External Privacy Policy Effective April 12, 2023 Policy #20-1

1. Purpose

Source Atlantic Limited, its parent company, subsidiaries, and affiliates (collectively, the “Company”, “we”, or “us”) are committed to protecting your personal information. This Privacy Policy (the “Policy”) describes how the Company collects, uses, discloses, and protects personal information about you. Please visit the Company’s webpage at www.sourceatlantic.ca to learn more about our group of companies. This is the current version of this Privacy Policy.

2. Scope and Application:

2.1 This Policy relates to the personal information collected by the Company in Canada or the U.S., as well as via our websites. This Privacy Policy addresses:

a) What does this Privacy Policy include?

b) What is personal information?

c) What personal information do we collect?

d) How do we collect your personal information?

e) How do we use your personal information?

f) With whom do we share your personal information?

g) How do we manage your consent?

h) How do we manage your privacy preferences?

i) How long do we retain your personal information?

j) What are your privacy rights?

k) What happens when you use our websites?

l) How do we protect your personal information?

m) How can you contact us about your privacy rights and additional information?

n) How do we keep our Privacy Policy up to date?

3. What does this Privacy Policy Include?

3.1 This Policy describes how we handle your personal information. This Policy applies to you in the course of all of your dealings and interactions with the Company, including when you visit one of our websites, sign up to be a part of any of our programs, promotions, contents, or events, apply for or purchase our products, or receive any of our services (collectively, the “Services”).

3.2 Please note that a specific privacy notice and/or additional terms and conditions may apply to how we are collecting and managing your personal information when you engage with some of our Services. If so, you will be provided with a specific privacy notice and/or additional terms and conditions relating to such Services, and such notice, terms and conditions are incorporated by reference into this Policy. For example, you are required to accept certain terms and conditions when you enter a contest. Those terms and conditions apply together with this Policy.

4. What is personal information?

4.1 Personal information is any information that identifies you or could be associated with you. This can include:

a) Your full name, age, date of birth, and gender.

b) Your billing or delivery address.

c) Your email address(es) and phone numbers (including for your mobile phone).

d) Your username.

e) Your current location.

f) Your browser history.

g) Your Social Insurance Number; or

h) Your credit card or other financial information, etc.

5. What personal information do we collect?

5.1 We limit the collection of personal information to what is reasonably necessary to fulfill the purposes for which it was collected.

5.2 We collect personal information, as defined below, in a variety of ways, including directly from you, and from third parties:

a) Contact information: We may collect your names and your usernames. We may also collect shipping addresses, phone numbers, email addresses and other digital contact or user information you provide or is provided to us by others in accordance with applicable third-party data and privacy policies.

b) Government-Issued Identification: Driver’s license or other similar government issued information, if required by law to validate your identity, for example, if you win a contest.

c) Transactional information: We may collect your purchase and billing history, shipping history, your payment information, including information from your credit or debit cards, and/or cheques. We may also collect authentication information, such as your signature and information we may need to extend creditto you.

d) Website information: When you visit our websites or use our apps we may collect your IP address, pages viewed, browser type, device information, location information, Internet Service Provider, domain name, the time/date of your website visit(s), the referring URL; screen resolution, exit page, time on page, email or ad clicked to bring you to site, buttons clicked while on site, on-site search queries, mouse tracking, and your computer’s operating system.

e) Demographic information: We may collect information about products or services you like, reviews you submit or where you shop. We may also collect information about your age and gender.

f) Location information: If you use our mobile websites or apps, we may collect location data from your device or related to your IP address. We use location data to find our nearest location to you, provide product pricing and/or availability, and provide you with driving directions. If you would prefer not to provide us with your device location information, you can control what location information is shared in the settings menu of your device.

g) Employment-related information: We collect information provided to us if you apply for an employment opportunity. This may include information included within resumes, cover letters or similar related materials.

h) Registration Information: If you register on our websites to attend an event or enter a contest, sweepstakes, promotion, or any other program offering of ours, we collect personal information such as your name, email address and other information required to administer your participation in the program.

i) Other information: We may collect any information or content you provide through our websites, social media accounts, online forums, emails, or written communications with us.

6. How do we collect your personal information?

6.1 Directly from you including:

a) via our website, including forms on our website;

b) from our surveys, loyalty programs and our contests;

c) from purchases (or returns), rentals, or leases of our products, services or spaces;

d) from credit applications and financial transactions with us;

e) from information provided via one of our sales channels, including email addresses to receive receipts;

f) if you apply or inquire about our Services;

g) if you apply or inquire about employment opportunities; or

h) from spoken and written communications with us.

6.2 Passively through browser and device cookies;

6.3 From other sources including:

a) our business partners;

b) shipping vendors who share updated addresses;

c) a friend, family member or associate of yours that does business with us, refers us, or is employed by us;

d) one of our affiliated companies.

7. How do we use your personal information?

7.1 We use the information we collect for our business purposes including:

a) To communicate with you about your account or our relationship with you;

b) To deliver the Services;

c) To market the Services;

d) To respond to your questions and requests;

e) To improve the Services;

f) To improve our facilities;

g) To improve your experience with the Services or our websites;

h) To identify trends and customer interests;

i) For security and loss prevention purposes;

j) For employment purposes;

k) For other uses we may disclose to you from time to time; or

l) Otherwise with your consent or as required or authorized by applicable law.

8. To whom do we share your personal information?

8.1 We may share your personal information as legally required or permitted, including:

a) Within our group of companies across Canada and the U.S. and with our service providers who provide services on our behalf, such as delivery services, payment processors, email deployment agencies, advertising and analytics services. By providing information to us you are consenting to the transfer of personal information to facilities that may be located outside of Canada, and understand that your information may be stored, accessed or processed in accordance with U.S. law. In no event will any of our service providers have the right to use your personal information for any reason other than to provide you with the services we specify, except as permitted by law. We may authorize our service providers to collect information on our behalf and we may share information with the vendors and manufacturers of our products and services to respond to your reviews and questions. We require our service providers to comply with this Policy and applicable laws in relation to the privacy and security of personal information and to notify us if they become aware of a privacy breach involving personal information that has been provided to them by the Company. The Company accepts no liability arising out of the negligence or fault of our service providers except as required by applicable law. For further information on the sharing of your information with our group of companies and our service providers, please contact us at [email protected].

b) We do not sell your personal information to any organization or person, except as part of a sale of all or substantially all of our business.

c) We may share your information with other entities (including actual or prospective buyers and our affiliates) in the event that we are involved in a bankruptcy, merger, reorganization or sale of any of our businesses and/or assets.

d) We may share your information in order to comply with the law. For example, we may disclose information to respond to a court order or subpoena. We may also disclose information to a government agency or investigatory body, or as otherwise required or permitted under applicable US, Canadian or foreign laws.

e) Finally, we may share your information for safety, security, and loss prevention. We may disclose your information to our suppliers or other business partners who need to contact you about a specific product safety issue or recall. We may, at your direction, provide information to a third party to facilitate resolution of a dispute. We may disclose information if we suspect fraud or share information as part of an investigation, and we may disclose personal information to assist us in collecting a debt owed.

9. How Do We Manage Consent?

9.1 By using the Services, you are providing your consent to the collection, use and disclosure of personal information as set out in this Policy.

9.2 In some cases, your consent may be “implied” in that your permission is assumed given the type of information being collected, your actions orinactions at the point where we collected your information and the purpose(s) for our use and storage of that information.

9.3 If we want to use your personal information for a new purpose, we will seek and obtain your consent priorto doing so.

10. How do we manage your privacy preferences?

10.1 Your consent can be withdrawn at any time, except in limited circumstances, including where there are legal or regulatory requirements or as a result of your contractual obligations with us. For example, if you have applied for credit which we extended to you, your consent regarding sharing your personal information to update credit reports and credit history with credit bureau agencies and other entities that support credit reporting history cannot be withdrawn during the time you have the credit with us and for a reasonable period afterwards.

10.2 Where you may choose not to provide us with certain personal information or withdraw your consent, we may not be able to offer you all of the Services that you requested or that could be offered to you.

10.3 Regarding our marketing communications to you: You may opt-out of all forms of our marketing messages by contacting us at [email protected]. Opting out of marketing messages will not prevent you from being able to receive emails regarding transactions like confirming or following up on an order, responding to your inquiry or notifying you of product recalls, etc.

10.4 Regarding personal information collected via our websites: You may update your browser settings on your device to delete or disable most of our cookies. You may also change your preferences on your device to turn off notifications, and location trackers.

11. How long do we retain your personal information?

11.1 How long we retain your personal information will depend on the type of information and the purpose for which we use or process that information. We will not store your personal information longer than necessary to carry out the purposes for which we collected your personal information.

11.2 The Company businesses include regulated entities who are subject to a variety of records retention requirements and may be required to retain your personal information for an extended period of time due to related legal obligations.

11.3 Where you request deletion of your personal information, we will inform you of any requests with which we cannot comply due to our policies, applicable law or otherwise.

12. What are your privacy rights?

12.1 You may request details about the personal information we have about you, subject to any legal restrictions. Upon request, we will provide you with access to your personal information within a reasonable timeframe, in compliance with applicable laws.

12.2 If you believe any of your personal information that we are holding is incorrect or incomplete, please contact us as soon as possible.

12.3 To support you with your access and correction requests, please contact us at [email protected]. We will take reasonable steps to correct any personal information found to be incorrect.

13. What happens when you use our websites?

13.1 Our websites use cookie technology, including session cookies and persistent cookies to ensure that our websites function properly and to make your use of our websites more convenient. A cookie is a text file which enables the respective website to store information about your activities on that site, or the length of your stay. A session cookie is a temporary cookie that is deleted when a browser session ends. A persistent cookie is used to remember your site preferences within our websites, such as language, sign-in information, or other preferences, and these remain on your device until you erase them or they expire.

13.2 We also use third-party cookies and other similar technologies that are managed by other parties, such as our business partners or service providers. These include:

a) analytical / performance cookies, which are stored on your device, to help us analyze how our website is used. Our service providers collect this information on our behalf and compile statistical reports for our use which help us improve the content and functionality of our website. These analytical / performance cookies do not allow us to identify specific individuals. For more information on our current service providers, including Google Analytics, Wistia, Hotjar and Ubersuggest please see their respective privacy policies.

b) cookies and other similar technologies such as web beacons, pixels and anonymous ad network tags, which may include an anonymous unique identifier. These are used for marketing and advertising purposes and to help you see ads on our websites and other websites that are matched to your interests.

13.3 Most web browsers are set to accept cookies by default; however, you should be able to disable most cookies associated with our websites via your browser settings. If you choose to do so, this may affect the functionality of the respective website and your ability to access certain features of that website. You may also change your preferences on your device to turn off notifications, and location trackers. You can opt out of third-party cookies used for targeted advertising by adjusting your cookie settings. To explore your options for opting out of targeted advertising, please see http://youradchoices.ca/choices.

14. How do we protect your personal information?

14.1 We are committed to ensuring that your personal information is secure. In order to prevent unauthorized access or disclosure, we have put in place reasonable and appropriate administrative, technical and organizational measures to safeguard and secure the personal information we process. This includes controls to prevent any unauthorized access, collection, use, disclosure, copying, modification or disposal of your personal information in accordance with applicable law.

14.2 We try to exercise care in the secure transmission of your information, and we have taken the steps that are reasonably available to us to protect any personal information that you have provided to us, including, in its disposal or destruction in due course.

14.3 Please remember that you control what personal information you provide while interacting with us and while using our websites.

14.4 If, despite all our efforts, a personal information breach does occur, we will take all reasonable steps to limit the damage. In case of a data breach which is likely to result in a risk of significant harm to you, and depending on the circumstances, we will make the appropriate notifications as required by law without unreasonable delay.

15. How can you contact us about your privacy rights and additional information?

15.1 If you have any questions about this Privacy Policy, including withdrawing consent, you may contact us at [email protected].

15.2 If you are not satisfied with our handling of any privacy complaints, you have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada or with the Privacy Commissioners of Alberta, BC or Quebec, as per your province of residence.

16. How do we keep our Privacy Policy up to date?

We review and update our policies and procedures as required to keep current with rules and regulations, new technologies, standards and customer concerns. Therefore, from time to time, we may need to update this Policy. By continuing to use the Services you are consenting to the updated terms of this Policy. The current version of our Privacy Policy will always be posted on our website.

Government legislation is monitored for updates; as required, policies will be changed accordingly Policy #20-1 Effective April 12, 2023 Policy Status: New Corporate Policy External Privacy Policy