Privacy Policy

Effective Date: April, 2025

Metro Supply Chain Group Inc. (“Metro”, “us”, “we” and “our”) is committed to protecting your privacy.

This Privacy Policy explains how Metro collects, uses, and discloses personal information which is collected by, or provided to, Metro in the course of its business. We reserve the right to change the terms of this Policy at any time. When we make changes, we will revise the date at the top of this Policy. We encourage you to review this Policy periodically.

1. GENERAL INFORMATION

WHAT PERSONAL INFORMATION DO WE COLLECT FROM YOU, AND HOW DO WE USE IT?

“Personal information” means any information that can identify you, either on its own or in combination with other information. Metro does not collect sensitive personal information.

We may collect, or be provided by a third party, personal information including:

Information Provided by Our Customers (Retailers and Other Businesses): Retailers or other businesses from which you have made a purchase may provide us personal information such as your:

- Name
- Address
- Phone number
- Email address

We use this personal information solely to perform our services in respect of products you have purchased from the relevant company. We may also use your contact information to contact you with respect to such services.

Information You Provide to Us:

In certain circumstances, you may provide us your personal information directly, such as when contacting our contact center or inputting payment details on a payment form. In such circumstances, we may collect personal information such as your:

- Name
- Address
- Phone number
- Email address
- Payment data, such as a credit or debit card number, and the security code associated with your payment instrument.
  
  We use this personal information to facilitate your transaction including placing your order, scheduling shipment of your order, or facilitating returns. We may also use your contact information to contact you with respect to your order. To the extent we collect payment information from you, we will do so in accordance with all PCI-DSS requirements.
Information Collected Upon Delivery:
Our drivers can take photographs of delivery locations, with your prior approval, to prove delivery of a product. These photographs may contain some personal information such as the driveway to your home or the address where you live.
Information Collected Automatically:

When you access metroscg.com, we collect some information automatically. The technologies we use to assist with this data collection include cookies, web beacons, tags and scripts and software development kits. For further details about the types of cookies we use, how they function and how you can manage your preferences, please refer to our cookie policy. The categories of personal information we collect automatically include:

- Identifiers and Device Information:
  Our servers automatically log information about the device you are using, including unique identifiers. The items we log include:

- - IP address
  - Cookie identifiers
  - Your browser language
  - Device identifiers

We may use this personal information for the following additional business purposes:

Auditing: To ensure our internal processes work as intended, and comply with legal, regulatory, or contractual obligations.
Fraud and Security Monitoring: To detect and prevent cyberattacks, bot activities, or other illicit activity within the services or website.

WHEN DO WE SHARE INFORMATION WITH THIRD PARTIES?

Except as set out in this policy, Metro does not disclose or sell your personal information to any third parties. We may, however, share your information in the following circumstances:

Our Affiliates:

We may disclose your personal information to any of our affiliates within the Metro corporate group, in which case we will require those affiliates to honor this Privacy Policy. Affiliates include our parent company and any other subsidiaries, joint venture partners or other companies that we control or that are under our common control.

Service Providers:
Metro may disclose your personal information to third-party service providers to perform certain services on our behalf, including:

- Fulfill orders and shipments.
- Provide technology and related infrastructure.
- Conduct audits
- Analyze service usage.
- Assist in marketing.
- Processing payments

For example, we may hire other companies to provide data storage, fulfill orders and shipments, assist in marketing, conduct audits, and so forth.

Law Enforcement:
Under certain circumstances, we may be required to disclose your personal information if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency).

Other Legal Requirements:
We may disclose your personal information in the good faith belief that such action is necessary to:
- Comply with a legal obligation.
- Protect and defend the rights or property of Metro.
- Prevent or investigate possible wrongdoing in connection with the services.
- Protect the personal safety of users of the service or the public.
- Protect against legal liability.

HOW DO WE HANDLE INTERNATIONAL TRANSFER OF PERSONAL INFORMATION?

Metro is headquartered in Canada. If you are located outside of Canada, your personal information is collected and then transferred to Canada, or to another country in which we, our affiliates, or service provider(s) operate.

If we transfer your personal out of the European Economic Area (“EEA”), we implement at least one of the following safeguards:

We transfer your information to countries that have been recognized by the European Commission as providing an adequate level of data protection according to EEA standards.
We take steps to ensure that the recipient is bound by contractual obligations, including European Union Standard Contractual Clauses together with additional safeguards to protect your personal data.

KEEPING YOUR INFORMATION UPDATED

We do not regularly update any personal information we collect from you. In the event it is necessary to update your personal information for the purposes for which it was collected, we will contact you to provide such updated information. You may also contact us to update your personal information.

HOW LONG DO WE RETAIN YOUR PERSONAL INFORMATION?

We will only retain your personal information as long as is necessary for the fulfillment of the purposes for which it was collected or as required by law. Your personal information is securely stored until such time as it is no longer required, after which it is destroyed, rendering it unable to identify you.

HOW DO WE KEEP YOUR PERSONAL INFORMATION SECURE?

We take the protection of your personal information seriously. We employ a range of safeguards designed to protect personal information against loss and theft as well as unauthorized access, disclosure, copying, use, and modification, including physical, organization and technological measures, commensurate with the sensitivity of your personal information. Our employees have access to your personal information only on a strict need-to-know basis, are trained in the proper handling of such information, and are required to keep such personal information confidential and use it only for the purposes for which it was provided.

Where we use service providers who might have access to your personal information, we require them to have privacy and security standards that are comparable to ours. We use contracts and other measures with our service providers to maintain the confidentiality and security of your personal information and to prevent it from being used for any other purpose. However, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to use these commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

WHAT ARE YOUR RIGHTS AND CHOICES?

We believe you to have the right to control the use of your personal information and provide methods to control the personal information we hold about you, including choices about how we use that information. Where noted for certain jurisdictions, these controls and choices are enforceable as rights under applicable law.

Requests to Access, Correct, Modify, or Delete Personal Information:
Based on your jurisdiction, you may have various rights to access, amend, delete, or otherwise obtain your personal information. You may update or amend your information at any time or request the exercise of other privacy rights by contacting us at privacy@MetroSCG.com.
Please note, however, that we may need to retain certain information when we have a legal obligation or lawful basis to do so.
Do Not Track:
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Policy.
Appeals:
If we refuse to take action on your exercise of choices described in this Privacy Policy, you can appeal such a refusal by contacting us at privacy@MetroSCG.com.

2. RIGHTS IN CANADA

This privacy notice section for Canada supplements the information contained in our Privacy Policy and it applies solely to Canada.

YOUR RIGHTS UNDER THE PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT
Metro undertakes to respect the confidentiality of your personal information and to guarantee you can exercise your rights. Under the Personal Information Protection and Electronic Documents Act (“PIPEDA”), you have the right by law to:

Request Access to Your Personal Information:
The right to access, update or delete the information we have on you. You may update or request deletion of your personal information by contacting us using the email address provided in this Privacy Policy. This also enables you to receive a copy of the personal information we hold about you.

Request Correction of Your Personal Information:
You have the right to have any incomplete or inaccurate information we hold about you corrected.

Withdraw Your Consent:
You have the right to withdraw your consent to use your personal information. If you withdraw your consent, we may not be able to provide you with access to certain specific services.

Lodge a Complaint:
Although we prefer that you contact us first, you always have the right to lodge a complaint about our collection, use, storage, or disclosure of your personal information with the appropriate data protection authority.

ADDITIONAL RIGHTS IN QUÉBEC

In addition to the right provided to Canadians, residents of Quebec may also benefit from the following rights:

Cessation of Dissemination:
If the dissemination of your personal information is contrary to the law or a court order or if certain other conditions specified in the applicable law are met, you have the right to request that we cease dissemination your personal information.

De-indexation:
If the dissemination is contrary to the law or a court order or if certain other conditions specified in the applicable law are met, you have the right to request that we de-index any hyperlink attached to your name and providing access to personal information by a technological means.
Re-indexation:
If certain conditions are met, you have the right to request that we re-index a hyperlink attached to your name and providing access to personal information by a technological means.

Mobility:
You have the right to request that computerized personal information collected from you be communicated to you in a commonly used technological format as well as to any person or body authorized by law to collect such information.

EXERCISING YOUR RIGHTS UNDER PIPEDA AND BILL 648

You may exercise your rights by contacting us at privacy@MetroSCG.com. Please note that we may ask you to verify your identity before responding to such requests. If you make a request, we will try our best to respond to you as soon as possible.

You may use these contact details if you wish to make a complaint to us relating to this Privacy Policy and/or your personal information. You may also contact the Office of the Privacy Commissioner of Canada or the appropriate provincial regulator. You can reach out to us to assist in the determination of the appropriate entity to contact.

The Office of the Privacy Commissioner of Canada:
- The ICO’s address:

Office of the Privacy Commissioner

30 Victoria Street

Gatineau, QC K1A 1H3

Phone: 1-800-282-1376
Website: https://www.priv.gc.ca

3. RIGHTS IN THE EUROPEAN UNION AND UNITED KINGDOM

This privacy notice section for the European Union (“EU”), EEA, and United Kingdom (“UK”) supplements the information contained in our Privacy Policy and it applies solely to the EU, EEA, and UK.

LEGAL BASIS FOR PROCESSING PERSONAL INFORMATION

Metro only collects, uses, or shares your personal information where there is a lawful basis to do so. Under the EU and UK General Data Protection Regulations, the lawful bases we rely on for processing this information are:

Consent: You have given your consent to process personal information for one or more specific purposes.

Performance of a Contract: Provision of personal information is necessary for the performance of an agreement with you and/or for any pre-contractual obligations thereof.

Legitimate Interests: Processing personal information is necessary for the purposes of the legitimate interests pursued by Metro. We have a legitimate interest in collecting and processing personal information, for example, to administer and conduct business within Metro and its affiliates.

Legal Obligations: We may disclose your information where we are legally required to do so to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process, such as in response to a court order or a subpoena (including in response to public authorities to meet national security or law enforcement requirements).

YOUR RIGHTS UNDER THE GDPR

Metro undertakes to respect the confidentiality of your personal information and to guarantee you can exercise your rights.

You have the right by law if you are within the EU or UK, to:

Request Access to Your Personal Information:
The right to access, update or delete the information we have on you. You may update or request deletion of your personal information by contacting us using the email address provided in this Privacy Policy. This also enables you to receive a copy of the personal information we hold about you.

Request Correction of Your Personal Information:
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Object to Processing of Your Personal Information:
This right exists where we are relying on a legitimate interest as the legal basis for our processing and there is something about your situation which makes you want to object to our processing of your personal information on this ground.

Request Deletion of Your Personal Information:
You have the right to ask us to delete or remove personal information when there is no good reason for us to continue processing it.
Request the Transfer of Your Personal Information:
We will provide you, or to a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw Your Consent:
You have the right to withdraw your consent to use your personal information. If you withdraw your consent, we may not be able to provide you with access to certain specific services.

BUSINESS TRANSFERS:

In the event of any acquisition or sale of Metro and/or its assets, we may be required to disclose your personal information to a purchasing entity. We reserve the right to disclose your personal information if required or permitted to do so by law. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

EXERCISING YOUR RIGHTS UNDER THE GDPR

You may also use these contact details if you wish to make a complaint to us relating to this Privacy Policy and/or your personal information. Further, you have the right to complain to a Data Protection Authority about our collection and use of your personal information:

EU/EEA:
For more information, please contact your local Data Protection Authority in the EU. A list of national Data Protection Authorities is available.

UK:

You can complain to the Information Commissioner’s Office (“ICO”) if you are unhappy with how we have used your

data.

- The ICO’s address:
  - Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

- Helpline number: 0303 123 1113
- ICO website: https://www.ico.org.uk

4. RIGHTS FOR CALIFORNIA RESIDENTS

This privacy notice section for California residents supplements the information contained in our Privacy Policy and it applies solely to all visitors, users, and others who reside in the State of California.

NOTICE AT COLLECTION

At or before the time of collection, you have a right to receive notice of our practices, including the categories of personal information to be collected, the purposes for which such information is collected or used, whether such information is sold or shared and how long such information is retained. You can find those details in this Privacy Policy under the “GENERAL INFORMATION” section.

RIGHTS UNDER THE CALIFORNIA CONSUMER PRIVACY ACT AND THE CALIFORNIA PRIVACY RIGHTS ACT

The California Consumer Privacy Act and the California Privacy Rights Act (collectively, “CCPA”) provides California residents with the following specific rights regarding their personal information:

The Right to Know/Access:
Under CCPA you have the right to request that we disclose information to you about our collection, use, sale, disclosure for business purposes and share of personal information. Once we receive and confirm your request, we will disclose to you:

- The categories of personal information we collected about you.
- The categories of sources for the personal information we collected about you.
- Our business or commercial purposes for collecting or selling that personal information.
- The categories of third parties with whom we share that personal information.
- The specific pieces of personal information we collected about you.
- If we disclosed your personal information for a business purpose, we will disclose to you the personal information categories disclosed.

The Right to Opt-Out of Sharing of Personal Information:
You have a right to opt-out from the “sharing” of your personal information with third parties who are not our service providers.

The Right to Correct Personal Information:
You have the right to correct or rectify any inaccurate personal information about you that we collected. Once we receive and confirm your request, we will use commercially reasonable efforts to correct (and direct our service providers to correct, if applicable) your personal information, unless an exception applies.

The Right to Delete Personal Information:
You have the right to request the deletion of your personal information under certain circumstances, subject to certain exceptions. Once we receive and confirm your request, we will delete (and direct our service providers to delete, if applicable) your personal information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service providers to:
- Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
- Debug products to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
- Comply with the California Electronic Communications Privacy Act.
- Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
- Comply with a legal obligation.
- Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

The Right to Non-Discrimination:
You have the right not to be discriminated against for exercising any of your consumer's rights, including by:
- Denying goods or services to you.
- Charging different prices or rates for goods or services, including the use of discounts or other benefits or imposing penalties.
- Providing a different level or quality of goods or services to you.
- Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

BUSINESS TRANSFERS:

EXERCISING YOUR RIGHTS UNDER THE CCPA

You may exercise your rights under CCPA by contacting us at privacy@MetroSCG.com. Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable request related to your personal information.

Your request to us must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with the required information if we cannot:

Verify your identity or authority to make the request; and
Confirm that the personal information relates to you.

We will disclose and deliver the required information free of charge within 45 days of receiving your verifiable request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary and with prior notice.

For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance.

DO NOT SELL MY PERSONAL INFORMATION

As defined in the CCPA, "sell" and "sale" includes making a consumer's personal information available to a third party for other valuable consideration. This means that we may have received some kind of benefit in return for sharing personal information, but not necessarily a monetary benefit.

We do not sell personal information as the term sell is commonly understood. We do allow service providers to use your personal information for the business purposes described in our Privacy Policy, and these may be deemed a sale under CCPA.

You have the right to opt-out of the sale of your personal information. Once we receive and confirm a verifiable consumer request from you, we will stop “selling” (sharing) your personal information. To exercise your right to opt-out, please contact us.

SHINE THE LIGHT PRIVACY RIGHTS

Under California's Shine the Light law, California residents can opt out of our sharing of their information to third parties, and in certain circumstances affiliates, for their direct marketing purposes.

If you'd like to request more information under the California Shine the Light law or opt-out of such sharing, please contact us.

5. RIGHTS FOR COLORADO AND CONNECTICUT RESIDENTS

This privacy notice section for Colorado and Connecticut residents supplements the information contained in our Privacy Policy and it applies solely to all visitors, users, and others who reside in the States of Colorado Connecticut.

NOTICE AT COLLECTION

RIGHTS UNDER THE COLORADO PRIVACY ACT AND CONNECTICUT DATA PRIVACY ACT

The Colorado Privacy Act (“CPA”) and Connecticut Data Privacy Act (“CTDPA”) provide, respectively, Colorado and Connecticut residents with the following specific rights regarding their personal information:

The Right to Opt-Out:
Under the CPA you have the right to opt-out of the processing of your personal information for the purposes of targeted advertising, the sale of your personal information, or profiling in furtherance of decisions that produce legal or similarly significant effects.

The Right of Access to Personal Information:
You have the right to confirm whether we are processing your personal information and to access such personal information.

The Right to Correct Personal Information:
You have the right to correct or rectify any inaccurate personal information about you that we collected. Once we receive and confirm your request, we will use commercially reasonable efforts to correct (and direct our service providers to correct, if applicable) your personal information, unless an exception applies.

The Right to Delete Personal Information:
You have the right to request the deletion of your personal information under certain circumstances, subject to certain exceptions. Once we receive and confirm your request, we will delete (and direct our service providers to delete, if applicable) your personal information from our records, unless an exception applies.

The Right to Personal Information Portability:
You have the right to obtain your personal information from us in a portable, and to the extent technically feasible, readily usable format that allows you to transmit your personal information to another entity, subject to certain exemptions.

The Right to Non-Discrimination:
You have the right not to be discriminated against for exercising any of your consumer's rights, including by:
- Denying goods or services to you.
- Charging different prices or rates for goods or services, including the use of discounts or other benefits or imposing penalties.
- Providing a different level or quality of goods or services to you.
- Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

EXERCISING YOUR RIGHTS UNDER THE CPA AND CTDPA

You may exercise your rights under CPA or CTDPA by contacting us at privacy@MetroSCG.com.

Your request to us must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with the required information if we cannot:

Verify your identity or authority to make the request; and
Confirm that the personal information relates to you.

DO NOT SELL MY PERSONAL INFORMATION

As defined in the CPA and CTDPA, "sell" and "sale" includes making a consumer's personal information available to a third party for other valuable consideration. This means that we may have received some kind of benefit in return for sharing personal information, but not necessarily a monetary benefit.

APPEALS

Should we deny your rights request, and after an appeal you disagree or have concerns about the results of the appeal, you may contact your State Attorney General via the following:

Colorado:
- Instructions how to file a data privacy complaint with the Colorado State Attorney general can be found here.
Connecticut:
- Instructions how to file a data privacy complaint with the Colorado State Attorney general can be found here.

6. RIGHTS FOR VIRGINIA RESIDENTS

This privacy notice section for Virginia residents supplements the information contained in our Privacy Policy and it applies solely to all visitors, users, and others who reside in the State of Virginia.

NOTICE AT COLLECTION

RIGHTS UNDER THE VIRGINIA CONSUMER DATA PRIVACY ACT

The Virginia Consumer Data Privacy Act (“VDCPA”) provides Virginia residents with the following specific rights regarding their personal information:

The Right to Opt-Out:
Under the VDCPA you have the right to opt-out of the processing of your personal information for the purposes of targeted advertising, the sale of your personal information, and profiling in advancing of decisions that produce legal or similarly significant effects.

The Right of Access to Personal Information:
You have the right to confirm whether we are processing your personal information and to access such personal information.

The Right to Correct Personal Information:
You have the right to correct any inaccurate personal information about you that we collected, considering the nature of the personal information and the purposes of processing. Once we receive and confirm your request, we will use commercially reasonable efforts to correct (and direct our service providers to correct, if applicable) your personal information.

The Right to Delete Personal Information:
You have the right to request the deletion of your personal information. Once we receive and confirm your request, we will delete (and direct our service providers to delete, if applicable) your personal information from our records, unless an exception applies.
The Right to Personal Information Portability:
You have the right to obtain your personal information from us in a portable, and to the extent technically feasible, readily usable format that allows you to transmit your personal information to another entity, subject to certain exemptions.

EXERCISING YOUR RIGHTS UNDER THE VDCPA

You may exercise your rights under VDCPA by contacting us at privacy@MetroSCG.com.

Your request to us must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with the required information if we cannot:

Verify your identity or authority to make the request; and
Confirm that the personal information relates to you.

APPEALS

Should we deny your rights request, and after an appeal you disagree or have concerns about the results of the appeal, you can find instructions on how to file a data privacy complaint with the Virginia State Attorney General here.

7. RIGHTS IN THE HONG KONG SPECIAL ADMINISTRATIVE REGION

This section is made by Metro in accordance with the Personal Data (Privacy) Ordinance (“PDPO”) of the Hong Kong Special Administrative Region. The section is intended to notify you why personal data is collected, how it will be used and to whom data access requests are to be addressed and applies solely in Hong Kong.

NOTICE AT COLLECTION

RIGHTS UNDER THE PDPO

You have the right under this Privacy Policy, and by law if you are within the Hong Kong Special Administrative Region, to:

Request whether we hold personal information about you and request such data.

Require us to correct any data relating to you which is inaccurate.

EXERCISING YOUR RIGHTS UNDER THE PDPO

You may exercise your rights of access and rectification by contacting us at privacy@MetroSCG.com. Please note that we may ask you to verify your identity before responding to such requests. If you make a request, we will try our best to respond to you as soon as possible.

8. CHILDREN’s PRIVACY

Metro’s website is intended for a general audience and is not directed at children under 13 years of age. We do not knowingly collect personal information from anyone under the age of 13. If you are a parent or guardian and you believe we have collected information from your child in a manner not permitted by law, contact us. We will remove the data to the extent required by applicable laws.

9. HOW TO CONTACT METRO

If you would like to know more about our privacy practices or if you would like to exercise certain rights under this policy, please contact our Privacy Officer by:

Email: privacy@MetroSCG.com
Mail:
- 2000-1002 Sherbrooke Street West, Montreal, QC, H3A 3L6 CANADA

Company Overview

Solutions Overview

Industries Overview

What can we help you find?

Privacy Policy

KEEPING YOUR INFORMATION UPDATED