QUITZONE PRIVACY POLICY

Dated July 24, 2026

Welcome to the QuitZone App (“App”). The App is published by our affiliate IMERA Canada Inc. This Privacy Policy explains how we, Imperial Tobacco Company Limited (d/b/a “ZONNIC”), may collect, use, disclose and otherwise process your personal information when you use the App, including its smoking cessation education, tracking, support and related features, tools and functionalities. Your privacy is important to us, and we are committed to protecting and respecting your privacy. Please read the following carefully.

If you have any queries or concerns regarding this QuitZone App Privacy Policy, please contact our Privacy Officer at data_protection_donnees@bat.com

1. WHAT INFORMATION DO WE COLLECT ABOUT YOU

To use certain features of the App, you may be required to have a ZONNIC account (“Account”) registered with us. If you already have an Account with us, you can use your login details to login and use the App. If you do not have an existing Account, you may be asked to register for one.

We collect and use information about you in the course of your use of the App. Your personal information may be collected:

directly from you, for example when you communicate with us;
via the App, for example when the App synchronises with our cloud environment;
via third party service providers or is publicly available information, for example when we are collecting information for the purposes of age verification (see further Verifying Your Age below).

Some of the personal information we collect depends on the App functionalities that you choose to enable and use. These functionalities may include smoking cessation education, quit-planning tools, craving and cigarette consumption tracking, smoke-free streak history, savings calculations, notifications, account management and related support features. The types of personal information that may be collected are set out below.

We may also collect some or all of the personal information listed below.

Identity data: information collected in connection with your login to the App, Account registration and age verification process, including your first and last name, email address, phone number, date of birth, residential address where required, and a password that you create.
Contact data: we collect information from you when you contact us about the App, including through email, telephone or any support functionality made available in the App. This may include information that identifies you, such as your name, email address and telephone number, along with additional information we need to help us respond to your question or comment. We may retain this information to assist you in the future and to improve our customer service and service offerings.
App engagement data: we collect information on how you engage with the App, including the features and functionalities you use or enable, the amount of time spent using those features and functionalities, and technical information that helps us understand and improve the App experience.
User terminal data: we collect information in connection with the device you use to access the App, including IP address, device make and model, operating system, network connection, device identifiers and, where permitted, advertising identifiers such as the Google Advertising ID (AAID/GAID), and similar technical information.
QuitZone data: if you choose to use the App’s quit-planning and tracking features, we may collect information related to your intentions for quitting smoking, your smoking cravings, your experience with nicotine replacement therapy, your daily cigarette consumption, days on which you do not consume cigarettes, your smoke-free streak history, and related dollar spend or savings calculations.
Other information that you provide to us: any extra information that you choose to tell us.

In addition, we collect and/or generate anonymised and aggregated information from your use of the App. We use anonymised and aggregated information in various ways, including to understand App engagement and usage. We may also share such anonymised and aggregate information with our parent company..

2. WHAT DO WE DO WITH THE INFORMATION WE COLLECT ABOUT YOU

We will use your personal information to:

identify you when you contact us or to authenticate you when logging into your account;
verify the accuracy of data we hold about you;
carry out age verification checks (please see Verifying Your Age for further details).
comply with a request from you in connection with the exercise of your rights; and
enforce or protect our contractual or other legal rights or to bring or defend legal proceedings.

We may use and process your personal information where it is necessary for us to pursue the following legitimate interests (whether ours, in connection with our business, or that of a third party) for the following purposes:

Processing necessary for us to measure the quality of our App

to carry out analytics to better understand how our users engage with the App and to improve user experience; to measure the effectiveness of marketing campaigns, QR codes, campaign links and other marketing touchpoints, including to understand whether a campaign or link resulted in an App install, App open or other App interaction; and

Processing necessary for us to assist you with any inquiries

to respond to communications you send to us relating to the App, and resolve any issues or queries you may have, including through any customer support functionality made available to you;

Processing necessary for us to operate the administrative, technical and security aspects of the App

to administer the App and for internal operations related to the App, including troubleshooting, testing, App performance and error management;
for the prevention of fraud and other criminal activities;
for efficiency, accuracy or other improvements of our databases and systems, for example, by combining systems;
to inform you of updates to our App terms and conditions and policies;
to correspond or communicate with you in relation to administrative, legal and business matters;
to allow you to register for other websites and services we or our affiliates operate to make those registration processes more convenient for you (for example, your Account);
for network and information security in order for us to take steps to protect your information against loss or damage, theft or unauthorised access;
to enforce or protect our contractual or other legal rights or to bring or defend legal proceedings; and
for other general administration including managing your queries, complaints, or claims, and to send service messages to you.

Where it is required to complete or, at your request, take steps to enter into, a contract:

The use of your personal information may be necessary to perform a contract that you have with us or perform steps you request to enter into a contract.

Where we have obtained your consent:

Where you have enabled certain App functionalities, we will send you personalised communications or otherwise provide you with the functionalities you have requested, such as quit-plan reminders, progress updates and related App features.

We rely upon your consent to send such communications to you. You provide this consent when you enable these functionalities. You can withdraw your consent at any time by disabling any of these functionalities in the App.

3. VERIFYING YOUR AGE

ZONNIC products are not suitable for use by persons under 18 years of age. Before you can access the App or create an Account through the App, we must verify your age.

Before being able to access the App, you may be asked to confirm that you are 18 years of age or older. Before being able to create an Account, you may be asked to provide your date of birth so that we can confirm that you are 18 years of age or older. We may use a third-party consumer reporting agency or other age verification provider to verify your age, but we do not obtain credit-related information from you.

4. RESEARCH PROJECTS AND SURVEYS

From time to time, we may offer you the opportunity to participate in surveys, research or pilot projects, which may be administered through a third-party research company. If you participate in one of these activities, the third-party may collect information about your use of the ZONNIC website, the App and related services, as described to you when you sign-up for the survey, research or pilot project. We receive information about these surveys and research studies in an aggregated, anonymized format. We may combine such survey data with other aggregate statistical information to help us to understand and improve the user experience across our products, services, ZONNIC website and App.

5. PUSH NOTIFICATIONS

When you install or use the App, you may be able to indicate whether you would like to receive push notifications to your mobile device, including notifications related to your quit plan, progress, reminders, App updates and other App features. We will collect and use information about your use of the App as necessary to provide these notifications. If you wish to change your preferences or stop receiving push notifications from us, you can turn off push notifications for the App within the App settings, where available, or in the settings of your mobile device.

6. WITH WHOM DO WE SHARE YOUR INFORMATION?

We may share your personal information with other organisations, such as:

with our parent company, any of our affiliates or other entities from the British American Tobacco (BAT) group;
with tax, audit or other authorities;
with our agents, mandataries, consultants, data processors and other service providers (including affiliates) if the personal information is necessary to allow these entities to provide services on our behalf. For example, we may use service providers to send email or other communications, host and develop our App, conduct research and surveys, verify your age and manage and analyse data and our advertising effectiveness. In such cases, your personal information will be used to provide the specific services we request and will be kept confidential. Our service providers are given the information they need to perform their designated functions and are not authorized to use or disclose personal information for their own marketing or other purposes. Our service providers maintain or process personal information in Canada, the US, EU and other jurisdictions. For additional information on the manner in which our service providers treat your personal information, contact us as set out below;
with your consent, we may disclose your email address to selected third parties for the purposes we specify when requesting your consent;
with certain third-parties as an asset in connection with a prospective or completed merger or sale (including transfers made as part of insolvency or bankruptcy proceedings) involving all or part of Imperial Tobacco Company Limited or as part of a corporate reorganization or stock sale or other change in corporate control; or;
along with our Canadian, US and other affiliates and service providers, as required or permitted by applicable law, such as in response to a search warrant or other legally valid inquiry or order (which may include lawful access by Canadian, US or other foreign governmental authorities, courts or law enforcement agencies), or to another organization in the case of a breach of an agreement or contravention of law or detecting, suppressing or preventing fraud, or as otherwise required or permitted by applicable Canadian, US or other law. We may also disclose personal information where necessary for the establishment, exercise or defense of legal claims and to investigate or prevent actual or suspect loss or harm to persons or property.

7. WHERE WE TRANSFER YOUR INFORMATION

Your personal information may be transferred outside of the Province of Québec or outside of Canada to the third parties described in S ection 6 (With whom do we share your information). We implement measures to ensure that your personal information is stored and transferred in a way which is secure. We will therefore only transfer data outside of the Province of Québec or outside of Canada where it is compliant with data protection legislation and the means of transfer provides adequate safeguards in relation to your data. We and our service providers may transfer your information to, or store it in, provinces or countries located outside the Province of Québec or outside of Canada including the European Economic Area (‘EEA’) and the United States. Where we transfer your personal information outside the Province of Québec or outside of Canada, we will take all reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy. For more information about how we or our service providers process your personal information, contact as us outlined below.

8. HOW WE SAFEGUARD YOUR INFORMATION

We have put in place a series of security safeguards designed to protect your personal information against loss and theft, as well as unauthorized access, disclosure, copying, use and modification, regardless of the format in which the information is held.

These security safeguards include physical measures, administrative measures and technological measures that are reasonable given the sensitivity of the information, the purposes for which it is to be used, the quantity and distribution of the information and the medium on which it is stored. These measures may include access controls, authentication measures, encryption or other technical protections, where appropriate.

We also take the necessary measures to ensure that all our managers and employees are informed on the contents of this Policy and requirements under applicable privacy legislation, and understand that they are required to conform to it at all times. Access to personal information is strictly limited on a need-to-know basis to the persons for whom such information is necessary for the performance of their functions and duties. Unauthorized access to or disclosure of your personal information by one of our employees is strictly prohibited and will result in appropriate disciplinary measures.

If you have a username, password, or other login details that enable you to access certain parts of the App, you must not allow any other person to use them and must treat them as confidential. If you believe or suspect that someone else knows your login details you must contact us at support@ca.zonnic.ca as soon as possible.

9. COOKIES AND SIMILAR TECHNOLOGIES

Our App uses cookies or similar technologies.

What are cookies?

A cookie is a small data file that may be placed on your device to allow an app or related online service to recognize you as a user when you return using the same device or browser, either for the duration of your visit or session (using a ‘session cookie’) or for repeat visits (a ‘persistent cookie’). Other similar technologies, such as clear GIFs, beacons and pixel tags, work in a similar way and we use the word ‘cookie’ in this policy to refer to these technologies where they collect information in this way.

Cookies can be ‘first party’ (which are set by us) or ‘third party’ (which are placed on your device by another service provider when you use the App).

We may use App cookies and similar technologies for the following App-related purposes:

Strictly necessary cookies or similar technologies. These are necessary for the App to function and cannot be switched off in our systems. They may include, for example, technologies used for security purposes, authentication, session management, or remembering your privacy preferences. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences. If these technologies are blocked or disabled, some parts of the App may not work properly.
Analytical cookies or similar technologies. These allow us to understand how users interact with the App, measure performance, identify technical issues, and improve the App experience. Information collected through these technologies may be aggregated after it is collected. If you do not allow these technologies, we may be unable to measure use of the App or monitor its performance effectively.
Functionality cookies or similar technologies. These are used to remember your preferences and support App functionality, such as your language or region preferences and other settings. If you do not allow these technologies, some App features may not function properly.
Targeting or advertizing cookies or similar technologies. Where applicable, these may be used to support advertising, measurement, or personalization in connection with the App. They do not directly store personal information such as your name, but may be based on identifiers associated with your device or browser. If you do not allow these technologies, advertising or personalization may be less relevant.
Device data: We obtain data relating to the mobile device you use to access the App, as described in this Privacy Policy.

How to control cookies and similar technologies

Depending on your device, operating system, browser, and App settings, you may be able to restrict, block, or delete cookies and similar technologies through your device or browser settings. Please note that if you disable certain cookies or similar technologies, some App features may not work properly.

Third-party cookies and similar technologies

We may work with third-party suppliers and partners who set or read cookies or similar technologies in connection with the App. These may include analytics, performance, security, authentication, advertising, or functionality providers.

Analytics technologies: We may use analytics technologies to help us collect information about how users interact with the App. The information collected may be sent to third-party analytics providers, which help us analyse App usage, improve performance, understand technical issues, and measure campaign effectiveness. Attribution and deep-linking technologies: We may use third-party attribution and deep-linking technologies to understand how users arrive at and interact with the App, including through QR codes and campaign links. These technologies may process device information, advertising identifiers where permitted, IP address, and information relating to interactions with campaign links and the App for attribution, analytics and campaign measurement purposes.
Third-party services: Some App functionality may be supported by services operated by third parties on our behalf. When you use functionality supported by these services, the relevant third party may set or read cookies or similar technologies as necessary to provide the service cookies.

10. HOW LONG WE KEEP YOUR INFORMATION

We will keep your personal information for the time required to fulfil the identified purposes, our legitimate business purposes and to conform to legislative requirements.

11. ACCOUNT DELETION

You can choose to permanently delete your Account, including where it is used to access the App, by going to your account page or account settings, or through the App, where this functionality is available and select “delete my account”. This action is irreversible, and you will be immediately logged out of your Account sessions, including the App. The deletion of your Account will also delete all associated data pertaining to your Account and App use, subject to any information we are required or permitted to retain under applicable law. Note that any accounts associated to a brand distributed by Imperial Tobacco Company Limited using the same email address may also be permanently deleted. The deletion process for your data and information from our systems may take up to 10 days. We will notify you by email as soon as the account deletion process is complete.

Certain data and information, such as customer support records, legal compliance records, transaction or account administration records, and information required to manage your privacy requests, may be retained where required or permitted by applicable law.

12. YOUR RIGHTS

We recognize that it is important to keep personal information accurate, complete and up-to-date and we take reasonable steps to ensure the accuracy and completeness of the personal information we use and disclose. However, you are responsible for informing us at the contact information set out below of any change in your personal information which may occur during the course of our relationship. Where available, you may also update certain information and manage certain App preferences, including notification preferences, through your Account or App settings.

You have the right to request access to your personal information which is in our custody or control, subject to limited exceptions prescribed by law. You can also request that information which is inaccurate or incomplete be rectified.

We will respond to every request for access and rectification, in accordance with applicable laws. In the event that we cannot provide access to or rectify your personal information, we will inform you of the reasons why, subject to any legal or regulatory restrictions, and we will provide you with any recourse available. We may request certain personal information for the purposes of verifying the identity of the individual seeking access to their personal information records.

Under certain circumstances and subject to applicable data protection laws, supported by a written request and proof of identification, you may withdraw your consent to our disclosure or use of personal information collected. As required or permitted by law, you may be entitled to additional rights, including:

(i) the right to control the dissemination of your personal information;

(ii) the right to receive computerized personal information collected from you in a structured, commonly used and technological format and to have this information transferred directly to another organization;

(iii) the right to be informed of and submit observations regarding automated decision-making; and

(iv) the right to request information about data processing.

Finally, you also have a right to lodge a complaint with a competent data protection authority, in particular in the country/province/state where you normally reside, where we are based or where an alleged infringement of data protection law has taken place, such as the Office of the Privacy Commissioner of Canada or the Commission d’accès à l’information du Québec.

13. CHANGES TO THIS PRIVACY POLICY

We may make changes to this Privacy Policy at any time by posting a copy of the modified notice on the App. Please visit the relevant section of the App regularly. Where appropriate, we may send you an email notifying you of any changes. Any changes will take effect on the date on which we post the modified notice on the App.

14. HOW TO CONTACT US

If you wish to contact us with any queries or concerns about this QuitZone App Privacy Policy or the manner in which we or our service providers treat your personal information, or to exercise any of your rights with respect to your personal information, please contact our Privacy Officer at:

Imperial Tobacco Company Limited

3711, St-Antoine West

Montréal (Québec)

H4C 3P6

data_protection_donnees@bat.com