1. Privacy Policy

Le Groupe KTDRAL ("we," "us") is committed to protecting the personal information entrusted to it, in accordance with Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25), the federal Personal Information Protection and Electronic Documents Act ("PIPEDA"), and, where applicable, the General Data Protection Regulation (EU, "GDPR").

1.1 Privacy Officer

Hughes Appleby Email: happleby@ktdralgroup.com Mailing address: 1380 rue Newton, Suite 202, Boucherville, Québec, Canada J4B 5H2

Any question, request for access or correction, or complaint regarding personal information may be addressed to him. He will respond within thirty (30) days.

1.2 Information we collect

We collect only the information necessary for the purposes described below.

Information you provide to us — when you complete a contact or commission form, or correspond with us: name, first name, email address, telephone number, city or region, and any information you choose to share about your project, your interior, your pieces, or your intentions.

Information collected automatically — as you browse: IP address, device and browser type, pages viewed, duration, and source of your visit. This data is collected by our host's built-in measurement tool (Squarespace Analytics) and is aggregated; we do not use it to identify you personally.

We collect no sensitive information, no biometric data, and we do not knowingly collect any information from minors.

1.3 Purposes

Your information is used solely to:

• respond to your inquiries and, where appropriate, arrange a meeting with the Studio;

• assess and prepare a potential commission;

• carry out and administer the mandates entrusted to the Studio;

• meet our legal, accounting, and tax obligations;

• measure, in aggregate form, the Site's traffic and improve the experience.

We never sell your personal information. We do not rent it. We undertake no unsolicited marketing.

1.4 Consent

By submitting your information through one of our forms, you consent to its collection and use for the purposes described above. You may withdraw your consent at any time by writing to the Privacy Officer; such withdrawal does not affect the lawfulness of prior processing or processing required by law.

1.5 Third parties and service providers

Your information is shared only with the providers strictly necessary to operate the Site and our communications, each bound by confidentiality and security commitments:

• Squarespace, Inc. (United States) — Site hosting, forms, and built-in audience measurement;

• Weglot SAS (France, European Union) — Site translation;

• Vimeo.com, Inc. (United States) — delivery of the video content embedded in the Site;

• Google LLC – Google Workspace (United States) — email and correspondence infrastructure.

When a commission requires it, certain strictly necessary information may be shared with our fabrication partners, only to the extent useful to carrying out the mandate.

1.6 Disclosure of information outside Québec

Some of our providers host or process data outside Québec, notably in the United States and the European Union. In accordance with Law 25, we conducted a privacy impact assessment before these disclosures, weighing the sensitivity of the information, the purposes, the contractual protections in place, and the legal regime applicable in those territories. We concluded that the information enjoys adequate protection there.

1.7 Retention

We keep your information only as long as necessary for the purposes for which it was collected:

• contact inquiries that did not lead to a commission: twenty-four (24) months after the last exchange;

• commission files: the duration of the mandate, then the period required by our legal, tax, and professional obligations (generally seven years);

• audience-measurement data: kept in aggregate form according to Squarespace's settings.

At the end of these periods, the information is securely destroyed or anonymized.

1.8 Security

We apply reasonable security measures proportionate to the sensitivity of the information: encryption of communications (TLS), two-factor authentication on our systems, access restricted to those whose duties require it, and internal governance of access.

1.9 Your rights

You hold the following rights, which you may exercise with the officer identified in section 1.1:

• Access — obtain confirmation that information about you exists and receive a copy of it;

• Correction — have inaccurate, incomplete, or ambiguous information corrected;

• Withdrawal of consent — stop the use or disclosure of your information;

• De-indexing and cessation of dissemination, in the cases provided by law;

• Portability — receive the computerized information you provided to us in a structured, commonly used technological format.

If you believe your rights have not been respected, you may file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or, depending on your situation, with the Office of the Privacy Commissioner of Canada.

1.10 Privacy incidents

Any confidentiality incident presenting a risk of serious harm will be reported promptly to the Commission d'accès à l'information du Québec and to the individuals concerned, in accordance with the law. We maintain a register of incidents.

1.11 European Union visitors (GDPR)

If you access the Site from the European Economic Area, the following applies. The data controller is Le Groupe KTDRAL (contact details under Site Publisher, above). The legal bases for our processing are: your consent (forms, non-essential cookies), the performance of pre-contractual or contractual measures (preparing and carrying out a commission), and our legitimate interest (Site security and improvement). You also hold the rights to erasure, restriction, objection, and portability set out in Articles 15 to 22 of the GDPR, as well as the right to lodge a complaint with your national supervisory authority. Transfers of data to Canada rely on the European Commission's adequacy decision covering organizations subject to PIPEDA; transfers to the United States rely on our providers' compliance mechanisms (notably the EU-U.S. Data Privacy Framework or standard contractual clauses).

1.12 United States visitors

We neither sell nor share personal information within the meaning of applicable U.S. laws, including the California Consumer Privacy Act (CCPA/CPRA). Residents of states with privacy laws may exercise their rights of access, deletion, and correction by writing to the officer identified in section 1.1, without discrimination.