Online Privacy Statement for the Water Street Collective Platform

This private trade Website is owned and operated by The Water Street Collective Limited. Please read this Online Privacy Statement (the “Privacy Statement”) carefully. By accessing and browsing this Website you agree to the Privacy Statement without limitations or qualifications. If you do not agree to the Privacy Statement, whether in whole or in part, do not access or use this Website.

In this Privacy Statement, the terms “TWSC”, “we”, “us” and “our” are used to refer to The Water Street Collective Limited and their affiliates.

The terms “British American Tobacco”, “the Group” and “The British American Tobacco Group” are used to refer to British American Tobacco p.l.c. and the group of companies constituting its direct and indirect subsidiaries and affiliates worldwide, including Imperial Tobacco Canada Limited. The British American Tobacco group (“BAT”) is a family of affiliated companies with operations in more than 180 countries.

1 Scope and application

Protecting your privacy is important to TWSC. The purpose of this Policy is to explain how we collect, use and disclose the personal information you may provide to us and is meant to comply with the Canadian federal and provincial privacy laws.

This Policy applies to and governs the activities of TWSC and is meant to exclude the personal information concerning individuals who seek to be, are or were employees of TWSC as a specific policy is applicable.

Personal information is any information which relates to an individual and allows that individual to be identified, whatever the nature of its medium and whatever the form in which it is accessible, whether written, graphic, taped, filmed, computerized or other. Information concerning a company or a partnership is not personal information.

This Policy applies to personal information that is in TWSC’s possession or that is under its control, including information that it may exchange with other BAT entities and information that it may transfer to a third party for warehousing or processing purposes.

2 Consent

Your consent to the collection, use or disclosure of your personal information must be manifest, free and enlightened. It must be given for specific purposes. Depending on the nature and sensitivity of your personal information, your consent can be express and positive (express and positive consent may be oral, in writing or electronic) or implied (such as providing information voluntarily after having been provided with our Privacy Statement). Generally, TWSC will seek your consent for the collection, use or disclosure of your personal information at the time of collection, except as otherwise required or in cases authorized by law.

Your consent can be withdrawn at any time, subject to legal and contractual restrictions and reasonable notice. Please note that if you choose to withdraw your consent, TWSC may not be able to provide or maintain your access to this private trade Website.

3 Collection and use of your personal information

TWSC only collects personal information about you that is necessary for the purposes of establishing, managing and maintaining our relationship with you. For example, personal information may be collected when you join the website, take part in its activities, enter one of our trade engagement programmes or contests, submit questions, comments or suggestions by telephone or electronically.

Personal information that is collected may include, but is not restricted to, identification information such as your first and last name, your home address, your telephone number and your email address. In conformity with the applicable tobacco legislation, your date of birth and evidence thereof is generally required.

In most circumstances, we will obtain your personal information directly from you. However, we may also collect personal information about you from outside sources with your consent or without your consent if the law so authorizes, such as when the collection from a third person is necessary to ensure the accuracy of the information you have provided, if the source is legally allowed to disclose personal information about you.

For example, TWSC may use your personal information for the following purposes:

• To identify you and establish and maintain our business relationship with you;
• To provide you with ongoing access to this private trade Website, including when you choose to submit questions, comments or suggestions;
• To improve our products and services;
• To prevent errors and fraud;
• To conduct surveys or research activities with persons involved in the sale and distribution of tobacco products;
• To comply with our legal obligations.

Your personal information shall not be used for purposes other than those described to you without your consent unless as required or authorized by law.

4 Communication of your personal information

TWSC recognizes that, except in the cases and under the conditions described hereinafter and as authorized or required by law, the communication of your personal information requires your consent when your personal information is communicated to a third person.

According to the applicable legislation, for example, personal information about you may be communicated by TWSC, without your consent, to the following persons:

• To our legal counsel;
• To a person or body having the power to compel communication of the information if it is required in the exercise of his or its duties or functions including to comply with a subpoena, a warrant or rules of the Court pertaining to the production of documents;
• To a person or body responsible, by law, for the prevention, detection or repression of crime or statutory offences who requires it in the performance of his or its duties and if the information is needed for the prosecution of an offence under applicable law;
• To a counterpart in commercial transaction in which we are engaged as permitted by applicable law;
• To a person to whom it is necessary to communicate the information under applicable law.

Access within TWSC also does not require your consent but is strictly limited to the persons for whom such information is necessary for the performance of their functions and duties. Unauthorized access to or disclosure of your personal information by an TWSC employee is strictly prohibited and will result in appropriate disciplinary measures.

Similarly, the exchange of your personal information between TWSC and other BAT entities does not require your consent if the personal information is necessary to allow these entities to assist TWSC for the purposes of establishing, managing and maintaining our business relationship. TWSC may also share your personal information, without your consent, with its agents, mandataries, consultants, data processors and other service providers if the personal information is necessary to allow these entities to further assist TWSC for the purposes of administering our relationship. In such cases, your personal information will be used exclusively to provide specific services and will be kept confidential in accordance with this Policy.

Please note that in the event that the third party to whom TWSC discloses personal information about you is located in a foreign jurisdiction, local laws may otherwise allow your personal information to be accessed by third parties without your consent.

5 Accuracy and safeguards

TWSC has put in place a series of security safeguards to protect your personal information against loss and theft, as well as unauthorized access, disclosure, copying, use and modification, regardless of the format in which the information is held.

These security safeguards include physical measures, organizational measures and technological measures that are reasonable given the sensitivity of the information, the purposes for which it is to be used, the quantity and distribution of the information and the medium on which it is stored.

TWSC also takes the necessary measures to ensure that all its managers and employees are informed on the contents of this Policy and understand that they are required to conform to it at all times.

TWSC further recognizes that it is important to keep personal information accurate, complete and up-to-date and takes reasonable steps to ensure the accuracy and completeness of the personal information it uses and discloses. However, you are responsible to inform TWSC of any significant change in your personal information which may occur during the course of our business relationship.

TWSC will keep your personal information for the time required to fulfill the identified purposes, its legitimate business purposes and to conform to the legislative requirements.

6 Access and rectification requests

You have the right to request to consult and to obtain communication of your personal information which is contained in a file held by TWSC. You can also request that information which is inaccurate, incomplete or equivocal be rectified and that information not justified by the purpose of the file be deleted.

If you are a resident of Quebec, in certain circumstance, you may have the right to request the cessation of dissemination, the de-indexation, or the re-indexation of your personal information. As of September 2024, you also have the right to request that computerized personal information we collect from you be communicated to you or to any person authorised by law in a structured, commonly used technological format. All questions or concerns regarding this Policy or about the collection, use and disclosure of your personal information, including requests for access or rectification, should be made in writing to the following email address:

info.ca@thewaterstreetcollective.com

TWSC will respond to every request for access and rectification within 30 business days of receiving the written request. In the event that TWSC cannot provide access to or rectify your personal information, it will inform you of the reasons why, subject to any legal or regulatory restrictions, and it will provide you with any recourse available.

You have, at all times, the right to lodge a complaint with the applicable privacy commissioner.

7 Modifications to the Policy

We reserve the right to change this Policy at any time.

Effective 06 October 2023.