Privacy Statement (CA)

1. Person in Charge of Processing

This privacy policy applies to the website operated by Alexeev Avocats (hereinafter "we," "us," or "our"). As a Quebec-based business, we are subject to An Act to modernize legislative provisions as regards the protection of personal information (commonly known as Quebec Law 25), which governs how we collect, use, disclose, and retain personal information about the individuals who visit our website or interact with our services.

We are committed to handling your personal information responsibly, transparently, and in full compliance with Quebec Law 25. This policy explains what personal information we collect, why we collect it, who we share it with, and what rights you have over it.

2. Personal Information Collected

Depending on how you interact with our website, we may collect the following categories of personal information:

• Identification and contact information: Your name, email address, phone number, and any other details you voluntarily provide when you fill out a contact form or reach out to us directly.
• Device and technical identifiers: Your IP address, browser type, operating system, device identifiers, and advertising identifiers collected automatically when you visit our site.
• Browsing and session data: Pages you visit, time spent on each page, navigation paths, clicks, scroll depth, and approximate geographic location derived from your IP address.
• Form submission data: Any information you enter into forms on our site, which may include your name, email address, the nature of your inquiry, and any other details you choose to share.
• Consent preferences: A record of the cookie and tracking choices you make through our consent management platform, along with the IP address associated with that consent event.

We do not knowingly collect sensitive personal information (such as health, financial, or biometric data) through this website. If you contact us about a legal matter that involves sensitive information, that information is handled under our professional obligations as a law firm and is governed by separate engagement-specific confidentiality terms.

3. Purposes of Processing

We use your personal information only for the purposes described below. Where we rely on your consent, you may withdraw it at any time (see Section 7).

• Operating and securing the website (Essential — legal basis: legitimate interest): We use session data, IP addresses, and consent preference records to keep the site functional, secure, and compliant with Quebec Law 25. This is handled through Moelleux (by Horizon-Cumulus), our consent management platform, which stores consent records and hosts this policy on servers located in Quebec (OVH, Beauharnois, QC). A preference cookie named moelleux_{site_key} is placed in your browser for up to 13 months to remember your choices.
• Audience measurement and site improvement (Analytics — legal basis: consent): We use Google Analytics 4 and Hotjar to understand how visitors navigate our site, which pages are most useful, and where we can improve the user experience. These tools collect device identifiers, IP addresses, pages visited, session duration, navigation behavior, and approximate location. Both services transfer data to the United States (see Section 5). These tools are only activated if you consent via our cookie banner.
• Marketing and conversion tracking (Marketing — legal basis: consent): We use HubSpot to track how visitors interact with our site in the context of our marketing efforts and to manage follow-up communications. HubSpot may collect device identifiers, IP addresses, pages visited, form submission data, advertising identifiers, and communication data. Data is transferred to the United States (see Section 5). HubSpot is only activated if you consent via our cookie banner.
• Displaying website content correctly (Functional — legal basis: legitimate interest): We use Google Fonts to render the typography on our site. When your browser loads a page, it may send your IP address to Google's servers in the United States in order to retrieve the font files. This is a technical necessity for proper display of our content.
• Responding to your inquiries (Contact — legal basis: consent / legitimate interest): When you submit a contact form or send us an email, we use the information you provide solely to respond to your request and, where relevant, to assess whether we can assist you with your legal matter.

4. Third Parties and Processors

The table below lists every third-party service currently active on our website, its purpose, its category, and whether it involves a transfer of personal information outside Quebec.

We also use Microsoft 365 (operated in the United States) for business email communications. When you email us directly, your message and contact details may be processed on Microsoft's servers in the United States. Our website itself is hosted by Horizon-Cumulus (Joliette, Quebec), and your data remains in Quebec at the hosting level.

5. Transfers Outside Quebec

Several of the services we use involve transferring your personal information to servers or processors located in the United States. Under section 17 of Quebec Law 25, we are required to inform you of these transfers and to take steps to ensure your information receives a level of protection comparable to what Quebec law provides.

The following services transfer personal information to the United States:

• Google Analytics 4 (United States): Your device identifiers, IP address, browsing behavior, and approximate location are processed by Google LLC in the United States. Google participates in the EU-U.S. Data Privacy Framework and relies on Standard Contractual Clauses for international transfers. We have configured Google Analytics with IP anonymization where technically available.
• Hotjar (United States): Session recordings and heatmap data, including your IP address and navigation behavior, are processed by Hotjar Ltd. on servers in the United States. Hotjar relies on Standard Contractual Clauses as a contractual safeguard for cross-border transfers.
• HubSpot (United States): Contact and behavioral data collected through our site may be processed by HubSpot, Inc. in the United States. HubSpot relies on Standard Contractual Clauses and participates in the EU-U.S. Data Privacy Framework.
• Google Fonts (United States): Your IP address is transmitted to Google's servers in the United States when font files are loaded. This transfer is incidental to the technical delivery of web fonts.
• Microsoft 365 — Business Email (United States): Emails you send to us are processed through Microsoft's infrastructure in the United States. Microsoft relies on Standard Contractual Clauses and participates in the EU-U.S. Data Privacy Framework.

Before authorizing these transfers, we conducted or reviewed a Privacy Impact Assessment (PIA) as required by Quebec Law 25 to confirm that the personal information transferred benefits from adequate protection in the destination jurisdiction. If you have questions about a specific transfer or wish to review our PIA findings, please contact our Person responsible for the protection of personal information (see Section 8).

6. Retention Period

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy, or as required by applicable law. The table below summarizes our retention practices by data type.

Once the applicable retention period expires, personal information is securely deleted or anonymized so that it can no longer be linked to an identifiable individual.

7. Rights of Visitors

Quebec Law 25 gives you meaningful rights over your personal information. You may exercise any of the following rights by contacting our Person responsible for the protection of personal information (see Section 8):

• Right of access: You may ask us to confirm whether we hold personal information about you and to receive a copy of that information in a clear and understandable format.
• Right of rectification: If any personal information we hold about you is inaccurate, incomplete, or ambiguous, you may ask us to correct it.
• Right of erasure (right to be forgotten): You may ask us to delete personal information we collected about you, subject to our legal and professional obligations to retain certain records.
• Right to data portability: You may ask us to provide you with the personal information you gave us in a structured, commonly used, and machine-readable format so that you can transfer it to another organization, where technically feasible.
• Right to withdraw consent: Where we rely on your consent to process your personal information (for example, for analytics or marketing cookies), you may withdraw that consent at any time — either through our cookie preference center or by contacting us directly. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

We will respond to your request within 30 days of receiving it, as required by Quebec Law 25. In complex cases, we may extend this period and will notify you accordingly.

If you believe we have not handled your personal information in accordance with Quebec Law 25, you have the right to file a complaint with the Quebec Information Access Commission (CAI) at www.cai.gouv.qc.ca.

8. Person Responsible for the Protection of Personal Information

In accordance with section 3.1 of Quebec Law 25, Alexeev Avocats has designated a Person responsible for the protection of personal information who oversees compliance with this policy and handles all requests and inquiries related to personal information.

• Name: Molly Krishtalka
• Title: Associée
• Email: mkrishtalka@alexeevco.com
• Phone: 514-545-7057

You may contact our Person responsible for the protection of personal information at any time to exercise your rights, ask questions about this policy, or raise a concern about how your personal information is handled. We will acknowledge your request promptly and provide a substantive response within 30 days, as required by Quebec Law 25.

9. Effective Date and Versioning

This privacy policy takes effect on 17 juin 2026.

Current version: 1

We may update this policy from time to time to reflect changes in our practices, the services we use, or applicable law. When we make material changes, we will update the effective date above and, where appropriate, notify you through our website or by other means. We encourage you to review this policy periodically to stay informed about how we protect your personal information.

Previous versions of this policy are available upon request by contacting our Person responsible for the protection of personal information (see Section 8).