1. Person in Charge of Processing

This privacy policy is published by Yänonhchia’ (hereinafter "we," "us," or "our"), a business operating in the finance sector and subject to Quebec Law 25 (An Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25). Quebec Law 25 governs how we collect, use, communicate, and retain personal information about visitors to our website and individuals with whom we interact in the course of our activities.

We are committed to handling your personal information responsibly, transparently, and in accordance with the requirements set out by the Quebec Information Access Commission (CAI), the regulatory body that oversees compliance with Quebec's privacy legislation.

2. Personal Information Collected

Depending on how you interact with our website, we may collect the following categories of personal information:

• Device and network identifiers: IP address, browser type, operating system, and device identifiers collected automatically when you visit our website.
• Browsing behavior: Pages visited, session duration, navigation patterns, and approximate geographic location derived from your IP address.
• User preferences: Your cookie consent choices and any navigation preferences stored locally in your browser.

We collect only the personal information that is necessary for the purposes described in Section 3 below. We do not collect sensitive categories of personal information (such as health data, financial account credentials, or government-issued identification numbers) through our website unless you voluntarily provide such information through a secure channel.

3. Purposes of Processing

We use your personal information for the following purposes:

• Consent management and policy delivery (Essential — Legal basis: legitimate interest and legal obligation): We use Moelleux (operated by Horizon-Cumulus, Joliette, Quebec) to record and manage your cookie consent choices and to host this privacy policy. A preference cookie named moelleux_{site_key} is stored in your browser for up to 13 months to remember your selections. Your IP address and consent preferences are processed solely for this purpose. Consent records are hosted in Quebec (OVH, Beauharnois, Quebec). This processing is necessary to fulfill our obligations under Quebec Law 25.
• Audience measurement and website analytics (Analytics — Legal basis: consent): With your consent, we use Google Analytics 4 (operated by Google LLC, United States) to measure how visitors use our website — including which pages are visited, how long sessions last, and general navigation patterns. This helps us understand our audience and improve our website. Google Analytics 4 collects device identifiers, IP addresses, pages visited, session duration, browsing behavior, approximate location, and user preferences. Because Google LLC operates primarily in the United States, this processing involves a transfer of personal information outside Quebec (see Section 5).

We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects on you.

4. Third Parties and Processors

The following third-party services process personal information on our behalf or in connection with our website. We share only the personal information that is strictly necessary for each service to fulfill its function.

We do not sell your personal information to third parties, and we do not share it with parties other than those listed above, except as required by law.

5. Transfers Outside Quebec

Quebec Law 25 (section 17) requires us to inform you when your personal information is communicated to a person or organization outside Quebec, and to ensure that it receives comparable protection.

Google Analytics 4 — United States: When you consent to analytics cookies, your personal information (including device identifiers, IP address, and browsing behavior) is transferred to Google LLC, which operates primarily in the United States. Prior to enabling this transfer, we conducted a Privacy Impact Assessment (PIA) to evaluate the level of protection afforded to your personal information in that jurisdiction. Google LLC participates in data protection frameworks and offers contractual safeguards (including Google's Data Processing Addendum) to govern the handling of personal information transferred outside Canada.

Microsoft 365 — United States: Our business email is operated through Microsoft 365 (Microsoft Corporation, United States). If you contact us by email, your message and any personal information it contains may be processed on servers located in the United States. Microsoft offers contractual safeguards through its Data Processing Agreement and applicable standard contractual commitments to protect personal information transferred outside Canada.

You may request information about the specific safeguards in place for any cross-border transfer by contacting our Person responsible for the protection of personal information (see Section 8).

6. Retention Period

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.

Once the applicable retention period expires, personal information is securely deleted or anonymized so that it can no longer be linked to an identifiable individual.

7. Rights of Data Subjects

Under Quebec Law 25, you have the following rights with respect to your personal information:

• Right of access: You may request confirmation of whether we hold personal information about you, and obtain a copy of that information in a clear and understandable format.
• Right of rectification: If your personal information is inaccurate, incomplete, or ambiguous, you may ask us to correct it. If we have communicated that information to third parties, we will notify them of the correction where feasible.
• Right of erasure (de-indexing): You may ask us to delete personal information that was collected without a valid legal basis, or where the purpose for which it was collected has been fulfilled and the retention period has expired. Certain information may be retained where required by law.
• Right to data portability: Where technically feasible, you may request that we provide your personal information in a structured, commonly used, and machine-readable format, or that we transmit it directly to another organization you designate.
• Right to withdraw consent: Where our processing is based on your consent, you may withdraw that consent at any time without penalty. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. To withdraw consent for analytics cookies, you may update your preferences using the consent banner on our website.

To exercise any of these rights, please contact our Person responsible for the protection of personal information using the details in Section 8. We will respond within 30 days of receiving your request, as required by Quebec Law 25.

If you are not satisfied with our response, you have the right to file a complaint with the CAI at: https://www.cai.gouv.qc.ca.

8. Person Responsible for the Protection of Personal Information

In accordance with section 3.1 of Quebec Law 25, Yänonhchia’ has designated a Person responsible for the protection of personal information. This individual is your primary point of contact for any questions, concerns, or requests relating to this policy or to the handling of your personal information.

• Name: Roxanne Gravelle
• Title: Gestionnaire Mise en Oeuvre
• Email: info@yahf.ca
• Phone: 418-843-5695

We will acknowledge your request promptly and provide a substantive response within 30 days, as required under Quebec Law 25. If your request is complex or voluminous, we may extend this period and will notify you accordingly.

9. Effective Date and Versioning

This privacy policy takes effect on 10 juin 2026 and supersedes any prior version of our privacy policy.

Version: 1

We may update this policy from time to time to reflect changes in our practices, in applicable law, or in the third-party services we use. When we make material changes, we will update the effective date above and, where appropriate, notify you through our website or by other means. We encourage you to review this policy periodically.