Privacy policy and Quebec's Law 25.

1. Person responsible for the protection of personal information

The legal entity responsible for the processing is OliMar Développement Inc. (“Olimar”), NEQ 1182173147, 336, rue Jeanne-d'Arc, Québec (Québec) G1S 2R7, Canada. This is the name that prevails in any text with legal effect and in any agreement in which Olimar is named.

The person responsible for the protection of personal information at Olimar is Olivier Lange. For any question, access request or exercise of your rights, you can reach them at info@olimar.ca.

2. Information collected

Olimar collects only the information strictly necessary to respond to your request:

• Contact form: name, email address, organization (optional), subject and message. This information goes directly to our mailbox and is not stored in a database. Information collected as part of the GoSec 2026 campaign follows a separate regime, described in section 11.
• Technical server logs: IP address and timestamp, kept briefly for security and diagnostic purposes. This data is not cross-referenced with other personal information.

We apply the principle of minimization: we collect only what we need, for as long as necessary.

3. Purposes

Information collected through the contact form is used solely to respond to your request. There is no other use, no behavioural profiling and no sale or transfer of your data to third parties for commercial purposes.

4. Consent

The contact form includes an explicit consent checkbox, in line with the requirements of Quebec's Law 25. By checking it, you consent to Olimar using your information to respond to your request.

You may withdraw your consent at any time by writing to info@olimar.ca. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Retention

• Request emails: kept for 24 months from receipt, then deleted or anonymized.
• Server logs: kept for 90 days, then automatically purged.

No other personal data is persistently kept in our systems, subject to section 11.

6. Disclosure to third parties

Olimar uses three technical service providers:

• Resend (email delivery) — a U.S. company whose servers are located in the United States. Your contact details (name, email) pass through Resend when the reply to your request is sent. This transfer outside Québec was the subject of a privacy impact assessment. Resend is bound by contractual confidentiality obligations.
• OVH (server hosting) — infrastructure physically located in Canada. Your hosted data does not leave Canadian territory.
• Google LLC (audience measurement, Google Analytics 4) — only if you consent: your browsing data is then transmitted to Google, in the United States, therefore outside Québec (see section 7).

No other disclosure to third parties is made, except where legally required and subject to section 11.

7. Cookies

The olimar.ca site does not set any advertising cookies. Its only non-essential cookies are those of the audience measurement described below, set only if you consent. Without your consent, none of these cookies is set and no data is transmitted to Google.

If you accept in the consent banner, the site measures its traffic with Google Analytics 4, a service of Google LLC. Cookies (_ga and _ga_…) are then set in your browser, and browsing data (pages viewed, referral source, device and browser type, approximate region) is transmitted to Google, in the United States, therefore outside Québec. Purpose: to measure the site's audience and improve it. According to Google, Google Analytics 4 does not log or store IP addresses (source). This data is kept for 14 months, then deleted.

You can withdraw your consent at any time with the “Cookie settings” link at the bottom of every page: measurement stops and Google Analytics cookies are erased. Your choice is remembered in your browser for 12 months at most. To learn more: Google's privacy policy and data protection in Google Analytics.

8. Individuals' rights

In accordance with Quebec's Law 25, you have the following rights:

• Access: obtain a copy of the personal information we hold about you.
• Rectification: have inaccurate or incomplete information corrected.
• Withdrawal of consent: end the processing of your information.
• De-indexation: in the cases provided by law, request that the dissemination of information concerning you cease or that it be de-indexed.

To exercise any of these rights, write to info@olimar.ca specifying your request. We will respond within the time limits provided by law (30 days, extendable once).

9. Confidentiality incidents

In the event of a confidentiality incident (unauthorized access, unauthorized disclosure or use of personal information), Olimar undertakes to:

• Keep an incident register in accordance with legal requirements.
• Notify the Commission d'accès à l'information (CAI) and the individuals concerned if the incident presents a risk of serious injury.
• Take appropriate corrective measures to limit the impact and prevent recurrence.

10. Updates

This policy may be updated to reflect changes in our practices or in legal requirements. The date of the last revision is shown below. We encourage you to review it periodically.

11. GoSec 2026 joint campaign

From September 23 to 25, 2026, on the occasion of the GoSec trade show, OliMar Développement Inc. is running a joint campaign with SecuAAS (9463-7220 Québec inc.). The form hosted at secuaas.com/gosec is operated by SecuAAS; the information collected there is disclosed to Olimar, which processes it for the purposes described below. Both companies are named at the point of collection.

Information collected: first name, last name, email address, organization, job title, organization size, stated interest, project timeline, preferred meeting slot and free-text description. In addition, for those who take part, the information related to the contest held at the booth.

Purposes: respond to your request, prepare the meeting at the show, manage your participation in the contest where applicable, and — only if you have separately consented — send you the joint newsletter.

Who contacts you back: Olimar does. The “we” used on the campaign page refers to Olimar for any contact following your request.

Where this information is kept: in Olimar's customer relationship management system, hosted on OVH infrastructure located in Canada. Your consent to the newsletter is recorded there separately from your consent to be contacted, with its timestamp: this is our consent register.

Retention: 24 months from collection, the same period as request emails (section 5). At the end of the Founder Offer, on October 31, 2026, individuals who did not follow up are not subject to any particular treatment: they remain ordinary prospects, subject to this same period. Your consent to the newsletter, for its part, remains valid until you withdraw it.

Newsletter and withdrawal: consent to the newsletter is optional and express — the box is unchecked by default. Each send identifies both senders and includes a working unsubscribe mechanism, in accordance with Canada's Anti-Spam Legislation (CASL). You can also unsubscribe at any time by writing to info@olimar.ca.

Exercising your rights: write to info@olimar.ca. An access, rectification or withdrawal request received by Olimar is forwarded to SecuAAS when it concerns information that both companies hold, so that it takes effect on both sides.

Last updated: September 24, 2026.