Privacy Policy

1.Notice at Collection

Depending on how you interact with us, we may collect categories of information including:

• name and contact information;
• company and professional information;
• account information;
• billing and shipping information;
• order and transaction information;
• payment-related information;
• artwork, designs and files;
• communications;
• Website usage information;
• device information;
• IP address;
• cookie and advertising identifiers;
• approximate geographic information;
• marketing and advertising interaction information;
• conversion information; and
• inferences concerning Website or marketing interactions.

We use this information for purposes including:

• providing products and services;
• administering customer relationships;
• processing and fulfilling orders;
• improving our Website and services;
• fraud prevention and security;
• communications;
• analytics;
• advertising;
• conversion measurement;
• attribution;
• remarketing and retargeting;
• customer and audience matching;
• business administration; and
• legal compliance.

We may disclose information to service providers, affiliates, payment processors, shipping providers, technology providers, analytics providers, advertising platforms and other recipients as described in this Policy.

Where applicable law requires consent or provides a right to opt out of particular processing, we will provide the applicable choice.

2.Information You Provide

Contact Information

We may collect:

• name;
• company name;
• position or job title;
• email address;
• telephone number;
• billing address;
• shipping address; and
• other contact details.

Account Information

We may collect:

• account credentials;
• authentication information;
• account settings;
• preferences; and
• account history.

Orders and Transactions

We may collect information including:

• products ordered;
• dimensions;
• box styles;
• materials;
• quantities;
• prices;
• artwork;
• specifications;
• proofs;
• production information;
• order history;
• delivery details; and
• shipping information.

Payment Information

Payments may be processed by third-party payment processors.

We generally do not need to retain complete payment-card numbers.

We may receive information such as:

• transaction identifiers;
• payment status;
• limited card information;
• billing information;
• fraud indicators; and
• information required to administer a payment or resolve a payment dispute.

Artwork and Files

We may collect logos, graphics, photographs, artwork, dielines, text, designs and other files supplied in connection with orders, quotations or inquiries.

Communications

We may retain:

• emails;
• Website inquiries;
• chat communications;
• customer-service communications;
• quote requests;
• feedback; and
• other communications with us.

Marketing Preferences

We may maintain information relating to:

• marketing consent;
• newsletter subscriptions;
• communication preferences;
• unsubscribe requests; and
• privacy preferences.

3.Information Collected Automatically

When you interact with our Website, advertisements, emails or digital services, we and our technology providers may automatically collect information such as:

• IP address;
• browser type;
• operating system;
• device type;
• device identifiers;
• advertising identifiers;
• cookie identifiers;
• referring URL;
• pages visited;
• buttons or links clicked;
• searches;
• timestamps;
• Website navigation;
• cart activity;
• form interactions;
• advertising interactions;
• conversions;
• approximate geographic location;
• session information; and
• technical diagnostic information.

This information may be collected through technologies including:

• cookies;
• pixels;
• tags;
• scripts;
• local storage;
• software development kits;
• APIs;
• server-side integrations; and
• similar technologies.

4.Cookies and Similar Technologies

We may use first-party and third-party technologies for several purposes.

Essential Technologies

These technologies may support:

• security;
• authentication;
• shopping carts;
• Website operation;
• account functionality;
• fraud prevention;
• payment processing;
• load balancing; and
• storage of privacy preferences.

Functional Technologies

These technologies may remember settings, preferences and selections and improve Website functionality.

Analytics Technologies

These technologies may help us understand:

• Website traffic;
• visitor behavior;
• Website performance;
• conversion funnels;
• technical issues; and
• interactions with our services.

Advertising and Measurement Technologies

These technologies may be used to:

• measure advertising effectiveness;
• attribute purchases or leads to advertising;
• determine whether users interacted with advertisements;
• create or measure marketing audiences;
• perform remarketing or retargeting;
• suppress certain advertisements;
• personalize advertisements;
• perform campaign optimization;
• measure cross-session or cross-device activity where permitted;
• prevent advertising fraud; and
• evaluate marketing performance.

Where required by law, non-essential advertising, analytics or profiling technologies will be subject to applicable consent or opt-out choices.

Where applicable law requires us to identify technologies capable of identifying, locating or profiling a person, we will provide the applicable notice and activation or consent mechanism.

5.Digital Advertising and Analytics Providers

We may work with digital advertising, technology and analytics providers including, for example:

• Google;
• Meta;
• Microsoft;
• LinkedIn;
• TikTok; and
• other advertising or analytics providers we may use from time to time.

Listing a provider as an example does not necessarily mean that provider is active on the Website at all times.

Depending on the service being used, we may transmit or make available information such as:

• Website events;
• advertising interactions;
• conversion information;
• transaction information;
• campaign information;
• device information;
• IP addresses;
• cookie identifiers;
• advertising identifiers; and
• first-party customer identifiers.

First-party customer identifiers may include:

• email address;
• telephone number;
• name; and
• postal address.

Where supported by the applicable service, identifying information may be normalized and

cryptographically hashed before transmission.

6.Enhanced Conversions and Hashed Identifiers

We may use advertising measurement technologies that improve conversion attribution by matching first-party customer information with information maintained by an advertising provider.

These services may include technologies commonly known as:

• Enhanced Conversions;
• Advanced Matching;
• Enhanced Matching;
• Offline Conversion Tracking;
• Server-Side Conversion Tracking; and
• similar services.

For example, an email address, telephone number, name or address associated with a purchase or inquiry may be cryptographically hashed before being transmitted to an advertising platform.

The provider may compare the hashed information with corresponding hashed identifiers associated with its users to determine whether advertising contributed to a transaction or other conversion.

Hashing reduces exposure of the underlying identifier during matching but does not necessarily cause the information to cease being personal information under applicable privacy law.

We therefore treat these activities as processing of personal information and apply applicable consent or opt-out requirements.

7.Customer Matching and Advertising Audiences

Where permitted by law and platform rules, we may use customer information to:

• identify existing customers on advertising platforms;
• create marketing audiences;
• advertise to existing or prospective customers;
• exclude existing customers from particular advertising campaigns;
• create modeled, similar or lookalike audiences;
• perform remarketing;
• perform retargeting; and
• measure advertising performance.

These activities may use identifiers such as hashed:

• email addresses;
• telephone numbers;
• names; or
• addresses.

Where applicable law requires consent or provides a right to opt out, we will provide the applicable mechanism.

8.Conversion APIs and Server-Side Tracking

We may use APIs, server-side integrations or similar technologies to send advertising and conversion information from our systems to advertising or analytics providers.

Server-side technologies may be used instead of, or in combination with, browser-based cookies and pixels.

These technologies may be used for substantially the same purposes described elsewhere in this Policy, including:

• conversion measurement;
• attribution;
• fraud detection;
• audience measurement;
• advertising optimization; and
• analytics.

9.Future Technologies

Digital marketing and analytics technologies change over time.

We may adopt technologies not specifically named in this Policy where they perform substantially similar functions to those already described, including:

• analytics;
• attribution;
• advertising measurement;
• customer matching;
• remarketing;
• audience development; and
• campaign optimization.

We will use such technologies in accordance with applicable law and update this Policy where a material change in our privacy practices requires additional disclosure.

10.How We Use Personal Information

We may use personal information for the following purposes.

Providing Products and Services

Including to:

• establish accounts;
• prepare quotations;
• process orders;
• prepare artwork and proofs;
• manufacture products;
• process payments;
• arrange shipping;
• provide customer service;
• address complaints; and
• process defect or warranty claims.

Operating and Improving Our Business

Including to:

• analyze Website performance;
• develop and improve products;
• improve online tools;
• troubleshoot technical problems;
• forecast demand;
• conduct business analytics;
• improve production processes; and
• improve customer experience.

Security and Fraud Prevention

Including to:

• authenticate transactions;
• identify suspicious activity;
• prevent fraud;
• secure accounts;
• investigate misuse;
• enforce agreements; and
• protect customers, employees, systems and property.

Advertising and Marketing

Including to:

• measure advertising effectiveness;
• perform conversion attribution;
• conduct remarketing and retargeting;
• create marketing audiences;
• conduct customer matching;
• optimize campaigns;
• personalize marketing where permitted;
• understand customer acquisition;
• communicate promotions; and
• evaluate advertising performance.

Communications

Including to:

• respond to inquiries;
• provide quotations;
• send order communications;
• provide shipping or production updates;
• send service announcements;
• request feedback; and
• send promotional communications where permitted.

Legal and Administrative Purposes

Including to:

• comply with tax obligations;
• maintain business records;
• comply with accounting obligations;
• respond to lawful requests;
• establish, exercise or defend legal claims;
• resolve payment disputes;
• investigate misconduct; and
• comply with applicable laws.

11.Sources of Information

We may obtain information:

• directly from you;
• from your employer or organization;
• from authorized account users;
• automatically through our Website;
• from payment processors;
• from shipping and logistics providers;
• from advertising providers;
• from analytics providers;
• from service providers;
• from referral sources;
• from affiliated Custom Box Builder entities; and
• from publicly available business information.

12.When We Disclose Information

We may disclose personal information to the following categories of recipients.

Custom Box Builder Affiliates

Custom Box Builder Inc. and Custom Box Builder USA Inc. may share information for:

• customer service;
• sales;
• order administration;
• manufacturing;
• accounting;
• marketing;
• analytics;
• information technology; and
• other legitimate business operations.

Service Providers

We may disclose information to companies providing:

• Website hosting;
• cloud services;
• data storage;
• customer relationship management;
• email;
• payment processing;
• fraud prevention;
• accounting;
• prepress;
• manufacturing;
• shipping;
• logistics;
• analytics;
• advertising;
• marketing automation;
• cybersecurity;
• communications; and
• customer support.

Advertising and Analytics Providers

As described above, information may be disclosed or made available to advertising and analytics platforms for:

• advertising measurement;
• attribution;
• customer matching;
• audience development;
• remarketing;
• retargeting; and
• marketing analytics.

Professional Advisors

Information may be disclosed to:

• lawyers;
• accountants;
• auditors;
• insurers;
• financial advisors; and
• other professional advisors.

Legal and Security Purposes

Information may be disclosed where reasonably necessary to:

• comply with applicable law;
• respond to lawful legal process;
• enforce our agreements;
• protect our legal rights;
• investigate fraud;
• address cybersecurity incidents;
• protect our Website; or
• protect people or property.

Business Transactions

Information may be disclosed or transferred in connection with:

• a merger;
• acquisition;
• financing;
• restructuring;
• sale of a business;
• sale of assets;
• insolvency; or
• similar corporate transaction.

13.Sale and Sharing of Personal Information

Custom Box Builder does not sell customer personal information for money as part of our ordinary business model.

Certain U.S. privacy statutes use broad definitions of “sale” or “sharing.”

Under those definitions, permitting an advertising provider to receive identifiers or Website interaction information for cross-context behavioral advertising may potentially constitute “selling” or “sharing” even where Custom Box Builder does not receive money in exchange for the information.

Where applicable privacy law gives individuals the right to opt out of such activity, we will provide the applicable opt-out mechanism.

14.U.S. Privacy Categories

Where applicable U.S. privacy law requires category-based disclosures, categories of personal information we may collect include:

Identifiers

Such as:

• name;
• email address;
• postal address;
• telephone number;
• IP address;
• account identifiers;
• device identifiers; and
• advertising identifiers.

Customer Records

Such as:

• contact information;
• billing information; and
• account information.

Commercial Information

Such as:

• orders;
• purchases;
• quotation history;
• transaction history;
• products viewed; and
• shopping-cart activity.

Internet and Electronic Activity

Such as:

• browsing behavior;
• Website interactions;
• referral information;
• advertising interactions;
• cookie information; and
• device information.

Geolocation Information

We may derive an approximate geographic area from an IP address or device information.

We do not ordinarily require precise GPS location information.

Professional or Employment Information

For business customers, this may include:

• company name;
• role;
• position; and
• professional contact information.

Inferences

We may derive information concerning:

• customer interests;
• marketing interactions;
• Website behavior; or
• likely advertising relevance.

The categories actually collected vary according to how an individual interacts with us.

15.Privacy and Advertising Choices

Depending on your location and applicable law, you may be able to manage non-essential cookies and advertising technologies through a cookie or privacy-preference tool available on our Website.

You may also be able to manage advertising preferences through:

• browser settings;
• device settings; and
• individual advertising platforms.

Deleting or blocking cookies may affect Website functionality.

Where required by applicable law, we will honor legally recognized browser-based opt-out preference signals, including Global Privacy Control, when received in a manner applicable to our processing.

16.Do Not Track

Some browsers offer “Do Not Track” signals.

Because there is no universally adopted technical or legal standard governing every Do Not Track signal, our Website may not respond to all such signals.

This does not affect our obligation to honor opt-out preference signals such as Global Privacy Control where applicable law requires us to do so.

17.Email and Electronic Marketing

We may send transactional communications concerning:

• quotations;
• orders;
• payments;
• production;
• shipping;
• accounts; and
• customer service.

We may also send promotional communications where permitted by applicable law.

For communications governed by Canada's Anti-Spam Legislation or similar laws, we will rely on an appropriate form of consent or another lawful basis.

Where required, promotional communications will provide an unsubscribe mechanism.

Unsubscribing from marketing does not prevent us from sending non-promotional communications reasonably necessary to administer an existing customer relationship or transaction.

18.Canadian Privacy Rights

Individuals in Canada may have rights under the Personal Information Protection and Electronic Documents Act and applicable provincial privacy legislation.

Subject to applicable exceptions, rights may include the ability to:

• request information regarding our privacy practices;
• request access to personal information under our control;
• challenge the accuracy or completeness of information;
• request correction;
• withdraw consent where consent is the applicable legal basis; and
• challenge our compliance with applicable privacy requirements.

Withdrawal of consent does not affect processing already lawfully undertaken and may not apply where information must be retained or processed for legal, contractual, security or other legally permitted purposes.

19.Québec Privacy Rights

Where Québec privacy legislation applies, individuals may have additional rights, including rights relating to:

• access;
• correction;
• withdrawal of consent where applicable;
• cessation of dissemination in circumstances provided by law;
• de-indexation or re-indexation in circumstances provided by law;
• portability where applicable; and
• information about certain automated decision-making or profiling activities where required.

Requests may be directed to our Privacy Officer using the contact information below.

20.U.S. State Privacy Rights

Residents of certain U.S. states may have additional privacy rights where the applicable law applies to Custom Box Builder.

Depending on the jurisdiction, these rights may include:

• confirming whether we process personal information;
• obtaining access;
• correcting inaccurate information;
• requesting deletion;
• obtaining portable copies of certain information;
• opting out of targeted advertising;
• opting out of sale or sharing;
• limiting certain uses of sensitive information;
• obtaining information concerning certain disclosures; and
• appealing decisions concerning privacy requests.

Rights and exceptions differ between states.

Nothing in this Policy is intended to represent that a particular state privacy statute applies to Custom Box Builder where the statute's applicability thresholds or jurisdictional requirements have not been met.

21.Privacy Requests

Requests regarding personal information may be submitted to our Privacy Officer at:

or by mail at:

Privacy Officer

or

Privacy Officer

Please provide enough information for us to understand and process the request.

We may take reasonable steps to verify:

• your identity;
• the authenticity of the request; and
• where applicable, your authority to act for another person.

We will respond within the time required by applicable law.

22.Sensitive Personal Information

Custom Box Builder does not ordinarily need customers to provide highly sensitive personal information such as:

• medical information;
• Social Security or Social Insurance numbers;
• government identification documents;
• precise financial-account credentials; or
• highly sensitive personal characteristics.

Customers should not provide unnecessary sensitive information in artwork, files or communications.

Payment information may be processed by payment providers as necessary to complete transactions.

We do not knowingly use highly sensitive personal information for targeted advertising in circumstances prohibited by applicable law.

23.Children

Our Website, products and services are designed for businesses and adults and are not directed to children.

We do not knowingly collect personal information from children for targeted advertising.

If we learn that information has been collected from a child in circumstances requiring parental consent that was not obtained, we will take appropriate action as required by law.

24.Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy and for legitimate:

• operational;
• security;
• accounting;
• tax;
• legal;
• fraud-prevention;
• warranty;
• dispute; and
• recordkeeping purposes.

Retention periods vary according to:

• the nature of the information;
• the transaction;
• the customer relationship;
• legal requirements;
• applicable limitation periods;
• security considerations; and
• legitimate business needs.

When information is no longer reasonably required, it may be securely deleted, destroyed, anonymized or de-identified in accordance with our practices and applicable law.

25.Information Security

We maintain administrative, technical and physical safeguards that we consider reasonable and appropriate in light of:

• the nature of the information;
• reasonably foreseeable threats;
• our business operations; and
• applicable legal requirements.

No data transmission or storage system can be guaranteed completely secure.

Accordingly, although we use reasonable safeguards, we cannot guarantee absolute security.

26.Third-Party Processors

Where personal information is transferred to a service provider for processing on our behalf, we remain responsible for our own obligations with respect to that information as required by applicable law.

We seek to use service providers with appropriate safeguards and contractual protections where appropriate.

27.Cross-Border Processing

Custom Box Builder operates in Canada and the United States and uses service providers that may operate in Canada, the United States or other jurisdictions.

Personal information may therefore be processed or stored outside the province, state or country in which it was collected.

Information processed in another jurisdiction may be subject to:

• the laws of that jurisdiction; and
• lawful access by courts, regulatory authorities, law-enforcement agencies or governments.

Where required by law, we use contractual or other measures designed to protect information transferred across borders.

28.Business Contact Information

A substantial portion of our customers are businesses.

Certain privacy laws treat business contact information used exclusively for professional communications differently from other forms of personal information.

Where an applicable exemption exists, we may process business contact information in accordance with that exemption.

29.Automated Tools and Profiling

We may use automated systems to assist with activities such as:

• fraud detection;
• security;
• Website personalization;
• advertising;
• analytics;
• marketing optimization; and
• operational decision support.

Where applicable law requires specific notice, consent or rights relating to automated decision-making or profiling, we will provide the applicable disclosure or mechanism.

30.Third-Party Websites

Our Website may contain links to independently operated websites or services.

Those third parties are responsible for their own privacy practices.

We encourage users to review the privacy policies of third-party services before providing personal information to them.

31.Business Transfers

If Custom Box Builder undergoes a:

• merger;
• sale;
• acquisition;
• corporate restructuring;
• financing;
• bankruptcy;
• insolvency; or
• transfer of business assets,

personal information may be disclosed or transferred as part of evaluating or completing the transaction, subject to applicable legal requirements.

32.Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in:

• our services;
• technology;
• advertising practices;
• business operations; or
• legal requirements.

The “Last Updated” date identifies the most recent revision.

Where applicable law requires additional notice or consent before materially changing the purposes for which personal information is used, we will provide that notice or obtain that consent.

33.Privacy Accountability

Custom Box Builder has designated responsibility for privacy compliance to its Privacy Officer.

Questions, concerns, complaints and privacy requests may be directed to:

Privacy Officer

Custom Box Builder Inc.

Custom Box Builder USA Inc.

We will review privacy inquiries and complaints and take reasonable steps to investigate and address concerns in accordance with applicable law.