1. Data controller

This privacy policy is published by Tricot(hereinafter “we” or “the company”), a Quebec-based company subject to the An Act to modernize legislative provisions respecting the protection of personal information (L.Q. 2021, c. 25), commonly known as “Bill 25.”

As a company that collects, uses, and discloses personal information in the course of its business, Tricot is committed to complying with the obligations set forth in Act 25, particularly with regard to transparency, consent, and the protection of the personal information of its customers, visitors, and partners.

This policy applies to anyone who visits our website, makes an online purchase, or contacts us electronically.

2. Personal information collected

Depending on the nature of your interaction with our website, we may collect the following categories of personal information:

Identification and contact information

• First and last name
• Postal address
• Email address
• Phone number

Transaction Information (E-commerce)

• Order details (items, quantities, amounts)
• Purchase History
• Billing and Shipping Information
• Payment information (processed directly by Stripe—we do not store your card numbers)

Navigation and technical information

• IP address
• Pages Visited and Session Duration
• Browsing behavior (clicks, scrolling, interactions)
• Device and Browser Identifiers
• Heatmap data and session recordings (Microsoft Clarity)

Advertising Information

• Advertising identifiers
• Social Media Handles (Meta/Facebook)
• Conversion and behavioral data related to advertising campaigns

Consent preferences

• Cookie Consent Options (Stored via Moelleux by Horizon-Cumulus)

We collect this information directly from you (when you make a purchase or contact us) or automatically through cookies and similar technologies, subject to your consent when required.

3. Purposes of processing

We use your personal information only for the purposes described below. For each purpose, we indicate the legal basis on which we rely.

Order Processing and Customer Service

Purpose: Process your purchases, manage deliveries, issue invoices, and respond to your inquiries.
Services involved : WooCommerce, Stripe.
Legal basis: Performance of a contract — processing is necessary to fulfill your order.

Audience measurement and site improvement

Purpose: To understand how visitors use our site so that we can improve its content and the browsing experience.
Services involved : Google Analytics 4, Microsoft Clarity, WooCommerce Analytics.
Legal basis: Consent — these analytics cookies are only enabled after you give your explicit consent.

Targeted Advertising and Retargeting

Purpose: To display relevant ads on third-party platforms and measure the effectiveness of our marketing campaigns.
Services involved : Meta Pixel (Facebook).
Legal basis: Consent — These marketing cookies are only enabled after you give your explicit consent.

Website Display and Functionality

Purpose: Ensure the website displays properly (fonts) and that payments are processed securely.
Services involved : Google Fonts, Stripe.
Legal basis: Legitimate interest — these elements are necessary for the technical operation of the website and the security of transactions.

Consent Management

Purpose: Save and remember your cookie consent choices so that we can respect your preferences on every visit.
Services involved : Moelleux by Horizon-Cumulus.
Legal basis: Legal obligation—Bill 25 requires us to document the consents obtained.

4. Third parties and subcontractors

The following table lists all third-party services integrated into our website, their purpose, their category, and whether information may be transferred outside of Quebec.

We do not sell your personal information to third parties. We only share it with the service providers listed above, to the extent necessary to fulfill the purposes described in Section 3.

5. Transfers outside Québec

In accordance with section 17 of Act 25, we hereby inform you that several of the third-party services we use process personal information outside of Quebec, primarily in the United States.

The following services involve the transfer of personal information to the United States:

• Google Analytics 4 (Google LLC, United States) — Your IP address, the pages you visit, and your browsing behavior may be processed on servers in the United States.
• Microsoft Clarity (Microsoft Corporation, United States) — your browsing data and session logs may be processed in the United States.
• WooCommerce Analytics (Automattic Inc., United States) — the store's performance data may be transmitted to servers in the United States.
• Meta Pixel (Facebook) (Meta Platforms Inc., United States) — your advertising identifiers and behavioral data are transmitted to Meta in the United States.
• Google Fonts (Google LLC, United States) — Your IP address is shared with Google when fonts are loaded.
• Stripe (Stripe Inc., United States) — your transaction and payment data are processed in the United States.

Before proceeding with these transfers, we ensure that adequate safeguards are in place, in particular by entering into contractual agreements with these providers (standard contractual clauses, privacy policies that comply with recognized international standards). These measures are intended to ensure a level of protection equivalent to that provided by Quebec law.

For analytics and marketing services (Google Analytics 4, Microsoft Clarity, Meta Pixel), these data transfers take place only after we have obtained your explicit consent through our Moelleux consent manager.

Website hosting: Our website is hosted in Quebec by Horizon-Cumulus. Data related to your consent and this privacy policy are also stored in Quebec (OVH Beauharnois).

E-mail : Our email communications are routed through Microsoft 365 (Microsoft Corporation, United States). Your email address may therefore be processed in the United States in this context.

6. Shelf life

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or to comply with our legal obligations. The following table outlines our retention practices.

Once these time limits have expired, your information is securely destroyed or irreversibly anonymized, in accordance with section 23 of Act 25.

7. Rights of persons concerned

Bill 25 grants you several rights regarding the personal information we hold about you. Here is an overview of those rights and how to exercise them.

Your right of access

You have the right to know what personal information we hold about you and to obtain a copy of it. We will respond to you within 30 days of receiving your request.

Right of rectification

If any information about you is inaccurate, incomplete, or ambiguous, you may ask us to correct it. We will make the correction as soon as possible.

Right to erasure (right to be forgotten)

You may request that your personal information be deleted when it is no longer necessary to retain it for the purposes for which it was collected, subject to our legal retention obligations (for example, tax data that we are required to retain for 7 years).

Right to portability

You have the right to receive, in a structured, commonly used, and machine-readable format, the personal information you have provided to us, so that you can transmit it to another data controller.

Right to withdraw consent

When the processing of your information is based on your consent, you may withdraw it at any time, without any adverse consequences for you. You can change your cookie preferences directly through our Moelleux consent manager, accessible from our website. Withdrawing your consent does not affect the lawfulness of the processing carried out prior to such withdrawal.

How to exercise your rights

To exercise any of these rights, please contact our Privacy Officer using the contact information provided in Section 8. We will acknowledge receipt of your request and respond within a maximum of 30 daysin accordance with Law 25.

Right to File a Complaint with the Commission on Access to Information

If you believe that your rights have not been respected or that your personal information has been processed in violation of Act 25, you have the right to file a complaint with the Commission for Access to Information (CAI) :

• Website : www.cai.gouv.qc.ca

8. Privacy Officer

In accordance with Section 8.1 of Act 25, Tricot has appointed a Privacy Officer (RPRP). Any questions, requests, or concerns regarding the protection of your personal information should be directed to the Privacy Officer.

• Name : Tricot
• Title / Address: 280 rue Beauchemin Dolbeau-Mistassini (Québec) G8L3H6 Canada
• E-mail : info@teamtricot.com
• Phone : 418 476-4487

We are committed to acknowledging receipt of any request as soon as possible and responding to it within a maximum of 30 days following receipt, in accordance with the legal time limit stipulated in Law 25.

Technical note: Our email infrastructure uses Microsoft 365 (U.S.). Your inquiry email may therefore pass through U.S. servers. If you would like all communication to be hosted entirely in Quebec, you can reach us by phone at the number listed above.

9. Effective date and versioning

This Privacy Policy is effective as of July, 8 2026 and corresponds to the version 2.

We reserve the right to modify this policy at any time to reflect changes to our practices, our services, or applicable laws. In the event of a significant change, we will notify you by posting a prominent notice on our website. The most recent version is always the one published on this page.

We encourage you to review this policy periodically to stay informed about how we protect your personal information.

This policy was generated and is hosted by Moelleux, a consent and privacy policy management service operated by Horizon-Cumulus (9322-8310 Québec inc.), Joliette (Québec). Consent records and the policy are stored in Québec (OVH Beauharnois).