4. Third parties and subcontractors

The following table lists all the third-party services available on our site or used as part of our operations, as well as the associated transfers of information.

We do not sell your personal information to third parties. We only communicate it to the subcontractors listed above, to the extent strictly necessary to fulfill the purposes described in section 3.

5. Transfers outside Québec

Some of our service providers are located outside Québec, which means that your personal information may be transmitted, stored or processed in other jurisdictions. In accordance with section 17 of Bill 25, we inform you of this below.

Services operated in the United States

• Google Analytics 4(Google LLC, United States) - your browsing and device identification data are processed in the United States for the purpose of audience analysis.
• WooCommerce Analytics(Automattic Inc., United States) - your transactional and store browsing data may be processed in the United States.
• Meta Pixel(Meta Platforms Inc., United States) - your advertising and conversion data is sent to the United States for remarketing.
• Google Fonts(Google LLC, United States) - your IP address is transmitted to the United States when fonts are loaded.
• Microsoft 365(Microsoft Corporation, United States) - your e-mail address may be processed in the United States in connection with the sending of our communications. To send our emails, we use Microsoft 365 (United States). Your details may therefore be processed in this jurisdiction.

Protective measures

Before any transfer outside Quebec, we ensure that personal information is adequately protected, in particular by :

• The conclusion of privacy protection contracts with our subcontractors, including recognized standard contractual clauses;
• Verification that the suppliers concerned have privacy policies that comply with applicable standards;
• The completion, where required, of a Privacy Impact Assessment (PIA) prior to any significant new transfer, in accordance with section 17 of Act 25.

Our main infrastructure (WordPress site, hosting, consent management via Moelleux) is hosted in Quebec by Horizon-Cumulus (Joliette, Quebec). Only the third-party services listed above involve transfers outside Quebec.

Technical note: your DMARC policy is configured in watch mode (p=none). To reinforce the authentication of your e-mails and reduce the risk of identity theft by e-mail, we suggest you change it to p=quarantine or p=reject with your DNS manager.

6. Shelf life

We keep your personal information only as long as necessary for the purposes for which it was collected, or as required by law. Here are our retention periods by type of data:

At the end of these periods, your information is securely destroyed or irreversibly anonymized, so that it is no longer possible to identify you.

7. Rights of persons concerned

Bill 25 grants you several rights with respect to your personal information held by us. Here's how to exercise them:

Right of access

You have the right to know what personal information we hold about you and to obtain a copy. We will respond within 30 days of receiving your request.

Right of rectification

If information concerning you is inaccurate, incomplete or ambiguous, you may request that it be corrected. We will make the correction as soon as possible and, where appropriate, inform third parties to whom the information has been communicated.

Right to erasure (right to be forgotten)

You may request the deletion of your personal information when its retention is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations (for example, accounting data for 7 years).

Right to portability

You have the right to receive the personal information you have provided to us in a structured, commonly used technological format, in order to be able to transmit it to another data controller, where this is technically feasible.

Right to withdraw consent

Where the processing of your information is based on your consent, you may withdraw it at any time, without prejudice to the lawfulness of the processing carried out prior to such withdrawal. You can change your cookie preferences at any time via the consent management panel available on our site. To withdraw your consent to commercial communications, use the unsubscribe link in each e-mail.

How to exercise your rights

To exercise any of these rights, contact our Privacy Officer (see section 8). Your request must enable us to identify you. We will reply within a maximum of30 daysfollowing receipt of your request, in accordance with Bill 25.

Right to file a complaint with the Commission d'accès à l'information

If you feel that your rights have not been respected or that your personal information has been processed in contravention of Bill 25, you may file a complaint with the Commission d'accès à l'information (CAI)Commission d'accès à l'information (CAI) :

• Website :https://www.cai.gouv.qc.ca

8. Privacy Officer

In accordance with section 8.1 of Bill 25, Fanny B art has designated a person responsible for the protection of personal information. This person is responsible for ensuring compliance with this policy and the legal obligations arising from it. This person is your point of contact for any questions or requests relating to your personal information.

• • Name :Fanny Boissonneault
  • Title :Photographer
  • E-mail : fanny@fannyb.ca

We undertake to respond to all requests within30 dayswe will notify you within 30 days of receipt of your request, in accordance with the legal deadline set out in Bill 25. If your request is complex or voluminous, we will advise you of any additional time required.

9. Effective date and versioning

This Privacy Policy is effective as ofJune 5, 2026and corresponds to version2.

We reserve the right to modify this policy at any time to reflect changes in our practices, in the services we use or in applicable legal requirements. In the event of a material change, we will notify you by means of a visible notice on our site or by e-mail, depending on the nature of the change. The most recent version is always available on this page.

We encourage you to review this policy periodically. The effective date indicated above lets you know if the policy has been updated since your last visit.