Privacy Policy

1. INTRODUCTION

Elmwood Spa, Elmspa, Terrace Restaurant and Bangkok Garden (together, our “Spa Properties and Affiliated Brands“) are committed to respecting and protecting the privacy of individuals who visit our websites, use our online services, subscribe to our marketing communications or otherwise interact with us electronically. This Privacy Policy (the “Policy“) describes how we collect, use, disclose, retain and protect personal information through our websites, online platforms, e-commerce operations and marketing activities.

This Policy applies to personal information collected through:

• • Our websites, including elmwoodspa.com, elmwoodspa.ca and elmspa-affiliated web properties (e.g. bangkokgarden.ca);
  • Our online booking systems and e-commerce platforms;
  • Our email marketing and electronic communications;
  • Our chat, telephone and Short Message Service (SMS) communication channels;
  • Our online feedback and review processes; and
  • Any other electronic interactions you may have with our Spa Properties and Affiliated Brands.

This Policy is governed by Canada’s Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (“PIPEDA“) and Canada’s Anti-Spam Legislation, S.C. 2010, c. 23 (“CA SL“), as applicable.

Please note that this Policy supplements and should be read alongside our separate Privacy Policy for Massage and Esthetician Services (Policy # HR 510), which addresses the collection, use and disclosure of personal information and personal health information in connection with in-person health care (massage) and esthetician services.

2. WHAT IS PERSONAL INFORMATION?

Personal information is information about an identifiable person.

In the context of our websites, online services and marketing activities, this includes information such as your name, email address, telephone number, mailing address, date of birth, IP

address, browser and device information, payment details, purchase history and any other information you provide to us or that is collected automatically when you interact with us online.

3. OUR SPA PROPERTIES (ELMWOOD SPA AND ELMSPA) AND AFFILIATED BRANDS (TERRACE RESTAURANT AND BANGKOK GARDEN)

Our Spa Properties consist of Elmwood Spa and elmspa, both located in Toronto, Ontario, offering massage therapy and esthetician services to the public.

Our Affiliated Brands consist of two, on-site restaurants located at our Elmwood Spa location – Terrace Restaurant (offering spa cuisine with traditional Canadian influences and a juice bar) and Bangkok Garden (offering Thai cuisine).

4. PERSONAL INFORMATION WE COLLECT

We collect personal information through our websites, online platforms and electronic communications as follows:

4.1. Information You Provide Directly

When you interact with our websites, make bookings, purchase products, subscribe to marketing communications or contact us electronically, we may collect the following personal information directly from you:

• • First and last name, email address, telephone number, mailing address and postal code;
  • Date of birth (for example, when you provide your birthday for birthday offers);
  • Payment information, including credit or debit card details, processed through our payment service providers;
  • Information you submit through our online booking forms, including service preferences and appointment details;
  • Information you submit through online forms hosted on our website, including direct billing forms for registered massage therapy services;
  • Information you provide when contacting us through our live chat feature, including your name, telephone number, email address, and the content of your inquiry;
  • Information you provide when participating in contests, promotions or surveys;
  • Feedback, ratings, and reviews you submit through our post-service feedback surveys; and
  • Restaurant reservation details, including first and last name, email address, and telephone number, when making reservations through our Bangkok Garden restaurant website (i.e. bangkokgarden.ca).

4.2. Information Collected Automatically

When you visit our websites or interact with us electronically, certain information may be collected automatically, including:

• • IP address, browser type, operating system, device identifiers and other technical information;
  • Cookies and similar tracking technologies, as described in Section 12 of this Policy; and
  • Information collected through our chat platform, which may include your IP address.

5. HOW AND WHY WE COLLECT, USE, AND DISCLOSE PERSONAL INFORMATION

5.1. Purposes of Collection and Use

We collect and use personal information through our online platforms and marketing activities for the following purposes:

• • To process online bookings and appointment reservations for spa services through our booking platform;
  • To process restaurant reservations through our online reservation system;
  • To process purchases and fulfill orders placed through our e-commerce platform, including shipping products to you;
  • To process payments securely through our third-party payment processors;
  • To send appointment reminders by email and telephone;
  • To send you email marketing communications, including newsletters, promotional offers, birthday offers and last-minute offers, where you have provided your consent or where we have an existing business relationship with you and you have not otherwise opted out of receiving such communications;
  • To send you SMS messages relating to your services, such as prompts to complete direct billing forms following registered massage therapy appointments;
  • To administer post-service feedback surveys and to invite you to share your reviews on third-party review platforms;
  • To analyze feedback and improve our services;
  • To respond to your inquiries through our live chat, telephone and email communication channels;
  • To maintain quality control through the recording and retention of telephone calls;
  • To administer and improve our websites, including by using cookies and similar technologies; and
  • To comply with our legal and regulatory obligations.

5.2. Consent

As required by PIPEDA, we will obtain your consent before or at the time of collecting, using or disclosing your personal information, unless an exception applies. Consent may be express or implied:

• • Express (or opt-in) consent is obtained when you take a deliberate action to agree to the collection, use, or disclosure of your personal information – for example, when you opt in to receive email marketing communications, subscribe to our newsletter or check a box indicating your consent on one of our online forms.
  • Implied (or opt-out) consent may arise in circumstances where you provide personal information for a purpose that is reasonably apparent from the context – for example, when you provide your email address and telephone number to make an online booking, or when you initiate a live chat inquiry and provide your contact details. You may withdraw your consent at any time by contacting our Privacy Officer (see Section 14 below) or by using the unsubscribe mechanism included in our marketing communications, as described in Section 6.2 of this Policy. Please note that withdrawing your consent may impact your ability to receive certain communications or access certain services.

6. COMMERCIAL ELECTRONIC MESSAGES AND CASL COMPLIANCE

We are committed to complying with CASL in all our electronic marketing activities.

6.1. Email Marketing

We use email to communicate promotional offers, newsletters, birthday offers, last-minute deals and other marketing communications to individuals who have provided their consent or with whom we have an existing business relationship.

Under CASL, we may send you commercial electronic messages in the following circumstances:

• • Express consent: Where you have affirmatively opted in to receive marketing communications from us – for example, by subscribing through our website or opting in to specific offers (such as birthday promotions or last-minute offers).
  • Existing business relationship: Where you have been a guest at one of our Spa Properties and/or Affiliated Brands within the preceding two years, CASL permits us to send you commercial electronic messages based on your existing business relationship with us. As the two-year period approaches, we will invite you to formally subscribe to continue receiving our communications, and we may send reminders and incentivized offers to facilitate your continued subscription.

6.2. Unsubscribe Mechanism

Every commercial electronic message we send includes a functioning unsubscribe mechanism. You may unsubscribe from our marketing communications at any time by clicking the unsubscribe link included in any of our emails or by contacting our Privacy Officer (see Section 14 below). We will process your unsubscribe request promptly and in accordance with CASL’s requirements.

6.3. SMS Communications

We may send you SMS messages in limited circumstances relating to the services you have received – for example, a one-time SMS prompt to complete a direct billing form following a registered massage therapy appointment. These messages are transactional in nature and will only be sent where you have not yet completed the applicable form. Should we expand our SMS communications in the future, we will obtain the appropriate consent in accordance with CASL before doing so.

6.4. Restaurant Reservation Communications

For online restaurant reservations made through our Bangkok Garden restaurant website, you will be given the option to indicate how you would like to receive communications (by SMS or email) and whether you wish to opt in to email marketing from Bangkok Garden.

7. THIRD-PARTY SERVICE PROVIDERS

We work with several third-party service providers to operate our websites, process bookings and payments, manage marketing communications, facilitate communications and fulfill e-commerce orders. These service providers may receive, store or process personal information on our behalf and are contractually required to use personal information only for the purposes for which it was provided and in accordance with applicable privacy laws.

The following is a summary of the key third-party service providers we use in connection with our web, online and marketing activities:

7.1. Book4Time – Online Booking and Spa Management

We use Book4Time, a product of Agilysys, Inc., as our primary spa management and online booking platform. When you book an appointment through our website, you are redirected to the Book4Time platform to complete your reservation. Book4Time collects and stores personal information relating to your bookings, service history and retail purchases, including your first and last name, address, email address, telephone number and details of services and products you have purchased. Book4Time also sends appointment reminder emails on our behalf.

For more information, please consult Agilysys’s privacy policy at: https://www.agilysys.com/en/privacy-policy/

7.2. Guest Intake – Client Intake and Consent Forms

We use Guest Intake for the collection and management of client intake and consent forms. Personal information submitted through Guest Intake is stored securely on the Guest Intake platform. On behalf of the Spa Properties, Guest Intake collects and stores personal information that is necessary to deliver massage and esthetician services to you. This includes:

• • First and last name, birthdate, address, and other contact information (i.e. phone numbers, fax numbers, email addresses);
  • Health history, including client age, family history, physical condition and function, social situation and employment information;
  • Names and contact information of your emergency contacts;
  • Payment information (e.g. credit or debit card information) and/or any third-party payor information.

For more information, please consult Guest Intake’s privacy policy at: https://guestintake.com/privacy-policy/

7.3. Mailchimp – Email Marketing

We use Mailchimp (which is powered by Intuit Inc.) as our email marketing platform. Mailchimp is connected to our websites, and subscriber information collected through our websites is stored within Mailchimp. The personal information stored by Mailchimp on our behalf includes first and last name, email address, date of birth, postal code, telephone number, last transaction number and date of last service. Mailchimp also maintains our subscriber lists, processes unsubscribe requests and provides us with monthly reports on list management, including records of subscribers who have been removed from our list in accordance with CASL requirements. Mailchimp has its own anti-spam policies and may penalize senders who receive a high volume of complaints, which helps ensure responsible email marketing practices.

For more information, please consult Intuit’s privacy policy (which applies to Mailchimp) at: https://www.intuit.com/privacy/statement/

7.4. 8×8 – Telephone, Chat and Email Communication Services

We use 8×8 as our telephone, live chat and email communications platform.

When you contact us by telephone, your call may be recorded for quality control and complaint resolution purposes. In accordance with our contract with 8×8, telephone recordings are retained by 8×8 in hot storage on a cloud system hosted by 8×8 for up to 130 days, allowing us instant access during that period. Following the retention period, your personal information (i.e. your name, phone number, telephone call details) is securely destroyed.

When you use our live chat feature, 8×8 may collect your name, telephone number, email address and IP address, along with the content of your chat interaction in accordance with our

contract with 8×8. This personal information is stored on 8×8’s local servers, after which the information is securely destroyed.

Email communications processed through 8×8 are stored by 8×8 on a local server for up to six (6) months.

Email and call recordings stored by 8×8 on behalf of the Spa Properties and Affiliated Brands are only accessible by authorized users within the Spa Properties and Affiliated Brands or through secure methods to our authorized agents.

Please note that we do not collect credit card information through our chat or telephone channels; if payment information is required, you will be asked to call in, and your payment details will be securely entered into our Book4Time system.

For more information, please consult 8×8’s privacy policy at: https://www.8×8.com/terms-and-conditions/privacy-policy

7.5. Shopify – E-Commerce

We use Shopify to operate our online retail store, through which we sell body care products, skincare products and gift cards. When you make a purchase through our Shopify store, we collect your first and last name, complete mailing address, email address, telephone number, and details of your purchase. Payment is processed through our payment provider, Moneris (see Section 7.6 below).

For more information, please consult Shopify’s privacy policy at: https://www.shopify.com/legal/privacy

7.6. Moneris – Payment Processing

We use Moneris as our payment processing service provider for transactions made through our e-commerce platform. Moneris processes your payment method information and related transaction data on our behalf. We do not directly store your credit or debit card information; payment processing is handled by Moneris in accordance with applicable payment card industry standards.

For more information, please consult Moneris’s privacy policy at: https://www.moneris.com/en/legal/privacy-policy

7.7. OpenTable – Restaurant Reservations

For online restaurant reservations at Bangkok Garden, we use OpenTable. When you make a reservation through OpenTable, OpenTable collects your first and last name, email address, and telephone number, along with your communication preferences. OpenTable may also be used for marketing purposes in connection with Bangkok Garden’s restaurant services, subject to your opt-in consent.

For more information, please consult OpenTable’s privacy policy at: https://www.opentable.com/legal/privacy-policy

7.8. OneLocal – Feedback and Reviews

We use OneLocal, a feedback platform integrated into our website, to collect and analyze post-service feedback from guests. Within 24 hours of your service, you may receive a feedback survey requesting your name, email address and a rating of your experience. If your rating meets a certain threshold, you may be invited to authorize sharing your review on third-party platforms, including Google, Facebook and TripAdvisor. If you agree, your review may be published on those platforms.

For more information, please consult OneLocal’s privacy policy at: https://www.onelocal.com/privacy/

7.9. Shipping Providers – Order Fulfillment

For products purchased through our online store, we use Canada Post, Purolator or FedEx (as applicable) to ship your order. To fulfill your order, we will share your name and mailing address with the applicable shipping provider. Shipping labels are generated through our Shopify platform.

7.10. Website Development and Management

Our websites for Spa Properties and Affiliated Brands are managed and maintained by a third-party web developer. This service provider assists with the technical operation and maintenance of our website, including the implementation of cookies and related tracking technologies.

7.11. Microsoft Forms – Direct Billing

For clients who receive registered massage therapy services and wish to use direct billing, we host a direct billing form on our website through Microsoft Forms, which collects personal information such as your first and last name, date of birth, service details and insurance/third party payor information. Information submitted through this form is not stored in Mailchimp or any of our marketing platforms; access to this information is limited to our Guest Services team and duty managers only. Registered massage therapists do not have access to information submitted through this form.

For more information, please consult Microsoft’s privacy policy at: https://www.microsoft.com/en-ca/privacy/privacystatement

8. CROSS-BORDER TRANSFERS OF PERSONAL INFORMATION

Several of the third-party service providers described in Section 7 of this Policy are headquartered in, or may store and process data in, jurisdictions outside of Canada, including the United States. As a result, your personal information may be transferred to, stored in or processed in a jurisdiction outside of Canada, where it may be subject to the laws of that jurisdiction – including laws that may permit access to personal information by foreign courts, law enforcement and government authorities.

The following service providers may process or store your personal information outside of Canada:

• • 8×8 (telephone, chat, and communication services): 8×8, Inc. is a United States-based company. Telephone recordings, chat interactions and email communications processed through 8×8 may be stored on servers located in the United States. This may include your name, telephone number, email address, IP address and the content of your communications.
  • Book4Time (Agilysys, Inc.) (online booking and spa management): Agilysys, Inc. is a United States-based company. Personal information relating to your bookings, service history and retail purchases may be processed or stored on servers located outside of Canada.
  • Mailchimp (Intuit Inc.) (email marketing): Mailchimp is operated by Intuit Inc., a United States-based company. Subscriber information – including your name, email address, date of birth, postal code, telephone number and service history – may be stored on servers located in the United States.
  • Shopify (e-commerce): Shopify Inc. is a Canadian company; however, Shopify may use infrastructure or sub-processors located outside of Canada to store or process personal information. Your name, mailing address, email address, telephone number and purchase details may be subject to processing outside of Canada.
  • OpenTable (restaurant reservations): OpenTable is a United States-based company. Your name, email address, telephone number and communication preferences may be stored on servers located in the United States.
  • One Local (feedback and reviews): One Local may process feedback data, including your name, email address and review content, on servers located outside of Canada.

In accordance with PIPEDA, we take reasonable steps to ensure that your personal information is afforded a comparable level of protection when transferred to service providers in foreign jurisdictions. These steps include:

• • Requiring all third-party service providers to enter into contractual agreements that include obligations to protect the confidentiality and security of personal information in accordance with applicable Canadian privacy laws;
  • Conducting due diligence on the privacy and security practices of service providers before engaging them to process personal information;
  • Limiting the personal information transferred to foreign service providers to only what is necessary to fulfill the identified purposes; and
  • Periodically reviewing service provider arrangements to confirm that adequate safeguards remain in place.

By using our websites, online services or subscribing to our marketing communications, you acknowledge and consent to the transfer and processing of your personal information in jurisdictions outside of Canada for the purposes described in this Policy. If you have questions or concerns about the cross-border transfer of your personal information, please contact our Privacy Officer (see Section 14 below).

9. DISCLOSURE OF PERSONAL INFORMATION

We will not disclose your personal information to third parties without your consent, except in the following circumstances: · To our third-party service providers described in Section 7 above, who process personal information on our behalf and only for the purposes for which it was provided;

• • Where disclosure is required or permitted by law, including in response to a court order, search warrant or other legal process;
  • Where you have authorized the sharing of a review or feedback on a third-party platform (such as Google, Facebook or TripAdvisor);
  • In an emergency where there is a threat to the life, health or safety of an individual; and
  • In other circumstances as permitted or required under PIPEDA.

10. PROTECTION OF PERSONAL INFORMATION

Protecting your personal information is important to us. We take reasonable and appropriate measures to safeguard the personal information in our custody and control, including:

• • Using reputable and secure third-party service providers to collect, process and store personal information;
  • Restricting internal access to personal information to only those employees who require it to perform their duties;
  • Securing computer and network systems using complex passwords, firewalls and other software protections;
  • Limiting collection of personal information to only what is necessary for the identified purposes; and
  • Implementing access controls and conducting periodic audits to ensure those controls are being followed.

11. RETENTION OF PERSONAL INFORMATION

We retain personal information collected through our online platforms and marketing activities for only as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following retention periods apply to specific categories of information:

• • Email marketing data (Mailchimp): Subscriber data is maintained in Mailchimp for as long as the individual remains an active subscriber. Individuals who unsubscribe are removed from the active list. Mailchimp provides us with monthly records of individuals who have been cleaned from our lists, which we store separately.
  • Chat interactions and telephone recordings (8×8): Chat interactions and call recordings are retained in hot storage for up to 130 days, after which they are subject to 8×8’s data retention and destruction practices.
  • Email interactions (8×8): Email interactions processed through 8×8 may be accessible for up to six (6) months, after which they are subject to 8×8’s data retention and destruction practices.
  • E-commerce and booking records (Shopify and Book4Time): Transaction and booking records are retained in accordance with our operational and legal requirements.

Following the expiry of applicable retention periods, personal information will be securely deleted or destroyed.

12. COOKIES AND TRACKING TECHNOLOGIES

Our websites use cookies and similar tracking technologies. When you visit our websites, including when you access our online booking system, a cookie notice will appear to inform you about our use of cookies and to obtain your consent where required. Cookies are used to enhance your browsing experience, analyze website traffic and support the functionality of our online services. For more information about the specific cookies we use and how to manage your cookie preferences, please refer to the cookie notice displayed on our websites.

13. YOUR PRIVACY RIGHTS

13.1. Right to Access and Correct Personal Information

Subject to applicable exceptions, you have the right to access the personal information we hold about you and to request corrections to any inaccuracies. Please submit all access and correction requests in writing to our Privacy Officer. We will endeavor to respond within 30 days of receiving your request. We reserve the right to verify your identity before releasing any personal information and may charge a nominal fee to cover the costs of processing your request.

13.2. Right to Withdraw Consent

You have the right to withdraw your consent to the collection, use and disclosure of your personal information at any time. To withdraw consent for marketing communications, you may use the unsubscribe mechanism in any of our emails or contact our Privacy Officer. Please note that withdrawal of consent is not retroactive; personal information collected, used or disclosed prior to your withdrawal will continue to be handled in accordance with applicable privacy laws and the terms of this Policy.

14. PRIVACY INQUIRIES

We will endeavor to respond in a timely manner to questions, concerns and/or complaints about the protection of your personal information and/or about this Policy.

If you have any questions, concerns, or complaints about this Policy, our privacy practices, or the way your personal information is being handled, please contact our Privacy Officer:

Elena Doubovtseva
spa@elmwoodspa.com
557 Church Street, 2nd Floor, Toronto, ON M4Y 2E2

If we are unable to resolve your privacy concerns, you have the right to contact or file a written complaint with the Office of the Privacy Commissioner of Canada (“OPC”), which oversees compliance with PIPEDA. The OPC can be contacted through the following information:

Office of the Privacy Commissioner of Canada

30 Victoria Street

Gatineau, Quebec K1A 1H3

Telephone: 1-800-282-1376

Website: www.priv.gc.ca

15. CHANGES TO THIS POLICY

We may update or revise this Policy from time to time. If we make any material changes to this Policy, we will notify you and obtain your consent (if required by applicable law) before the changes take effect. Material changes will apply only to personal information collected after the amended Policy takes effect. We encourage you to review this Policy periodically to stay informed about how we are protecting your personal information.

16. REVISION CONTROL

May 2026 Policy Revised and Updated