Privacy Policy

Melech Retail ("we", "us", or "our") is a retail supply chain consultancy based in Vancouver, British Columbia, Canada. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information you provide when you visit melech.ca or submit an inquiry through our contact form.

We comply with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and the British Columbia Personal Information Protection Act (PIPA BC). If you have questions about this policy, please contact us at david@melech.ca.

We only collect personal information that is necessary for the purpose for which it is collected.

Contact form. When you submit an inquiry through our website contact form, we collect: • Your name • Your email address • Your company name (if provided) • The content of your message

We do not collect payment information, government-issued identifiers, or sensitive personal information through this website.

Automatically collected data. Like most websites, our hosting infrastructure may log standard technical data (IP address, browser type, pages visited, referral source, and timestamps) for security and performance monitoring purposes. This data is not linked to your identity and is retained for a maximum of 90 days.

We collect and use your personal information solely for the following purposes:

• To respond to your inquiry and evaluate whether our services may be a fit for your needs • To correspond with you about a potential or ongoing consulting engagement • To comply with any legal obligations

We will not use your information for any purpose other than those listed above without obtaining your prior consent.

By submitting the contact form, you expressly consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy.

You may withdraw your consent at any time by contacting us at david@melech.ca. Withdrawal of consent may limit our ability to respond to your inquiry or continue a consulting relationship.

We do not sell, trade, or rent your personal information to third parties.

We may share your information only in the following limited circumstances:

• Service providers. We use Resend (resend.com) as our transactional email delivery provider to route contact form submissions to our inbox. Resend processes your data solely to deliver the email and does not retain or use it for any other purpose. Resend's infrastructure is operated in compliance with SOC 2 Type II standards. • Legal requirements. We may disclose your information if required to do so by law or in response to valid requests from public authorities (e.g., a court order or government agency). • Business transfers. In the unlikely event of a merger, acquisition, or sale of all or part of our assets, personal information may be transferred. You will be notified via a prominent notice on our website if such a change affects how your data is used.

We take reasonable steps to ensure that any third-party service providers we work with maintain appropriate privacy and security standards.

We retain your contact information for as long as it is needed to fulfill the purpose for which it was collected, or as required by law. If an engagement does not proceed, inquiry data is deleted within 12 months of the last communication. If you request earlier deletion, we will fulfill that request within 30 days.

We implement reasonable administrative, technical, and physical safeguards to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These include encrypted data transmission (HTTPS/TLS), access controls limited to authorized personnel, and use of reputable third-party service providers with demonstrated security practices.

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Under PIPEDA and BC PIPA, you have the right to:

• Access the personal information we hold about you • Request correction of any inaccurate or incomplete information • Withdraw consent to our use of your personal information (subject to legal and contractual obligations) • Request deletion of your personal information, subject to our retention obligations

To exercise any of these rights, please contact us in writing at david@melech.ca. We will respond within 30 days of receiving a complete request.

Our website does not use advertising trackers or third-party marketing cookies. We may use minimal, session-level cookies required for basic website functionality. We do not use Google Analytics or similar behavioural tracking services. If this changes in the future, this policy will be updated and visitors will be informed.

Our website may contain links to external sites (such as LinkedIn or our founder's employer). We are not responsible for the privacy practices of those sites and encourage you to review their respective privacy policies.

Our website and services are directed exclusively at business professionals. We do not knowingly collect personal information from individuals under the age of 18. If you believe we have inadvertently collected such information, please contact us immediately.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The "Last updated" date at the bottom of this page will reflect the most recent revision. Continued use of our website after a policy change constitutes your acceptance of the revised policy.

For any questions, concerns, or requests related to this Privacy Policy or your personal information, please contact:

Melech Retail — Privacy Officer Email: david@melech.ca Location: Vancouver, BC, Canada

If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca).