Privacy Policy

BUDTENDERS ASSOCIATION INC. PRIVACY POLICY Effective Date: June, 2026 — Version 2.0

This Privacy Policy replaces and consolidates our previous Privacy Policy and Data Usage Policy into a single document.

1. WHO WE ARE AND WHAT THIS POLICY COVERS

1.1 Budtenders Association Inc. ("BTA", "we", "our", "us") operates a cannabis retail intelligence and professional development platform for consumers, budtenders, retail managers, and retail owners (the "Platform"). This policy explains what personal information we collect, why, who we share it with, where it is stored, how long we keep it, and the choices and rights you have. It applies to the Platform under the Budtenders Association brand and under any current or future brand of BTA or its affiliates.

1.2 Our Privacy Officer is accountable for our privacy practices. You can reach them at [email protected] (see Section 12). We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Quebec's Act respecting the protection of personal information in the private sector for our Quebec members.

2. WHAT WE COLLECT

Depending on how you use the Platform, we collect:

• Account and profile information: name, email, phone number, date of birth, province, and the profile details you choose to add.
• Professional information: for retail professionals — your role, employer/store affiliation, and, where we verify your status, supporting documents such as proof of employment or certifications. We keep a record of the verification outcome and delete the underlying documents on the schedule in Section 7.
• Research contributions: your responses to surveys, quizzes, polls, and ratings. Because our community's research relates to cannabis — including preferences and consumption habits — we treat this as sensitive information and ask for your express consent at sign-up before collecting it (Section 4).
• Points and rewards activity: points earned, rewards redeemed, referrals, tier status, and contest entries.
• Technical and usage information: IP address, browser and device type, pages visited, and interactions with Platform features.
• Consent and acceptance records: the version of the terms and consents you accepted and when — we keep these so we can always show what you agreed to.

3. HOW WE USE YOUR INFORMATION

We use personal information to:

• Run your membership: create and manage your account, verify eligibility and professional status, deliver rewards, and provide member features.
• Personalize your experience: tailor content, survey invitations, and recommendations to your role and interests.
• Produce our research and intelligence products: we analyze member research contributions to create market research, industry reports, and commercial intelligence products — such as brand and retail insights, indices, and scores — that we provide to cannabis industry clients. These products are built from de-identified and aggregated data: they do not identify you, and no client can see your individual responses. This research is how we keep membership free.
• Communicate with you: membership emails (welcome, verification, rewards), service announcements, and — only if you opt in — newsletters and marketing.
• Keep the Platform safe and lawful: detect fraud and abuse, enforce our Terms & Conditions, and meet legal obligations.

3.1 Automated Analysis. We use analytics and AI tools, including services provided by third-party providers, to help analyze survey responses and platform engagement. Identifying details are removed before free-text responses are analyzed by these tools, our providers are bound by data processing agreements, and they are not permitted to use your information to train their own models.

4. CONSENT AND YOUR CHOICES

4.1 How We Ask. At sign-up we ask for your consent in two separate steps: (a) acceptance of our Terms & Conditions and this Privacy Policy; and (b) your express consent to collect and use your cannabis-related research contributions to produce de-identified research and intelligence products, as described in Section 3. We keep a record of both.

4.2 Leaderboards. Leaderboards: if you appear on a Platform leaderboard (for example, a top-10 or top-50 list), your display name and rank are visible to other members. You can choose a display name that does not identify you, and you can opt out of leaderboard display in your account settings.

4.3 Opt-In Disclosures. Brand and partner communications: we do not disclose your identity or contact information to brands, event partners, or any other company unless you expressly opt in to communications from that specific company through the Platform. You can withdraw an opt-in at any time and we will stop the disclosure.

4.4 Withdrawing Consent. You can withdraw consent at any time, subject to legal and contractual limits, by adjusting your settings or contacting our Privacy Officer. Withdrawing consent for research contributions stops future collection; contributions already de-identified and blended into aggregate research can no longer be traced back to you and cannot be recalled. Withdrawing essential consents may mean we can no longer provide your membership.

5. WHEN WE SHARE INFORMATION

5.1 We do not sell your personal information. We share it only as follows:

(a) Service providers. Companies that host our infrastructure, deliver our email, and provide analytics and AI processing, under contracts that limit their use of your information to providing services to us;

(b) Industry clients. Receive de-identified, aggregated insights only. They never receive your identity or individual responses, except where you have expressly opted in under Section 4.3;

(c) Fulfilment. Contest and reward fulfilment — where a prize partner fulfils a prize you have won, we share your name and delivery details with them for fulfilment only;

(d) Verification. Credential verification — where you have earned a credential, we may confirm your credential status to a third party (such as an employer) that asks to verify it;

(e) Legal. Legal requirements — where required by law, court order, or to protect the rights and safety of BTA, our members, or others;

(f) Business transactions. If BTA is involved in a merger, acquisition, financing, reorganization (including a rebrand to a successor entity), or sale of assets, personal information may be transferred as part of that transaction. Any recipient must protect it consistently with this policy and use it only for the purposes it was collected, and we will notify you of a completed transaction that transfers your information.

6. WHERE YOUR INFORMATION LIVES

6.1 Your personal information is stored with reputable cloud infrastructure providers. Our primary database and file storage are currently hosted in the United States, and some of our service providers — including email delivery and AI-analysis providers — also process data in the United States. When your information is stored or processed outside Canada, it is protected by data processing agreements and contractual safeguards, but it may be accessible to authorities in those jurisdictions under their laws. If you would like more information about our service providers or these safeguards, contact our Privacy Officer.

7. HOW LONG WE KEEP INFORMATION

• Active accounts: For the life of your membership.
• Closed accounts: Personal information is deleted or anonymized within 90 days of closure, unless a longer period is required by law or listed below.
• Research contributions: De-identified and retained indefinitely as part of our research dataset; once de-identified, they no longer identify you.
• Verification documents: Underlying documents (e.g., proof of employment) are deleted within [90] days of the verification decision; we keep the outcome and date.
• Transaction, points, and reward records: 7 years, for audit, tax, and compliance purposes.
• Consent, acceptance, and opt-in records: Kept for as long as needed to demonstrate your consents, including after account closure.
• Contest records: Winner and release records kept as required by law; entry records deleted with account data.

8. COOKIES AND ANALYTICS

8.1 We use a small number of necessary cookies for core functions — age confirmation, login sessions, authentication, and security. These cannot be turned off because the Platform does not work without them. For analytics, we run a self-hosted, cookieless analytics tool on our own infrastructure: it sets no cookies, does not track you across other sites, and is not shared with or accessible to any third-party analytics vendor. For visitors who are not logged in, it collects no personal information; for logged-in members, page views and interactions are associated with your account so we can understand how members use the Platform. Your cookie preferences can be managed via "Cookie Settings" in the site footer.

9. KEEPING YOUR INFORMATION SAFE

9.1 We protect your information with industry-standard measures, including encryption in transit (TLS), secure authentication, access controls limited to those who need it, and regular security reviews. No system is perfectly secure, but if a breach creates a real risk of significant harm to you, we will notify you and the appropriate privacy regulator(s) as required by law.

10. YOUR RIGHTS

You can, at any time:

• Access: request a copy of the personal information we hold about you.
• Correct: update your profile yourself, or ask us to correct inaccurate information.
• Delete: close your account and request deletion of your personal information, subject to the retention periods in Section 7.
• Port: for our Quebec members and wherever the law provides it, request computerized personal information you provided to us in a structured, commonly used technological format.
• Withdraw consent: as described in Section 4.4.
• Complain: contact our Privacy Officer first — we respond within 30 days — and you may also complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator, including the Commission d'accès à l'information du Québec for Quebec residents.

11. AGE

11.1 The Platform is for individuals who have reached the legal age for cannabis purchase in their province or territory of residence. We do not knowingly collect personal information from anyone under that age, and if we learn we have, we will delete it promptly.

12. CHANGES AND CONTACT

12.1 Changes. We may update this policy from time to time. For material changes, we will notify you by email and on the Platform at least fifteen (15) days before the change takes effect, and each version is dated and archived.

12.2 Contact. Privacy Officer, Budtenders Association Inc. — [email protected]. We respond to privacy requests within 30 days.