Data Controller / Person Responsible for Personal Information

Parts Avatar Investments Inc.

245 Matheson Blvd E

Mississauga, Ontario, Canada L4Z 3K2

Privacy Officer / Responsable de la protection des renseignements personnels

Email: privacy@partsavatar.ca

General Support: support@partsavatar.ca

Mail: Privacy Officer, Parts Avatar Investments Inc., 245 Matheson Blvd E, Mississauga, ON, Canada L4Z 3K2

We have designated a Privacy Officer responsible for compliance with applicable Canadian privacy laws. As an Ontario-based commercial organization, Parts Avatar is primarily governed by the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) in respect of its commercial activities. Where our customers reside in provinces with their own substantially similar private-sector privacy laws — British Columbia’s Personal Information Protection Act (“BC PIPA”), Alberta’s Personal Information Protection Act (“Alberta PIPA”), and Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25 (“Quebec Law 25”) — we comply with those laws in respect of those residents. We also comply with Canada’s Anti-Spam Legislation (“CASL”). The Privacy Officer is the contact point for all Canadian and U.S. state privacy law requests.

This Policy applies to personal information that Parts Avatar collects, uses, or discloses about:

• visitors to our websites and apps;

• registered account holders and guest checkout customers;

• subscribers to our marketing communications;

• callers to our customer-service lines and users of our chat or messaging tools;

• recipients of our deliveries; and

• people who interact with our advertising on third-party platforms (such as Meta/Facebook, Google, TikTok, Bing/Microsoft, YouTube, Reddit, X, Pinterest, and Snapchat).

This Policy does not apply to personal information that is collected and used independently by third-party platforms (for example, a credit-card network, a courier, or a payment gateway operating as an independent controller), or to other companies’ websites you reach by following a link from our Services. Those third parties have their own privacy practices that we do not control.

The categories of personal information we collect depend on how you interact with the Services. We collect the following categories:

(a) Identifiers and Contact Information. Name, billing and shipping addresses, email address, phone number, account username, password (stored in hashed form), order history, and unique online identifiers such as device IDs, cookie IDs, mobile advertising IDs, and IP addresses.

(b) Commercial Information. Products viewed, searched, added to cart, purchased, returned, or refunded; the vehicle make, model, year, trim, VIN (only if you provide it for fitment), and other vehicle-fitment data; product reviews, ratings, and feedback; loyalty or rewards balances; warranty registrations.

(c) Financial Information. Payment-card data (collected directly by our PCI-DSS-compliant payment processor — Parts Avatar does not store full payment-card numbers); billing address; the last four digits and brand of payment cards stored for re-order convenience.

(d) Internet, Device, and Usage Information. IP address; browser type and version; operating system and version; device type and model; mobile carrier; referring and exit URLs; pages viewed; clicks, scrolls, mouse-overs, taps, swipes; time on page; date/time stamps; download errors; preferred language; locale and timezone; precise or approximate geolocation derived from IP or device signals; battery and connectivity metrics relevant to app performance.

(e) Audio, Visual, and Communications Information. Recordings or transcripts of calls to our customer-service lines (you will be advised at the start of the call); chat transcripts; emails and other messages you send us; images, photos, videos, and files you upload (for example, to document a warranty claim or return); contact-form submissions.

(f) Inferences. Profiles we build by combining the above to predict your preferences, propensity to purchase, vehicle fitment matches, and product recommendations.

(g) Professional or Employment Information. For business customers, fleet operators, repair shops, jobbers, and vendors, we may collect business name, role/title, GST/HST or PST registration numbers, resale certificate information, and shipping account numbers.

(h) Information from Other Sources. Updated delivery and address information from couriers (Canada Post, Purolator, FedEx, UPS, etc.); identity- and fraud-prevention signals from anti-fraud vendors; advertising audience and conversion data from advertising and analytics partners; publicly available business directories; and information from co-branded partners or referral programs.

Sensitive Personal Information. Our Services are not designed to collect sensitive categories of personal information (for example, government identifiers other than those you optionally provide for tax-exempt accounts, precise geolocation beyond what’s necessary to estimate shipping, health data, religious or philosophical beliefs, racial or ethnic origin, union membership, sex life or sexual orientation, biometric data, or children’s data). We do not knowingly collect such information through our Services. Please do not submit sensitive personal information to us unless we specifically request it for a stated purpose.

We collect personal information:

• directly from you when you create an account, make a purchase, contact customer service, submit a review, fill in a form, participate in a survey or promotion, or subscribe to communications;

• automatically through cookies, web beacons, software development kits (SDKs), server logs, and similar technologies (see Section 8 below);

• from third parties, including couriers, payment processors, fraud-prevention vendors, marketing and analytics partners, identity-verification services, and publicly available sources.

Where reasonably possible, we collect personal information directly from you. Where we collect it from third parties, we do so only as permitted by law.

We use personal information for the following purposes, and we limit the use of each category to what is reasonable to achieve those purposes:

(a) to create and administer your account, authenticate you, and provide customer support;

(b) to process and fulfil your orders (including picking, packing, shipping, returns, refunds, exchanges, and warranty claims);

(c) to verify your identity and prevent fraud, chargebacks, abuse of promotions, account takeover, and other illegal or harmful activity;

(d) to process payments, taxes, and shipping fees;

(e) to communicate with you about your orders, account, surveys, programs, and changes to our terms;

(f) to provide product recommendations, vehicle fitment, search results, and a personalized experience;

(g) to send marketing communications and serve interest-based and retargeted advertising, where permitted (see Sections 8 and 9);

(h) to measure the performance of our marketing, advertising, and website features (analytics);

(i) to operate, secure, monitor, troubleshoot, debug, and improve the Services;

(j) to comply with legal obligations, including tax, accounting, consumer-protection, product-safety, recall, and customs laws;

(k) to enforce our Terms of Use, protect our rights, and respond to legal process; and

(l) for any other purpose for which we obtain your specific consent.

Legal bases under Canadian and similar laws. Under Canadian privacy laws, we rely on your express or implied consent, the necessity of the processing for performance of a contract with you, our legitimate business interests where appropriate and reasonable, and our compliance with legal obligations. Under the European General Data Protection Regulation (“GDPR”) and the UK GDPR (which may apply if you are in the European Economic Area, the United Kingdom, or Switzerland), we rely on the corresponding legal bases (Article 6: consent, contract, legitimate interest, legal obligation, vital interest, public task). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Parts Avatar does not sell personal information for money. We do, however, share or disclose personal information as described below. Under some U.S. state laws (notably the California Consumer Privacy Act, as amended by the California Privacy Rights Act, collectively “CCPA”), some of these activities may be characterized as “selling” or “sharing for cross-context behavioural advertising.” See Section 13 for California-specific disclosures and your right to opt out.

(a) Service providers / processors. Companies that perform services for us under written contract and may use personal information only as we direct, including:

(b) Affiliates and corporate group. Other entities in the Parts Avatar corporate family, where they are bound by privacy practices at least as protective as those in this Policy.

(c) Business transactions. Counterparties and their advisors in a merger, acquisition, financing, restructuring, insolvency, sale of assets, or similar transaction, subject to confidentiality safeguards.

(d) Legal and safety. Law enforcement, regulators, courts, and other parties where we believe in good faith that disclosure is required by law, legal process, or court order, or is necessary to enforce our agreements, investigate fraud, protect against threats, or protect the rights, property, or safety of Parts Avatar, our customers, or the public.

(e) With your direction or consent. Any other party you authorize, including when you participate in a co-branded program, social-media login, share content publicly on the Services, or specifically request the disclosure.

We require service providers to handle personal information consistent with this Policy and applicable law, and to implement appropriate technical and organizational measures.

Parts Avatar is headquartered in Canada, and personal information is primarily stored and processed in Canada. However, some of our service providers and other entities for the Parts Avatar corporate group store or access personal information in the United States or other countries. When personal information is transferred outside the province in which you reside, or outside Canada, it becomes subject to the laws of the country where it is stored or accessed, including lawful access by foreign government, courts, and law-enforcement authorities.

Quebec residents — Law 25 notice. If you are located in Quebec, you have the right, before your personal information is transferred outside Quebec, to be informed of (i) the personal information that may be transferred, (ii) the purposes of the transfer, (iii) the categories of recipients, (iv) the place(s) where the information may be communicated, and (v) the privacy risks associated with the destination. We have completed a Privacy Impact Assessment (PIA) for these transfers in accordance with section 17 of Quebec Law 25. To request a summary of that PIA or further information, contact our Privacy Officer.

By using the Services, you acknowledge that your personal information may be transferred to, processed, and stored in the United States and other jurisdictions where our service providers and other entities for the Parts Avatar corporate group operate, subject to contractual safeguards that we determine provide a level of protection equivalent to that required under Canadian law.

We send marketing emails, SMS messages, and push notifications only with your consent, except where applicable law (including Canada’s Anti-Spam Legislation, the U.S. CAN-SPAM Act, and the U.S. Telephone Consumer Protection Act) permits us to send them without consent (for example, transactional messages about an existing order).

You can withdraw consent and unsubscribe at any time:

• Email: click the “Unsubscribe” link at the bottom of any marketing email.

• SMS: reply STOP to any marketing SMS.

• Push notifications: disable push notifications in your device settings.

• Account preferences: update your communication preferences in your account settings.

We will process unsubscribe requests within 10 business days, as required by CASL.

We may continue to send you transactional and service messages (for example, order confirmations, shipping updates, account-security notices, and recall notices) even after you unsubscribe from marketing.

We use limited automated decision-making for fraud prevention, payment risk-scoring, product recommendations, search ranking, and personalized marketing. We do not make decisions that produce significant legal or similarly significant effects on you solely on the basis of automated processing without human involvement, except where (i) the decision is necessary to enter into or perform a contract with you (for example, declining a high-risk transaction), (ii) the law authorizes it, or (iii) you have given express consent.

Quebec residents — Law 25 notice. If a decision based exclusively on automated processing is made about you, you may, on request, be informed of the personal information used to make the decision, the reasons and principal factors that led to the decision, and your right to have the information used corrected. You may also request a human review of the decision by contacting our Privacy Officer.

We retain personal information only as long as reasonably necessary to fulfil the purposes for which it was collected, comply with our legal and accounting obligations, resolve disputes, and enforce our agreements. After that, we destroy, delete, or anonymize the information.

Indicative retention periods (subject to longer retention required by tax, accounting, customs, product-safety, warranty, recall, fraud, or litigation-hold obligations):

We maintain administrative, technical, and physical safeguards designed to protect personal information from loss, theft, unauthorized access, disclosure, copying, use, or modification. These include encryption in transit (TLS), encryption at rest for sensitive fields, access controls and least-privilege provisioning, multi-factor authentication for administrative accounts, network segmentation, vulnerability management, secure software development practices, employee training, vendor risk assessments, and incident-response procedures. Our payment processors are validated as PCI-DSS-compliant.

No security program is perfect. If we become aware of a confidentiality breach that creates a real risk of significant harm, we will notify affected individuals and applicable regulators as required by PIPEDA, BC PIPA, Alberta PIPA, Quebec Law 25, and the U.S. state breach-notification statutes.

You play an important role. Choose a unique, strong password; keep your account credentials confidential; enable multi-factor authentication if available; and notify us immediately at privacy@partsavatar.ca if you suspect unauthorized activity.

Subject to applicable law and reasonable verification, you have the following rights. Where rights differ by jurisdiction, the jurisdiction-specific section governs.

13.1 Rights for Everyone

• Access. Request a copy of the personal information we hold about you.

• Correction. Request that we correct inaccurate, incomplete, or out-of-date personal information.

• Withdrawal of consent. Withdraw consent at any time for processing based on consent, subject to legal and contractual limits.

• Unsubscribe from marketing communications.

13.2 Canadian Residents

In addition to the rights above:

• Challenge our compliance with applicable Canadian privacy laws by contacting our Privacy Officer. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca), the Office of the Information and Privacy Commissioner for British Columbia (https://www.oipc.bc.ca), the Office of the Information and Privacy Commissioner of Alberta (https://www.oipc.ab.ca), the Commission d’accès à l’information du Québec (https://www.cai.gouv.qc.ca), or another relevant regulator.

13.3 Quebec Residents (Law 25)

You also have:

• Portability — the right to receive personal information you have provided in a structured, commonly used, technological format, and to have it communicated to another organization where technically feasible.

• De-indexing / cessation of dissemination — the right to require us to cease disseminating your personal information or to de-index a link enabling access to it where the dissemination contravenes the law or a court order, or causes serious injury that outweighs the public interest.

• Information about automated decisions — see Section 10.

• Information about transfers outside Quebec — see Section 7.

13.4 California Residents (CCPA/CPRA)

If you are a California resident, you have the rights described below. Parts Avatar has not “sold” personal information for monetary consideration in the preceding twelve (12) months. We do, however, “share” personal information for cross-context behavioural advertising as those terms are defined under the CCPA, through the Tracking Technologies described in Section 8.

Rights:

• Right to know. Request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes, and the categories of third parties to whom we have disclosed personal information.

• Right to delete. Request deletion of personal information we have collected from you, subject to exceptions (for example, completing a transaction, detecting fraud, complying with a legal obligation, exercising free speech, internal uses reasonably aligned with your expectations).

• Right to correct inaccurate personal information.

• Right to opt out of sale or sharing. Direct us not to “sell” or “share” your personal information for cross-context behavioural advertising. We honour the Global Privacy Control (GPC) signal as a valid opt-out for the browser and device transmitting it. You can also opt out at any time using our “Your Privacy Choices” / “Do Not Sell or Share My Personal Information” link in the website footer.

• Right to limit the use of sensitive personal information. While we do not generally process sensitive personal information for purposes that trigger the right to limit, you may submit such a request to our Privacy Officer.

• Right to non-discrimination. We will not discriminate against you for exercising your privacy rights (for example, by denying goods or services or charging different prices), except as permitted by law for participation in voluntary financial-incentive programs we may offer.

• Authorized agents. You may designate an authorized agent to submit requests on your behalf, subject to our verification of the agent’s authority and your identity.

Notice at Collection. The categories of personal information we collect, the purposes for which they are used, and the categories of third parties to whom they are disclosed are set out in Sections 3, 5, and 6. The retention periods are set out in Section 11.

How to exercise California rights. Email privacy@partsavatar.ca with the subject “California Privacy Request,” visit the “Your Privacy Choices” link in our website footer, or call our toll-free customer support and ask for the Privacy Officer. We will verify your identity before responding (for example, by confirming information you have on file with us) and aim to respond within 45 days, with a possible 45-day extension where reasonably necessary. We provide responses for the preceding 12-month period.

13.5 Other U.S. State Residents

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Jersey, Indiana, Tennessee, Nebraska, New Hampshire, Kentucky, Maryland, Minnesota, Rhode Island, or another U.S. state with a comprehensive consumer-privacy law, you generally have rights to access, correct, delete, port, and opt out of “targeted advertising,” “sale,” and certain “profiling” activities, and to appeal a denial of a request. To exercise these rights, contact privacy@partsavatar.ca with the name of your state in the subject line. We respond within the timelines required by your state’s law (typically 45 days, with extensions where permitted).

13.6 European Economic Area, United Kingdom, and Switzerland

If you are in the EEA, UK, or Switzerland, you also have the rights of access, rectification, erasure, restriction, portability, and objection under the GDPR / UK GDPR / Swiss FADP, the right to withdraw consent, and the right to lodge a complaint with your supervisory authority.

13.7 How We Handle Requests

We will verify your identity using information you provide and information we already have. We may decline or limit a request as permitted or required by law (for example, where granting it would infringe another person’s rights, reveal trade secrets, or compromise an investigation). We do not charge a fee for the first request in a 12-month period.

The Services are intended for adults. We do not knowingly collect personal information from children under the age of 14 (or the lower age of consent for online services in your province or country) without verifiable parental consent. If you are a parent or guardian and believe we have collected personal information from your child without consent, contact privacy@partsavatar.ca and we will delete it promptly.

For California residents under 16, we do not “sell” or “share” personal information for cross-context behavioural advertising without affirmative authorization (opt-in) from the minor or, for those under 13, from the parent.

We comply with the U.S. Children’s Online Privacy Protection Act (“COPPA”) and analogous provisions in Canadian privacy laws (including the heightened consent standard for minors under Quebec Law 25).

The Services may contain links to, or embeds from, third-party websites, plug-ins, services, or applications (for example, Google Maps, YouTube videos, social-media share buttons, payment provider widgets, single-sign-on logins, and trust-mark seals). These third parties may collect personal information about you, including through Tracking Technologies they control. This Policy does not apply to those third parties; please review their privacy notices before interacting with them.

We may update this Policy from time to time. The “Last Updated” date at the top reflects the most recent revision. If we make material changes, we will provide notice as required by applicable law (for example, by posting a prominent notice on the Services, sending an email, or, where required, obtaining renewed consent). Your continued use of the Services after the Effective Date of an updated Policy indicates your acceptance of the updated terms, except where we are required to obtain renewed consent.

We will never materially reduce the protections of this Policy with respect to personal information already collected, without your consent.

This Privacy Policy is governed by and construed in accordance with the laws of the Province of Ontario and the federal laws of Canada applicable in Ontario, without regard to its conflict-of-laws principles. Subject to applicable consumer-protection laws that grant you a right to bring proceedings in your local courts, the courts of Ontario have non-exclusive jurisdiction over any dispute arising out of or relating to this Policy.

If any provision of this Policy is held by a court of competent jurisdiction to be invalid or unenforceable, the remaining provisions remain in full force and effect.

For California, Virginia, Colorado, Connecticut, Utah, Texas, and other U.S. residents, nothing in this Policy is intended to waive any non-waivable right under your home state’s privacy laws.

For privacy questions, requests, or complaints, contact:

Privacy Officer

Parts Avatar Investments Inc.

245 Matheson Blvd E

Mississauga, Ontario, Canada L4Z 3K2

Email: privacy@partsavatar.ca

If you are not satisfied with our response, you may contact:

• Canada (federal): Office of the Privacy Commissioner of Canada, https://www.priv.gc.ca

• British Columbia: Office of the Information and Privacy Commissioner for BC, https://www.oipc.bc.ca

• Alberta: Office of the Information and Privacy Commissioner of Alberta, https://www.oipc.ab.ca

• Quebec: Commission d’accès à l’information du Québec, https://www.cai.gouv.qc.ca

• California: California Privacy Protection Agency, https://cppa.ca.gov, or the California Attorney General, https://oag.ca.gov