Baqers Data Protection Policy

Effective date: November 3, 2025
Baqers refers to Baqers Canada (or such related Canadian entity as applicable), an online cake delivery platform that connects customers with independent Baker Vendor.

1. DEFINITIONS

“Automated Decision-Making” means when a decision is made which is based solely on automated Processing (including Profiling) which produces legal effects or significantly affects an individual.

“Baqers” means Baqers Canada

“Consent” means any freely given, specific, informed and unambiguous indication of the Data Subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the Processing of Personal Data relating to them.

“Data Controller” means a person who either alone, jointly with other persons or in common with other persons determines the purposes for and the manner in which Personal Data is processed or is to be processed.

“Data Subject” means an identifiable person; one who can be identified directly or indirectly, in particular by reference to an identification number or to one or more factors specific to their physical, physiological, mental, economic, cultural or social identity.

“Data Protection Impact Assessment or DPIA” means tools and assessments used to identify and reduce risks of a data Processing activity. DPIAs can be carried out as part of Privacy by Design and should be conducted for major systems or business change programs involving the Processing of Personal Data.

“Data Protection Laws” means applicable Canadian federal and provincial privacy and data protection laws (for example, the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial private-sector laws such as Quebec’s Act respecting the protection of personal information in the private sector (Law 25), British Columbia’s Personal Information Protection Act (PIPA) and Alberta’s Personal Information Protection Act).

“Data Protection Officer or DPO” means the person appointed as such to oversee Baqers’s compliance with applicable Data Protection Laws. A DPO is responsible for advising Baqers (including its employees) on their obligations under Data Protection Laws, for monitoring compliance with Data Protection Laws and with Baqers’s policies, and for providing advice.

“Office of the Privacy Commissioner (OPC)” means Canada’s federal privacy regulator.

“Personal Data” (or “Personal Information”) means any information relating to an identified or identifiable natural person (a ‘Data Subject’). An identifiable natural person is one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity. This can include name, address, a photo, an email address, bank details, posts on social networking websites, medical information, IP address, device identifiers, payment details and other unique identifiers.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed. “Policy” means this Data Protection Policy.

“Privacy by Design and Default” means implementing appropriate technical and organisational measures in an effective manner to ensure compliance with applicable Data Protection Laws.

“Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Profiling” means any form of automated Processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

“Pseudonymisation” means replacing information that directly or indirectly identifies an individual with one or more artificial identifiers or pseudonyms so that the person, to whom the data relates, cannot be identified without the use of additional information which is meant to be kept separately and secure.

“Sensitive Personal Data” means data relating to religious or other beliefs, sexual orientation, health, race, ethnicity, political views, trade-union membership, criminal records or any other sensitive personal information.

“Third Party” means any natural or legal person, public authority, establishment or any other body other than the Data Subject, the Data Controller, the Data Administrator and the persons who are engaged by the Data Controller or the Data Administrator to process Personal Data.

2. INTRODUCTION


1. Baqers takes its responsibilities with regard to the management of Personal Data and compliance with applicable Data Protection Laws very seriously. This Policy sets out how Baqers manages those responsibilities in Canada
2. Baqers obtains, uses, stores, and otherwise processes Personal Data relating to potential employees (applicants) and clients, current employees and clients, former employees and clients, current and former workers, contractors, website users and contacts — collectively referred to in this Policy as Data Subjects. When Processing Personal Data, Baqers is obliged to fulfil individuals’ reasonable expectations of privacy by complying with applicable Data Protection Laws.
3. This Policy therefore seeks to ensure that Baqers: a) is clear about how Personal Data must be processed and Baqers’s expectations for all those who process Personal Data on its behalf;
   b) complies with applicable Data Protection Laws and good practice;
   c) protects its reputation by ensuring the Personal Data entrusted to us is processed in accordance with Data Subjects’ rights; and
   d) protects itself from risks of Personal Data Breaches and other breaches of Data Protection Laws.

3. SCOPE


1. This Policy applies to all Personal Data we process regardless of the location where that Personal Data is stored (for example, on an employee, consultant or vendor’s own device) and regardless of the Data Subject. All employees, consultants, vendors and others Processing Personal Data on Baqers’s behalf must read it. A failure to comply with this Policy may result in disciplinary or contractual action.
2. Every member of staff, consultant and vendor of Baqers is required to read and assimilate the contents of this Policy and to abide by it fully. Baqers shall have the right to seek redress against any member of staff, consultant or vendor whose failure to comply with this Policy results in damages being sought or awarded, or any legal action instituted against Baqers
3. The Chief Executive Officer is responsible for ensuring that all Baqers employees, consultants and vendors comply with this Policy and should implement appropriate practices, processes, controls and training to ensure compliance.
4. The Data Protection Officer (“DPO”) is responsible for overseeing this Policy. Baqers’s DPO can be reached at nmajekodunmi@baqers.com

4. OUR COMMITMENT TO THE TEN FAIR INFORMATION PRINCIPLES


BAQERS adheres to the Ten Fair Information Principles under PIPEDA:

1. Accountability: We are responsible for personal information under our control and have appointed a Privacy Officer to ensure compliance with this policy.
2. Identifying Purposes: We clearly identify the purposes for which personal information is collected, either before or at the time of collection.
3. Consent: We obtain meaningful consent for the collection, use, or disclosure of personal information, except where otherwise permitted or required by law.
4. Limiting Collection: We collect only the personal information necessary to fulfill the identified purposes.
5. Limiting Use, Disclosure, and Retention: Personal information is used and disclosed only for the purposes for which it was collected and retained only as long as necessary to fulfill those purposes.
6. Accuracy: We ensure that personal information is accurate, complete, and up to date as required for its intended use.
7. Safeguards: We protect personal information with appropriate physical, organizational, and technological safeguards.
8. Openness: Our policies and practices relating to the management of personal information are available upon request.
9. Individual Access: Individuals have the right to request access to their personal information and to challenge its accuracy or completeness.
10. Challenging Compliance: Individuals may challenge Baqers’ compliance with these principles by contacting our Privacy Officer or the Office of the Privacy Commissioner of Canada

5. CONSENT


1. You should only obtain a Data Subject’s Consent if there is no other legal basis for the Processing. Consent requires genuine choice and genuine control.
2. A Data Subject Consents to Processing of their Personal Data if they clearly indicate agreement either by a statement or positive action to the Processing. Silence, pre-ticked boxes or inactivity do not mean Consent. Consent must be specifically and expressly given. If Consent is given in a document that deals with other matters, you must ensure that the Consent is separate and distinct from those other matters.
3. Prior to giving Consent, the Data Subject shall be informed of their right and the ease to withdraw their Consent at any time. Withdrawal of Consent must be promptly honoured. Withdrawal should not affect the lawfulness of Processing based on Consent before its withdrawal.
4. Consent may need to be renewed if you intend to process Personal Data for a different and incompatible purpose which was not disclosed when the Data Subject first consented, or if the Consent is historic.
5. You will need to ensure that you have evidence of the Consent given and you should keep a record of all Consents obtained so that Baqers can demonstrate compliance.
6. No Consent shall be sought, given or accepted in any circumstance that may engender direct or indirect propagation of atrocities, hate, child-rights violation, criminal acts or anti-social conduct.

6. DATA COLLECTION


1. Baqers collects, stores and processes Personal Data needed to provide its service offering, and ensures that such Personal Data is adequate, relevant and not excessive for the legitimate purpose of Processing. In summary, the information that Baqers collects includes Personally Identifiable Information and related identifiers (for example, customer/employee/business name, phone number, residential and email address, date of birth, government identification numbers where necessary, user ID and password, social media details, payment details and financial account information). Baqers may also collect technical information that is linked to you specifically (for example, IP address, device identifiers).
2. Baqers collects the above-mentioned information using custom applications, electronic spreadsheets, web forms, email, physical requests, cookies, third-party applications and web tokens.
3. When clients send email or other communications to Baqers, we may retain those communications in order to process inquiries, respond to requests and improve our services. When clients access Baqers’s services, Baqers servers automatically record information that the client’s browser or device sends when visiting a website.
4. Baqers collects the above-mentioned information for marketing, business development, research, key business operations, processing, or carrying out tasks to fulfil legitimate business objectives.
5. Prior to collecting Personal Data from the Data Subject, Baqers shall provide the Data Subject with the following information (as applicable):
   1. identity and contact details of Baqers;
   2. the contact details of the DPO;
   3. the purpose of the Processing for which the Personal Data is intended, as well as the legal basis for the Processing;
   4. the legitimate interests pursued by Baqers or by any Third Party who has access to the Personal Data;
   5. the recipients or categories of recipients of the Personal Data (if any);
   6. where applicable, the fact that Baqers intends to transfer Personal Data to a recipient in a foreign country or international organisation and the safeguards in place for such transfers;
   7. the period for which the Personal Data will be stored, or if that is not possible, the criteria used to determine that period;
   8. the existence of the right to request from Baqers access to and rectification or erasure of Personal Data or restriction of Processing concerning the Data Subject or to object to Processing as well as the right to data portability;
   9. the existence of the right to withdraw Consent at any time, without affecting the lawfulness of Processing based on Consent before its withdrawal;
   10. the right to lodge a complaint with the Office of the Privacy Commissioner of Canada or any other relevant provincial authority;
   11. whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, and the possible consequences of failure to provide such data;
   12. the existence of Automated Decision-Making, including Profiling and, in those cases, meaningful information about the logic involved as well as the significance and the envisaged consequences of such Processing for the Data Subject; and
   13. where Baqers intends to further process the Personal Data for a purpose other than that for which it was collected, Baqers shall provide the Data Subject prior to that further Processing with information on that other purpose and any relevant information.
6. You must check the accuracy of any Personal Data at the point of collection and at regular intervals thereafter. You must take all reasonable steps to destroy or amend inaccurate records without delay and you should update out-of-date Personal Data where necessary.
7. Personal Data must be accurate and, where necessary, kept up to date.
8. You should ensure that Personal Data is recorded in the correct files.
9. Incomplete records can lead to inaccurate conclusions being drawn and, where there is such a risk, you should ensure that relevant records are completed.

7. DATA PROCESSING


1. You must ascertain that the Processing of Personal Data is lawful.
2. Processing shall be lawful if at least one of the following applies (Canadian framing):
   1. the Data Subject has given Consent to the Processing of their Personal Data for one or more specific purposes;
   2. Processing is necessary for the performance of a contract to which the Data Subject is a party or in order to take steps at the request of the Data Subject prior to entering into a contract;
   3. Processing is necessary for compliance with a legal obligation to which the Controller is subject;
   4. Processing is necessary in order to protect the vital interests of the Data Subject or of another natural person;
   5. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of public authority vested in the Controller; or
   6. Processing is necessary for the legitimate interests pursued by Baqers or by a third party, provided those interests are not overridden by the interests or fundamental rights and freedoms of the Data Subject.

8. DATA SUBJECTS’ RIGHTS


1. Where the legal basis of our Processing is Consent, Data Subjects have the right to withdraw that Consent at any time.
2. Data Subjects have the right to request access to the Personal Data that we hold.
3. Data Subjects have the right to prevent our use of the Personal Data for direct marketing purposes.
4. Data Subjects have the right to object to our Processing of Personal Data in limited circumstances.
5. Data Subjects have the right to request erasure of Personal Data where:
   1. it is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
   2. the only legal basis of Processing is Consent and that Consent has been withdrawn and there is no other legal basis on which we can process that Personal Data;
   3. the Data Subject objects to our Processing where the legal basis is the pursuit of a legitimate interest and we can show no overriding legitimate grounds or interest; or
   4. the Processing is unlawful.
6. Data Subjects have the right to request rectification of inaccurate data or completion of incomplete data.
7. Data Subjects have the right to request restriction of Processing in specific circumstances (for example where there is a complaint about accuracy).
8. Data Subjects have the right to request information about safeguards under which Personal Data is transferred outside Canada.
9. Data Subjects have the right not to be subject to decisions based solely on automated Processing, including Profiling, except in limited circumstances where permitted and subject to safeguards or explicit Consent.
10. Data Subjects have the right to prevent Processing that is likely to cause damage or distress to themselves or anyone else.
11. Data Subjects have the right to data portability, as applicable.
12. Data Subjects have the right to be notified of a Personal Data Breach which creates a real risk of significant harm to them.
13. Data Subjects have the right to make a complaint to the Office of the Privacy Commissioner of Canada or the relevant provincial privacy commissioner.
14. Data Subjects have the right, in limited circumstances, to receive or request transfer of their Personal Data to a Third Party in a structured, commonly used and machine-readable format.
15. Where provincial regimes (for example Quebec Law 25) provide greater rights, Baqers will apply those additional protections for Data Subjects in that province.

9. REQUESTS


1. Baqers shall take appropriate measures to provide any information relating to Processing to the Data Subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for information addressed specifically to a child.
2. The information may be provided orally or in writing, or by other means, including where appropriate by electronic means.
3. You must verify the identity of an individual requesting data. Where you have reasonable doubt concerning the identity of the person making the request for information, you may request additional information necessary to confirm identity.
4. You must immediately forward any Data Subject access request you receive to the Data Protection team at nmajekodunmi@baqers.com.
5. Requests for Data Subject access will generally be complied with without undue delay and normally within one month of receipt, subject to permitted extensions under applicable law.
6. The entitlement is to the Personal Data we hold about the Data Subject rather than to documents per se.
7. Information provided to the Data Subject and any communication and any action taken shall normally be provided free of charge. Where the Data Subject’s request is manifestly unfounded or excessive (for example repetitive requests), Baqers may either:
   1. charge a reasonable fee taking into account administrative costs of providing the information; or
   2. refuse the request and explain the reasons for the refusal.
8. You should not allow third parties to persuade you into disclosing Personal Data without proper authorisation.
9. You should not alter, conceal, block or destroy Personal Data once a request for access has been made. Contact the Data Protection team before any changes are made to Personal Data which is the subject of an access request.

10. ACCOUNTABILITY


1. Baqers must implement appropriate technical and organisational measures in an effective manner to ensure compliance with the personal data protection principles and must be able to demonstrate such compliance.
2. Baqers must therefore apply adequate resources and controls to ensure and to document compliance including:
   1. appointing a suitably qualified DPO;
   2. implementing Privacy by Design when Processing Personal Data and completing a Data Protection Impact Assessment (DPIA) where Processing presents a high privacy risk;
   3. integrating data protection into our policies and procedures and producing required documentation such as privacy notices, records of Processing and records of Personal Data Breaches;
   4. training members of staff on compliance with Data Protection Laws and keeping records of such training;
   5. regularly testing privacy measures and conducting periodic reviews and audits to assess compliance.

11. DATA SECURITY


1. Baqers is required to implement and maintain appropriate safeguards to protect Personal Data, taking into account in particular the risks to Data Subjects presented by unauthorised or unlawful Processing or accidental loss, destruction of, or damage to their Personal Data.
2. Safeguarding will include the use of encryption and Pseudonymisation where appropriate. It also includes protecting confidentiality (that only those who need to know and are authorised to use Personal Data have access), integrity and availability of Personal Data. We will regularly evaluate and test the effectiveness of those safeguards.
3. You are responsible for protecting the Personal Data that you process in the course of your duties. You must therefore handle Personal Data in a way that guards against accidental loss or disclosure or other unintended or unlawful Processing and in a way that maintains its confidentiality. Particular care must be taken with Sensitive Personal Data.
4. You must comply with all instructions, procedures and technologies Baqers puts in place to maintain the security of Personal Data, from collection to destruction.
5. You must not attempt to circumvent the administrative, physical and technical safeguards we implement.

12. RESPONSIBILITIES OF THE DPO


1. advising Baqers and its employees of obligations under Data Protection Laws;
2. monitoring compliance with this Policy and Data Protection Laws;
3. overseeing Baqers’s policies with respect to data protection and monitoring, training and audit activities that relate to compliance;
4. providing advice on DPIAs;
5. supervising internal data Processing;
6. dealing with requests, complaints and enquiries from Data Subjects and regulators;
7. acting as the contact point between Baqers and the Office of the Privacy Commissioner (and provincial commissioners where applicable); and
8. having due regard to the risks associated with Processing operations, taking into account the nature, scope, context and purposes of Processing.

13. EMPLOYEE RESPONSIBILITIES


1. Employees who process Personal Data about Baqers employees, clients, applicants, alumni or any other individual must comply with this Policy. Employees must ensure that:
   1. all Personal Data is kept securely;
   2. no Personal Data is disclosed either verbally or in writing, accidentally or otherwise, to any unauthorised Third Party;
   3. Personal Data is kept in accordance with this Policy;
   4. any queries regarding data protection, including subject access requests and complaints, are promptly directed to the DPO and the Data Protection team;
   5. any data protection breaches are swiftly brought to the attention of the Data Protection team and the DPO and that they support the Data Protection team in resolving breaches; and
   6. where there is uncertainty around a data protection matter, advice is sought from the Data Protection team and the DPO.
2. Where employees are responsible for ad hoc staff, short-term staff, volunteers, contractors or interns who process Personal Data, they must ensure such persons are aware of the data protection principles.
3. Employees who are unsure about authorised third parties to whom they can disclose Personal Data should seek advice from the Data Protection team or the DPO.
4. You may only process Personal Data where performing your job duties requires it and you must not process Personal Data for reasons unrelated to your job duties.

14. THIRD-PARTARY DATA PROCESSORS


1. Data Processing by a Third Party shall be governed by a written contract between the Third Party and Baqers.
2. Where external companies are used to process Personal Data on behalf of Baqers, responsibility for the security and appropriate use of that data remains with Baqers.
3. Where a Third-Party data processor is used:
   1. the Third-Party data processor shall be selected by Baqers and must provide sufficient guarantees about its security measures to protect the Processing of Personal Data;
   2. reasonable steps must be taken by the DPO to ensure such security measures are in place; and
   3. a written contract establishing what Personal Data will be processed and for what purpose must be entered into by both parties.
4. Baqers shall take reasonable steps to ensure that the Third-Party data processor has not breached data protection principles and that the Third Party applies appropriate protections. Where processing occurs outside Canada, Baqers will ensure contractual or other lawful safeguards are in place.
5. You may only transfer Personal Data to Third-Party service providers approved by the relevant Baqers manager who provide sufficient guarantees and agree to act only on Baqers’s instructions.
6. For guidance about use of Third-Party data processors please contact the Data Protection team.

15. CONTRACTORS, SHORT-TERM AND VOLUNTARY STAFF


1. Baqers is responsible for Personal Data used by anyone working on its behalf. Managers who engage contractors or short-term staff must ensure they are appropriately vetted for the data they will process. In addition, managers should ensure that:
   1. any Personal Data collected or processed in the course of work is kept securely and confidentially;
   2. all Personal Data is returned to Baqers on completion of the work, including any copies that may have been made, or securely destroyed with notification to Baqers;
   3. Baqers receives prior notification of any disclosure of Personal Data to any organisation or person who is not a direct employee of the contractor;
   4. any Personal Data made available by Baqers, or collected in the course of the work, is not stored or processed outside Canada unless appropriate safeguards are in place or Consent has been obtained; and
   5. reasonable steps are taken to ensure contractors do not have access to Personal Data beyond what is essential.
2. For further guidance, contact the DPO at nmajekodunmi@baqers.com.

16. CLIENT AND USER RESPONSIBILITIES


1. Clients and Users are responsible for:
   1. familiarising themselves with the privacy notice provided when their relationship with Baqers commences; and
   2. ensuring that Personal Data provided to Baqers is accurate and up to date.

17. REPORTING A PERSONAL DATA BREACH


1. You are required to report any Personal Data Breach where there is a risk to the rights and freedoms of the Data Subject. Where a Personal Data Breach causes a real risk of significant harm, Baqers will notify affected individuals and the Office of the Privacy Commissioner (and applicable provincial regulator) in accordance with applicable law and guidance.
2. Baqers has procedures to deal with suspected Personal Data Breaches and will notify Data Subjects or the relevant regulator where legally required. Breach remediation steps should be initiated without undue delay and Baqers will take reasonable steps to contain and remediate the breach.
3. If you know or suspect that a Personal Data Breach has occurred, you must immediately contact the Data Protection team at nmajekodunmi@baqers.com and retain all evidence relating to the incident.
4. Records of Personal Data Breaches must be kept and must set out:
   1. the facts surrounding the breach;
   2. its effects;
   3. the remedial action taken.
5. Baqers will not be responsible for a Personal Data Breach caused by events beyond its reasonable control (for example acts of God, war, terrorism), or where the Data Subject has instructed transfer of data to a third party and the resulting breach is caused by that third party and not by Baqers’s failure to implement reasonable safeguards.

18. LIMITATIONS ON TRANSFER OF PERSONAL DATA

1. Where Personal Data is transferred outside Canada, Baqers shall not transfer or permit Personal Data to be transferred unless appropriate safeguards are in place (for example contractual clauses, binding corporate rules, or other lawful mechanisms) or the Data Subject has given explicit Consent after being informed of the risks.
2. In the absence of such safeguards, cross-border transfers may only be made where a legal basis exists (for example, necessity for performance of a contract) and the Data Subject has been informed of any associated risks.
3. Where transfers are made, Data Subjects will be provided with clear information about recipients, purposes and safeguards.

19. RECORD KEEPING AND DATA RETENTION

1. Baqers is required to keep full and accurate records of Processing activities. You must maintain accurate records reflecting Processing activities, Consents and procedures.
2. Records should include, at a minimum, Baqers contact details, DPO contact, descriptions of Personal Data types, Processing activities and purposes, Third-party recipients, storage locations, transfer details, retention periods and security measures.
3. You must ensure Personal Data no longer needed for specified purposes is deleted or erased in accordance with this Policy and retention schedules.
4. Where a Data Subject requires rectification or erasure, you should inform recipients of that Personal Data that it has been rectified or erased unless impossible or onerous to do so. Take reasonable steps to destroy or erase Personal Data no longer required.

20. TRAINING AND AUDIT

1. Baqers will ensure employees undergo privacy training to comply with Data Protection Laws. Systems and processes will be tested and reviewed regularly.
2. You must attend mandatory data privacy training. Contact the Chief Operating Officer or Human Resources for training details.
3. You must regularly review systems and processes under your control to ensure compliance.

21. PRIVACY BY DESIGN AND DPIAs

1. Baqers will implement privacy-by-design measures when Processing Personal Data by applying appropriate technical and organisational measures to ensure compliance.
2. Personal Data processed by default will be limited to what is necessary for each specific purpose.
3. Baqers will conduct DPIAs for high-risk Processing before such Processing is undertaken.
4. Conduct a DPIA (and discuss findings with the DPO) in circumstances including: new technologies, automated Processing including Profiling, large-scale Processing of Sensitive Personal Data, and large-scale monitoring.
5. A DPIA should include: description of Processing and purposes; assessment of necessity and proportionality; assessment of risks to individuals; and risk-mitigation measures.

22. DIRECT MARKETING

1. Baqers is subject to Canada’s Anti-Spam Legislation (CASL) and related privacy rules when sending commercial electronic messages. Baqers will obtain Consent where required, identify the sender and provide an unsubscribe mechanism in each message.
2. The right to object to direct marketing must be clearly offered to the Data Subject. Objections and unsubscribe requests will be honoured promptly and, where required, suppressed from marketing lists while retaining minimal information to respect future preferences.

23. SHARING PERSONAL DATA

1. In the absence of Consent, a legal obligation or other lawful basis, Personal Data should not be disclosed to third parties unrelated to Baqers.
2. Without a court order, law enforcement agencies do not have an automatic right of access to records of Personal Data. Refer law enforcement requests to the DPO; disclose only where required by law or with appropriate legal process.
3. Sharing Personal Data for research purposes may be permissible subject to safeguards and de-identification where appropriate. Contact the Data Protection team for guidance at nmajekodunmi@baqers.com.

24. CHANGES TO THIS POLICY

We reserve the right to change this Policy. Material changes will be communicated to affected Data Subjects where required; updated versions will be published with the effective date.

CONTACT / COMPLAINTS

If you have questions about this Policy or want to exercise your data rights, contact the Data Protection team at nmajekodunmi@baqers.com. You may also contact the Office of the Privacy Commissioner of Canada or the relevant provincial privacy commissioner for unresolved complaints.