GetGreenline ULC

Privacy Policy

Effective Date: July 6, 2026  |  GetGreenline ULC  |  3400, 350 – 7th Ave S.W., Calgary, AB  T2P 3N9

This Privacy Policy describes how GetGreenline ULC (“GetGreenline,” “we,” “our,” or “us”) collects, uses, discloses, and retains personal information in connection with the Greenline Platform, BLAZE Brands, and our website at getgreenline.co. This policy applies to licensed cannabis retailers (“Retail Partners”), licensed cannabis brand advertisers (“Brand Partners”), consumers who purchase cannabis at Greenline-powered retail locations, and visitors to our website.

1.  Our Privacy Framework — PIPEDA’s 10 Fair Information Principles

GetGreenline’s privacy practices are built on the 10 Fair Information Principles established under PIPEDA and mirrored in Alberta PIPA and BC PIPA. We apply the most stringent applicable standard in any given circumstance.

2.  Information We Collect and How We Use It

2.1  Retail Partners (Licensed Cannabis Retailers)

When a licensed cannabis retailer creates a Greenline account, we collect account and contact information, cannabis retail licensing details, payment and billing information, platform usage data, and support communications. We use this information to provide and operate the Greenline Platform, process payments, verify cannabis licensing compliance, communicate service updates, and enforce our Terms and Conditions.

For Retail Partners enrolled in BLAZE Brands, we also collect consumer transaction data as described in the BLAZE Brands Retail Partner Addendum and Data Use Agreement. That data use is governed by the Addendum and the express consent provided through Order Form execution.

2.2  Brand Partners (Licensed Cannabis Brand Advertisers)

When a licensed cannabis brand creates a BLAZE Brands account, we collect account and contact information (business name, contact name, work email, work phone), cannabis licensing details, payment and billing information, campaign configurations, creative assets, and platform usage data. We use this information to deliver BLAZE Brands platform services, process campaign billing, provide analytics outputs, verify licensing, and enforce the Brand Partner Terms of Service.

Brand Partner account data — including campaign configurations, creative assets, and billing records — may be stored and processed on servers located in the United States as described in Section 6. Brand Partner account contact information (name, work email, work phone) is collected and used for the purpose of professional communication and platform administration and is exempt from PIPEDA’s personal information provisions under Section 4.01 (business contact information exemption) to the extent it is used solely for those purposes.

2.3  Consumers

When a consumer purchases cannabis at a Greenline-powered retailer, uses the retailer’s loyalty program, or transacts through a Greenline-powered e-commerce storefront, GetGreenline processes certain personal information on behalf of the retailer as a data processor. The retailer is the data controller for consumer personal information. GetGreenline processes consumer personal information only at the retailer’s direction and for the purposes for which it was originally collected. Consumers should refer to their retailer’s privacy policy for the primary disclosure of how their personal information is handled.

Key categories of consumer personal information processed by GetGreenline on behalf of retailers include: name, date of birth and age verification records, purchase transaction records, loyalty program data, delivery address, and device and session data for online menu interactions. See Section 3 (Data Inventory) for server locations and retention periods for each category.

3.  Data Inventory — Categories, Locations, and Retention

⚠ indicates data stored and processed on servers in the United States by GetGreenline’s third-party cloud infrastructure provider. See Section 6 for full cross-border transfer disclosure.

4.  Consent and Legal Basis for Processing

4.1  Consent Bases

GetGreenline relies on the following consent bases for different categories of processing:

• Implied consent for platform operation. Collection and use of retailer and consumer personal information necessary to operate the Greenline Platform is implied from the retailer’s agreement to our Terms and Conditions and the consumer’s use of the retailer’s services. This consent covers all processing in Canada.
• Express consent for cross-border processing of loyalty and e-commerce data. Because loyalty program and e-commerce personal information is processed in the United States, GetGreenline obtains express consent from consumers through an at-collection notice at or before the time of sign-up, as required by Alberta PIPA Section 13.1. This notice identifies the United States as the processing location, describes the purposes of processing, names our Privacy Officer as the contact for questions, and discloses the risk of foreign government access. Consumers may decline this consent but will not be able to use the loyalty or e-commerce features.
• Express consent for BLAZE Brands data use. Retail Partners enrolled in BLAZE Brands provide express consent through Order Form execution as described in the BLAZE Brands Retail Partner Addendum.

4.2  Withdrawal of Consent

Consumers may withdraw consent to cross-border processing of their loyalty or e-commerce personal information at any time by contacting the relevant retailer or GetGreenline at privacy@getgreenline.co. Withdrawal is prospective. Records subject to mandatory cannabis regulatory retention cannot be deleted upon withdrawal during the applicable retention period. Withdrawal from loyalty or e-commerce processing does not affect the consumer’s ability to purchase cannabis in-store.

5.  Sharing of Personal Information

GetGreenline does not sell personal information. We share personal information in the following circumstances:

• We use third-party service providers to assist in delivering the Greenline Platform, including cloud infrastructure providers, payment processors, and support tools. All service providers are bound by data processing agreements requiring them to maintain comparable privacy protections and to process personal information only for authorized purposes. A list of our current subprocessors is available on request from privacy@getgreenline.co.
• Loyalty program data and e-commerce personal information is processed by GetGreenline’s US-based cloud infrastructure provider as described in Section 6. This provider processes data on GetGreenline’s behalf only and may not use it for its own purposes.
• Anonymized, aggregated consumer transaction data is used to generate Brand Partner analytics outputs and may be sold to third parties as market intelligence as described in the BLAZE Brands Retail Partner Addendum. These outputs do not contain personal information.
• We may disclose personal information to regulatory authorities, law enforcement, or courts when required by the Cannabis Act, Alberta PIPA, PIPEDA, or other applicable law, or to protect GetGreenline’s legal rights.
• In connection with a merger, acquisition, or sale of all or substantially all of GetGreenline’s assets, personal information may be transferred to the successor entity. Retail Partners and consumers will be notified in advance.

6.  Cross-Border Data Transfers — Alberta PIPA Section 13.1 Disclosure

6.1  What Data Is Transferred Outside Canada

GetGreenline uses a US-based third-party cloud infrastructure provider to store and process the following categories of personal information outside Canada: loyalty program enrollment and transaction data; e-commerce account information, order history, and online menu interaction data; and certain platform usage and operational data. The specific categories and server locations are set out in the Data Inventory table in Section 3.

Personal information relating to cannabis point-of-sale transactions and age verification records, BLAZE Brands anonymized analytics outputs, and retailer cannabis licensing records are stored and processed exclusively on servers located in Canada.

6.2  Country of Transfer

Personal information identified as stored in the United States in the Section 3 data inventory is processed by servers located in the United States of America. GetGreenline does not transfer personal information to any other foreign jurisdiction in connection with its platform operations.

6.3  Purpose of Transfer

Personal information is transferred to the US-based cloud infrastructure provider solely for the purpose of operating and maintaining the Greenline Platform, including loyalty program administration, e-commerce transaction processing, platform performance monitoring, and related technical operations. The US-based provider is not permitted to use personal information for any other purpose.

6.4  Protections in Place

GetGreenline takes the following steps to protect personal information transferred to its US-based infrastructure provider:

• GetGreenline has entered into a Data Processing Agreement with its US cloud infrastructure provider requiring the provider to: process personal information only for authorized purposes; maintain security standards comparable to those required by Alberta PIPA and PIPEDA; notify GetGreenline of any security incidents within 72 hours; provide GetGreenline with audit rights; and comply with applicable privacy laws to the extent possible.
• Personal information in transit is encrypted using TLS. Data at rest is encrypted using AES-256 or equivalent. Access controls limit access to authorized personnel.
• GetGreenline remains accountable for personal information in the hands of its US-based provider. GetGreenline will investigate and respond to complaints about the provider’s handling of personal information.

6.5  Foreign Government Access — CLOUD Act Disclosure

6.6  Privacy Officer Contact for Cross-Border Transfer Questions

As required by Alberta PIPA Section 13.1, the following individual is designated to respond to questions about GetGreenline’s cross-border data transfer policies and practices:

7.  Data Security

GetGreenline maintains an information security program designed to protect personal information against unauthorized access, disclosure, alteration, destruction, or loss. Our safeguards include encryption of data in transit (TLS) and at rest (AES-256 or equivalent), access controls based on least-privilege principles, two-factor authentication for system access, regular vulnerability assessments and penetration testing, incident response procedures, and vendor management controls requiring comparable security from all subprocessors.

In the event of a privacy breach posing a real risk of significant harm, GetGreenline will notify the applicable privacy commissioner (OPC, OIPC Alberta, or OIPC BC) and, where required, affected individuals. GetGreenline maintains records of all privacy breaches as required by applicable law.

8.  Data Retention

GetGreenline retains personal information only as long as necessary for the identified purposes or as required by law. Key retention periods are set out in the data inventory table in Section 3. Cannabis transaction records are subject to mandatory minimum retention periods of two years under federal Cannabis Regulations and three years under the Ontario AGCO Registrar’s Standards. These records cannot be deleted upon request during applicable retention periods. Following expiry of mandatory retention periods, personal information is securely deleted or irreversibly anonymized.

9.  Your Privacy Rights

Under PIPEDA, Alberta PIPA, and BC PIPA, individuals have the following rights with respect to their personal information held by GetGreenline:

• Right to access your personal information and be informed of how it is used and disclosed.
• Right to request correction of inaccurate or incomplete personal information.
• Right to withdraw consent, subject to legal or contractual restrictions. Note that cannabis transaction records cannot be deleted during mandatory regulatory retention periods.
• Right to lodge a complaint with GetGreenline’s Privacy Officer, and thereafter with the applicable privacy commissioner.

To exercise any of these rights, contact privacy@getgreenline.co or write to the Privacy Officer at 3400, 350 – 7th Avenue S.W., Calgary, Alberta T2P 3N9. GetGreenline will respond within thirty (30) days of receiving a verifiable request.

10.  Privacy Complaints and Regulatory Contacts

If you have a concern about GetGreenline’s privacy practices that cannot be resolved with our Privacy Officer, you may escalate to the applicable privacy commissioner:

• Office of the Privacy Commissioner of Canada (OPC): www.priv.gc.ca | 1-800-282-1376 (Ontario and federal matters)
• Office of the Information and Privacy Commissioner of Alberta (OIPC Alberta): www.oipc.ab.ca | (780) 422-6860 or 1-888-878-4044
• Office of the Information and Privacy Commissioner for British Columbia (OIPC BC): www.oipc.bc.ca | 1-800-663-7867

11.  Changes to This Policy and Language

GetGreenline may update this Privacy Policy from time to time. Material changes will be notified by email to Retail Partners and by posting the updated policy at getgreenline.co/privacy at least thirty (30) days before the effective date. Continued use of the Greenline Platform after the effective date constitutes acceptance of the updated policy.

This policy is drafted in English. Les parties ont convenu que la présente politique soit rédigée en anglais. In the event of any inconsistency between an English version and any translated version, the English version governs.