Bota Bota, spa-sur-l’eau, operated by 4473191 Canada Inc., protects the personal information collected in connection with its services, reservations, sales and communications, including through its website and on-site.

This Privacy Policy explains what personal information we collect, why we use it, who we may share it with and how you can exercise your rights.

Personal Information We Collect

We only collect personal information that you have consented to provide. We limit the collection of your personal information to what is necessary to establish, manage and maintain our relationship with you.

For example, personal information may be collected when you:

• book a service;
• purchase a gift card;
• subscribe to our newsletter;
• check in on-site; or
• contact us with questions or comments.

This personal information may include, without limitation:

• identifying information such as your first and last name, mailing address, email address, telephone number, etc.;
• medical information, such as allergies, medical history, etc.;
• financial information used to process payment of your invoices;
• any other information you choose to provide voluntarily; or
• any other information that may help us better serve you.

How We Use Your Personal Information

We may use your personal information for the following purposes:

• to identify you as a user of our website and, where applicable, as a client;
• to establish and maintain our business relationship with you;
• to provide you with services on an ongoing basis;
• to improve our products and services, including your experience using this website;
• to communicate with you regarding questions or comments;
• to provide you with information about products and services that may be of interest to you;
• to prevent errors and fraud; and
• to comply with our legal obligations.

Sharing Your Personal Information

In order to provide the products and services you have requested, we may share your personal information with trusted third parties, including:

• service providers we retain to perform certain functions on our behalf, such as data processing, IT maintenance and website services;
• our partners in connection with exclusive offers and collaborations; and
• any entity involved in a merger, corporate reorganization or change of control affecting all or part of our organization.

We take appropriate measures to ensure that these service providers and partners process your personal information only for the specified purposes.

For group reservations, the reservations and purchases made by group members will appear on the same invoice, and individual payments will not be possible. Group members may therefore have access to the personal information and purchase details of other members of the group. If you wish to pay separately or do not want this information to be shared, it is your responsibility to make separate reservations.

Use of Cookies

We use cookies to improve your browsing experience and better understand how you use our website. Cookies are small files stored on your computer when you visit our website. They contain information such as your display language and certain browsing preferences or activity.

This information is used for statistical purposes, to enable certain features and to make the website easier to navigate. Information collected through cookies remains confidential at all times.

You can disable or block cookies by changing your browser settings.

Links to Other Websites

From time to time, our website may contain hyperlinks to other websites. Information exchanged on those websites is not subject to this Privacy Policy, but rather to the privacy policies of the applicable third-party websites, where such policies exist.

We encourage you to review those policies before providing any personal information.

Retention Periods

Your personal information is retained only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Access, Correction and Data Portability

Once your identity has been confirmed, you may request access to the personal information we hold about you, subject to applicable legal requirements. Requests for access must be made in writing.

You also have the right to request the portability of your personal information. Upon request, and where technically feasible, we will provide your personal information in a structured, commonly used and machine-readable format.

To update your personal information or exercise your right to data portability, please contact us promptly by telephone or email so that we can keep your file up to date.

Requests for Deletion and De-indexing

To protect our clients’ personal information and reduce the risk of identity theft, formal requests for deletion or de-indexing must be submitted in writing by mail to the organization’s head office, to the attention of the Privacy Officer.

Requests submitted through other means, including by email, telephone or verbally, are considered informal and will not be processed until a compliant request has been received.

The processing of a compliant request is subject to verification of the identity of the individual concerned. Any time limits prescribed by law will begin only once a complete and compliant request has been received.

Privacy Officer Contact Information

If you have any questions regarding the processing or updating of your personal information, or if you would like to raise any concerns regarding your personal information, please contact us by email at rprp@botabota.ca or by telephone at +1 514-284-0333.

A response will be provided within the time limits prescribed by law, subject to the receipt of a compliant request where required.

Updates to This Privacy Policy

We may modify this Privacy Policy at any time. We therefore encourage you to review it regularly to stay informed about how we process personal information.

This version was last updated on September 8, 2026.