Privacy Policy

Effective Date: October 13, 2026

1. Who We Are

Vaya Cannabis Network Inc. (herein “Vaya”, “we”, “us”, or “our”) is the organization responsible for personal information collected, used, and disclosed through the Site and related communications covered by this Privacy Policy.

2. Scope

This Privacy Policy explains how Vaya handles personal information collected through www.vayanetwork.com, any related web pages, features, forms, accounts, messages, and communications, and related interactions with users in connection with the Site.

This Privacy Policy applies to personal information that we collect from or about users through the Site and related communications. It does not necessarily apply to personal information handled by third parties, including third-party websites, services, or businesses that may be linked to, integrated with, or referenced on the Site. Their privacy practices are governed by their own policies.

3. What We Collect

Depending on how you interact with the Site, we may collect the following categories of personal information:

(a) Identity and age verification information: such as your name, date of birth, declarations relating to age and eligibility, and, if requested or used, information from government-issued identification or other verification records.

(b) Account and contact information: such as your email address, phone number, city or region, username, password credentials in protected or hashed form, and other account profile details you choose to provide.

(c) User Content: such as profile details, collection notes, listings, messages, comments, images, submissions, and other content you upload, post, send, or otherwise make available through the Site.

(d) Transactional or contact records, if applicable: such as records of introductions, inquiries, contact attempts, support requests, complaints, and, if the Site later includes such functionality, records relating to orders, payments, deliveries, fulfilment, or other transactions.

(e) Technical, usage, and device information: such as IP address, browser type, device identifiers, operating system, session information, pages viewed, dates and times of access, referring URLs, log data, and records of terms or consents accepted.

(f) Communications: such as correspondence with us by email, web form, messaging features, or other channels, and any preferences you communicate to us, including marketing preferences where applicable.

4. Purposes for Collection, Use, and Disclosure

We may collect, use, and disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances, including to:

(a) verify age, identity, and eligibility to access the Site or certain features;

(b) create, administer, maintain, and authenticate accounts;

(d) display, host, process, transmit, moderate, and manage User Content and user communications;

(e) communicate with you about your account, inquiries, support requests, updates, security issues, and administrative matters;

(f) protect the safety, integrity, rights, property, and security of users, the Site, Vaya, and third parties;

(g) detect, prevent, investigate, and respond to fraud, unlawful activity, policy violations, or security incidents;

(h) comply with legal, regulatory, court, evidentiary, insurance, audit, record-keeping, and contractual requirements;

(i) establish, exercise, or defend legal claims; and

(j) understand Site usage and improve the Site, user experience, and related services.

We do not sell personal information as that term is commonly understood. We do not knowingly use personal information to direct cannabis advertising or promotion to persons below the legal age.

5. Consent

We collect, use, and disclose personal information with consent where required by applicable law, which may be express or implied depending on the sensitivity of the information and the reasonable expectations of the individual.

Consent may be obtained, for example, when you pass an age gate, create an account, submit a form, upload content, communicate with us, choose profile settings, opt in to communications, or otherwise voluntarily provide information after being given notice of the purposes.

If you choose not to provide certain personal information, or if you withdraw consent, we may be unable to provide some or all Site features, maintain your account, verify age or eligibility, respond to requests, or continue providing services that depend on that information.

You may withdraw consent, subject to legal or contractual restrictions and reasonable notice, by contacting us using the privacy contact details below. Withdrawal of consent will not affect collection, use, or disclosure that was already authorized, and in some cases we may retain or continue to use certain information where required or permitted by law, including for legal, security, audit, or record-keeping purposes.

6. Disclosure of Personal Information

We may disclose personal information in the following circumstances, as reasonably necessary for the purposes described in this Privacy Policy:

(a) to service providers that help us host, support, secure, maintain, analyze, communicate through, or operate the Site, subject to contractual or other appropriate safeguards;

(b) to professional advisers, such as legal counsel, auditors, insurers, consultants, and accountants, where reasonably necessary;

(c) where required or permitted by applicable law, regulation, court order, warrant, subpoena, lawful access request, or other legal process, including requests from regulators, law enforcement, Health Canada, or other governmental authorities;

(d) in connection with an actual or proposed financing, securitization, insurance process, merger, acquisition, asset sale, reorganization, or other business transaction, subject to appropriate confidentiality protections where practicable;

(e) to other users or the public to the extent you intentionally choose to make information visible through your profile, listing, post, or other Site settings; and

(f) to fulfil a lawful Court Order.

We do not disclose your personal information to other users except to the extent you choose to make it available through the Site or as otherwise described in this Privacy Policy.

7. Service Providers and Cross-Border Processing

We may use third-party service providers to store, host, process, analyze, transmit, or otherwise handle personal information on our behalf. Those providers may be located in, or may access personal information from, jurisdictions outside Alberta or outside Canada, depending on the systems actually used.

8. Retention and Safeguards

We retain personal information only for as long as reasonably necessary to fulfil the identified purposes for which it was collected, to support operational and evidentiary needs, and to satisfy legal, regulatory, contractual, or policy requirements. When personal information is no longer reasonably required, we will delete, anonymize, or securely destroy it, subject to applicable retention obligations and technical limitations.

Certain information, such as age-verification records, consent logs, account records, communications, and security logs, may be retained for longer periods where reasonably necessary to demonstrate compliance, investigate incidents, enforce rights, or meet legal obligations.

We use administrative, technical, and physical safeguards that are reasonable in light of the sensitivity of the information and the nature of our operations, including access controls, contractual restrictions, and other security measures appropriate to the circumstances. However, no method of transmission over the Internet and no method of electronic storage is completely secure, and we cannot guarantee absolute security.

9. Access, Correction, and Complaints

Subject to applicable law, you may request access to your personal information under our custody or control and request correction of inaccuracies in that information. We may require sufficient information to verify your identity before responding to a request.

We will respond to requests within the time required by the Personal Information Protection Act (Alberta), subject to any extensions or exceptions permitted by law.

If you have a concern or complaint about our privacy practices, we encourage you to contact us first so that we can review and respond. You also have the right to contact the Office of the Information and Privacy Commissioner for Alberta.

10. Cookies and Similar Technologies

The Site may use cookies, local storage, pixels, tags, server logs, analytics tools, and similar technologies in connection with the Site and related communications. For the purposes of this section, “cookies” are small files or similar records that may be placed on, stored on, or read from a browser or device when a user accesses or interacts with the Site, and similar technologies may perform related functions depending on the systems actually used by the Site and related communications.

Depending on how the Site operates from time to time, these technologies may be used for the following purposes:

(a) to enable core Site functionality, maintain sessions, preserve security, support age gates or eligibility-related features, and allow the Site to operate properly;

(b) to remember user choices, settings, and preferences and support a more consistent user experience;

(c) to understand usage patterns, measure how the Site is used, identify technical issues, and improve Site performance, user experience, and related services;

(d) to help protect the safety, integrity, rights, property, and security of users, the Site, Vaya, and third parties, and to detect, prevent, investigate, and respond to fraud, unlawful activity, policy violations, or security incidents; and

(e) to support communications or marketing functions where lawful.

These technologies may collect technical, usage, and device information such as IP address, browser type, device information, device identifiers, operating system, session information, pages viewed, dates and times of access, referring URLs, log data, records of terms or consents accepted, and records relating to interactions with the Site or communications, including forms, messages, correspondence, support requests, and marketing preferences where applicable. Some cookies and similar technologies may be operated by third-party providers. As described in section 7 of this Privacy Policy, third-party service providers that store, host, process, analyze, transmit, or otherwise handle information collected through cookies and similar technologies on our behalf may be located in, or may access information from, jurisdictions outside Alberta or outside Canada, depending on the systems actually used.

You may be able to control certain cookies and similar technologies through your browser or device settings. If you choose to block, disable, or remove certain technologies, some Site features may not function properly, and this may affect Site functionality, session maintenance, remembered preferences, security features, age or eligibility verification, and the availability of some communications or account-related features. Any marketing communications remain subject to section 11, and marketing consent is separate from consent required for general Site operation and privacy purposes.

11. Marketing Communications

If Vaya sends newsletters, promotional emails, text messages, or other marketing communications, we will do so in accordance with applicable law, including Canada’s anti-spam legislation where applicable. Marketing consent is separate from consent required for general Site operation and privacy purposes.

You may opt out of marketing emails by using the unsubscribe mechanism included in the message or by contacting us. You may also contact us to update your communication preferences. Even if you opt out of marketing communications, we may still send non-promotional service, legal, security, transactional, or account-related messages where permitted or required by law.

12. Minors

The Site is not intended for persons under the legal age required to access cannabis-related information or services in their jurisdiction, and in Alberta that age is 18. We do not knowingly collect personal information from persons below the applicable legal age for such access. If we become aware that personal information has been collected from a person who is not legally permitted to use the Site, we may take steps to delete that information and disable related access, subject to legal retention requirements.

13. Breach Response

If a privacy or security incident affecting personal information occurs, we will assess the incident and respond in a manner we consider appropriate in the circumstances, including taking steps to contain, investigate, mitigate, document, and remediate the issue.

Where notification to affected individuals, the Office of the Information and Privacy Commissioner of Alberta, or any other authority is required by applicable law, we will provide such notice in accordance with those legal requirements. Nothing in this Privacy Policy constitutes an admission that any particular incident meets a legal notification threshold unless and until that determination is made under applicable law.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or Site features. We will post the updated Privacy Policy on the Site with a revised effective date. Where required by applicable law, or where we consider it reasonably appropriate for a material change, we may also provide additional notice by email, account notice, or other reasonable means.

Your continued use of the Site after an updated Privacy Policy is posted signifies your acknowledgement of the revised Privacy Policy, subject to any additional consent requirements imposed by law.