CMARKET LTD. – PRIVACY POLICY
Province of British Columbia, Canada
Effective Date: February 20, 2026
This Privacy Policy describes how CMarket Ltd. (“CMarket,” “we,” “our,” or “us”) collects, uses, discloses, safeguards, and retains Personal Information in connection with CommunityMarket.ca (the “Platform”).
This Policy is governed by the Personal Information Protection Act (British Columbia) (“PIPA”) and applicable Canadian privacy laws.
By accessing or using the Platform, you consent to the collection, use, and disclosure of Personal Information as described below.

1. DEFINITIONS

“Personal Information” means information about an identifiable individual, as defined under PIPA.
It includes, but is not limited to:
Name
Email address
Phone number
Physical address
Transaction history
Online identifiers (IP address, device identifiers)
Personal Information does not include anonymized or aggregated information that cannot reasonably identify an individual.

2. OUR ROLE AS A

MARKETPLACE
CMarket Ltd. operates solely as an online marketplace intermediary connecting Customers and independent third-party Vendors.
Vendors are independent businesses.
Once Personal Information is shared for fulfillment purposes, Vendors act as independent organizations responsible for their own privacy compliance.
CMarket does not control Vendor internal data handling practices beyond contractual limitations imposed through Vendor agreements.
Nothing in this Policy creates agency,

partnership, or employment relationships between CMarket and Vendors.

3. INFORMATION WE COLLECT

3.1 Information You Provide
Customers:
Full name
Email address
Phone number
Delivery or pickup address
Order and transaction history
Communications with customer support
Vendors:

Legal/business name
Business contact information
Licensing or insurance information (where required)
Payout information processed via Stripe
3.2 Automatically Collected Information
When you use the Platform, we may collect:
IP address
Browser and device information
Session data
Usage patterns
Log files
3.3 Cookies & Similar Technologies

We use cookies and similar technologies for:
Essential functionality
Fraud prevention
Security monitoring
Performance analytics
You may control cookies through browser settings; however, disabling certain cookies may limit Platform functionality.

4. PURPOSES FOR COLLECTION, USE & DISCLOSURE

Personal Information is collected, used, and disclosed solely for purposes that are reasonable in the circumstances, including:

Processing and facilitating transactions
Coordinating delivery and fulfillment
Customer service and dispute resolution
Fraud detection and risk management
Compliance with legal and regulatory obligations
Internal analytics and service improvement
We limit collection to information reasonably necessary for these purposes (data minimization principle).
We do not sell Personal Information.

5. DISCLOSURE OF PERSONAL INFORMATION

5.1 Disclosure to Vendors
We disclose limited Personal Information (such as name, phone number, and address) to Vendors strictly for:
Order preparation
Delivery coordination
Transaction completion
Vendors are contractually prohibited from:
Using Personal Information for independent marketing
Building external customer databases
Retaining Personal Information

beyond operational necessity
CMarket is not responsible for Vendor misuse of information outside reasonable Platform control.
5.2 Third-Party Service Providers
We may share Personal Information with service providers such as:
Stripe (payment processing)
Cloud hosting providers
Analytics providers
Security and fraud monitoring services
These providers are contractually required to maintain appropriate confidentiality and security safeguards.

5.3 Legal & Safety Disclosure
We may disclose Personal Information:
In response to lawful court orders, subpoenas, or legal processes
To law enforcement agencies (including RCMP)
To regulatory authorities
To protect the safety, legal rights, or integrity of the Platform

6. CROSS-BORDER PROCESSING

Some service providers may process Personal Information outside Canada.
Personal Information stored or processed outside Canada may be

subject to foreign laws and lawful access by foreign authorities.
By using the Platform, you consent to such cross-border transfers where operationally necessary.

7. SAFEGUARDS

We implement reasonable security safeguards appropriate to the sensitivity of the information, including:
Administrative safeguards (restricted access controls, internal policies)
Technical safeguards (encryption, secure hosting environments, firewalls)
Physical safeguards (secured infrastructure facilities)

While we take reasonable measures, no system can guarantee absolute security.

8. PRIVACY BREACHES

If a security breach involving Personal Information creates a real risk of significant harm, we will:
Notify affected individuals as required by law
Notify the Office of the Information and Privacy Commissioner for British Columbia (OIPC), where required

9. RETENTION & DESTRUCTION

Personal Information is retained only as long as necessary for:

Legal compliance
Tax and accounting requirements
Fraud prevention
Dispute resolution
When no longer required, Personal Information will be securely destroyed or anonymized.

10. ACCESS & CORRECTION RIGHTS (PIPA)

Under PIPA, individuals have the right to:
Request access to their Personal Information
Request correction of inaccurate information
Requests will be responded to within

thirty (30) days, subject to limited exceptions permitted by law.
We may require identity verification prior to processing requests.

11. WITHDRAWAL OF CONSENT

You may withdraw consent to certain uses of Personal Information, subject to legal and contractual limitations.
Withdrawal may restrict or prevent continued use of the Platform.

12. BUSINESS TRANSFERS

In the event of a merger, acquisition, financing, restructuring, or sale of assets, Personal Information may be transferred as part of the transaction,

subject to applicable legal safeguards.

13. AGE RESTRICTIONS

The Platform is intended for individuals who have reached the age of majority in their jurisdiction.
We do not knowingly collect Personal Information from minors.

14. ELECTRONIC RECORDS

Electronic logs and system records may be retained and used as evidence in dispute resolution and legal proceedings, unless proven inaccurate.

15. POLICY UPDATES

We may update this Privacy Policy from time to time.

Material changes will be posted with an updated Effective Date.
Continued use of the Platform constitutes acceptance of updates.

16. CONTACT INFORMATION

Privacy Officer
CMarket Ltd.
2319 Clarke St
Port Moody, BC V3H 1Y9
Email: [email protected]
If you are not satisfied with our response, you may contact:
Office of the Information and Privacy Commissioner for British Columbia
www.oipc.bc.ca