ATLANTIC CORE OPERATIONS LTD.

MASTER PRIVACY POLICY

Effective date: July 4, 2026

Last updated: July 4, 2026

1. Introduction

Atlantic Core Operations Ltd. respects the privacy and confidentiality of its customers, clients, prospective clients, website visitors, business contacts, suppliers, contractors, job applicants, partners, and other individuals with whom it interacts.

This Privacy Policy explains how Atlantic Core Operations Ltd. collects, uses, discloses, retains, protects, and otherwise handles personal information.

This Policy is intended to support compliance with applicable Canadian privacy and electronic-communications laws, including, where applicable:

• the Personal Information Protection and Electronic Documents Act;
• the Breach of Security Safeguards Regulations;
• Canada’s anti-spam legislation and related regulations;
• Newfoundland and Labrador privacy legislation applicable to specific regulated activities;
• applicable tax, accounting, employment, consumer-protection, corporate-record, and legal-process requirements; and
• any successor, replacement, or amending legislation.

Legal requirements may vary depending on the nature of the information, the individual involved, the service being provided, and the jurisdiction in which the information is collected or processed.

2. Organization Covered by This Policy

This Policy applies to Atlantic Core Operations Ltd., referred to in this Policy as “ACO,” “we,” “us,” or “our.”

It also applies to operations, divisions, brands, trade names, websites, projects, and services owned, operated, managed, or administered by ACO where this Policy is referenced, including:

• ACO Business Support;
• Stephenville Mobile Tire Service;
• West Coast Vending;
• online ordering and delivery-platform support services;
• future ACO-owned operations, divisions, brands, or trade names; and
• websites, forms, social-media pages, communication channels, and digital systems operated by or on behalf of ACO.

A specific operation may publish an additional privacy notice where its activities require more detailed or specialized disclosure. If a specific notice conflicts with this general Policy, the more specific notice will apply to the relevant activity.

3. Scope

This Policy applies to personal information collected through or in connection with:

• atlanticoperations.ca;
• contact forms and quote-request forms;
• email, telephone, SMS, messaging applications, and social media;
• in-person interactions;
• service bookings and appointments;
• contracts, proposals, invoices, and payment records;
• business-support projects;
• online ordering and delivery-platform setup work;
• mobile tire and vehicle-support services;
• vending-machine operations and location partnerships;
• promotions, surveys, contests, mailing lists, and events;
• photography, video, testimonials, and case studies;
• job applications and contractor inquiries;
• third-party platforms used by ACO; and
• information provided to ACO by clients, suppliers, partners, or service providers.

This Policy does not replace contractual confidentiality obligations, employment policies, platform privacy policies, or privacy notices issued by independent third parties.

4. Meaning of Personal Information

For the purposes of this Policy, personal information means information about an identifiable individual, whether recorded electronically, on paper, visually, orally, or in another form.

Personal information may include factual or subjective information and may include information that, alone or when combined with other information, can identify an individual.

Personal information generally does not include business contact information used solely to communicate with an individual in their professional or business capacity where excluded by applicable law.

5. Accountability and Privacy Officer

ACO is responsible for personal information under its control, including information transferred to service providers for processing on ACO’s behalf.

ACO designates the following position as responsible for privacy compliance:

Privacy Officer

Atlantic Core Operations Ltd.

Email: contact@atlanticoperations.ca

Telephone: +1 (902) 932-8930

The Privacy Officer is responsible for:

• overseeing privacy policies and procedures;
• responding to access, correction, and deletion requests;
• reviewing privacy complaints;
• coordinating breach-response activities;
• assessing new systems, technologies, vendors, and projects;
• maintaining privacy-related records;
• supporting staff and contractor awareness; and
• reviewing this Policy when ACO’s activities or legal obligations change.

6. Categories of Information We May Collect

Depending on the interaction or service, ACO may collect the following categories of information.

6.1 Identity and Contact Information

• name;
• business or organization name;
• job title;
• mailing or service address;
• email address;
• telephone number;
• social-media username;
• preferred communication method; and
• other information needed to identify or contact an individual.

6.2 Business and Project Information

• business type and operating details;
• requested services;
• project requirements and objectives;
• menus, product lists, pricing, photographs, branding materials, and business documents;
• account, platform, website, or software information voluntarily provided for a project;
• customer-service processes and business workflows;
• supplier and partner information;
• information contained in proposals, contracts, project notes, and correspondence; and
• information needed to assess, quote, perform, or support a project.

6.3 Booking and Service Information

For mobile or location-based services, ACO may collect:

• appointment date and time;
• service location;
• vehicle make, model, year, licence plate, wheel or tire details;
• requested work and service history;
• access or parking instructions;
• photographs documenting the condition or completion of work; and
• information reasonably required to provide the requested service.

6.4 Online Ordering and Delivery-Platform Information

Where ACO provides online ordering, menu, or delivery-platform support, we may receive:

• merchant or business contact information;
• menu and product information;
• store hours and availability information;
• pricing, modifiers, categories, and descriptions;
• product photographs;
• pickup and fulfillment procedures;
• platform correspondence;
• account identifiers;
• access permissions authorized by the client; and
• information required to complete setup, troubleshooting, or support.

ACO does not require clients to provide unrestricted credentials where delegated access or another safer access method is available.

6.5 Transaction and Payment Information

ACO may collect or process:

• transaction date and amount;
• payment status;
• invoice and receipt information;
• billing address;
• refund information;
• tax information;
• limited payment-method details supplied by a payment processor; and
• records required for accounting, fraud prevention, and legal compliance.

Full payment-card information is generally processed by independent payment processors and should not be stored directly by ACO unless necessary, authorized, and protected under applicable payment-security requirements.

6.6 Website and Technical Information

When an individual visits an ACO website or uses an online form, ACO or its service providers may automatically receive:

• Internet Protocol address;
• browser type and version;
• device type;
• operating system;
• approximate location derived from an IP address;
• referring website;
• pages viewed;
• links clicked;
• form interactions;
• date and time of access;
• session identifiers;
• cookie identifiers;
• website-performance and error information; and
• security and fraud-detection information.

6.7 Communications

ACO may retain:

• emails;
• SMS messages;
• direct messages;
• contact-form submissions;
• telephone notes;
• voicemail;
• social-media correspondence;
• customer-service records;
• complaint records; and
• other communications with or about an individual.

Calls, meetings, or service interactions may be recorded only where ACO has provided appropriate notice and obtained any consent required by law.

6.8 Photographs, Audio, and Video

ACO may collect photographs, audio, or video for:

• documenting completed work;
• quality assurance;
• insurance or dispute resolution;
• security;
• product or menu photography;
• before-and-after comparisons;
• marketing, testimonials, or case studies where appropriate permission has been obtained; and
• internal training or operational documentation.

6.9 Social-Media and Public Information

ACO may collect information that an individual makes available through:

• public social-media profiles;
• public business directories;
• public reviews;
• public websites;
• professional networking platforms;
• government or corporate registries; and
• other lawful public sources.

Public availability does not automatically mean that information will be used for every purpose. ACO will consider the context, sensitivity, and appropriateness of the intended use.

6.10 Vending and Equipment Information

ACO-operated vending or equipment systems may generate or receive:

• machine location and identifier;
• transaction date and time;
• item selected;
• transaction amount;
• equipment status;
• inventory levels;
• error logs;
• service and maintenance records; and
• limited payment information supplied by a processor.

ACO does not ordinarily receive a cardholder’s full payment-card number from contactless vending transactions.

6.11 Marketing and Preference Information

• communication preferences;
• marketing consent;
• unsubscribe requests;
• promotion or contest entries;
• survey responses;
• interests inferred from interactions with ACO content, where permitted; and
• campaign engagement information.

6.12 Employment and Contractor Information

Where an individual applies to work with or provide services to ACO, we may collect:

• résumé and employment history;
• qualifications and references;
• licences and certifications;
• availability;
• interview notes;
• background information lawfully required for the role;
• payroll, tax, and banking information if engaged; and
• emergency-contact and employment-administration information.

Additional employee or contractor privacy notices may apply.

6.13 Age and Identity Verification

ACO may request evidence of age, identity, authority, ownership, or signing capacity where reasonably required for:

• age-restricted activities;
• fraud prevention;
• account access;
• contractual authority;
• payment disputes;
• legal compliance; or
• verification of a privacy request.

ACO will generally avoid retaining a complete copy of government-issued identification unless retention is reasonably necessary and legally permitted.

6.14 Sensitive Information

ACO does not intentionally request sensitive personal information unless it is reasonably necessary for a legitimate and identified purpose.

Sensitive information may include:

• financial information;
• identity documents;
• precise service-location information;
• employment information;
• dispute or complaint details;
• accessibility information; or
• information carrying an elevated risk of harm if misused.

ACO applies safeguards proportionate to the sensitivity, amount, format, distribution, and purpose of the information.

7. Sources of Information

ACO may collect information:

• directly from the individual;
• from an authorized representative;
• from a business, employer, client, or account owner;
• from a payment processor;
• from a website, hosting, analytics, communications, or security provider;
• from social-media or online platforms;
• from delivery, ordering, scheduling, or merchant platforms;
• from suppliers, insurers, contractors, or business partners;
• from publicly available sources;
• through cookies and similar technologies; or
• where otherwise permitted or required by law.

Where one person provides information about another person, the person providing it is responsible for having appropriate authority to do so.

8. Purposes for Collection, Use, and Disclosure

ACO may collect, use, or disclose personal information for purposes including:

• responding to inquiries;
• identifying and communicating with customers and clients;
• providing quotes, estimates, and proposals;
• evaluating project or service requirements;
• entering into and administering contracts;
• scheduling and completing services;
• delivering business-support work;
• creating or updating websites, menus, graphics, and operational materials;
• configuring online ordering or delivery-platform services;
• coordinating suppliers, contractors, and service providers;
• processing payments, refunds, invoices, and receipts;
• maintaining accounting, tax, corporate, and transaction records;
• providing customer service and project updates;
• managing complaints, claims, warranties, or disputes;
• verifying identity, authority, age, or eligibility;
• preventing fraud, abuse, unauthorized access, and security incidents;
• improving services, operations, websites, and customer experience;
• conducting analytics and performance measurement;
• maintaining business continuity and backups;
• promoting ACO services where lawful consent or another legal basis exists;
• managing employment and contractor relationships;
• complying with legal, regulatory, insurance, tax, accounting, and contractual obligations;
• enforcing agreements and protecting legal rights;
• conducting due diligence for financing, restructuring, investment, sale, or acquisition; and
• any other reasonable purpose identified at or before the time of collection.

ACO will not use personal information for a materially different purpose without obtaining additional consent or establishing another lawful basis.

9. Consent

ACO will seek consent in a form appropriate to:

• the sensitivity of the information;
• the reasonable expectations of the individual;
• the purpose of collection;
• the method of interaction; and
• applicable law.

Consent may be:

• express or implied;
• written, electronic, verbal, or demonstrated through conduct; or
• obtained through a representative with lawful authority.

ACO will provide information reasonably necessary for an individual to understand the nature, purpose, and consequences of the collection, use, or disclosure.

An individual may withdraw consent for optional activities, subject to:

• legal or contractual restrictions;
• reasonable notice;
• completed transactions;
• records that ACO is required to retain; and
• information reasonably required to continue providing a requested service.

Withdrawal of consent may limit ACO’s ability to provide certain services.

10. Client-Provided and Third-Party Personal Information

ACO may process personal information supplied by a business client while providing websites, systems, online ordering, marketing, administrative, or operational support.

Depending on the arrangement:

• the client may remain responsible for determining why and how the information is collected and used;
• ACO may act as a service provider processing information under the client’s instructions; and
• ACO may independently control limited information required for billing, security, legal compliance, and administration.

Clients are responsible for ensuring they have lawful authority to provide personal information to ACO.

ACO may require contractual privacy, confidentiality, security, deletion, and breach-notification terms before accepting client data.

ACO will not knowingly use client-provided personal information for unrelated marketing or independent commercial purposes without proper authorization.

11. Artificial Intelligence and Automated Tools

ACO may use artificial-intelligence-assisted tools, automation, or software to support:

• drafting;
• design;
• image editing;
• content organization;
• data categorization;
• research;
• workflow automation;
• customer-service preparation;
• transcription;
• document review; or
• operational efficiency.

Where personal or confidential information is involved, ACO will consider:

• whether the information is necessary;
• whether it can be removed, anonymized, or minimized;
• the sensitivity of the information;
• the provider’s privacy and security practices;
• contractual controls;
• storage location;
• retention settings; and
• whether human review is required.

ACO does not intend to make legally significant decisions about individuals solely through automated processing without appropriate human involvement, notice, and any consent required by law.

Clients and users should not submit unnecessary sensitive or confidential information through general-purpose forms or communication channels.

12. Cookies and Similar Technologies

ACO websites may use cookies, local storage, pixels, tags, scripts, or similar technologies for:

• website operation;
• security;
• fraud prevention;
• remembering user preferences;
• form functionality;
• performance measurement;
• analytics;
• content improvement;
• advertising or campaign measurement, where implemented; and
• understanding how visitors interact with the website.

Cookies may be:

• essential, where required for the website to function;
• functional, where used to remember preferences;
• analytics, where used to measure website performance; or
• advertising, where used to measure campaigns or personalize advertising.

Where required, ACO will request appropriate consent before activating optional analytics or advertising technologies.

Users can manage cookies through browser controls and any cookie-preference tool made available on the website. Blocking cookies may affect certain website functions.

13. Analytics and Advertising

ACO may use third-party analytics, social-media, advertising, or campaign-measurement services.

These providers may collect device, browser, interaction, cookie, and approximate-location information according to their own privacy policies and ACO’s configuration choices.

ACO will assess consent requirements before using technologies that:

• track users across websites;
• create advertising profiles;
• deliver behaviourally targeted advertising; or
• combine website activity with information held by another platform.

ACO will not knowingly use sensitive personal information for targeted advertising in a manner inconsistent with applicable law.

14. Commercial Electronic Messages

ACO may send commercial electronic messages, including promotional emails or texts, only where:

• the recipient has provided express consent;
• valid implied consent exists;
• the message is otherwise permitted or exempted by law; or
• the communication is required to complete or administer a requested transaction or service.

Where required, commercial messages will:

• identify ACO and any organization on whose behalf the message is sent;
• provide valid contact information;
• contain a functioning unsubscribe mechanism; and
• process unsubscribe requests within the legally required period.

ACO may retain consent and unsubscribe records to demonstrate compliance.

Service messages, invoices, appointment reminders, requested quotes, project updates, and responses to inquiries may be sent where reasonably necessary to administer the relationship.

15. Telephone and Direct Marketing

ACO may contact individuals by telephone where:

• the individual has requested contact;
• an existing business relationship permits the communication;
• consent has been obtained;
• the number is a business number used for the relevant purpose; or
• the contact is otherwise permitted by law.

ACO will maintain and honour internal do-not-contact preferences where required.

16. Payment Processing

ACO may use third-party payment processors, banks, point-of-sale providers, e-transfer services, or merchant platforms.

Payment providers may collect and process financial information under their own privacy policies and contractual terms.

ACO will seek to minimize direct possession of full payment-card information.

Payment and transaction information may be retained where required for:

• accounting;
• reconciliation;
• refunds;
• chargebacks;
• tax compliance;
• fraud prevention; and
• dispute resolution.

17. Third-Party Platforms

ACO may use or interact with independent platforms, including:

• website-hosting providers;
• email providers;
• social-media platforms;
• payment processors;
• cloud-storage providers;
• customer-management systems;
• accounting systems;
• online ordering and delivery platforms;
• scheduling tools;
• advertising services;
• AI and design platforms; and
• telecommunications providers.

Information submitted directly to an independent platform is also subject to that platform’s privacy policy and terms.

ACO is not responsible for the independent privacy practices, security, availability, or decisions of third-party platforms.

18. DoorDash and Other Delivery Platforms

ACO may provide independent setup, menu, branding, photography, workflow, or readiness support relating to DoorDash or other ordering platforms.

Unless expressly stated otherwise:

• ACO is not the ordering platform;
• ACO does not determine platform privacy practices;
• ACO does not control platform approval, commissions, rankings, customer accounts, driver availability, or platform data retention;
• personal information submitted directly to a platform is governed by that platform’s privacy policy; and
• clients remain responsible for their merchant account, legal compliance, customer data, menu accuracy, and platform obligations.

ACO will use merchant or platform information only as reasonably required to provide authorized support.

19. Location and Mobile-Service Information

ACO may collect a customer’s service location to perform mobile or on-site services.

Location information may be used for:

• dispatch;
• route planning;
• appointment coordination;
• service verification;
• billing;
• safety;
• dispute resolution; and
• operational records.

ACO does not intend to continuously track customers outside the context of an active service interaction.

20. Photography, Testimonials, and Case Studies

ACO will obtain appropriate permission before publicly using identifiable customer photographs, testimonials, project details, logos, or case-study information where consent is required.

Permission may define:

• the approved content;
• permitted channels;
• attribution;
• duration;
• editing rights; and
• withdrawal arrangements.

Photographs taken solely for service documentation, quality assurance, insurance, or dispute purposes will not automatically be used for public marketing.

21. Surveillance and Security Recording

ACO-operated premises, equipment locations, service areas, or vending locations may use video surveillance or other security systems where reasonably required for:

• safety;
• theft prevention;
• property protection;
• fraud investigation;
• incident review; or
• legal compliance.

Where ACO controls the surveillance system, reasonable notice will be provided where required.

Surveillance will not be used in locations where individuals reasonably expect a high degree of privacy.

22. Children and Young Persons

ACO’s general websites and business services are not designed primarily for children.

ACO does not knowingly collect personal information from children where consent cannot be meaningfully provided, except where:

• a parent or lawful guardian has provided authorization;
• the information is necessary to provide a requested service;
• collection is permitted or required by law; or
• the interaction is otherwise appropriate in the circumstances.

If ACO learns that personal information was collected from a child without appropriate authority, ACO will take reasonable steps to delete or appropriately address it.

ACO will not knowingly use children’s information for behavioural advertising.

23. Disclosure of Personal Information

ACO may disclose personal information:

• with the individual’s consent;
• at the individual’s direction;
• to employees or contractors who require access for legitimate duties;
• to service providers processing information on ACO’s behalf;
• to payment processors and financial institutions;
• to insurers, accountants, auditors, and professional advisers;
• to suppliers or subcontractors required to complete a service;
• to a client where ACO processes information on that client’s behalf;
• to regulators, courts, law enforcement, or government authorities where permitted or required;
• to protect safety, property, security, legal rights, or contractual rights;
• to investigate fraud, abuse, or security incidents;
• in connection with a business transaction; or
• where otherwise permitted or required by law.

ACO does not sell or rent personal information for monetary consideration.

24. Service Providers and Outsourcing

ACO may transfer personal information to service providers that perform functions such as:

• website hosting;
• cloud storage;
• email;
• document management;
• communications;
• payment processing;
• accounting;
• marketing;
• analytics;
• software support;
• data backup;
• security;
• AI-assisted processing; and
• professional advisory services.

ACO will use contractual or other reasonable measures appropriate to the circumstances to require service providers to:

• protect personal information;
• use it only for authorized purposes;
• limit access;
• report security incidents;
• delete or return information where appropriate; and
• comply with applicable legal obligations.

25. Processing Outside Canada

Personal information may be processed or stored outside Newfoundland and Labrador or outside Canada by ACO’s service providers.

Information processed in another jurisdiction may be accessible to courts, governments, law-enforcement agencies, or regulators under that jurisdiction’s laws.

ACO remains accountable for information transferred to a service provider for processing, subject to applicable law, and will use reasonable contractual and organizational safeguards.

Individuals may contact the Privacy Officer for further information about foreign processing relevant to their information.

26. Business Transactions

ACO may use or disclose personal information in connection with:

• financing;
• investment;
• restructuring;
• amalgamation;
• merger;
• acquisition;
• sale of assets;
• transfer of an operation;
• insolvency;
• due diligence; or
• another proposed or completed business transaction.

Where required, ACO will use confidentiality agreements, access restrictions, and safeguards appropriate to the sensitivity of the information.

If a transaction is completed, personal information may be transferred to the successor organization where legally permitted and subject to applicable obligations.

27. Legal and Regulatory Disclosure

ACO may collect, preserve, use, or disclose personal information where reasonably necessary to:

• comply with a subpoena, warrant, court order, or lawful demand;
• satisfy tax, accounting, corporate, insurance, or regulatory requirements;
• cooperate with an investigation;
• establish, exercise, or defend legal claims;
• collect a debt;
• enforce a contract;
• investigate fraud or misconduct;
• protect an individual from serious harm; or
• meet another legal obligation.

ACO may challenge or narrow a request where appropriate and legally permitted.

28. Retention

ACO retains personal information only for as long as reasonably necessary for the identified purpose or as required by law.

Retention periods may depend on:

• the type and sensitivity of the information;
• the duration of the customer or client relationship;
• the project or service;
• contractual requirements;
• tax and accounting obligations;
• warranty or insurance requirements;
• limitation periods;
• dispute or complaint risk;
• security requirements; and
• legal holds.

When information is no longer required, ACO will take reasonable steps to:

• securely delete it;
• destroy it;
• anonymize it; or
• make it irreversibly non-identifiable.

Backups may retain information temporarily until overwritten through normal system processes.

29. Accuracy

ACO will take reasonable steps to ensure that personal information used to make a decision or provide a service is accurate, complete, and current.

Individuals are responsible for notifying ACO when relevant information changes.

ACO may request supporting information before correcting records where necessary to maintain accuracy, integrity, or legal compliance.

30. Security Safeguards

ACO uses administrative, technical, contractual, and physical safeguards appropriate to the sensitivity and circumstances of the information.

Safeguards may include:

• access controls;
• strong passwords;
• multifactor authentication where available;
• role-based access;
• secure devices;
• encryption where appropriate;
• reputable hosting and cloud providers;
• backups;
• malware protection;
• confidentiality obligations;
• staff and contractor instructions;
• secure disposal;
• vendor reviews;
• logging and monitoring;
• incident-response procedures; and
• limits on collection and retention.

No electronic system, website, transmission method, or storage platform can be guaranteed completely secure.

31. Privacy Breaches

ACO maintains procedures for identifying, containing, investigating, documenting, and responding to suspected privacy breaches.

ACO will assess:

• the sensitivity of the information;
• the number of individuals affected;
• whether the information was encrypted or otherwise protected;
• the likelihood of misuse;
• the foreseeable harm;
• whether the information has been recovered;
• whether unauthorized access was confirmed; and
• other relevant circumstances.

Where a breach creates a real risk of significant harm and notification is legally required, ACO will:

• report the breach to the appropriate privacy regulator;
• notify affected individuals as soon as feasible;
• notify other organizations or government institutions where required to reduce the risk of harm; and
• maintain required breach records.

ACO may notify individuals about other incidents where doing so is appropriate even if formal legal notification is not required.

32. Access to Personal Information

Subject to applicable exceptions, an individual may request:

• confirmation that ACO holds personal information about them;
• access to that information;
• information about how it has been used;
• information about organizations to which it has been disclosed; and
• an explanation of applicable abbreviations or codes.

ACO may require:

• a written request;
• sufficient detail to identify the information;
• identity verification; and
• reasonable time to search for and review records.

ACO may refuse access where permitted or required by law, including where disclosure would reveal:

• another person’s personal information;
• confidential commercial information;
• legally privileged information;
• security-sensitive information;
• information generated during a formal dispute process; or
• information that cannot reasonably be separated from protected information.

ACO will explain any refusal unless prohibited by law.

33. Correction

An individual may request correction of inaccurate or incomplete personal information.

Where appropriate, ACO will:

• correct the information;
• annotate the record;
• notify relevant service providers or recipients; or
• record a disagreement where the requested correction is not accepted.

34. Withdrawal of Consent and Deletion Requests

Individuals may request withdrawal of consent or deletion of personal information.

ACO will assess the request in light of:

• legal retention requirements;
• contractual obligations;
• transaction records;
• fraud prevention;
• security;
• active disputes;
• insurance requirements;
• backup systems; and
• the continued need to provide a requested service.

ACO may retain information where legally permitted or required even after consent is withdrawn or deletion is requested.

35. Marketing Preferences

Individuals may opt out of promotional communications by:

• using the unsubscribe method provided;
• replying with an unsubscribe request where appropriate; or
• contacting the Privacy Officer.

Opting out of marketing does not prevent ACO from sending necessary service, safety, billing, legal, or transactional communications.

36. Complaints

Privacy concerns should first be directed to the Privacy Officer.

ACO will:

• acknowledge the complaint;
• review relevant information;
• investigate where appropriate;
• respond within a reasonable period;
• explain corrective action where appropriate; and
• maintain a record of the complaint and outcome.

If an individual is not satisfied, they may contact the Office of the Privacy Commissioner of Canada or another regulator with jurisdiction.

37. External Links

ACO websites may link to third-party websites, social-media pages, payment services, ordering platforms, suppliers, partners, or other resources.

ACO does not control and is not responsible for the privacy, security, content, terms, or practices of independent third parties.

Individuals should review the privacy policy of each external service before submitting personal information.

38. Changes to This Policy

ACO may update this Policy to reflect changes in:

• law;
• regulatory guidance;
• business operations;
• technology;
• vendors;
• services;
• data practices; or
• organizational structure.

The current version will be posted with an updated effective or revision date.

Where a change materially affects how existing personal information is handled, ACO will provide additional notice or obtain consent where required.

39. Interpretation

This Policy is intended to be interpreted consistently with applicable law.

If any provision is found to be invalid or unenforceable, the remaining provisions will continue to apply to the extent permitted.

Headings are included for convenience and do not limit the meaning of a provision.

The words “including” and “includes” mean “including without limitation.”

40. Contact Information

Questions, complaints, requests, or concerns regarding privacy may be directed to:

Privacy Officer

Atlantic Core Operations Ltd.

Western Newfoundland, Canada

Email: contact@atlanticoperations.ca

Telephone: +1 (902) 932-8930

Website: atlanticoperations.ca