Privacy Policy

1 Introduction The Canadian Centre for Economic Analysis, Inc. (“CANCEA”, “we”, “us”, or “our”) is committed to protecting the privacy of individuals who visit our website at www.cancea.ca (the “Site”) and who participate in our surveys and related research activities (collectively, the “Services”). This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with the Site and our survey and research activities. Our practices are designed to comply with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and any substantially similar provincial privacy legislation where it applies. By using the Site or participating in our surveys, you agree to the collection, use, and disclosure of your personal information as described in this Privacy Policy. 2 What is “personal information”? For the purposes of this Privacy Policy, “personal information” means information about an identifiable individual, including any information that can be used to identify you directly (for example, your name or email address) or indirectly (for example, a combination of demographic information). Information that has been de-identified or aggregated so that it cannot reasonably be associated with an identifiable individual is not considered personal information. 3 Information we collect The information we collect will depend on how you interact with us and which surveys or features you choose to use. 3.1 Information you provide directly When you visit the Site or respond to a survey, you may choose to provide:

• Contact information – such as your name, email address, telephone number, and mailing address.
• Survey responses – including opinions, experiences, preferences, ratings, and other information you provide in response to survey questions.
• Demographic information – such as age range, gender, household type, occupation, income range, or region (usually requested on an optional basis).
• Communication content – information you provide when you contact us with questions, feedback, or complaints.

Where reasonably possible, we design surveys so that you may participate without identifying yourself, unless identifying information is needed for a specific purpose (for example, if you ask us to contact you with follow-up information or for prize draws where legally permitted). 3.2 Information collected automatically When you use the Site, we may automatically collect:

• Technical information – such as your IP address, browser type, device type, operating system, and approximate geographic region.
• Usage information – such as pages viewed, links clicked, time spent on the Site, and the referring URL.

We typically collect this information using cookies, log files, and similar technologies, primarily to operate and improve the Site. See Section 8 (Cookies and similar technologies) for more detail. 3.3 Information from third-party sources From time to time, we may receive survey responses or contact information through third-party partners (for example, research partners, panels, or organisations that invite their members or clients to participate in our surveys). Where this occurs, the third party is responsible for having the necessary authority to share your information with us for the stated survey purposes. We handle such information in accordance with this Privacy Policy and any additional terms provided with the survey. 4 How and why we use personal information We use personal information only for purposes that a reasonable person would consider appropriate in the circumstances, including:

1. Conducting surveys and research
   • To design, administer, and analyse surveys and research studies.
   • To understand attitudes, opinions, behaviours, and trends.
   • To produce de-identified or aggregated reports and insights for our clients, partners, and stakeholders.
2. Communicating with you
   • To respond to your questions, requests, or complaints.
   • To send you information that you have requested or consented to receive (for example, survey follow-ups or summaries of results, where applicable).
   • To manage contest entries or incentives associated with surveys, where legally permitted.
3. Website operation and improvement
   • To operate, maintain, and secure the Site.
   • To understand how our Site is used and to improve its performance, content, and user experience.
4. Legal, risk management, and compliance
   • To comply with applicable laws, regulations, and legal processes.
   • To prevent, detect, and protect against fraud, error, security incidents, and misuse of our Services.
   • To enforce our terms of use and protect our rights, property, and safety, and those of others.

We will not use your personal information for additional purposes without your consent, unless required or permitted by law. 5 No sale of personal information We do not sell your personal information. We also do not rent, trade, or otherwise disclose your personal information to third parties for their own marketing or other independent commercial purposes. Any sharing of personal information is limited to what is reasonably necessary to provide our Services, operate our business, or comply with legal obligations, as described below. 6 When we share personal information We may disclose personal information in the following limited circumstances: 6.1 Service providers and contractors We may share personal information with carefully selected third-party service providers who assist us in operating the Site, hosting data, administering surveys, processing incentives, or analysing results. These service providers:

• Are located in Canada, and
• Host and store personal information on servers that are physically located in Canada.

These service providers are only permitted to access personal information as necessary to perform services on our behalf and are contractually required to:

• Protect personal information using appropriate safeguards; and
• Use it only for the purposes of providing services to us and not for their own purposes.

6.2 Research partners and clients In some cases, surveys may be conducted on behalf of a research partner or client. In those cases, we may share:

• De-identified or aggregated results that do not identify individual respondents; and
• Identifiable information only where:
  • It is clearly disclosed at the time of collection,
  • You have consented (where required by law), and
  • There are appropriate contractual protections in place.

6.3 Business transactions In the event of a merger, acquisition, sale of assets, reorganisation, or similar business transaction involving CANCEA, personal information may be transferred as part of the transaction, subject to appropriate confidentiality protections and provided the receiving party agrees to honour the commitments in this Privacy Policy or provides comparable safeguards. 6.4 Legal and regulatory requirements We may disclose personal information when required or authorised by applicable law, for example:

• To comply with a subpoena, court order, or other legal process.
• To respond to lawful requests from governmental or regulatory authorities.
• To protect our rights, property, or safety, or that of our employees, clients, respondents, or the public.

7 Storage in Canada and cross-border considerations Our policy is to store and process personal information in Canada and to avoid the use of service providers that store or process personal information outside Canada.

• All survey data and related personal information that we collect through the Site or our survey activities is hosted and stored in Canada.
• We do not intentionally transfer, store, or permit routine access to personal information from locations outside Canada.
• We do not use service providers located outside Canada for services that involve the storage or processing of personal information.

When you use our Site or communicate with us over the Internet, your data may, however, transit through other jurisdictions as part of normal Internet routing (for example, as network traffic passes through servers located in other countries). This type of transient routing is inherent to Internet communications and does not involve us directing personal information to be stored or processed outside Canada. If our practices change in the future and personal information is to be stored or processed outside Canada, we will update this Privacy Policy accordingly and, where required by law, provide additional notice or obtain your consent. 8 Cookies and similar technologies We use cookies and similar technologies to:

• Enable core Site functionality.
• Maintain session security and prevent fraud.
• Understand usage patterns and improve the Site.

You may manage cookies through your browser settings. If you disable certain cookies, some features of the Site may not function properly. Where non-essential cookies or analytics tools are used that are not strictly necessary for the operation of the Site, we will rely on consent where required by applicable law, which may be obtained through a cookie banner or your browser settings. 9 How we protect personal information We take reasonable administrative, technical, and physical safeguards to protect personal information against loss, theft, misuse, and unauthorised access, disclosure, alteration, and destruction. These measures may include:

• Access controls and role-based permissions.
• Secure networks and encryption in transit and/or at rest, where appropriate.
• Contractual confidentiality obligations for employees, contractors, and service providers.
• Data minimisation and retention practices (see Section 10).

However, no method of transmission over the Internet or electronic storage is completely secure. While we strive to protect personal information, we cannot guarantee absolute security. 10 Data retention and de-identification We retain personal information only as long as necessary to fulfil the purposes for which it was collected and to meet our legal, regulatory, and contractual obligations.

• Where possible, survey data is de-identified or aggregated so that individuals are no longer identifiable. De-identified or aggregated data may be retained and used for research, statistical, or reporting purposes.
• Identifiable information (such as contact details linked to responses) is retained only for as long as needed for the purpose for which it was collected (for example, to administer incentives, respond to enquiries, or conduct follow-ups) and is then securely deleted or de-identified.

Retention periods may vary depending on the nature of the information and applicable legal requirements. 11 Your rights and choices Depending on the laws that apply where you live, you may have certain rights relating to your personal information, including the right to:

• Access your personal information held by us.
• Correct or update inaccurate or incomplete personal information.
• Withdraw consent to our processing of your personal information, where we rely on consent (subject to legal or contractual restrictions and reasonable notice).
• Request deletion or de-identification of your personal information, subject to applicable legal and contractual obligations.

We may take reasonable steps to verify your identity before responding to your request. In some cases, we may not be able to fulfil your request, for example, where it would disclose personal information about another individual, where we are legally required to retain certain information, or where the information has already been de-identified. To exercise any of these rights, please contact us using the contact details in Section 14 (Contact us). You can also choose not to answer particular survey questions or to stop participating in a survey at any time. 12 Children’s privacy Our Site and surveys are generally intended for use by adults. We do not knowingly collect personal information from children under the age of 13 (or any higher age where additional consent is required by applicable law) without the consent of a parent or legal guardian. If you believe that a child has provided personal information to us without appropriate consent, please contact us so that we can take steps to delete such information or obtain proper consent. 13 Third-party websites and services The Site may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. If you follow a link to another website or service, their privacy policies will govern your use of those services. We encourage you to review the privacy policies of any third-party websites or services you visit. 14 Contact us If you have any questions or concerns about this Privacy Policy or our privacy practices, or if you wish to exercise your privacy rights, please contact us at: Canadian Centre for Economic Analysis, Inc. Email: connect@cancea.ca 15 Changes to this Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will revise the “Last updated” date at the top of the policy and, where required by law, we will notify you and/or seek your consent. Your continued use of the Site or participation in our surveys after any changes to this Privacy Policy constitutes your acceptance of the updated policy.