Privacy Policy

Last updated: September 15, 2026

Crosstown Metal Industries Ltd. respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain and protect personal information through www.crosstownmetal.com and related pages or subdomains operated by us that link to this Policy (collectively, the “Site”).

1. Scope and applicable law

This Policy applies to personal information handled by Crosstown Metal Industries Ltd. (“CMI”, “we”, “us” or “our”) through the Site and related communications. It does not apply to third-party websites or services linked from the Site, or to information that is not personal information under applicable law.

CMI handles personal information in accordance with British Columbia’s Personal Information Protection Act (“PIPA”) and, where applicable, Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and other applicable privacy laws.

2. What is personal information?

Personal information is information about an identifiable individual. It generally does not include business contact information used to communicate with someone in relation to their employment, business or profession where applicable law excludes that information.

3. Information we collect

The information we collect depends on how you use the Site and communicate with us.

Information you provide

• contact details, such as your name, email address, telephone number, company, job title and mailing address;
• inquiry and project details submitted through Contact Us, Request for Quote, Website Feedback or similar functions;
• documents, drawings, specifications, photographs or other files you choose to provide;
• communications and records of our correspondence with you; and
• any other personal information you voluntarily provide.

Information collected automatically

When you visit the Site, our systems and service providers may automatically collect technical and usage information, such as:

• Internet Protocol (IP) address and approximate location derived from it;
• browser type, device type, operating system and language settings;
• date and time of access, pages viewed, links selected, referring page and time spent on pages; and
• cookie identifiers and similar technical information.

We may combine or aggregate usage information so it no longer identifies an individual. Aggregated or de-identified information is not treated as personal information where applicable law permits.

4. How we collect information

We collect personal information directly from you when you complete a form, request a quote, provide website feedback, telephone or email us, or otherwise communicate with CMI. We also collect technical information automatically through the Site and may receive information from service providers that host, secure, maintain or measure use of the Site.

5. How we use personal information

We may use personal information to:

• respond to inquiries, requests for information, feedback and requests for quote;
• assess potential projects, prepare estimates or quotations, and manage business relationships;
• receive and review documents or files that you ask us to consider;
• operate, maintain, secure, troubleshoot and improve the Site and our services;
• understand Site traffic and usage trends;
• detect, investigate and prevent fraud, misuse, security incidents and unlawful activity;
• maintain business, legal and security records;
• comply with legal, regulatory, insurance, contractual and audit requirements; and
• carry out another purpose that we identify when collecting the information, with consent where required.

6. Consent and choices

We obtain consent where required by law. Consent may be express or implied, depending on the circumstances and sensitivity of the information. For example, when you voluntarily submit contact information and project details, we may use that information to respond to your request and take reasonable related steps.

You may withdraw consent on reasonable notice, subject to legal or contractual restrictions. Withdrawal may limit our ability to respond to a request or provide a service. To withdraw consent or ask about your choices, contact our Privacy Officer using the details below.

If CMI sends a commercial electronic message, it will do so in accordance with Canada’s anti-spam legislation, including applicable consent, identification and unsubscribe requirements.

7. Cookies and similar technologies

Cookies are small text files placed on a device by a website. The Site may use:

• essential cookies needed for security, navigation and core Site functions;
• preference cookies that remember settings or choices; and
• analytics cookies or similar technologies that help us understand how visitors use the Site and improve performance.

You can usually manage or delete cookies through your browser settings. Blocking some cookies may affect Site functionality. Where required, we will request consent before using non-essential cookies. The specific cookies in use may change as the Site and its service providers are updated.

8. When we disclose personal information

We may disclose personal information only as reasonably necessary for the purposes described in this Policy, including to:

• employees and representatives who need the information to respond to or administer a request;
• website hosting, information technology, cybersecurity, communications, analytics, professional and records-management service providers that support CMI;
• professional advisers, insurers, auditors, regulators, law enforcement or government authorities where permitted or required by law;
• a party to a proposed or completed financing, reorganization, merger, sale or other business transaction, subject to appropriate protections where required; and
• another person with your consent or as otherwise permitted or required by law.

Service providers may process information only for the services they provide to CMI and are expected to protect it using appropriate safeguards. We do not disclose personal information for a third party’s independent marketing purposes unless we have consent or the disclosure is otherwise permitted by law.

9. Processing outside British Columbia or Canada

Some service providers may store or process personal information outside British Columbia or Canada. Information processed in another jurisdiction may be subject to the laws of that jurisdiction and may be accessible to courts, law enforcement or government authorities there. Contact our Privacy Officer if you would like more information about our service providers or processing locations.

10. Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to meet legal, contractual, insurance, security and recordkeeping requirements. Retention periods vary according to the type of information and the reason it is held. When information is no longer required, we securely destroy, erase or anonymize it, subject to permitted backup and archival practices.

11. Safeguards

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information. These may include access controls, security tools, staff practices, vendor controls and secure disposal. No internet transmission or storage system is completely secure, and we cannot guarantee absolute security.

12. Access and correction

You may request access to personal information about you that is under our control and ask us to correct information that is inaccurate or incomplete, subject to exceptions under applicable law. We may need to verify your identity and may request that the application be made in writing. If we cannot provide access or make a requested correction, we will explain why where required.

13. Children’s privacy

The Site is intended for business and general audiences and is not directed to children. We do not knowingly collect personal information from children through the Site without appropriate consent. If you believe a child has provided personal information to us, contact our Privacy Officer.

14. Third-party links

The Site may contain links to third-party websites, platforms and documents. Their privacy practices are governed by their own policies. CMI is not responsible for the privacy, security or content of third-party services.

15. Changes to this Policy

We may update this Policy to reflect changes in our practices, the Site, service providers or legal requirements. The revised Policy takes effect when posted, unless a later date is stated. The “Last updated” date identifies the current version. If a change is material, we may provide additional notice where appropriate.

16. Questions, requests and complaints

Our Privacy Officer is accountable for CMI’s compliance with applicable privacy requirements. Contact the Privacy Officer to ask a question, withdraw consent, request access or correction, or make a privacy complaint. We will review and respond in accordance with applicable law.