PRIVACY NOTICE

Carquest Canada

Last Updated: September 7, 2026

Carquest Canada Holdings Inc. and Carquest Canada Ltd. (collectively, “Carquest,” the “Company,” “we,” or “us”), which are owned by Advance Auto Parts, Inc., want you to be familiar with how we collect, use, and disclose personal information in connection with our Canadian consumer and business relationships. For details about the scope of this privacy notice, please refer to the Scope section below. This Privacy Notice is not a contract and does not limit any rights or obligations that may apply under Canadian federal or provincial privacy laws.

This privacy notice is available in English. Une version française de cet énoncé de confidentialité est disponible à l'adresse suivante : Politique de Confidentialité

Categories of Personal Information

We collect the following categories of personal information:

• Identifiers and Contact Information. This includes your name, postal address, phone number, and email address. It also includes online identifiers such as your IP address or cookie ID, and financial or payment information, such as your payment card information.
• Business Contact and Commercial Account Information. This includes business contact details, job title, employer or company name, commercial account identifiers, purchase order or invoice information, trade or credit application information, and communications with sales, account, vendor, procurement, or customer support teams.
• Commercial Information. This includes vehicle information (e.g., type, year, make, model), products or services you purchased, reviewed, or considered purchasing, and product warranty registrations.
• Internet Activity Information. This includes your browsing history, search history, or other information about how you interact with our websites, applications, and advertisements.
• Geolocation Data. This includes precise geolocation data when you choose to share your location (e.g., through mobile app settings), as well as coarse location data (e.g., city or region) that we infer from your IP address.
• Audio or Electronic Data. This includes recordings captured when you communicate with us by phone or through virtual channels. Where required by law, we provide notice at or before the time of recording.
• Demographic and Survey Information. This includes information you provide in surveys or promotional entries.
• Inferences and Preferences. Information we learn or infer about you, such as your shopping preferences.
• Sensitive Personal Information. This may include driver’s license information, precise geolocation, financial or payment information, and other information that may be considered sensitive under applicable law. We collect sensitive personal information only where necessary for the identified purposes, with express consent where required by law, and subject to safeguards appropriate to the sensitivity of the information. Please do not share sensitive personal information with us unless we specifically request it.
• Additional Personal Information Disclosed at Collection. We may collect additional categories of personal information if we identify the category and purpose at or before the time of collection, or if you otherwise provide consent where required by applicable law.

To the extent we process de-identified information, we will maintain and use it in de-identified form and will not attempt to re-identify the information unless permitted by applicable law.

Methods of Collection

We collect personal information from various sources, including directly from you, through automated means, from vendors and other external sources, and by generating information about you.

Information You Provide

You may provide personal information when you interact with us. This includes when you:

• Visit our stores or contact us for customer service (including by phone, email, or chat)
• Sign up for a newsletter or respond to a survey
• Register a product warranty
• Enter a contest or sweepstakes
• Interact with our websites or mobile applications
• Provide information at events or in-store
• Apply for, use, or manage a commercial, trade, fleet, vendor, or supplier relationship with us
• Provide purchase orders, invoices, trade references, or other business records

Automated Information Collection

When you visit our digital properties (e.g., websites, mobile apps, HTML-formatted email messages), we collect information using technologies such as cookies, pixels, tags, embedded scripts, SDKs, and other tracking tools. This may include:

• Device and browser information: IP address, device type, operating system, browser type, language settings, and advertising identifiers.
• Usage data: Pages visited, links clicked, app usage patterns, and interaction behavior.

We use analytics tools (such as Google Analytics) to understand how users interact with our services and to measure advertising effectiveness.

Information from Other Sources

• Other Businesses in Our Corporate Family. We may receive information from another business within our corporate family.
• Publicly Available Sources. Information from public records and online directories.
• Joint Marketing Partners. Information from partners with whom we jointly offer products, services, or promotions.
• Data Enrichment Services. Services that provide additional context, such as updated contact details.
• Social Media Platforms. Information about your interactions with our content on social media, subject to your privacy settings.
• Advertising and Analytics Providers. Information about your interactions with our advertisements.
• Commercial Account and Credit Sources. Information from commercial customers, vendors, suppliers, payment processors, financial institutions, credit agencies, trade references, logistics providers, and other sources that support our business relationships.

Information We Generate or Derive

We may generate or infer information about you based on data we collect, for example, analyzing your activity to identify preferences and provide personalized recommendations.

Purpose of Collection

We collect and use your personal information for the following purposes. Under Canadian privacy law, we identify these purposes at or before the time of collection and obtain consent where required.

Provide Products or Services

We use personal information to:

• Complete and document transactions, process returns and exchanges, verify your information, and provide customer service
• Administer loyalty programs, promotions, warranties, and related benefits
• Provide in-store services and support

Business Relationships and Commercial Accounts

We use personal information to:

• Establish, administer, and support commercial, trade, fleet, vendor, supplier, and procurement relationships
• Process invoices, payments, rebates, credits, returns and related accounting records
• Evaluate and manage credit, trade references, fraud prevention, collections, and account risk
• Communicate with business contacts about products, services, contracts, orders, warranties, account administration, and business opportunities

Customer Communication and Outreach

We use personal information to:

• Send newsletters, marketing communications, and targeted advertising about our products and services
• Understand your interests and preferences to personalize our interactions
• Respond to and document your inquiries, questions, suggestions, or complaints
• Send administrative messages, such as updates to our terms or policies
• Offer sweepstakes, contests, or other promotional activities

Maintain and Improve Products and Services

We use personal information to:

• Conduct data analytics and research, including developing new products and services
• Customize your experience in stores and online, including personalized advertisements and offers
• Support business operations such as auditing, debugging, fraud prevention, and security

Legal, Compliance, Law Enforcement, and Security

We use personal information to:

• Comply with and enforce legal, contractual, and regulatory requirements
• Assist law enforcement and respond to regulatory inquiries
• Protect the physical and cyber security of the Company, its employees, and its customers

Other Purposes

We may use personal information for other purposes disclosed at the time of collection or for which you have provided consent.

Disclosure of Personal Information

We may disclose personal information for the following purposes:

Other Businesses in Our Corporate Family

We disclose personal information to other businesses in our corporate family to deliver products or services, communicate relevant updates, maintain quality, and fulfill legal and security obligations.

Product and Service Providers

We disclose personal information to service providers who assist our business operations, including website hosting, data analytics, payment processing, fraud prevention, IT services, customer support, promotional services, email delivery, and auditing. These providers are contractually required to protect personal information and use it only for the purposes for which it was disclosed.

Commercial Account, Payment, Credit, and Business Partners

We may disclose personal information to banks, payment processors, credit agencies, trade references, insurers, logistics providers, professional advisers, auditors, suppliers, and other business partners where needed to establish, administer, support, or enforce commercial, trade, vendor, supplier, procurement, payment, or financial relationships.

Third Parties

We may disclose personal information to advertising partners, social media platforms, ad technology providers, and analytics companies to deliver relevant advertising, track engagement, and measure campaign effectiveness.

We may also disclose personal information to joint marketing partners and third-party sponsors of promotions, contests, or sweepstakes.

Legal, Enforcement, and Security

We may disclose personal information when required by law, regulation, or legal process (such as a court order or subpoena), in response to lawful requests from government agencies or law enforcement, or to protect the rights, property, or safety of our Company, customers, or others.

Business Transfers

We may disclose your personal information in connection with any reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

With Your Consent

You may elect to disclose personal information by consenting to or directing us to do so.

Your Privacy Choices

Marketing Emails

If you no longer want to receive marketing emails from us, you may opt out by using the unsubscribe link in the footer of the email. We may still send you important administrative messages from which you cannot opt out.

SMS

If you no longer want to receive automated text messages, you may opt out by responding STOP to such messages.

Mobile Apps

You can uninstall our mobile app or manage push notification preferences using the standard settings on your mobile device.

Cookies and Other Technologies

Cookies are small data files stored on your browser that help us collect information such as browser type, IP address, time spent on our services, pages visited, and language preferences. We, as well as our service providers and third-party vendors, use the data collected by these technologies to enhance security, improve navigation, personalize your experience, and facilitate Interest-Based Advertising (see section below). In addition to cookies, we may use other online technologies, such as web beacons, pixels, tags, embedded scripts, and SDKs (in mobile apps) for the purposes above.

We may use third-party web analytics services such as Google Analytics. You can learn more about how Google Analytics collects and processes data and opt out at https://tools.google.com/dlpage/gaoptout/.

Interest-Based Advertising

We may collect information about your interactions with our websites and apps to deliver interest-based advertising (ads based on your browsing behavior), subject to your consent if required by applicable law. You can opt out of interest-based advertising by visiting the Digital Advertising Alliance of Canada at https://youradchoices.ca/ or by adjusting your device’s advertising settings.

Withdrawing Consent

Subject to legal or contractual restrictions and reasonable notice, you may withdraw your consent to our collection, use, or disclosure of your personal information at any time. Please note that withdrawal of consent may affect our ability to provide you with certain products or services. To withdraw consent, please contact us using the information in the Contact section below.

Privacy Rights

Under Canadian federal and provincial privacy laws, including PIPEDA, Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), Alberta PIPA, and BC PIPA, consumers, business contacts, and other individuals may have the following rights with respect to their personal information, subject to limited exceptions provided by law:

These rights apply where the information is personal information under applicable law. Some laws treat business contact information or work product information differently when it is used solely to contact an individual in their business capacity, but other information about an identifiable business contact may still be personal information.

• Access/Portability. You may request access to or a copy of the personal information we hold and process about you.
• Correction/Rectification. You may request correction of any personal information that is inaccurate, incomplete, or equivocal.
• Withdrawal of Consent. You may withdraw your consent to the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions and reasonable notice.
• Deletion. In certain circumstances, you may request deletion of personal information, subject to exceptions permitted by law.
• Non-Retaliation. We will not refuse to provide you with products or services, or subject you to different treatment, solely because you exercised a privacy right.
• For Québec residents, you will be prompted to provide consent for non-essential cookies upon entering our websites intended for Québec residents. You may modify your cookie preferences at any time through the “Cookie Preferences” setting, except where the technology is strictly necessary to provide the services you request or is otherwise permitted by law.

How to Exercise Your Rights

To exercise any of the Canadian privacy rights described above, please submit a privacy request form; we will respond to your request within the timeframes required by the law that applies to your request, which may vary by jurisdiction and may be extended where permitted.

We may need to verify your identity before processing your request. If you submit a request on behalf of another individual (e.g., as an authorized representative, parent, or tutor), we may require proof of authority.

Quebec-Specific Disclosures

The following additional disclosures apply to individuals whose personal information is collected, held, used, or communicated in the course of our activities in Quebec, in accordance with Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25).

Person in Charge of Personal Information Protection

Carquest has designated a person in charge of the protection of personal information (the “Privacy Officer”). Quebec residents may contact the Privacy Officer regarding any questions or concerns via the channels listed in the Contact Us section.

Cross-Border Transfers and Storage Outside Canada

Carquest assesses personal information that is being transferred outside of Quebec to adequately protect the information. As a company with operations across Canada and the US, Carquest and its family of companies may transfer your information outside of Quebec to better serve you as a customer.

For Quebec residents, before communicating personal information outside Quebec, we assess the privacy-related factors required by Quebec law, including the sensitivity of the information, the purposes for which it will be used, the safeguards that will apply, and the legal framework applicable in the receiving jurisdiction. We enter into written agreements with service providers and other recipients outside Quebec where required by law.

Children and Youth Information

Our website is intended for use by those who have reached the age of majority in the province where they reside and is not directed to children. For purposes of this Privacy Notice, a "child" is an individual who is not capable of providing meaningful consent under applicable privacy laws, and a "youth" is an individual who has not yet reached the age of majority in their province or territory of residence but who may be capable of providing meaningful consent depending on their age, maturity, and the circumstances.

We do not knowingly collect personal information from children. We also do not knowingly collect personal information from a youth where the consent of a parent or legal guardian is required under applicable law. In Quebec, parental or guardian consent is generally required for individuals under 14 years of age. If a youth or child has provided us with personal information without appropriate consent, we ask that a parent or guardian contact us so that the information can be deleted.

Data Protection

We strive to maintain reasonable administrative, technical, contractual, and physical safeguards to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification.

However, due to the inherent risks associated with internet use and information systems, we cannot guarantee that our systems, websites, or applications will be completely secure.

Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required or permitted by applicable law.

Scope

“Personal information” in this privacy notice means information about an identifiable individual. It does not include aggregated or de-identified information that cannot reasonably be used to identify an individual. Depending on applicable law, it may also exclude business contact information used solely for the purpose of communicating with an individual in their capacity as an employee or representative of an organization.

This privacy notice applies to personal information collected about prospective, current, or former customers, consumers, commercial account contacts, vendor and supplier contacts, business partners, and other individuals who interact with Carquest in Canada. It does not apply to:

• Job applicants or employment-related records at Carquest (which are governed by separate notices)
• Your interactions with third-party websites or services that may be linked to or accessible from Carquest websites; those sites are governed by their own privacy notices
• Social media features on our websites (such as Facebook or Instagram widgets), which may be hosted by third parties and are subject to those third parties’ privacy policies
• Situations where Carquest acts as a service provider or processor on behalf of another organization
• Carquest stores operated by independent dealers (including any other activities or communications undertaken by those dealers)

Updates to This Privacy Notice

The “LAST UPDATED” legend at the top of this privacy notice indicates when it was last revised. Any changes will become effective when we post the revised privacy notice. We encourage you to review this privacy notice periodically.

Contact

If you have any questions about this privacy notice or our practices regarding the collection, use, and disclosure of personal information, please contact us:

Quebec residents may direct inquiries about the protection of their personal information to the Privacy Officer at the contact information above.

Please do not include credit card, driver’s license, or other sensitive information in your emails to us unless we specifically request it through a secure process.