Privacy Statement Effective: December 17, 2018 Cronos Group Inc. and its subsidiaries and affiliates (collectively “Cronos Group”, “We”, or “Our”) are committed to respecting your privacy. This Privacy Statement is intended to answer your important questions about our privacy practices, whether you are looking for information or are mining the experience of Cronos Group to refine your expertise in meeting the needs of your patients. This Privacy Statement is incorporated into and made a part of our Terms of Use Agreement (the “Terms of Use”). If you have not done so already, please also review Cronos Group’s Terms of Use. The Terms of Use contain provisions that limit Cronos Group’s liability to users of the Services. This Privacy Statement applies to all Cronos Group online or digital services activities, including, but not limited to our websites (collectively, the “Site”) and digital services (“Services”) in which they are posted or linked. For each of: www.TheCronosGroup.com, www.PeaceNaturals.com, www.OriginalBC.com, www.CoveCannabis.ca, www.SpinachCannabis.com, Cronos Group is the controller of any Personal Information that we collect on through your use of such Sites. Please carefully read this Privacy Statement to learn more about how we collect, use, disclose and store information provided and the steps we take to help protect the information provided from unauthorized use or disclosure. When you submit information to or through the Services, you consent to the collection, processing and retention of your information as described in this Privacy Statement. IF YOU DO NOT AGREE WITH ANY PART OF THIS PRIVACY STATEMENT, PLEASE DO NOT USE ANY OF THE SERVICES. Please note that this Privacy Statement does not apply to information collected through third-party websites or services that you may access through the Services. There is also a Client Privacy Policy that also applies to clients of Peace Naturals Project Inc. (“Peace Naturals”) , which can be found on the Peace Naturals Website, www.PeaceNaturals.com. Cronos Group may process personal information in global databases that can be accessed by authorized Cronos Group personnel worldwide. Personal information stored outside your country may be subject to access by law enforcement agencies or other third parties under applicable local laws. 1.INFORMATION WE COLLECT When you use the Services, we collect Personal Information and Usage Data. In this Privacy Statement, “Personal Information” means information about an identified or identifiable natural person. Personal Information includes: (1) contact data (such as e-mail address, telephone number and employer); (2) demographic data (such as gender, date of birth and postal code); and (3) certain Usage Data (defined below). Certain subsets of Personal Information, such as information about health or medical status and Location Data (defined below), are characterized as sensitive (collectively, “Sensitive Personal Information”) and may be subject to stricter regulation and consent requirements than other information. Before providing it to us, we urge you to carefully consider whether to disclose your Sensitive Personal Information. If you do provide Sensitive Personal Information to us, you consent to its use and disclosure for the purposes and in the manner described in this Privacy Statement. “Usage Data” is information about an individual’s activity on or through the Services that, by itself, does not identify the individual, such as browser type, operating system and webpages visited. We typically do not consider Usage Data as Personal Information because Usage Data by itself usually does not identify an individual. However, we treat Usage Data as Personal Information where required by law, or when combined with Personal Information. 2.HOW INFORMATION IS COLLECTED AND USED Cronos Group collects and uses information to operate the Services, including: Information That You Voluntarily Provide When Using the Services. We collect and use the Personal Information that you voluntarily provide to us through the Services. You may use certain Services without registering or identifying yourself but, if you do not register, you may not have access to all of the Services. If you choose to register, we may use the Personal Information you provide to confirm your registration and to respond to requests from you. Upon your request, we may also use the Personal Information to send you special promotions or newsletters with information that may interest you. If you are a healthcare professional or an institutional healthcare provider (collectively, “Providers”), you are responsible for obtaining any legally required authorization, consent or other permission from your patients prior to providing their Personal Information to Cronos Group through the Services. By submitting any Personal Information about a patient, you represent and warrant to Cronos Group that you have obtained all required permissions to do so. Through Your Use of Interactive Services. If you choose to participate in our questionnaires and surveys and other interactive Services, we will collect the information, including any Sensitive Personal Information that you share to help us better understand how our products are used by our customers. The information you provide through interactive Services may be combined (subject to all applicable laws) with the Personal Information provided elsewhere in or through the Services. We may combine your and others’ Personal Information to create summary data that we will use for our business purposes, such as research to improve our products and analyses that may help us better market our products. If you submit health-related Personal Information through the Services to participate in a clinical trial, we may use your Personal Information to assess whether you qualify for enrollment in the trial, to contact you about potential participation in the trial, and to provide you with additional information about the trial. You may provide information to be published or displayed (“Posted“) on public areas of the Services (collectively, “User Contributions“). Your User Contributions are Posted and made available publicly at your own risk. Cronos Group does not control the actions of third parties with access to your User Contributions. If you are a Provider and submit Personal Information through the Site or the Services about a study subject related to his or her participation in a clinical trial, that Personal Information will be processed in accordance with this Privacy Statement. If we determine that the potential study subject is eligible for the trial, we will use the information to contact you about his or her potential participation in the trial and to provide you with additional information. When you Correspond with Cronos Group about Cronos Group Products. If you contact Cronos Group through the Site or the Services or use the Services to ask questions or report problems regarding your experience in using one of our products, we may use the information you provide in submitting reports to Health Canada or other third parties as required by law. Subject to our obligations under applicable laws, we also may use the information to contact the prescribing physician to follow up regarding an event involving use of our product. Through Data Collection Tools. Cronos Group may also automatically collect information about use of the Services through data collection tools, such as web beacons and cookies. A “web beacon” is a piece of code that enables us to monitor user activity and website traffic. A “cookie” is a randomly-generated unique numeric code stored in the user’s web browser settings or computer’s hard drive. A cookie typically contains the name of the domain (internet location) from which the cookie originated, the “lifetime” of the cookie (i.e., when it expires), as well as the randomly generated unique numeric code. We use the information collected through data collection tools to monitor usage patterns, store information about user preferences and to improve the Services. For example, your Personal Information may be used to create customized offers, information and services tailored to your interests and preferences. We may track your activities over time and across third-party websites or other online services to display advertisements on third-party websites. If you do not want us to use your information in this way, please see “Your Privacy Choices” below. For more information about our digital advertising practices, please see “Digital Advertising” below. When you Connect with Social Media though the Services. Certain Services may link with social media platforms and social media plug-ins (e.g., the Facebook “Like” button, “Share to Twitter” button) (collectively, “Social Media”). When accessing the Services through a Social Media account, Cronos Group may (depending on the applicable user privacy settings) automatically have access to information provided to or through the Social Media platform. Cronos Group may collect and use this information for the purposes described in this Privacy Statement or at the time the information was collected. Through Service Providers. Third parties that assist us with our business operations also collect and use information (including Personal Information and Usage Data) through the Services and also may share the collected information with us. For example, our vendors collect and share information with us to analyze use of the Services, to help us detect and prevent fraud and to improve user experience. Some of our vendors may process or store Personal Information outside Canada, where that information may be subject to access by law enforcement agencies under applicable local laws. Cronos Group takes steps to ensure that our service providers adequately protect Personal Information and use it solely for the purposes of the service they are providing. 3.HOW INFORMATION IS SHARED AND DISCLOSED We may share and disclose information as described at the time information is collected and as follows: To Perform Services. We may use third parties to perform services requested or functions initiated by users. In addition, we may disclose Personal Information to identify a user in connection with communications sent through the Services. We also may offer users the opportunity to share information with friends and other users through the Services. With Cronos Group’s Third Party Contractors. We share information, including Personal Information, with our service providers to perform the functions for which we engage them, such as data analysis, system design and maintenance, customer services and for marketing and promotions. With Co-branding Partners. We may partner with other companies to provide you with content or services on a joint or “co-branded” basis. When websites or services are co-branded, you will see both the Cronos Group logo and the logo of our co-branding partner. When you register for a co-branded website or service, your registration information may be shared with one or more of Cronos Group’s co-branding partners. You may avoid sharing your information with Cronos Group’s partners on co-branded sites or service by choosing not to use them. Each cobranding partner will have its own privacy policy and its privacy practices may differ from this Privacy Statement. Social Media Plugins. When you use the Services, Social Media operators can place a cookie on your computer to recognize individuals who have previously visited the Services. If you are logged into a Social Media account while using the Services, the social plugins allow that Social Media to receive information that you have accessed and used the Services. The social plugins also allow the Social Media operator to share information about your activities in or through the Services with other Social Media users. For example, Facebook Social Plugins allows Facebook to show your Likes and comments on our pages to your Facebook friends. Facebook Social Plugins also allows you to see your friends’ Facebook activity through the Services. Cronos Group does not control any of the content from the Social Media plugins. For more information about Social Media plugins, please refer to the privacy statements and other legal notices of the Social Media platform. Legal Requirements. In certain circumstances, Cronos Group may release your Personal Information in response to a court order, subpoena, search warrant, regulation, binding order of a data protection agency, governmental request or other legal or regulatory process. Cronos Group may disclose information if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Cronos Group and our customers or others. Corporate Changes. We may transfer information, including your Personal Information, in connection with a merger, sale, acquisition, divestiture, restructuring, reorganization, dissolution, bankruptcy or other change of ownership or control by Cronos Group or any affiliated company (in each case, whether in whole or in part), including any due diligence exercise carried out in relation to the same, provided that the information disclosed is necessary to evaluate or complete the transaction. When one of these events occurs, Cronos Group will use reasonable efforts to notify users if their Personal Information becomes subject to different privacy practices. 4. DIGITAL ADVERTISING We use third-party advertising companies to serve ads on other websites and digital services. These companies may use information obtained from data collection tools in order to measure advertising effectiveness and to provide advertisements of interest to you. You can opt out so as not to receive targeted ads from use of the tools, but this will not affect any general advertisements you may receive. If you wish to opt out, please contact us at marketing@thecronosgroup.com. 5. LINKS TO OTHER WEBSITES/SERVICES A link to a third-party website or digital service does not mean that Cronos Group endorses it or the quality or accuracy of information presented on it. If you decide to visit a third-party website or service, you are subject to its privacy practices and not this Privacy Statement. We encourage you to carefully read the privacy policy or statement and other legal notices of each website or service that you visit. 6.OUR CHILDREN’S POLICY The Services are not intended for use by children. If you are under the age of majority in your place of residence, you may not use the Services. If we learn that a child under the age of majority has provided Personal Information to or through the Services without first receiving his or her parent’s verified consent, we will use that information only to respond directly to that child (or his or her parent or legal guardian) to inform the child that he or she cannot use the Services and subsequently we will dispose of such Personal Information in accordance with this Privacy Statement. 7.YOUR PRIVACY CHOICES Cronos Group aims to provide you with choices regarding the Personal Information you provide to us. This section describes mechanisms that we offer you to control certain uses and disclosures of your information. When you access any interactive Service, you will be asked to affirmatively choose (“opt in”) to provide the requested information. You may always choose not to provide the requested information but then you may not be able to use the Service as intended. Access/Correct/Update Personal Information. You may request access to, or correction of the Personal Information in our control by contacting us at marketing@thecronosgroup.com. Receive Marketing Communications. When you register for the Services, you may request to receive email containing information about Cronos Group that we think you might find useful, including promotions, announcements of new services and products, as well as newsletters. If you decide, at any time, that you no longer wish to receive these emails you may unsubscribe using the unsubscribe mechanism in the email or by contacting us at marketing@thecronosgroup.com. Accept and Reject Cookies. Your browser software can be set to reject all cookies, but if you reject our cookies, certain of the functions and conveniences of the Services may not work properly. To learn more about cookies, please check your browser’s help or similar feature. How We Respond to Browser “Do Not Track” Signals. Some web browsers incorporate a “do-not-track” (“DNT”) or similar feature that signals to websites with which the browser communicates that a visitor does not want to have his/her online activity tracked. If a digital service that responds to a particular DNT signal receives the DNT signal, the browser can block that digital service from collecting certain Personal Information about the browser’s user. As of the Effective Date not all browsers offer a DNT option and DNT signals are not yet uniform. For this reason, Cronos Group along with many other digital service operators do not currently respond to DNT signals. For more information about DNT signals, visit allaboutdnt.com. IMPORTANT NOTE: Under applicable law, Cronos Group may be unable to comply with a request to amend or remove information that was provided to Cronos Group by a healthcare professional or by a consumer regarding an adverse medical reaction. 8.HOW INFORMATION IS RETAINED AND SECURED Personal information is maintained on our servers or those of our service providers and will be accessible by our authorized employees, agents and representatives as necessary for the purposes described in this Privacy Statement. We retain information as long as it is necessary and relevant for our operations. In addition, we retain Personal Information to comply with applicable law, prevent fraud, resolve disputes, troubleshoot problems, assist with any investigation, enforce our Terms of Use, and other actions permitted by law. When your Personal Information is no longer needed for our business or legal purposes, we dispose of it by deleting or anonymizing it subject to applicable laws. In accordance with applicable laws, we employ reasonable security measures intended to help protect the security of all information submitted through the Services. The security of information transmitted through the internet cannot, however, be guaranteed. We are not responsible for any interception or interruption of any communications or for changes to or losses of data through the internet. Users of the Services are responsible for maintaining the security of any password, user ID or other form of authentication involved in obtaining access to password protected or secure areas of the Services. Any access to the Services through your user ID and password will be treated as authorized by you. To help protect your Personal Information, we may suspend your use of all or part of the Services, without notice, if Cronos Group suspects or detects any breach of security. Unauthorized access to such areas is prohibited and may lead to criminal prosecution. 9.CHANGES TO THIS PRIVACY STATEMENT Cronos Group reserves the right to change the terms of this Privacy Statement. If we make any material changes to this Privacy Statement, we will notify you in advance through the Services. If we decide to use Personal Information in a manner that is materially different from the uses described in this Privacy Statement or otherwise disclosed to you, you will have the choice to allow or disallow any additional uses or disclosures of your Personal Information. However, in some cases, we will no longer be able to provide you with Services if you do not consent to uses of your Personal Information necessary to provide those Services. We will not make retroactive changes that reduce your privacy rights unless we are legally required to do so. Your continued use of the Services after the Effective Date constitutes your acceptance of the Privacy Statement. 10.QUESTIONS If you have any questions with respect to this Privacy Statement or your rights hereunder, or would like to request access to or correction of your Personal Information, please send an email to privacy@thecronosgroup.com. 1-888-64-PEACE (73223) P.O. Box 999 Stayner, Ontario L0M 1S0 Mon to Fri: 8 am to 6 pm EST Code of Business Conduct & Ethics Website Terms of Use Website Privacy Statement Privacy Policy Cookie Policy Accessibility Plan ©2021 Peace Naturals Project. PEACE NATURALS and the PEACE NATURALS logos are trademarks of Peace Naturals Project Inc. Share This