Privacy Policy

1. Introduction

Hilo Mirrors Inc. (“Hilo Mirrors,” “we,” “our,” or “us”) is a Canadian custom mirrors and glass manufacturer headquartered in the province of Quebec, Canada. We serve hotels, residential developments, senior living facilities, and commercial projects across Canada, the United States, and internationally.

This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal information when you visit our website at hilomirrors.com (the “Website”), use our online quote form, communicate with our team, or otherwise interact with our services (collectively, the “Services”).

We are committed to protecting your privacy in accordance with all applicable privacy legislation, including but not limited to:

• Quebec: An Act Respecting the Protection of Personal Information in the Private Sector (Quebec Privacy Act), as amended by Law 25 (Bill 64)
• Canada:Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL)
• United States: California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA); Virginia Consumer Data Protection Act (VCDPA); Colorado Privacy Act (CPA); Connecticut Data Privacy Act (CTDPA); and other applicable state laws
• European Union / International: General Data Protection Regulation (GDPR) where applicable to data subjects located in the EEA/UK

By using our Website or Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please do not use our Services.

2. Definitions

In this Privacy Policy, the following terms have the following meanings:

• “Personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable individual.
• “Processing” means any operation performed on personal information, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, erasure, or destruction.
• “Consent”means any freely given, specific, informed, and unambiguous indication of a data subject's wishes by which they signify agreement to the processing of personal information relating to them.
• “Data Subject” or “You” means any natural person whose personal information is being processed.
• “Service Provider” means any third party that processes personal information on behalf of Hilo Mirrors.

3. Person Responsible for the Protection of Personal Information

In accordance with Quebec Law 25, Hilo Mirrors has designated a Person Responsible for the Protection of Personal Information (the “Privacy Officer”). The Privacy Officer is responsible for ensuring compliance with applicable privacy legislation and handling all privacy-related inquiries and complaints.

Privacy Officer Contact:

Hilo Mirrors Inc.
Attention: Privacy Officer
Email: privacy@hilomirrors.com
Phone: 1-800-877-9955
Mailing address available upon request.

4. Information We Collect

4.1 Information You Provide Directly

We collect personal information that you voluntarily provide to us, including when you:

• Complete our online project quote form
• Contact us via email, phone, or live chat
• Subscribe to our newsletter or marketing communications
• Enter into a business relationship with us
• Submit documents, plans, or specifications for project quoting

The categories of personal information we collect directly include:

• Identity information: Full name, job title, professional role
• Contact information: Email address, phone number, mailing address
• Business information: Company name, project type, project scope, number of units, budget range, timeline
• Project specifications: Product selections, dimensions, features, design preferences, uploaded files (plans, specifications, reference images)
• Communication records: Content of messages, notes, and correspondence

4.2 Information Collected Automatically

When you visit our Website, we automatically collect certain technical information through cookies, web beacons, pixels, and similar technologies, including:

• Device information: Browser type and version, operating system, device type, screen resolution, language preference
• Usage information: Pages visited, time spent on pages, click patterns, scroll depth, referring URL, exit pages
• Network information: IP address (anonymized where required by law), approximate geographic location (city-level)
• Form interaction data: Partial form entries captured during the quote process to improve user experience and prevent data loss (see Section 4.3)

4.3 Partial Form Data Capture

Our quote form includes a partial data capture feature that temporarily saves information you enter (such as your name, email, phone number, and company name) in your browser's session storage as you type. This serves two purposes:

• Data recovery:If you accidentally navigate away from the form or your browser session is interrupted, your progress is preserved so you don't need to start over.
• Lead capture: If you begin filling out the form but do not complete it, the partially entered information may be logged for follow-up purposes, subject to your consent.

This data is stored locally in your browser (session storage) and is automatically cleared when you close your browser tab or successfully submit the form. You may clear this data at any time by clearing your browser's session storage or site data.

4.4 Information from Third Parties

We may receive personal information from third-party sources, including:

• Business partners or referral sources who provide your contact information with your knowledge
• Publicly available business directories and professional networks
• Analytics providers and advertising networks

5. How We Use Your Information

We use your personal information for the following purposes:

5.1 Service Delivery

• To process and respond to your project quote requests
• To provide personalized pricing and product recommendations
• To assign a dedicated project manager to your account
• To communicate about project specifications, timelines, and deliverables
• To fulfill orders and manage business relationships

5.2 Business Operations

• To prioritize and score leads based on project scope and urgency (internal use only)
• To improve our products, services, and customer experience
• To conduct internal analytics and market research
• To train and improve our team's responsiveness

5.3 Communications

• To send you project-related communications (quotes, updates, confirmations)
• To respond to your inquiries and provide customer support
• To send marketing communications where you have provided consent (you may opt out at any time)

5.4 Legal & Compliance

• To comply with applicable laws, regulations, and legal processes
• To protect our rights, privacy, safety, or property
• To enforce our terms and conditions
• To detect and prevent fraud, security incidents, or illegal activities

5.5 Website Improvement

• To analyze Website usage patterns and improve user experience
• To conduct A/B testing and optimize conversion rates
• To diagnose technical problems and maintain Website security

6. Legal Bases for Processing

We process your personal information based on one or more of the following legal bases, depending on the jurisdiction and context:

• Consent: Where you have given clear consent for us to process your personal information for a specific purpose (e.g., submitting the quote form, subscribing to communications).
• Contractual necessity: Where processing is necessary for the performance of a contract with you or to take pre-contractual steps at your request.
• Legitimate interests: Where processing is necessary for our legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms (e.g., lead scoring, analytics, fraud prevention).
• Legal obligation: Where processing is necessary to comply with applicable laws or regulations.

7. Cookies and Tracking Technologies

7.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They help websites remember your preferences and improve your browsing experience.

7.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Website to function properly (e.g., session management, security tokens, form state preservation). These cannot be disabled.
• Performance/Analytics Cookies: Help us understand how visitors interact with our Website by collecting anonymous usage data (e.g., Google Analytics with IP anonymization enabled).
• Functional Cookies: Remember your preferences (e.g., language, theme, form progress) to provide a more personalized experience.
• Marketing Cookies: Used to track visitors across websites to display relevant advertisements. We only use these with your explicit consent.

7.3 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling certain cookies may affect the functionality of our Website, including the ability to save your form progress.

For Quebec residents: In accordance with Law 25, we obtain your consent before placing non-essential cookies on your device, except where an exception applies under the legislation.

8. Data Sharing and Disclosure

We do not sell your personal information. We do not rent, trade, or otherwise make your personal data available to third parties for their own marketing purposes.

We may share your personal information with the following categories of recipients:

8.1 Service Providers

We engage trusted third-party service providers to assist us in operating our business. These providers process personal information solely on our behalf and under our instructions:

• Cloud hosting and infrastructure providers (servers located in Canada and/or the United States)
• Customer relationship management (CRM) systems
• Email delivery and communication platforms
• Analytics and website optimization tools
• Payment processors (for transactional purposes only)

All service providers are bound by contractual obligations to maintain the confidentiality and security of your personal information and to process it only for the purposes for which it was disclosed.

8.2 Legal Requirements

We may disclose your personal information if required to do so by law or in response to:

• A court order, subpoena, or other legal process
• A request from a government authority or regulatory body
• An investigation of suspected fraud, illegal activity, or violations of our policies

8.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity. We will provide notice before your personal information becomes subject to a different privacy policy.

8.4 With Your Consent

We may share your personal information with third parties when you have given us explicit consent to do so.

9. International Data Transfers

As a Canadian company serving clients across North America and internationally, your personal information may be processed and stored in Canada, the United States, or other jurisdictions where our service providers maintain facilities.

When personal information is transferred outside of Quebec or Canada, we ensure appropriate safeguards are in place, including:

• Contractual clauses requiring the recipient to provide a level of protection equivalent to that provided under Quebec and Canadian law
• Privacy impact assessments conducted prior to international transfers (as required by Law 25)
• Standard contractual clauses approved by relevant authorities (for GDPR transfers)
• Certification under recognized privacy frameworks

By using our Services, you acknowledge and consent to the transfer of your personal information to jurisdictions that may have different privacy laws than your jurisdiction of residence.

10. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, plus any additional period required by applicable law. Our retention periods are determined based on:

• The nature and sensitivity of the personal information
• The purposes for which we process the information
• Applicable legal, regulatory, and contractual requirements
• Our legitimate business needs (e.g., maintaining records for warranty purposes)

General retention periods:

• Quote requests (not converted to orders): Up to 24 months from the date of submission, then anonymized or deleted
• Customer records (active business relationship): Duration of the business relationship plus 7 years (for tax and legal purposes)
• Marketing consent records: Until consent is withdrawn, plus a reasonable period to process the withdrawal
• Website analytics data: Up to 26 months (anonymized/aggregated data may be retained indefinitely)
• Partial form capture data (session storage): Automatically deleted when the browser tab is closed

When personal information is no longer needed, we securely delete or anonymize it using industry-standard methods.

11. Data Security

We implement appropriate technical, administrative, and physical security measures to protect your personal information against unauthorized access, alteration, disclosure, loss, or destruction. These measures include:

• Encryption: All data transmitted between your browser and our servers is protected by 256-bit SSL/TLS encryption (HTTPS)
• Access controls: Personal information is accessible only to authorized personnel on a need-to-know basis, with role-based access controls and multi-factor authentication
• Infrastructure security: Our hosting environment employs firewalls, intrusion detection systems, and regular security audits
• Employee training: All team members with access to personal information receive regular privacy and security awareness training
• Incident response: We maintain an incident response plan for prompt detection, reporting, and remediation of any privacy breach
• Vendor security assessments: We evaluate the security practices of our service providers before engaging them

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

12. Your Rights

Depending on your jurisdiction of residence, you may have some or all of the following rights regarding your personal information:

12.1 Rights Under Quebec Law (Law 25)

• Right to access: You have the right to request access to the personal information we hold about you, including the categories of information, the purposes of processing, and any third parties to whom it has been disclosed.
• Right to rectification: You have the right to request correction of inaccurate or incomplete personal information.
• Right to deletion: You have the right to request deletion of your personal information where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
• Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Right to portability: You have the right to receive your personal information in a structured, commonly used, machine-readable format (as of September 2024 under Law 25).
• Right to be informed of automated decision-making: You have the right to be informed if automated decision-making is used and to provide observations.
• Right to de-indexation: You have the right to request that links to your personal information be de-indexed from search engines where the dissemination contravenes the law or a court order.

12.2 Rights Under PIPEDA (Canada)

• Right to know what personal information we hold about you
• Right to access your personal information
• Right to challenge the accuracy and completeness of information
• Right to withdraw consent (subject to legal or contractual restrictions)
• Right to file a complaint with the Office of the Privacy Commissioner of Canada

12.3 Rights Under CCPA/CPRA (California Residents)

• Right to know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to correct: You have the right to request correction of inaccurate personal information.
• Right to opt out: You have the right to opt out of the sale or sharing of personal information. Note: We do not sell personal information.
• Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.
• Right to limit use of sensitive personal information: You may limit our use of sensitive personal information to what is necessary for providing Services.

12.4 Rights Under GDPR (EEA/UK Residents)

• Right to access (Article 15)
• Right to rectification (Article 16)
• Right to erasure / “Right to be forgotten” (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object to processing (Article 21)
• Rights related to automated decision-making and profiling (Article 22)
• Right to lodge a complaint with a supervisory authority

12.5 Rights Under Other U.S. State Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with comprehensive privacy legislation may have similar rights including access, correction, deletion, data portability, and the right to opt out of targeted advertising, sale of personal information, and profiling.

12.6 Exercising Your Rights

To exercise any of the above rights, please contact our Privacy Officer using the contact information provided in Section 3. We will respond to your request within the timeframes required by applicable law:

• Quebec Law 25: Within 30 days (extendable by 30 days with notice)
• PIPEDA: Within 30 days
• CCPA/CPRA: Within 45 days (extendable by 45 days with notice)
• GDPR: Within one month (extendable by two months with notice)

We may need to verify your identity before processing your request. If we are unable to verify your identity, we may ask for additional information.

13. Automated Decision-Making and Lead Scoring

Our quote form uses an internal lead scoring algorithm to prioritize project inquiries based on factors such as project size, timeline, and product selections. This scoring is used solely for internal project management and resource allocation purposes and does not result in any decision that produces legal effects or similarly significantly affects you.

The lead score does not affect the quality of service you receive, the pricing you are offered, or your ability to access our Services. All customers receive the same high standard of professional service regardless of their lead score.

If you have questions about how automated processing is used in connection with your data, please contact our Privacy Officer.

14. Children's Privacy

Our Services are directed exclusively to business professionals and are not intended for individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children or minors. If we become aware that we have inadvertently collected personal information from a child, we will promptly delete such information.

If you are a parent or guardian and believe that your child has provided us with personal information, please contact us using the information in Section 3.

15. Marketing Communications

We may send you marketing communications about our products, services, promotions, and industry insights only where:

• You have provided your express consent (opt-in) as required by CASL, or
• An implied consent exception applies (e.g., existing business relationship within the past two years), or
• Your jurisdiction permits marketing communications based on legitimate interests with an opt-out mechanism

Opting out: You may opt out of marketing communications at any time by:

• Clicking the “unsubscribe” link in any marketing email
• Contacting us at privacy@hilomirrors.com
• Replying “STOP” to any SMS marketing message

Please note that opting out of marketing communications will not affect transactional or service-related communications (e.g., quote confirmations, project updates).

16. Do Not Track Signals

Some web browsers transmit “Do Not Track” (DNT) signals to websites. We honor DNT signals and do not track, plant cookies, or use advertising when a DNT browser mechanism is in place. We also honor the Global Privacy Control (GPC) signal as an opt-out of sale/sharing under applicable U.S. state privacy laws.

17. Third-Party Links and Services

Our Website may contain links to third-party websites, services, or applications that are not operated by us. This Privacy Policy does not apply to such third-party services. We encourage you to review the privacy policies of any third-party websites you visit.

We are not responsible for the privacy practices, content, or security of any third-party websites or services.

18. Privacy Breach Notification

In the event of a privacy breach involving your personal information that creates a real risk of significant harm, we will:

• Notify affected individuals as soon as feasible, providing details about the breach, potential consequences, and measures we have taken or recommend taking
• Report to relevant authorities:Commission d'accès à l'information du Québec (CAI), Office of the Privacy Commissioner of Canada (OPC), and any other applicable regulatory body
• Document the breach in our internal breach register, including an assessment of harm, remedial measures, and prevention strategies

We maintain an incident response plan that includes procedures for assessing, containing, and remediating privacy breaches in accordance with the timelines prescribed by Quebec Law 25, PIPEDA, and other applicable legislation.

19. Privacy Impact Assessments

In accordance with Quebec Law 25, we conduct Privacy Impact Assessments (PIAs) before:

• Implementing any new information system or project involving personal information
• Transferring personal information outside Quebec
• Making significant changes to our data processing activities
• Engaging new service providers who will process personal information on our behalf

These assessments evaluate the necessity, proportionality, and risks of the proposed processing activities and identify appropriate mitigation measures.

20. Accessibility

We are committed to making this Privacy Policy accessible to all individuals, including those with disabilities. If you require this policy in an alternative format (e.g., large print, audio, Braille, or simplified language), please contact our Privacy Officer.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last updated” date at the top of this page
• Provide prominent notice on our Website (e.g., a banner or notification) for significant changes
• Where required by law, obtain your renewed consent before applying changes that affect how we process your personal information

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

22. Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of the province of Quebec and the federal laws of Canada applicable therein, without regard to conflicts of law principles. Any dispute arising from or relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of the province of Quebec, Canada.

Notwithstanding the foregoing, nothing in this section shall limit your rights under applicable privacy legislation in your jurisdiction of residence to file a complaint with your local data protection authority.

23. Complaints

If you are not satisfied with our response to a privacy-related inquiry or believe that your personal information is being handled in a manner inconsistent with this Privacy Policy or applicable law, you may file a complaint with:

• Our Privacy Officer (see Section 3 for contact details) — we will investigate and respond within 30 days
• Commission d'accès à l'information du Québec (CAI): www.cai.gouv.qc.ca
• Office of the Privacy Commissioner of Canada (OPC): www.priv.gc.ca
• Your local data protection authority (for residents outside Canada)

24. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Hilo Mirrors Inc.
Attention: Privacy Officer
Email: privacy@hilomirrors.com
General inquiries: info@hilomirrors.com
Phone: 1-800-877-9955

We aim to respond to all privacy-related inquiries within 30 calendar days. If additional time is required due to the complexity of your request, we will notify you of the extension and the reason for it.

25. Supplemental Notices

25.1 Notice to Quebec Residents

This Privacy Policy is designed to comply with An Act Respecting the Protection of Personal Information in the Private Sector, as amended by Law 25 (formerly Bill 64). As a Quebec-based organization, we are subject to the jurisdiction of the Commission d'accès à l'information du Québec (CAI). Our designated Person Responsible for the Protection of Personal Information can be reached using the contact information in Section 3.

25.2 Notice to California Residents

This section supplements the information in our Privacy Policy and applies solely to visitors, users, and others who reside in the State of California, pursuant to the CCPA as amended by the CPRA.

Categories of personal information collected in the past 12 months:

• Identifiers (name, email, phone number, IP address)
• Commercial information (project details, product interests, quotes requested)
• Internet/network activity (browsing history on our Website, interaction with our form)
• Professional/employment information (company name, job title, role)
• Inferences drawn from the above (lead score, project priority)

We do not sell or share personal information as defined under the CCPA/CPRA.

California residents may exercise their rights by contacting us as described in Section 12.6. You may also designate an authorized agent to make a request on your behalf.

25.3 Notice to EEA/UK Residents

If you are located in the European Economic Area or the United Kingdom, Hilo Mirrors Inc. is the data controller responsible for your personal information. Where we process your data based on legitimate interests, you have the right to object. For cross-border transfers, we rely on standard contractual clauses or other approved transfer mechanisms.

Document version: 3.0
Effective date: May 28, 2026
Previous version date: February 2026
Next scheduled review: May 2027