PRIVACY
POLICY

JTI-Macdonald Corp. (“JTI”, “we” or “us”), the operator of the publications and other information available at exportacigarettes.ca; macdonaldcigarettes.ca; liggettducatcigarettes.ca; camelcigarettes.ca; winstoncigarettes.ca; americanspiritcigarettes.ca (collectively, the “Website”) on behalf of itself and of JTI Canada Tech Inc. (each a “Company” and collectively the “Companies”), is committed to protecting any personal information which you may provide while using, or that we may obtain from your use of, the Website or the emails we send to you. The purpose of this privacy policy (the “Policy”) is to inform you of our privacy practices and policies, including:

• how and why we collect your personal information;
• how we intend to use your personal information;
• with which parties we may share your personal information; and
• to provide you with contact information should you have questions or concerns about our practices.

This Policy is accessible via the Website.

BY USING THE WEBSITE, YOU CONSENT TO THE COLLECTION, STORAGE, USE, DISCLOSURE AND RETENTION OF YOUR PERSONAL INFORMATION IN ACCORDANCE WITH THIS POLICY. IF YOU DO NOT AGREE WITH THIS POLICY, YOU SHOULD NOT ACCESS OR USE THE WEBSITE.

Overview of Our Privacy Practices

Our privacy practices are summarized here. Under this Policy, the Companies:

(1) May collect personal information during an age verification process to verify that you are at least 19 years old and are of legal age to purchase tobacco and vaping products in your province of residence;

(2) May collect personal information to register and authenticate you with the Website for marketing purposes, market research purposes, administrative purposes and information sharing purposes;

(3) May collect data through your Website usage, your internet protocol (IP) address, the Website cookies and email web beacons;

(4) Collects non-identifiable information regarding Website users (such as the date and time you accessed the website);

(5) Shares this information with its authorized employees, agents, service providers and legal representatives, and may also share this information with third parties that we engage to provide products and services on our behalf;

(6) Except as set out in (5), does not share your personal information with third parties without your consent, unless authorized or required by law or as disclosed to you when the information is collected;

(7) Collects and uses this information to comply with applicable laws and regulations, to administer the Website, to protect the Companies and Website users from fraud, and to communicate with you (unless you have opted out of receiving such information);

(8) Allows you to withdraw your consent to the collection, use and disclosure of your personal information at any time; and

(9) Mitigates the risk and impact of potential harms involved in the disclosure of personal information through the adoption of reasonable physical, electronic and managerial procedures appropriate to the sensitivity of the data in an effort to safeguard the personal information you provide to us. Even with these measures, there is a residual risk of the loss of, unauthorized access to or unauthorized disclosure of your information which could result in financial or other harm to you.

Further information with respect to our privacy practices is set out below.

Personal Information Collected by the Companies

When you first access the Website, you will be asked to confirm that you are at least 19 years old and are of legal age to purchase tobacco and vaping products in your province of residence.

You are required to create an account and complete an age verification process in order to access product information and brand preference advertising, and /or to access information on the regulation of tobacco and vaping products, and certain Website features. We may further ask you to supply some or all of the following personal information for account creation and age verification: your name, postal address, telephone number, personal email address, date of birth and identity verification information (such as images of your government issued ID, passport, national ID card, or driving license, as permitted by applicable laws).

In some cases, the Companies may ask you to provide additional information after initial registration, including your email address. We may also collect your Website usage data and your internet protocol (IP) address, and other similar information that you provide to us via the Website, including information collected through the use of cookies on your browser. As well, we may collect information relating to the emails that we send to you, such as when you open the email, through the use of single pixel gifs, also called web beacons, or other tracking technologies.

You should exercise discretion when disclosing your personal information to us, and should not disclose sensitive or confidential information that you wish to remain private.

Non-Identifiable Information Automatically Collected

The Website may automatically collect certain non-identifiable information regarding Website users, such as the date and time you access the Website, the Internet address of the website from which you linked directly to the Website, the operating system you are using, the sections of the Website you visit, the Website pages read and images viewed, and the materials you post to or download from the Website. We may collect, use, transfer and disclose aggregated and/or non-personal information.

Cookies

The Website uses "cookies", a technology that installs information on a website user's computer to permit the Website to recognize future visits using that computer. Cookies enhance the convenience and use of the Website. For example, the information provided through cookies is used to recognize you as a previous user of the Website, to track your activity on the Website in order to respond to your needs, to offer personalized web page content and information for your use, and to otherwise facilitate your Website experience. You may choose to decline cookies if your browser permits, but doing so may affect your use of the Website and your ability to access certain features of the Website.

Web Beacons

We also include web beacons in the emails that we send to you. Web beacons allow us to collect information about when email recipients open the emails we send, what parts of the email they review, their IP address, browser or email client type and other similar details. Some of this information may be correlated with recipients’ email addresses. We use this information to review how recipients are responding to the emails we send.

Purpose of Collection and Use of Your Personal Information

The Companies collect and use personal information that you supply during registration or that is collected through your use of the Website or from the emails we send for the following purposes:

• To ensure that users of the Website and recipients of our emails are at least 19 years old and are of legal age to purchase tobacco or vaping products in their province of residence;
• To register you with the Website and to authenticate users for security purposes;
• To provide personalized user features and access;
• To provide customer service and support to you;
• As permitted by, and to comply with, applicable laws and regulations;
• To administer the Website and to manage the emails that we send;
• To protect the Companies and Website users against fraud;
• To notify you in connection with any changes to our services or this Policy;
• To facilitate single sign-on (SSO) across each of the Websites operated by the Companies;
• To communicate with you about the Companies and their products (provided that you confirm that your email address is only accessible to adults in your province of residence), about the regulation of their products , unless and until you opt-out of receiving such information by contacting us at liggettducatcigarettes@jti.com; and
• Other purposes permitted by law.

Disclosure of Personal Information

We will keep personal information that you provide to us private, and will disclose such personal information only in accordance with this Policy.

The Companies do not sell, rent, or lease to third parties any personal information they collect from you. The Companies may disclose or share personal information with its authorized employees, agents, service providers (including age verification suppliers) and legal representatives for the purposes described in this Policy. We may also share your personal information with third parties that we engage to provide products and services on our behalf. The Companies will not otherwise share your personal information with third parties without your consent, unless authorized or required by law or as disclosed to you when the information is collected. The Companies may disclose your personal information to a government institution or agency that has asserted its lawful authority to obtain the information, or in order to comply with laws and regulations, or where the Companies have reasonable grounds to believe the information could be useful in the investigation of unlawful activity, or to comply with a subpoena or warrant or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with court rules regarding the production of records and information, or to protect the Companies’ rights and property. If the Companies are involved in the sale or transfer of some or all of its businesses, the Companies may disclose your personal information in connection with the transfer or sale.

How the Companies Protect Your Privacy

The Companies keep the personal information they collect about you confidential and have adopted reasonable physical, electronic and managerial procedures appropriate to the sensitivity of the data in an effort to safeguard the personal information you provide to the Companies. Notwithstanding these measures, no collection, storage or transmission of information over the Internet on websites or otherwise can be guaranteed to be 100% secure, and therefore we cannot ensure, warrant or guarantee the security of any such information.

Withdrawal of Consent

You may withdraw your consent to the collection, use and disclosure of personal information about you at any time. To do this, please contact our Privacy Officer at the e-mail address listed in this Policy. Withdrawal of your consent to the collection, use and disclosure of personal information may result in you being unable to continue use of our Website or services.

Verifying and Amending your Personal Information

Subject to certain exceptions prescribed by law, you will be given reasonable access to your personal information held by the Companies and you may request that your personal information be corrected or updated. Please e-mail our Privacy Officer and we will assist you. You may be required to put your request in writing to confirm your request and identity. It is your responsibility to notify us of any changes to your personal information, including contact information, so we can contact you and inform you about updates to this Policy and any other relevant information with respect to your use of the Website.

Retention of Personal Information

We will keep and retain your personal information in compliance with our legal obligations, and only as long as necessary for the purposes for which it was collected.

Storage and Location of Information

The Companies may store and process your personal information collected through the Website on the servers of our third party service providers (including Microsoft Corporation and its affiliates), located in the USA or, from time to time, in other locations outside Canada that the Companies deem necessary or convenient in order to provide you with efficient and effective service, including but not limited to Europe. As such, foreign governments, courts, law enforcement or regulatory agencies may be able to access your personal information under foreign laws.

Privacy Policy Changes and Updates

We may revise this Policy at any time, without notice to you. We may, however, choose to notify you of a change to this Policy, for example by announcing the change on the Website. Your continued use of the Website constitutes your consent to the contents of any updated policy.

Where we make significant changes to this Policy, we will notify you directly of the changes by sending you an email informing you of the changes, and will require your consent prior to the changes coming into effect. Significant changes include using your personal information for a new purpose not anticipated originally or a new disclosure of your personal information to a third party for a purposes other than processing that is integral to the delivery of a service.

Resolving Your Concerns

If you would like more information about this Policy or the personal information collection, use and disclosure policies and practices of the Companies or their service providers, please contact our Privacy Officer by e-mail at: privacy.canada@jti.com. Please let us know your questions or concerns and we will do our best to help you.