Privacy Statement (CA)

1. Person in Charge of Processing

This privacy policy applies to the website operated by Mille et un cupcake (hereinafter "we," "us," or "our"). We are subject to Quebec Law 25 (An Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25), which governs how we collect, use, disclose, and retain personal information about visitors and customers.

This policy explains what personal information we collect through this website, why we collect it, who we share it with, and what rights you have under Quebec Law 25. We are committed to handling your personal information with transparency and care.

2. Personal Information Collected

Depending on how you interact with our website, we may collect the following categories of personal information:

Identification and Contact Information

• Name and email address (when you submit a contact or inquiry form)
• Any other information you voluntarily provide through a form

Technical and Navigation Information

• IP address
• Device identifiers and browser type
• Pages visited and time spent on each page
• Navigation behavior (clicks, scrolls, mouse movements, session recordings)
• Approximate geographic location (derived from IP address)

Advertising and Transaction Information

• Advertising identifiers and social identifiers (via Meta Pixel)
• Pages visited and conversion events for ad targeting purposes
• Form submission data and communication data (via HubSpot)

Consent Preferences

• Your cookie consent choices, stored via a preference cookie named moelleux_{site_key} (valid for 13 months), managed by Moelleux (par Horizon-Cumulus), hosted in Quebec (OVH Beauharnois).

We do not knowingly collect sensitive personal information such as health data, financial account numbers, or government-issued identification numbers through this website.

3. Purposes of Processing

We use your personal information only for the purposes described below.

Consent Management and Policy Hosting — Essential

We use Moelleux (par Horizon-Cumulus) to record and store your cookie consent choices and to host this privacy policy. This is strictly necessary for the website to comply with Quebec Law 25. Legal basis: legal obligation.

Audience Measurement and Site Optimization — Analytics

We use Google Analytics 4 and Hotjar to understand how visitors use our website — which pages are most visited, how long sessions last, and where visitors encounter friction. This helps us improve the website experience. Google Analytics 4 collects device identifiers, IP address, pages visited, session duration, navigation behavior, and approximate location. Hotjar additionally records sessions and generates heatmaps. Both services transfer data to the United States. Legal basis: consent (you may withdraw at any time).

Targeted Advertising and Remarketing — Marketing

We use the Meta Pixel (Facebook) to measure the effectiveness of our advertising campaigns and to show you relevant ads on Meta platforms after you visit our website. We use HubSpot to manage email marketing campaigns and automate follow-up communications with people who have expressed interest in our offerings. Both services transfer data to the United States. Legal basis: consent (you may withdraw at any time).

Website Display — Functional

We use Google Fonts to render text on our website correctly. When your browser loads a page, it contacts Google's servers to retrieve font files, which may transmit your IP address to Google in the United States. Legal basis: legitimate interest in providing a properly rendered website. You may raise an objection at any time by contacting us.

4. Third Parties and Processors

The table below lists every third-party service active on this website, its purpose, its category, and whether it involves a transfer of personal information outside Quebec.

Our website is hosted by Horizon-Cumulus (Joliette, Quebec). The website itself and consent records are stored in Quebec. Our business email is operated through Google Workspace (United States); please see Section 5 for details on that transfer.

5. Transfers Outside Quebec

Several services we use transfer personal information to the United States. Under section 17 of Quebec Law 25, we are required to disclose these transfers and to conduct a Privacy Impact Assessment (PIA) before any such transfer takes place, to ensure that the personal information receives adequate protection in the destination jurisdiction.

The following transfers to the United States occur in connection with this website:

• Google Analytics 4 (Google LLC, United States) — navigation and audience data, including IP address and device identifiers, are processed on Google's servers in the United States. Google LLC participates in the EU-U.S. Data Privacy Framework and relies on Standard Contractual Clauses for international transfers.
• Hotjar (Hotjar Ltd., United States) — session recordings, heatmap data, IP address, and navigation behavior are processed in the United States. Hotjar relies on Standard Contractual Clauses as a contractual safeguard.
• Meta Pixel / Facebook (Meta Platforms, Inc., United States) — advertising identifiers, social identifiers, IP address, and conversion event data are transferred to Meta's servers in the United States. Meta relies on Standard Contractual Clauses for cross-border transfers.
• HubSpot (HubSpot, Inc., United States) — contact information, form data, and communication data are processed on HubSpot's servers in the United States. HubSpot relies on Standard Contractual Clauses as a contractual safeguard.
• Google Fonts (Google LLC, United States) — your IP address is transmitted to Google's servers when font files are loaded. Google LLC participates in the EU-U.S. Data Privacy Framework.
• Google Workspace (Google LLC, United States) — our business email is operated through Google Workspace. Email communications you send us may be processed on Google's servers in the United States.

Before activating each of the above services, we conducted or rely on a Privacy Impact Assessment (PIA / EFVP) as required by section 17 of Quebec Law 25, to confirm that appropriate contractual and organizational safeguards are in place. You may request a summary of these assessments by contacting our Person responsible for the protection of personal information (see Section 8).

6. Retention Period

We retain personal information only for as long as necessary to fulfill the purposes described in this policy, or as required by law.

When personal information is no longer needed, we destroy or anonymize it in a secure manner so that it can no longer be associated with you.

7. Your Rights

Under Quebec Law 25, you have the following rights with respect to your personal information. To exercise any of these rights, please contact our Person responsible for the protection of personal information (see Section 8). We will respond within 30 days of receiving your request.

• Right of access: You may ask us to confirm whether we hold personal information about you and to receive a copy of that information in a clear and understandable format.
• Right of rectification: If your personal information is inaccurate, incomplete, or ambiguous, you may ask us to correct it. If we have shared that information with third parties, we will notify them of the correction where feasible.
• Right of erasure (right to be forgotten): You may ask us to delete your personal information when it is no longer necessary for the purposes for which it was collected, or when you withdraw your consent and no other legal basis applies. Some information may need to be retained to comply with a legal obligation.
• Right to data portability: You may ask us to provide your personal information in a structured, commonly used, and machine-readable format so that you can transfer it to another organization, where technically feasible.
• Right to withdraw consent: Where we rely on your consent to process personal information (analytics, marketing), you may withdraw that consent at any time — either through the cookie preference center on this website or by contacting us directly. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

If you believe your rights have not been respected, you may file a complaint with the Quebec Information Access Commission (CAI) at www.cai.gouv.qc.ca .

8. Person Responsible for the Protection of Personal Information

In accordance with section 3.1 of Quebec Law 25, Mille et un cupcake has designated a Person responsible for the protection of personal information. This person is your primary point of contact for any question, request, or concern regarding the handling of your personal information.

• Name: Anick Pensato
• Title: PROPRIÉTAIRE
• Email: anick@milleetuncupcake.com
• Phone: 450-951-3140

We will acknowledge your request promptly and provide a substantive response within 30 days, as required by Quebec Law 25. If your request is complex or voluminous, we may extend this period by an additional 30 days and will notify you accordingly.

9. Effective Date and Versioning

This privacy policy takes effect on 11 juin 2026 and corresponds to version 1.

We may update this policy from time to time to reflect changes in our practices, the services we use, or applicable law. When we make material changes, we will update the effective date above and, where appropriate, notify you through the website or by email. We encourage you to review this policy periodically.

Previous versions of this policy are available upon request by contacting our Person responsible for the protection of personal information.