Version number: 2026-1

Last updated: March 26, 2026

SmileyApp Solutions Inc. is a company that values your privacy and cares about how your personal information is handled.

It is our responsibility to ensure that all information collected during our activities is handled securely. Policies and practices governing the management of personal information are critical elements for the sound management of personal information. This Policy aims to inform you of our practices regarding the collection, use, processing, disclosure, retention, and destruction of your personal information.

Your access to our Platform is conditional upon your acceptance and compliance with this Policy. This Policy applies to everyone, including but not limited to visitors, users, and any other Person wishing to access or use our Platform.

In the course of our activities, we collect, use, and process information for the purpose of providing our services. Confidentiality is paramount to us. We adhere to ethical standards in processing all information, especially personal information.

By providing us with personal information (through our Platform, by email, in person, or by phone), you agree that it will be processed in accordance with this Policy, and you authorize SmileyApp Solutions Inc. (hereinafter "SmileyApp") and its service providers to process your personal information for the purposes set out below.

1. DEFINITIONS

Unless otherwise indicated in the text, words and expressions beginning with a capital letter appearing in the Policy are to be interpreted as follows:

"End Client(s)" means any Person who acquires products or files through the store operated by the Subscriber User via the Platform made available to them by SmileyApp.

"Account(s)" means the user Account created by a Subscriber User on the Platform, allowing them to access the Services, manage their galleries, content, customer data, End Clients, orders, and Subscription Plan.

"Third-Party Content" means any content, data, information, material, software, service, or element, in any form whatsoever, that is provided, made available, or accessible by a third party other than SmileyApp, including integrated content, linked content, or content accessible through the Platform, regardless of how it is used or made available by the Subscriber User or their End Clients.

"Customer Data" means all data, information, content, files, and documents, in any form whatsoever, that are provided, uploaded, entered, transmitted, generated, or otherwise made available by or on behalf of an End Client in connection with the use of the Services by the Subscriber User, including personal information, transactional data, images, orders, and any other data related to interactions between the Subscriber User and their End Clients, which are hosted, processed, or otherwise used through the Platform, excluding Third-Party Content and Third-Party Products.

"Law(s)" means, as the case may be, whether a federal, provincial, municipal, or foreign jurisdiction, a law, regulation, order, decree, administrative directive or policy, or other legislative or executive instrument of a public or parapublic authority, a rule of common law, as well as any judicial and administrative decision by a competent court relating to their validity, interpretation, and application, and includes, where required, an international treaty and an interprovincial or intergovernmental agreement, it being understood that, when the Policy refers to a specific law, this includes all regulations adopted thereunder, all related amendments, as well as any law or regulation that complements or replaces that law or regulation, as applicable.

"Person" means, as the case may be, an individual, a partnership, a corporation, a cooperative, an association, a union, a trust, or any other organization with or without its own legal personality, as well as any public authority of foreign, federal, provincial, territorial, or municipal jurisdiction, and includes the legal representatives of such a person.

"Subscription Plan(s)" means any subscription formula offered by SmileyApp, as described on the Platform, including free or paid Subscription Plans.

"Platform" means the online infrastructure made available to End Clients and Subscriber Users by SmileyApp, including the website, administration interface, store, gallery pages, ordering tools, and the technical systems necessary for its operation.

"Policy" means this policy, including its preamble and appendices, as well

as any amendment made by SmileyApp in accordance with these terms.

"Third-Party Products" means any product, good, or service offered, sold, distributed, or otherwise provided by a third party, including products or services offered by partners, suppliers, or external integrations accessible through the Platform, without SmileyApp being the manufacturer, seller, distributor, or provider thereof.

"Services" For the Subscriber User, means all basic Services provided by SmileyApp and accessible to the Subscriber User according to the chosen Subscription Plan, including, where applicable, any additional Service offered as a complement, in accordance with the applicable terms and conditions.

For the End Client, means all features and services accessible to the End Client through the Platform, including the consultation, acquisition, download, or use of content, products, or services offered by the Subscriber User, in accordance with the terms established by the Subscriber User and the Platform's terms of use.

"Additional Service(s)" means any service that is not a basic service according to the terms of the chosen Subscription Plan, including retouching, production, delivery services, or advanced features.

"Basic Service(s)" means all features and services provided by SmileyApp enabling Subscriber Users to create and present online photo galleries, upload and store visual content, sell photographs or derivative products, and manage orders, transactions, and interactions with their End Clients, all according to the terms of the chosen Subscription Plan.

"Subscriber User(s)" means any Person who creates an Account on the Platform and subscribes to a Subscription Plan to access the Services, within the framework of their professional or commercial activities, excluding any End Client.


WHO ARE WE?

SmileyApp operates a business that provides software Services to Subscriber Users and End Clients through its Platform.

We are directly responsible for processing your personal information in accordance with applicable legislation and regulatory standards that apply to our business.



WHAT PERSONAL INFORMATION DO WE COLLECT?

We may collect and process different types of personal information as part of our Services, including:

• Identification information, such as name, address, email address, IP address, phone number, date of birth, permanent code;
• Biographical information such as job title, photos, and video or audio content;
• Billing information and financial information, such as billing address, bank account information, payment data, and salary information;
• Information relating to products sold;
• Information relating to your business such as business number and business name.
• Information you provide when you upload and share content with us or a Subscriber User on our Platform, including images, photos, logos, videos, or any other content you choose to upload when using our Platform.
• Recruitment information, such as a resume, education and professional background information, details regarding professional affiliations, and other relevant information for potential recruitment by SmileyApp or a company related to SmileyApp or a potential association with SmileyApp or a company related to SmileyApp;
• Information provided to us by or on behalf of Subscriber Users or End Clients, or that we produce as part of our Services, which may, where relevant, include special categories of personal information (including racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, or sexual orientation, etc.) or so-called sensitive personal information ("sensitive information"), as defined in the Act respecting the protection of personal information in the private sector (Quebec) (medical, biometric, or otherwise intimate information, or, due to the context of its use or communication, which creates a high degree of reasonable expectation of privacy);
• Identification data and other background check data, such as a copy of a driver's license or information on the source of funds, necessary to comply with anti-money laundering laws and collected as part of our client relationship acceptance and ongoing monitoring procedures;
• Marketing and communication preferences information, as well as related information, such as comments and survey responses; and
• Any other personal information provided.
  

We typically collect personal information that you voluntarily provide to us, but we may also collect information from third parties and as a Service provider for Subscriber Users, if we or they have obtained the required consent or if required or permitted by Law. We may also collect information through our Platform.

By providing us with personal information, you consent to our collection, use, and disclosure of that personal information in accordance with the Policy and as permitted or required by Law.

Please note that if you provide us with personal information about other individuals (such as your clients, directors, officers, shareholders, or employees), you must ensure that you have duly informed them that you are providing us with their information and have obtained their consent for such disclosure of information.

We do not knowingly collect information from children or other individuals under the age of 16. If you are a minor under 16, please do not provide us with personal information without the express consent of a parent or guardian. If you are a parent or guardian and you know that your children have provided us with personal information, please contact us. If we learn that we have collected personal information from minor children without verifiable parental consent, we will take steps to remove that information from our servers.


HOW DO WE COLLECT YOUR PERSONAL INFORMATION?

We collect your personal information in several ways:

• Through digital means (phone, email, fax, others);
• Through your Account on our Platform;
• Through our Platform;
• Through our newsletter;
• Through cookies when you visit our Platform.

HOW DO WE USE YOUR PERSONAL INFORMATION?

We may use personal information in any of the ways listed below, with your consent or, where applicable, based on another legal basis under applicable Laws. In each case, we indicate why we use your personal information:

• To provide our Services and for the conduct of our business, to administer and perform our Services, including to fulfill our obligations arising from any agreement entered into between you and us;
• To open and manage your Account;
• To respond to inquiries or other requests from Persons visiting our Platform;
• To facilitate the use of our Platform and ensure that content is presented in a relevant and optimal way for you and your device.
• For marketing and business development purposes - to provide details on new Services, information on legal developments, and invitations to events when a Person has chosen to receive such information;
• For research and development purposes (including from a security perspective) - to conduct analyses to better understand our customers' service and marketing requirements and to better understand our business and develop our products and offerings; you can unsubscribe at any time;
• For recruitment purposes - to enable us to process job applications and assess whether a Person meets the requirements for the position they may apply for at SmileyApp or a company related to SmileyApp;
• To fulfill our legal, regulatory, or risk management obligations - to comply with our legal obligations (to conduct due diligence on a client/obtain information about a client, detect corruption, sanctions, and reputational risks);
• To prevent fraud and/or perform other background checks that may be required at any time under applicable Law and/or best practices (if false or inaccurate information is provided or if fraud is found or suspected, information may be passed to fraud prevention agencies and may be recorded by us or by such agencies). When we process special categories of personal information, we may also rely on important public interest considerations (prevention or detection of crimes) or legally based claims;
• To enforce our rights, to fulfill our legal or regulatory information disclosure obligations, and/or to protect the rights of third parties;
• To ensure we are paid - to recover payments owed to us and, if necessary, to enforce such recoveries by using debt collection agencies or by taking other legal means (including by initiating legal proceedings); and
• To reorganize or change our business - if we undertake a reorganization (for example, by merging, consolidating, or selling a portion of our business), we may need to transfer some or all personal information to a relevant third party (or its advisors) as part of any due diligence or transfer process to that reorganized entity or third party for the same purposes as set out in the Policy or for the purpose of analyzing any proposed reorganization.

HOW DO WE COLLECT YOUR CONSENT?

We will obtain your consent before collecting, using, or disclosing personal information for any purpose, unless permitted or required by Law.

SmileyApp considers that your consent to the collection, use, or disclosure of your personal information will be validly provided:

• If given expressly by your written or oral agreement;
• If you voluntarily provide personal information for an obvious purpose;
• If you do not object to the collection, use, or disclosure of your personal information by SmileyApp Inc. within a reasonable period after SmileyApp has clearly informed you, including through this policy, of its intention to do so and the purposes pursued.

In some cases, SmileyApp may collect personal information about a Person without their consent, in accordance with applicable Laws.

WHO HAS ACCESS TO YOUR PERSONAL INFORMATION WITHIN OUR ORGANIZATION?

Within our organization, only those Persons whose access to personal information is necessary to perform their duties may access it. The following categories of Persons may therefore have access to your information:

• The customer service center, to answer your questions and assist you;
• Persons directly responsible for providing products and customer services;
• SmileyApp representatives, in the course of their professional duties and to ensure compliance with legal and contractual obligations.

Every Person with access to your personal information is required to respect the confidentiality and protection measures provided by this Policy.

WITH WHOM DO WE SHARE PERSONAL INFORMATION?

It may happen that, in the course of the services we provide to you, we may need to communicate your personal information to a third party. Here are some examples of entities with whom your information may be shared:

• Other entities or companies affiliated with SmileyApp or their representatives;
• Third-party service providers and/or partners who provide us with website, administrative support, maintenance, photo management, QR code generation, order tracking, and other services. These third parties may have access to or process personal information as part of the services they provide to us. We limit the information we provide to these service providers to only the information that is reasonably necessary for them to perform their functions, and the written contracts we have with these service providers require them to take reasonable measures in compliance with the Act to ensure the confidentiality of this information;
• Government, regulatory, or law enforcement agencies when we are required to disclose such information or if we believe in good faith that such disclosure is necessary to comply with applicable Laws;
• Our professional advisors, bankers, and auditors.
• Links to said third parties

We will only use personal information to achieve the primary and legitimate purpose for which it was collected, or for purposes compatible with that primary purpose. SmileyApp does not sell information to third parties.

Our Platform may contain third-party content and offer third-party products accessible through the Platform. This content and products come from third parties and are provided solely as a convenience for subscribed Users and End Customers. SmileyApp has no control over the content, practices, privacy policies, or security of third-party Content and third-party Products.

Consequently, any personal information transmitted via third-party Content or third-party Products is not covered by this Privacy Policy but is subject to the privacy policies and practices in effect on these third-party sites or platforms. It is the responsibility of subscribed Users and End Customers to review these policies to ensure the protection of their personal information.

GEOGRAPHIC LOCATION OF YOUR PERSONAL INFORMATION

Our processing of personal information is limited to Individuals and entities established in Quebec. Nevertheless, your personal information may be communicated to service providers whose facilities are located elsewhere in Canada, all to fulfill the purposes of our information collection.

Before transferring your information to another country, we take reasonable steps to ensure that it will be adequately protected. As with our local suppliers, those located outside the country will be contractually obligated to comply with our expectations regarding the protection of your personal information.

HOW LONG DO WE RETAIN PERSONAL INFORMATION?

We will only retain personal information for as long as necessary for the purposes set out in this Policy and to comply with our legal and regulatory obligations, and always in accordance with the Act respecting the protection of personal information in the private sector (Quebec) and any other applicable Law.

Unless otherwise provided by law, we usually retain personal information for at least eight (8) years from the end of the relationship with the Person concerned or longer if required by law.

HOW DO WE PROTECT PERSONAL INFORMATION?

We recognize that information security is an integral part of personal information confidentiality.

We implement industry best practices to ensure the protection of personal information in accordance with applicable legislation in this area.

To this end, we maintain reasonable physical, technical, or procedural safeguards to protect your personal information against unauthorized and non-compliant access, use, modification, disclosure, and/or destruction in accordance with current legislation, including the use of cloud computing, backup, and security and cybersecurity systems.

All SmileyApp members and third-party providers whose services we may retain and who process personal information on our behalf are also required to respect the confidentiality of personal information.

A security incident log is created and kept up to date.



WHAT RIGHTS DOES AN INDIVIDUAL HAVE REGARDING THEIR PERSONAL INFORMATION?

In certain circumstances and in accordance with applicable data protection laws, you have the following rights:

• Access: the right to ask whether we are processing your personal information and, if so, to request access to that information. Subject to applicable law and, where applicable, the payment of a reasonable transcription, reproduction, or transmission fee, the Person may receive a copy of the personal information we hold and certain other information concerning them;
• Portability: the right to obtain a copy of computerized personal information concerning you in a structured and commonly used technological format;
• Rights related to the use of technologies: your right to be informed if we use technology with functions that allow you to be identified, located, or profiled, if applicable, and to be informed of the means offered to activate such functions, if applicable;
• Accuracy: we are required to take reasonable steps to ensure that the personal information in our possession is accurate, complete, not misleading, and up-to-date;
• Rectification: the right to request the rectification of any inaccurate, incomplete, or ambiguous personal information, or whose communication and retention are not authorized by law, that we hold about you.
• Erasure: the right to ask us to erase, destroy, or remove personal information in certain circumstances. There are certain exceptions under which we may refuse a request for erasure or destruction, particularly when the personal information is required for compliance with the Law or a contractual agreement between the parties, or in relation to claims;
• Right to be forgotten: the right to ask us to cease disseminating personal information or to de-index any hyperlink allowing access to it by technological means, or to demand that the hyperlink be re-indexed, if the dissemination of personal information contravenes the Law or if the conditions set out in the Act respecting the protection of personal information in the private sector (Quebec) are met;
• Restriction: the right to ask us to suspend the processing of certain personal information, particularly to establish its accuracy or the reason for its processing;
• Automated decisions: the right to have any personal information used to make a decision based exclusively on automated processing rectified and the right to submit your observations to our privacy officer; and
• Consent: where we have obtained consent to the processing of personal information, the right to withdraw that consent in the circumstances provided by law.

In the event of a security incident, please contact the officer as indicated in the "How to contact us?" section below, who will diligently take appropriate measures in accordance with our internal policy.



HOW DO WE USE COOKIES?

We use navigation cookies (or "cookies") to:

• improve platform performance;
• quantify our Platform's traffic;
• authenticate authorized subscribed Users;
• and analyze and define the interests of subscribed Users and End Customers to better personalize our Services.

The use of cookies is required for the authentication of subscribed Users. Unless a subscribed User has already provided personal information (for example, via the activation of a service linked to an Account) from their mobile device or computer, cookies do not directly identify them.

You can normally control the recording of navigation cookies from the options offered by your browser. Disabling certain cookies may affect the quality of your browsing or make certain Platform functionalities unavailable.

You can manage your navigation cookie preferences via your browser, by uninstalling or blocking certain cookies. You can withdraw your consent at any time by adjusting these preferences. Some functionalities may require cookies for security purposes.

You can also install the Google Analytics opt-out browser add-on, which prevents Google Analytics JavaScript from sharing information with Google Analytics about visit activity.

For more information on navigation cookies and how we use them, please consult our Cookie Policy.

 

HOW TO CONTACT US?

If you have any questions regarding this Policy or how we process your personal information, or to exercise your rights, please contact our personal information protection officer by email or mail at the following coordinates:

SOLUTIONS SMILEYAPP INC.

Maxime Milot

5043, boulevard Royal

Shawinigan (Quebec) G9N 8G5

(maxime@smileyapp.ca)

HOW DO WE UPDATE THIS PRIVACY POLICY?

We may modify the content of our Platform and how cookies are used without notice and, consequently, this Policy may be modified at any time.

We therefore invite you to consult them regularly to stay informed about how we process personal information.