessary for processing your orders.

3. Purposes of Processing

We use the personal information we collect for the following purposes, each tied to a legal basis under Quebec Law 25:

• Processing your orders and managing your customer account - We use your identification, contact, and transaction data to fulfill purchases, manage returns, and communicate with you about your orders. Legal basis: performance of a contract (and your consent where applicable).
• Operating and securing our website - We use technical information (IP address, device identifiers) to ensure the site functions correctly, prevent fraud, and maintain security. This includes the use of Cloudflare for content delivery and infrastructure performance. Legal basis: legitimate interest.
• Measuring and improving site performance - We use Google Analytics 4 and WooCommerce Analytics to understand how visitors use our site, which pages are most visited, and how our e-commerce store performs. This helps us improve your experience. Legal basis: your consent (collected via our cookie consent banner).
• Targeted advertising and remarketing - We use the Meta Pixel (Facebook) to track conversions and show you relevant ads on social media platforms based on your browsing behavior on our site. Legal basis: your consent (collected via our cookie consent banner).
• Playing embedded videos - We use Vimeo to host and display video content embedded on our website. When you play a video, Vimeo may collect technical information about your device and session. Legal basis: your consent (collected via our cookie consent banner).
• Managing your consent preferences - We use Moelleux (by Horizon-Cumulus) to record and honor your cookie consent choices. A preference cookie named moelleux_{site_key} is stored in your browser for up to 13 months. Legal basis: legitimate interest (necessary to comply with our consent obligations under Quebec Law 25).
• Sending our newsletter - If you subscribe to our newsletter, we use your email address to send you updates about our products, collections, and promotions. Legal basis: your consent, which you may withdraw at any time.
• Complying with legal obligations - We may retain certain transaction records to meet our tax, accounting, and legal obligations. Legal basis: legal obligation.

We do not use your personal information for any purpose incompatible with those listed above without first obtaining your consent.

4. Third Parties and Processors

We share personal information with the following third-party service providers, each acting as a processor on our behalf or as an independent controller for their own purposes. We have entered into, or rely on, appropriate agreements with each of them.

We do not sell your personal information to any third party. We do not share your personal information with third parties for their own marketing purposes without your explicit consent.

5. Transfers Outside Quebec

Several of our service providers operate outside Quebec, which means your personal information may be transferred to, stored in, or processed in jurisdictions with different privacy laws than those in Quebec. In accordance with section 17 of Quebec Law 25if we conduct or rely on a Privacy Impact Assessment (PIA - also called an privacy impact assessmentpIA, or EFVP) before authorizing any such transfer, to ensure that the personal information receives adequate protection in the destination jurisdiction.

The following transfers outside Quebec occur in connection with our website operations:

• Google Analytics 4 (United States): Device identifiers, IP addresses, pages visited, session duration, navigation behavior, and approximate location are transferred to Google LLC in the United States. Google relies on Standard Contractual Clauses and its own data processing terms to safeguard transferred data.
• Meta Pixel / Facebook (United States): Device identifiers, IP addresses, pages visited, transaction data, advertising identifiers, and social identifiers are transferred to Meta Platforms, Inc. in the United States. Meta relies on Standard Contractual Clauses and its data processing terms.
• Vimeo (United States): Device identifiers, IP addresses, session duration, and navigation behavior are transferred to Vimeo, Inc. in the United States when you play an embedded video. Vimeo relies on Standard Contractual Clauses.
• WooCommerce Analytics (United States): Pages visited, session duration, navigation behavior, transaction data, and form data may be processed by Automattic Inc. in the United States. Automattic relies on Standard Contractual Clauses.
• Cloudflare (United States): Device identifiers and IP addresses are processed by Cloudflare, Inc. in the United States as part of its global content delivery network. Cloudflare relies on Standard Contractual Clauses.
• Microsoft 365 (United States): Email communications and associated contact information are processed by Microsoft Corporation in the United States. Microsoft relies on Standard Contractual Clauses and its Data Processing Agreement.

You may request a copy of the relevant contractual safeguards or PIA summary by contacting our Person responsible for the protection of personal information at the coordinates listed in Section 8.

6. Retention Period

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. The following table summarizes our retention practices:

Once the applicable retention period expires, personal information is securely deleted or anonymized so that it can no longer be linked to any individual.

7. Your Rights

Under Quebec Law 25, you have the following rights with respect to your personal information. To exercise any of these rights, please contact our Person responsible for the protection of personal information using the contact details in Section 8. We will respond within 30 days of receiving your request, as required by law.

• Right of access: You have the right to ask us whether we hold personal information about you, and to receive a copy of that information in a clear and understandable format.
• Right of rectification: If any personal information we hold about you is inaccurate, incomplete, or ambiguous, you have the right to ask us to correct it.
• Right of erasure (right to be forgotten): You may ask us to delete personal information that we collected without legal authority, that is no longer necessary for the purposes for which it was collected, or where you have withdrawn your consent and there is no other legal basis for retaining it.
• Right to data portability: You have the right to receive personal information that you provided to us in a structured, commonly used, and machine-readable format, and to have it transmitted to another organization where technically feasible.
• Right to withdraw consent: Where we process your personal information based on your consent (for example, for analytics cookies, marketing cookies, or our newsletter), you may withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. You can manage your cookie preferences at any time through our consent banner, and unsubscribe from our newsletter via the link included in every email we send.

If you believe that we have not handled your personal information in accordance with Quebec Law 25, you have the right to file a complaint with the Quebec Information Access Commission (CAI) at https://www.cai.gouv.qc.ca. We encourage you to contact us first so we can try to resolve your concern directly.

8. Person Responsible for the Protection of Personal Information

In accordance with section 3.1 of Quebec Law 25, we have designated a Person responsible for the protection of personal information who oversees our compliance with the Act and serves as your point of contact for any privacy-related questions or requests.

• Name: Fannie Laroche Fannie Laroche
• Title / Role: co-founder
• Email: info@flauracuirvegetal.com
• Phone: 514 247-3655

You may contact our Person responsible for the protection of personal information at any time to exercise your rights, ask questions about this policy, or raise a concern about how your personal information is being handled. We are committed to responding to all requests within 30 daysas required under Quebec Law 25.

9. Effective Date and Versioning

This privacy policy takes effect on June 10, 2026 and supersedes any previous version.

Version: 1

We may update this policy from time to time to reflect changes in our practices, the services we use, or applicable law. When we make material changes, we will update the effective date above and, where appropriate, notify you by email or through a notice on our website. We encourage you to review this policy periodically.

This policy was generated and is hosted by Moelleux (by Horizon-Cumulus)consent records are hosted in Quebec via OVH Beauharnois, a Quebec-based consent management and privacy policy platform operated by 9322-8310 Québec inc (Joliette, Quebec). Consent records are hosted in Quebec via OVH Beauharnois.