Privacy Policy

1. Who This Policy Applies To

This Privacy Policy describes how In Bloom Cannabis ("we", "us", "our") collects, uses, discloses, and protects personal information about visitors to our website at demo.inbloomcannabis.ca and inbloomcannabis.ca, customers of our retail store at 1831 Main St W, Hamilton, ON L8S 1H6, and users of our online ordering and chat services. We comply with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario laws.

2. Information We Collect

3. Why We Collect It

We collect personal information for the following purposes:

• To verify that you are 19 years of age or older, as required by Ontario law.
• To process, fulfill, and deliver your order, including pickup notifications and delivery routing.
• To process payments, prevent fraud, and detect chargebacks or unauthorized use.
• To answer questions, provide customer service, and respond to your messages or chat.
• To meet our legal and regulatory obligations under the federal Cannabis Act, the Ontario Cannabis Licence Act, 2018, AGCO Registrar's Standards, tax law, and consumer-protection law.
• To operate, secure, and improve our website and services.
• If you opt in, to send promotional messages and product updates. You can unsubscribe at any time.

We rely on your consent for these purposes. By placing an order or using the website, you consent to the collection and use of your information for the purposes described here. You can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice (see Section 10).

4. When We Share Information

We share personal information only with parties that need it for one of the purposes above, and we require those parties to protect it. We share with:

• Our payment processor and acquiring bank, to authorize and settle card transactions.
• The Ontario Cannabis Store (OCS) and Alcohol and Gaming Commission of Ontario (AGCO) when required by law, for compliance reporting, audit, or investigation.
• Health Canada if a product recall or adverse-event report requires it.
• Service providers who help us run the business, including our website host, online-ordering platform, delivery dispatch, age-verification provider, email and SMS provider, and analytics tools, all under written agreements that limit their use of personal information to providing services to us.
• Law enforcement, regulators, or courts when we are legally required to do so or to protect our rights, property, or safety.
• A successor in the event of a merger, acquisition, or sale of assets, subject to the terms of this Policy.

We do not sell, rent, or trade your personal information.

5. Payment Processing

Online card payments are processed by an authorized Canadian payment processor through a PCI-DSS compliant gateway. The processor receives the card data needed to complete your transaction and may retain it as required by card-network rules and applicable law. We receive a transaction confirmation, the card brand, the last four digits, and a reference number. We do not store your full card number, expiry, or CVV on our servers. The payment processor's privacy practices are governed by its own privacy policy, available on its website.

6. Cookies & Analytics

Our website uses cookies and similar technologies to remember your age-gate confirmation, keep your shopping cart and session, secure the site, and measure how the site is used so we can improve it. Some cookies are strictly necessary for the site to function; others are analytics or preference cookies. You can disable cookies in your browser settings, though parts of the site (including the age gate and ordering) may not work properly without them. We may use aggregated, non-identifying analytics from providers such as standard web-analytics tools to understand site traffic.

7. Chat Assistant ("Bloom")

Our website includes an AI-powered chat assistant. Messages you send the assistant are processed by our chat infrastructure to generate responses, answer product questions, and help you place an order. We may retain chat transcripts to operate the service, debug issues, and improve responses. Do not share sensitive personal information (such as health details or full payment information) in the chat. The chat is not a substitute for medical or legal advice.

8. How Long We Keep It

We keep personal information only as long as needed for the purposes described, or as required by law:

• Order, transaction, and tax records: at least seven (7) years to meet Canada Revenue Agency and AGCO record-keeping requirements.
• Account and contact information: for as long as you have an active account or relationship with us, then archived for the period required by law.
• Marketing preferences: until you unsubscribe, plus a short suppression period to honour your opt-out.
• Website logs and analytics: typically up to 24 months in identifying form, then aggregated or deleted.
• Chat transcripts: typically up to 12 months unless retained longer for fraud or compliance review.

9. How We Protect It

We use physical, technological, and organizational safeguards proportionate to the sensitivity of the information, including encryption in transit (HTTPS/TLS) for our website and ordering, restricted staff access on a need-to-know basis, secure storage at our retail location, and contractual security obligations on our service providers. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security but will notify affected individuals and the appropriate authorities if a breach involving real risk of significant harm occurs, as required by PIPEDA.

10. Your Rights

Subject to legal limits, you have the right to:

• Access the personal information we hold about you and request a copy.
• Correct information that is inaccurate or out of date.
• Withdraw consent for future use of your information, understanding that this may prevent us from providing certain services (for example, processing or delivering an order).
• Unsubscribe from marketing emails or SMS at any time, using the unsubscribe link or by contacting us.
• Complain to our Privacy Officer (Section 14) and, if not resolved, to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To make a request, contact us using the details in Section 14. We will respond within 30 days or explain why more time is needed.

11. Children & Minors

Our website and services are intended only for adults 19 years of age or older. We do not knowingly collect personal information from anyone under 19. If we learn that we have collected information from a person under 19, we will delete it and refuse the order. Parents or guardians who believe their child has provided personal information should contact us immediately.

12. Information Stored Outside Canada

Some of our service providers (for example, certain analytics, email, or chat infrastructure providers) may store or process information outside Canada. While outside Canada, the information may be subject to the laws of that country, including lawful requests by foreign authorities. We require these providers to apply protections substantially equivalent to those in this Policy.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or the law. Material changes will be reflected by updating the "Last updated" date at the top of this page. Continued use of the website after changes are posted constitutes acceptance of the revised Policy.

14. Contact & Privacy Officer

Questions, requests, or complaints about this Policy or our handling of your personal information may be directed to our Privacy Officer:

Privacy Officer, In Bloom Cannabis
1831 Main St W, Hamilton, ON L8S 1H6
Phone: (365) 883-3188
Email: sales@inbloomcannabis.ca

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at 1-800-282-1376 or priv.gc.ca.