Privacy Policy and Protection of Personal Information

DIY Robotics

Last updated and effective as of: May 1, 2025

Your trust is important to us. We want you to understand what personal information we may collect about you when you interact with DIY Robotics Inc. (hereinafter “DIY Robotics”), how we use your personal information, and how we protect it.

This privacy policy describes our policies and procedures regarding the collection, use, and disclosure of your information when you use our services, and informs you of your privacy rights and how the law protects you.

We use your personal data to provide and improve the service. By using the service, you agree to the collection and use of information in accordance with this privacy policy. You may be entitled to request access to the personal information we hold about you, request correction or deletion, and exercise other rights provided by applicable laws in your jurisdiction. To exercise your rights, you can contact us at info@diy-robotics.com.

1. Context

DIY Robotics is a company specializing in the design of modular robotic cells for industrial automation. As part of its activities, the company collects, uses, communicates, and retains personal information. This policy aims to ensure the protection of this information and to inform data subjects about the company’s privacy practices.

2. Scope of the Policy

This policy applies to all DIY Robotics activities, including employees, collaborators, partners, subcontractors, suppliers, and consultants who have access to personal information. It also covers all websites, digital platforms, and services controlled by DIY Robotics. This policy was developed in accordance with the Quebec Act Respecting the Protection of Personal Information in the Private Sector (Law 25).

3. Definitions

4. Collection of Personal Information

DIY Robotics collects personal information lawfully and transparently, and only for specified, explicit, and legitimate purposes. Collection is mainly done directly from data subjects but may also be done from third parties with the prior consent of the individual, unless otherwise provided by law.

Indirect Collection from Third Parties – Right to Information

If personal information is collected from a third party rather than directly from the data subject, DIY Robotics agrees, upon written request, to inform the individual of the source of the information, unless a legal exception applies.

Profiling and Geolocation

DIY Robotics uses certain technological tools that may collect information about the approximate location of users (e.g., city, region, time zone) based on their IP address, and perform marketing profiling (e.g., pages viewed, interactions, visit frequency) to tailor communications, content, and offers.

This data is not used to make automated decisions that have legal or significant effects on the data subject.

Data subjects can oppose profiling or geolocation at any time via their browser settings.

5. Use and Disclosure of Personal Information

Personal information collected is used only for the purposes for which it was collected, unless the data subject expressly consents otherwise or an exception is provided by law.

Service Providers – Contractual Framework

When personal information is disclosed to a service provider, DIY Robotics requires by contract that the provider:

• Uses the data only for the assigned mandate;
• Ensures confidentiality and security of the information;
• Does not retain the information after the mandate ends;
• Notifies DIY Robotics immediately in case of an actual or potential breach;
• Allows DIY Robotics to audit compliance with its obligations.

Disclosure Outside Quebec

Personal information may be hosted or processed outside Quebec, particularly when a technology or cloud provider is located in another province or internationally. Before any transfer, DIY Robotics ensures that the data will receive an equivalent level of protection, including through standard contractual clauses, security audits, or adequacy decisions.

6. Consent

Consent to collect, use, and disclose personal information must be clear, free, informed, and given for specific purposes. It can be obtained implicitly or explicitly, depending on the nature of the information collected and the circumstances.

7. Retention and Destruction of Personal Information

DIY Robotics retains personal information only as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law (e.g., tax obligations, regulatory compliance, contractual requirements, or potential disputes).

To determine the appropriate retention period, we consider:

• The nature and sensitivity of the information,
• The potential risk of harm from unauthorized use or disclosure,
• The purposes for which it was collected,
• Whether those purposes can be achieved by other means,
• And applicable legal or regulatory requirements.

When the information is no longer needed, it is:

• Either securely destroyed,
• Or irreversibly anonymized so that it no longer identifies any individual.

Personal information used to make a decision about an individual will be retained for at least one year following the decision.

8. Data Security

DIY Robotics implements reasonable security measures to protect the personal information it manages. These include firewalls, encryption of sensitive data, two-factor authentication, restricted access, and locked facilities.

9. Rights of Data Subjects

In accordance with Law 25 and, where applicable, the General Data Protection Regulation (GDPR), any individual whose personal information is processed by DIY Robotics has the right to:

• Access their personal information held by DIY Robotics;
• Request correction of any inaccurate, incomplete, or ambiguous information;
• Withdraw consent to the use or disclosure of their information, subject to applicable legal or contractual obligations;
• Request deletion of their personal information when it is no longer necessary or justified by law;
• Request temporary restriction of data processing, especially during accuracy verification or in case of a dispute;
• Object to certain processing, especially for marketing purposes;
• Request data portability (i.e., receive their data in a structured, machine-readable format and transfer it to a third party);
• Be informed of any automated decision-making, including profiling, when such decisions produce legal or significant effects.

DIY Robotics currently does not make decisions based solely on automated processing. If this changes, individuals will be informed and may request a human review of the decision.

Requests regarding these rights must be made in writing and sent to our privacy officer at: info@diy-robotics.com. Proof of identity may be required to ensure confidentiality and security. DIY Robotics commits to responding within 30 days.

10. Complaint Handling Process

Any individual wishing to file a complaint regarding this policy or the protection of their personal information may do so in writing. The complaint will be handled confidentially, and a reasoned response will be provided within 30 days of acknowledgment.

11. Technological Privacy Settings

When DIY Robotics offers a technological service with privacy settings, they are configured by default to the highest level of protection, in accordance with Law 25. Users may then adjust these settings according to their preferences.

12. Children’s Privacy

DIY Robotics services are not intended for children under the age of 13. We do not knowingly collect personal information from minors without verifiable parental or legal guardian consent. If we discover that a child has provided us with personal information without authorization, we will take steps to delete it.

13. Cookie Policy

We use cookies and similar technologies (tags, pixels, scripts) to enhance user experience, analyze site traffic, and personalize content and ads.

Types of cookies used:

• Essential cookies: necessary for site functionality (e.g., session management, security).
• Performance cookies: help understand site usage (e.g., pages visited, duration).
• Functional cookies: remember preferences (e.g., language, region).
• Marketing cookies: used to display personalized ads on other sites.

You can accept or reject these cookies via a consent banner on your first visit, or adjust your preferences anytime via the “Manage cookies” link at the bottom of the page.

Refusing certain cookies may affect the functionality of some features.

To learn more about how our advertising partners (e.g., Google, Meta) use cookies, please refer to their respective policies.

14. Marketing and Personalized Advertising

DIY Robotics may use certain technological tools (such as Google Ads, LinkedIn Ads, or Meta Ads) to deliver personalized ads or measure campaign performance. To do so, cookies or web beacons may be installed during your visit.

We may also share certain usage data, in pseudonymized form, with our advertising partners to offer you relevant promotions, in accordance with your preferences.

You can at any time:

• Manage your preferences via the initial consent banner on our site;
• Disable marketing cookies in your browser settings;
• Contact us at info@diy-robotics.com to exercise your opt-out rights or withdraw consent.

We do not use your personal information for direct marketing without your prior consent. You can unsubscribe from any promotional communications via the link in our emails or by contacting us.

15. Privacy Officer

Name: Valérie Girouard

Address: 465 rue Joseph-Latour, Sherbrooke, QC, J1C 0W2

Email: info@diy-robotics.com

16. Publication and Updates

This policy is published on DIY Robotics’ website and is accessible to any concerned individual. Any material changes to this policy will be communicated appropriately.

17. Annex A – Types of Personal Information by Profile