Privacy Notice

¹Introduction

commonsku Inc. (“commonsku”, “us”, “we”, “our”) owns and operates the website located at https://commonsku.com/ and its subdomains (“Website”) and the cloud-based workflow platform for promotional products professionals, as described in more detail on the Website (“Platform”). The Website and Platform shall be referred to herein as the “Services”.

This privacy notice (“Notice”) sets out how we collect, use, and disclose Personal Information while operating our business. We will only use your Personal Information in accordance with this Notice and in accordance with applicable law. We take steps to ensure that the Personal Information that we collect about you is adequate, relevant, not excessive, and used for limited purposes.

By using the Services, you consent to the collection, use and disclosure of your Personal Information as described in this Notice. Except as set forth in this Notice, your Personal Information will not be collected, used or disclosed for any other purpose without your consent. If you do not agree with our policies and practices regarding Personal Information, you should not use our Services.

We may change this Notice from time to time at our sole discretion. We encourage you to review this Notice each time you use the Services to see if the Notice has been changed, as indicated by the “Last Updated” date set out above. commonsku may require you to provide consent to the updated Notice before further use of the Services is permitted.

²Scope of this Notice

This Notice applies to Personal Information we collect about visitors of our Website, commonsku customers who have purchased access to the Platform (“Customers”) and authorized end users of a Customer (“End Users”). Customers and End Users are collectively referred to as “Users”, “you”, or “your”.

This Notice does not apply to a Customer’s collection, use, and disclosure of Personal Information by Customer about their End Users. If you are an End User, we encourage you to read the Notice of your enterprise or contact their privacy officer to understand how your Personal Information may be collected, used, and disclosed by them.

From time to time, Customers or their End Users may share Personal Information about third parties with us via the Platform, either directly or through a Third-Party Integration. In connection with our provision of Services, we process this Personal Information on the Customer’s behalf and in accordance with their instructions. For such Personal Information, the privacy notice of the corresponding Customer (rather than this Notice) will apply. Our activities as a service provider for Customers are governed by the contracts we have with our Customers.

Certain Services functionality may allow Users to share Personal Information (either their own Personal Information or Personal Information of third parties) with other Users via the Services. For example, a Customer who is a distributor may choose to interact or do business with another Customer who is a supplier via the Platform, and the two parties may exchange Personal Information between each other in connection with such dealings. If you use such functionality, any Personal Information you share or make available to other Users that we can access will be subject to this Notice, but please note that such Personal Information will also be subject to the privacy practice of the applicable User.

This Notice does not apply to Personal Information of commonsku personnel. If you currently work for commonsku, please contact the commonsku Privacy Officer per Section 9 below for more information about your Personal Information may be collected, used and disclosed by us.

The Services may contain links to third-party websites, products, or services that we do not own or operate. This Notice does not apply to the collection, use, and disclosure of your Personal Information by such third parties or by Third-Party Integrations. We are not responsible for the privacy practices of these third parties and encourage you to review their privacy notices to find out information about how they may use your Personal Information.

³How your Personal Information is Collected

3.1

Information Provided to Us

We collect Personal Information provided to us as follows:

1. Information Shared via the Website. Certain functionality of the Website allows you to share information with us. For example, you may submit information to us when you register for a Platform demo or sign up for our newsletter. We collect any Personal Information you choose to provide to us via the Website. We ask that you do not disclose sensitive Personal Information (including, without limitation, medical information) when you provide information to us.
2. Information Shared during Onboarding. When onboarding prospective Customers onto the Platform, we collect information shared with us during the Platform onboarding and implementation process, some of which may constitute Personal Information. This information may be collected via the Website, Platform, or when the Customer interacts with our personnel. This information includes includes name, phone number, email address, payment and billing information, and any other information shared with us during Platform onboarding and implementation.
3. Information Shared via the Platform. We collect any information (including any Personal Information) that is made available to us via the Platform, either directly by Users or indirectly via a Third-Party Integration. We ask that you do not disclose sensitive Personal Information (including, without limitation, medical information) or any Personal Information not related to your use of our Services when you share information with us via the Services.
4. Third-Party Integrations. We may integrate with or rely on third party platforms and services to provide aspects of the Services to you (“Third-Party Integrations”). Any Personal Information made available to us via Third-Party Integrations that we can access will be subject to this Notice, but please note that such Personal Information will also be subject to the privacy practice of the applicable Third-Party Integration.

3.2

Information We Collect When You Use the Services

1. Cookies. When you use the Services, commonsku may collect certain information through technologies such as cookies and other automatic data collection technologies (“Cookies”). We may use Cookies for authentication and to compile aggregate statistics about usage of the Services, such as how long Users spend using the Platform, and what parts or pages of the Website are viewed most often. This information is used to improve the content and operation of the Services. You may opt out of Cookies or prevent third-party websites from accessing our Cookies by adjusting your privacy settings on your browser. However, opting out of Cookies may disable some features of the Services and may prevent us from providing you with the information and services you have requested.
2. Device and Location Information. When you use the Services, commonsku may collect information about your device (“Device Information”). Some Device Information, such as unique device identifiers, may constitute Personal Information. The Personal Information we collect from Device Information can depend on the individual settings of your device and software that you use to access the Services. We recommend checking the policies of your device manufacturer or software provider to learn what Device Information may be shared with commonsku. You may disable the sharing of Device Information, but doing so may disable some features of the Services and may prevent us from providing you with the information and services you have requested.

⁴Use and Sharing of Personal Information

We use Personal Information in the following ways:

• To authenticate and onboard you, and provide you access to the Services.
• To provide, maintain, improve, and enhance the Services, including analyzing performance trends and usage to enhance our Services, personalizing and improving your experience with our Services, marketing our Services, performing internal research to develop new Services, and quality assurance.
• To develop new commonsku products, features, and services.
• To communicate with you, provide you with updates and other information relating to the Services, provide information that you request, respond to comments and questions, and otherwise provide customer support.
• To manage our Customer relationships, including servicing Customer accounts and managing billing.
• For marketing and advertising purposes, such as sending you promotional and advertising materials (where you have subscribed to receive them).
• To find and prevent fraud and respond to trust and safety issues that may arise.
• To meet our legal or regulatory compliance obligations and to enforce violations of our legal contracts and other policies.
• To facilitate a possible corporate transaction such as a merger, sale, or acquisition.
• Any other legitimate business purposes or where you have given your consent.

In connection with the purposes listed above, we may share your Personal Information with our third-party service providers which support the delivery of the Services, enable our marketing activities, and support our business operations. Further, we may share your Personal Information with our professional advisors including lawyers, accountants, financial advisors, consultants and insurance brokers.

When we share your Personal Information with third parties, we either (i) enter into written agreements that require each such third party to provide a comparable level of protection for your Personal Information as the protection offered by commonsku; or (ii) ensure that any sharing of Personal Information with a third party who will be using the Personal Information for their own purposes is conducted in compliance with applicable laws.

Please note that we may use information that does not identify you (such as Personal Information that has been aggregated and/or anonymized) for any purpose except as prohibited by applicable law.

⁵Disclosure of Personal Information to Third Parties

We will not disclose your Personal Information to third parties outside of commonsku unless we obtain appropriate consent or unless otherwise permitted by applicable law. The following are circumstances where we may disclose your Personal Information to third parties:

1. Business Transactions. If we undergo a business transaction, such as a purchase, sale, merger, financing, or amalgamation or any other type of change in control of our business or assets (“Business Transaction”), Personal Information may be disclosed to a third party evaluating or facilitating the Business Transaction (“Entity”). Such disclosures will be made under contract with the Entity and in connection with the Entity’s due diligence for any such Business Transactions. If we and the Entity proceed with the Business Transaction, your Personal Information will remain subject to this Notice.
2. Legal Purposes. We may disclose your Personal Information to third parties if we have reason to believe that disclosing this Personal Information is necessary to identify, contact or bring legal action against someone who may be causing injury to or interference with (either intentionally or unintentionally) our rights or property, other Users, or anyone else (including the rights or property of anyone else) that could be harmed by such activities. Further, we may disclose Personal Information when we believe in good faith that such disclosure is required by and is in accordance with the law (such as disclosures in response to a subpoena, warrant, or other legal order).

⁶Security

We use commercially reasonable efforts to store and maintain your Personal Information in a secure environment. We take technical, contractual, administrative, and physical security steps designed to protect Personal Information that you provide to us. We have implemented procedures designed to limit the dissemination of your Personal Information to only such designated commonsku personnel and third parties as reasonably necessary to carry out the stated purposes we have communicated to you.

Please note that our servers and those of third parties who may receive your Personal Information may be located in different provinces within Canada and in jurisdictions outside of Canada, such as the United States and/or the European Economic Area (“Foreign Jurisdiction”). Accordingly, Personal Information processed or stored in Canadian jurisdictions outside the Canadian province where the Personal Information originates or in Foreign Jurisdictions outside Canada may be available to governments or their agencies in that Foreign Jurisdiction under a lawful access order.

⁷Data Retention and Deletion

We will keep your Personal Information for as long as it remains necessary for the identified purpose of collection or as required by law, which may extend beyond the termination of our relationship with you. All retained Personal Information will remain subject to the terms of this Notice. You have the right to ask us to remove your Personal Information from our databases, and we will do so to the best of our ability, but it may not be possible to completely delete all of your Personal Information due to technological and legal constraints (for example, when your Personal Information pertains to another User).

⁸Access and Accuracy

You may access the Personal Information we hold about you to verify accuracy of your Personal Information, to have a general account of our uses of your Personal Information, and to correct your Personal Information as appropriate. Upon receipt of your written request, we will provide you with a copy of your Personal Information although in certain limited circumstances, we may not be able to make all relevant Personal Information available to you (for example, where that Personal Information also pertains to another User). In such circumstances, we will provide reasons for the denial to you upon request. We will make every reasonable effort to keep your Personal Information accurate, and to respond to you in a timely manner.

⁹Contact Us

If you have any questions regarding this Notice or your Personal Information, please contact our Privacy Officer per the information below:

• Via email: Email us at info@commonsku.com using the subject line “Re Privacy Notice”.
• Via mail: Mail us correspondence to 250 Merton Street, Suite 501, Toronto, ON, M4S 1B1