ADDRESSSYNC INNOVATIONS INC.

1. OUR PRIVACY PRINCIPLE

AddressSync is designed around a simple principle:

Personal information should be collected only when necessary, used only for legitimate and identified purposes, communicated only to authorized recipients, protected throughout its lifecycle, and retained only for as long as reasonably necessary or legally required. Our architecture is designed to minimize unnecessary persistence of personal information while allowing authorized address changes to be securely transmitted to institutions selected by the individual.

Where the AddressSync architecture uses a transient Buffer Loop, information may pass through the Buffer Loop for the limited purpose of validating, routing, coordinating, or transmitting an authorized address-change transaction. The existence, duration, and technical operation of any Buffer Loop processing are governed by our internal technical and privacy controls. Where AddressSync maintains an AddressSync Vault or other persistent repository, information retained there is subject to the retention, access-control, security, and deletion rules described in this Policy.

2. WHO IS RESPONSIBLE FOR YOUR PERSONAL INFORMATION?

AddressSync Innovations Inc. is responsible for personal information under its custody or control. Under Quebec Law 25, the person exercising the highest authority within the organization is responsible for ensuring compliance with applicable private-sector privacy legislation, unless that function has been formally delegated in accordance with applicable law.

Responsible for the Protection of Personal Information Privacy Officer / Responsible Person: David Bright AddressSync Innovations Inc. Montreal, Quebec, Canada Email: support@addresssync.ca Postal Address: 3 ave. du Moulin Lachine QC, Canada

The title and contact information of the person responsible for the protection of personal information will be maintained publicly and updated when necessary.

3. WHAT IS PERSONAL INFORMATION?

“Personal information” generally means information about an identifiable individual. Depending on the Services used, this may include information such as:

• name;
• residential or mailing address;
• previous address;
• new address;
• effective date of an address change;
• date of birth;
• telephone number;
• email address;
• account identifiers;
• authentication information;
• transaction or synchronization identifiers;
• institution selections;
• records showing when an address-change request was initiated, validated, transmitted, accepted, rejected, or failed;
• technical information associated with a transaction;
• device, browser, IP address, log, security, and authentication information;
• consent and authorization records;
• correspondence with AddressSync;
• information required to investigate fraud, abuse, security incidents, or unauthorized transactions.

Not every user will provide every category of information.

4. PERSONAL INFORMATION WE COLLECT

5. WHY WE COLLECT PERSONAL INFORMATION

AddressSync collects, uses, or communicates personal information only for identified purposes that are reasonably necessary for the Services or otherwise permitted by law. These purposes may include:

• A. Providing Address Synchronization: To receive, validate, process, route, transmit, monitor, and document an authorized address-change request.
• B. Identity Verification: To determine that the person initiating an address-change request is the appropriate account holder or authorized person.
• C. Security and Fraud Prevention: To detect unauthorized access, fraudulent transactions, impersonation, abuse, account takeover, malicious activity, or other security threats.
• D. Authentication: To provide password-based and multi-factor authentication and related account-security functions.
• E. Institution Authorization: To determine which participating institutions or organizations the user has authorized AddressSync to communicate with.
• F. Transaction Integrity: To maintain sufficient technical and transactional records to establish what information was submitted, when it was submitted, what authorization existed, and what transmission occurred.
• G. Customer Support: To investigate and resolve support requests, complaints, synchronization failures, and technical problems.
• H. Legal and Regulatory Compliance: To comply with applicable laws, court orders, lawful governmental requests, regulatory obligations, and legal processes.
• I. Security Monitoring: To protect AddressSync, its users, institutional partners, service providers, systems, and infrastructure.
• J. Service Improvement: Where legally permitted and appropriately safeguarded, AddressSync may use aggregated, de-identified, or anonymized information for statistical analysis, service reliability, security analysis, performance measurement, research, and product improvement.

AddressSync will not use personal information for an unrelated new purpose without an appropriate legal basis and, where required, obtaining additional consent.

6. NECESSITY AND DATA MINIMIZATION

AddressSync applies a data-minimization approach. We seek to collect only the information reasonably necessary for the specific purpose for which it is collected. Before introducing a new category of personal information, AddressSync should evaluate whether that information is necessary to achieve the identified purpose. Where a less intrusive method can reasonably achieve the same legitimate purpose, AddressSync may consider using that alternative.

7. CONSENT

Where consent is required by applicable law, AddressSync seeks consent in a manner intended to be meaningful, informed, specific, and understandable. Consent requests should identify, as appropriate:

• what information is being collected;
• why it is being collected;
• how it will be used;
• with whom it may be communicated;
• the consequences of providing or withholding consent;
• how consent may be withdrawn.

For sensitive personal information or uses outside reasonable expectations, AddressSync may require express consent. Consent does not authorize AddressSync to disregard its other privacy obligations. Meaningful consent is a central requirement of PIPEDA, and Quebec's privacy framework also requires consent to be obtained for specific purposes and in clear language. (Office of the Privacy Commissioner)

8. ADDRESS-SYNC AUTHORIZATION

When a user selects or links an institution through AddressSync, the user authorizes AddressSync, subject to the applicable service flow and terms, to communicate the information necessary to process the selected address-change request to that institution. The authorization may include:

• identity information;
• address information;
• effective date;
• transaction identifiers;
• information necessary to authenticate or validate the transaction.

The scope of the authorization is limited to the selected institution(s), selected service(s), and identified purpose(s). AddressSync does not interpret a user's authorization as permission to disclose personal information to unrelated organizations.

9. RECEIVING INSTITUTIONS

AddressSync may transmit information to institutions selected or authorized by the user. Depending on the nature of the relationship, those institutions may independently determine how they process information after receiving it. Examples may include:

• financial institutions;
• insurance organizations;
• utilities;
• telecommunications providers;
• government or public-sector organizations;
• educational institutions;
• subscription or service providers;
• other participating organizations.

Once an institution receives information, that institution may become independently responsible for its own handling, retention, security, and use of the information. AddressSync does not control: whether the receiving institution accepts an address change; how quickly it processes the change; how it updates its own records; how long it retains the information; whether it sends correspondence to the new address; whether its internal systems experience errors or outages. Users should therefore continue to comply with any direct notification requirements imposed by their institutions.

10. THIRD-PARTY SERVICE PROVIDERS

AddressSync may use carefully selected service providers to operate portions of the Services. These may include providers supporting:

• cloud infrastructure;
• database hosting;
• authentication;
• encrypted storage;
• communications;
• monitoring;
• cybersecurity;
• address validation;
• logging;
• customer support;
• analytics;
• backup and disaster recovery.

Service providers may access personal information only to the extent reasonably necessary to provide contracted services, subject to applicable contractual, security, and privacy requirements. AddressSync remains accountable for personal information under its control even where certain processing functions are performed by service providers.

11. ADDRESS VALIDATION

AddressSync may use third-party address-validation services to verify, standardize, format, or otherwise validate address information. Where such a service requires the communication of personal information, AddressSync will assess the necessity, security, contractual safeguards, and legal basis for the communication. Where a third-party service processes information outside Quebec, AddressSync will comply with applicable Quebec requirements concerning transfers outside Quebec, including the required privacy impact assessment where applicable. Quebec law requires such an assessment before communicating personal information outside Quebec and requires consideration of the sensitivity, purpose, safeguards, and applicable foreign legal regime. (Légis Québec)

12. INFORMATION STORED IN THE ADDRESSSYNC VAULT

Where the AddressSync product includes a persistent AddressSync Vault, certain information may be retained to support legitimate functions such as:

• maintaining an address history requested by the user;
• transaction traceability;
• user-requested recordkeeping;
• dispute resolution;
• security investigations;
• fraud prevention;
• legal compliance;
• institutional synchronization history.

The Vault is not intended to provide unrestricted access to personal information. Access is controlled through authentication, authorization, least-privilege principles, logging, and other security measures appropriate to the sensitivity of the information. The actual retention period for each category of information is determined by AddressSync's retention schedule and applicable legal requirements.

13. BUFFER LOOP AND TRANSIENT PROCESSING

The AddressSync architecture may use a Buffer Loop to facilitate controlled, temporary processing of address-change information. The Buffer Loop is designed to reduce unnecessary persistent exposure of personal information while allowing an authorized transaction to be:

• received;
• validated;
• authenticated;
• routed;
• transmitted;
• acknowledged or otherwise recorded as required by the service.

The Buffer Loop does not represent that a receiving institution has permanently updated its records. Where information is no longer necessary for the Buffer Loop's identified processing purpose, it should be removed or otherwise handled according to AddressSync's documented retention and deletion controls, subject to legitimate legal, security, audit, dispute, or transactional requirements.

14. PRIVACY BY DESIGN AND PRIVACY BY DEFAULT

AddressSync seeks to incorporate privacy into the design and operation of its systems rather than treating privacy as an after-the-fact control. This may include:

• data minimization;
• purpose limitation;
• least-privilege access;
• encryption;
• secure authentication;
• segregation of environments;
• audit logging;
• controlled APIs;
• transaction identifiers;
• retention limits;
• deletion controls;
• security monitoring;
• privacy impact assessments.

Where applicable, AddressSync configures publicly offered technological products and services with privacy-protective default settings. Quebec's Law 25 expressly establishes privacy-by-default requirements for technological products and services offered to the public. (Cai Québec)

15. SECURITY SAFEGUARDS

AddressSync uses administrative, technical, physical, and organizational safeguards appropriate to the sensitivity and volume of personal information processed. Depending on the system component, safeguards may include:

• encryption in transit;
• encryption at rest;
• secure authentication;
• multi-factor authentication;
• role-based access control;
• least-privilege access;
• access logging;
• security monitoring;
• vulnerability management;
• secure software-development practices;
• backups and disaster recovery;
• employee confidentiality obligations;
• security training;
• incident-response procedures;
• controlled administrative access.

Encryption Statement: Where implemented and technically verified, AddressSync may use industry-standard encryption such as AES-256 for protected data at rest and TLS for data transmitted over networks. AddressSync should not publish a specific encryption standard unless it is actually implemented throughout the relevant environment. Similarly, claims regarding ISO certification or Canadian-only hosting should be published only where supported by current contractual and infrastructure evidence. PIPEDA requires safeguards appropriate to the sensitivity of personal information rather than prescribing one universal technical standard. (Office of the Privacy Commissioner)

16. PRIVACY IMPACT ASSESSMENTS

AddressSync will conduct privacy impact assessments (“PIAs” or, where applicable in Quebec, “EFVPs”) when required by applicable law and may conduct them as a privacy-by-design practice for high-risk initiatives. An assessment may consider:

• sensitivity of information;
• volume of information;
• purpose of processing;
• technology involved;
• access controls;
• cybersecurity risks;
• service-provider relationships;
• data residency;
• international transfers;
• applicable foreign laws;
• potential harm;
• mitigation measures.

Quebec Law 25 requires privacy impact assessments in specified circumstances, including projects involving acquisition, development, or redesign of information systems or electronic service delivery involving personal information. (Cai Québec)

17. COMMUNICATION OUTSIDE QUEBEC

Where personal information is communicated outside Quebec, AddressSync will comply with applicable Quebec requirements. Before such communication where required by law, AddressSync will conduct the required privacy impact assessment and evaluate factors including: sensitivity of the information; purpose of the communication; security and contractual safeguards; applicable laws in the destination jurisdiction; level of protection available to the information. The communication will proceed only where legally permitted and where the required safeguards and contractual arrangements are in place.

18. COOKIES AND TECHNICAL INFORMATION

AddressSync may use cookies, local storage, session identifiers, logs, pixels, or similar technologies for purposes such as:

• authentication;
• session management;
• security;
• fraud prevention;
• service functionality;
• preferences;
• performance monitoring.

Where non-essential analytics or tracking technologies are implemented, AddressSync will provide appropriate notice and obtain consent where required. Users may be able to control certain cookies through their browser or device settings, although disabling essential technologies may impair certain Services.

19. AUTOMATED PROCESSING AND PROFILING

AddressSync may use automated processes for purposes such as:

• address formatting or validation;
• duplicate detection;
• fraud or security screening;
• transaction routing;
• technical error detection;
• service reliability.

AddressSync does not intend to use personal information to make decisions about individuals based on discriminatory profiling. If AddressSync introduces automated decision-making that is legally subject to additional disclosure requirements, AddressSync will provide the information required by applicable law and appropriate mechanisms for exercising applicable rights.

20. PERSONAL INFORMATION OF MINORS

AddressSync is not designed to independently collect personal information from children for purposes unrelated to the Services. Where Quebec law requires parental or tutor authorization for the collection, use, or communication of personal information concerning a person under the applicable age threshold, AddressSync will implement appropriate controls. Law 25 contains specific rules concerning personal information of minors, including consent requirements for persons under 14. (Gouvernement du Québec)

21. RETENTION

AddressSync does not retain personal information indefinitely merely because it has been collected. Retention periods depend upon:

• the purpose for which information was collected;
• whether a transaction remains active;
• user-requested services;
• legal obligations;
• security and fraud-prevention requirements;
• dispute resolution;
• audit requirements;
• contractual obligations;
• limitation periods;
• whether the information can be securely deleted or anonymized.

When personal information is no longer required and no legal or legitimate reason for continued retention exists, AddressSync will securely destroy, delete, or otherwise handle the information in accordance with its retention and destruction procedures. Quebec's privacy framework requires organizations to establish governance practices addressing retention and destruction. (Légis Québec)

22. DESTRUCTION AND DE-IDENTIFICATION

When information is no longer required, AddressSync may:

• securely delete it;
• destroy physical records;
• render information irreversibly anonymous where legally permitted;
• otherwise dispose of it using safeguards appropriate to its sensitivity.

Information will not be represented as “anonymous” merely because direct identifiers have been removed if the individual could reasonably still be re-identified.

23. ACCESS TO PERSONAL INFORMATION

Subject to applicable legal exceptions, individuals may request access to personal information held by AddressSync. A request may include:

• the personal information AddressSync holds;
• information concerning its use;
• information concerning its communication;
• applicable categories of recipients;
• other information required by law.

We may require sufficient information to verify the identity and authority of the requester before providing access. PIPEDA generally provides individuals with a right of access and correction, subject to statutory exceptions. (Office of the Privacy Commissioner)

24. CORRECTION AND RECTIFICATION

If you believe personal information held by AddressSync is inaccurate, incomplete, or outdated, you may request correction. Where appropriate, AddressSync may also communicate corrected information to recipients to whom the inaccurate information was previously disclosed.

25. WITHDRAWAL OF CONSENT

Where processing is based on consent, an individual may withdraw consent, subject to legal or contractual restrictions and reasonable notice. Withdrawal may affect AddressSync's ability to provide certain Services. For example, withdrawing authorization to transmit an address to an institution may prevent AddressSync from completing that synchronization request. Withdrawal does not necessarily require AddressSync to delete information that must lawfully be retained for another purpose.

26. DELETION REQUESTS

You may request deletion of your account or personal information. AddressSync will assess the request under applicable law. Deletion may be refused or delayed where information must reasonably be retained for:

• legal compliance;
• fraud prevention;
• security;
• dispute resolution;
• enforcement of agreements;
• accounting or regulatory obligations;
• establishing, exercising, or defending legal claims;
• other legally recognized purposes.

Where complete deletion is not legally possible, AddressSync will limit continued use to the purposes requiring retention.

27. PRIVACY COMPLAINTS

If you believe AddressSync has mishandled your personal information, you may submit a written privacy complaint to our Privacy Officer. The complaint should identify, where reasonably possible:

• the nature of the concern;
• the relevant information;
• the date or approximate date;
• the service involved;
• any supporting documentation.

AddressSync will investigate complaints in accordance with its privacy complaint procedures. Where an individual is dissatisfied with the response or where applicable law permits, the individual may also have recourse to the applicable privacy regulator, including the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada, depending on the applicable legislation.

28. PRIVACY INCIDENTS

A privacy incident may include:

• unauthorized access;
• unauthorized disclosure;
• loss;
• theft;
• accidental disclosure;
• unauthorized modification;
• destruction;
• cybersecurity compromise;
• other event affecting personal information.

AddressSync maintains procedures for identifying, containing, investigating, documenting, and mitigating privacy incidents. Where applicable law requires notification to affected individuals or a regulator, AddressSync will make the required notification within the applicable timeframe. Quebec Law 25 requires organizations to maintain an incident register and to notify the Commission and affected individuals where a confidentiality incident presents a risk of serious harm. (Cai Québec)

29. THIRD-PARTY WEBSITES AND SERVICES

The AddressSync Services may contain links or integrations to third-party services. AddressSync is not responsible for the privacy practices of independent third parties. Users should review the privacy policies of institutions and other organizations to which they choose to transmit information.

30. BUSINESS TRANSACTIONS

If AddressSync is involved in a merger, financing, acquisition, reorganization, sale of assets, insolvency proceeding, or similar transaction, personal information may be transferred as part of the transaction where permitted by law. Any such transfer will remain subject to applicable privacy obligations.

31. CHANGES TO THIS PRIVACY POLICY

AddressSync may update this Policy to reflect:

• changes in law;
• changes in the Services;
• changes in technology;
• changes in data practices;
• security improvements;
• regulatory guidance.

The “Last Updated” date will be revised when the Policy changes. Where required by law, AddressSync will provide notice of material changes before or when they take effect.

32. GOVERNING PRIVACY LAW

This Policy is interpreted together with applicable privacy legislation. For Quebec users and activities subject to Quebec's private-sector privacy legislation, the applicable Quebec legislation governs to the extent applicable. For activities subject to PIPEDA or other applicable Canadian privacy legislation, the applicable legislation governs. Nothing in this Policy limits a right that cannot lawfully be waived.

33. CONTACT INFORMATION

AddressSync Innovations Inc. Privacy Officer / Responsible for the Protection of Personal Information: David Bright Email: support@addresssync.ca Mail: AddressSync Innovations Inc. 3 ave. du Moulin Lachine QC, Canada General Support: support@addresssync.ca

34. PRIVACY POLICY SUMMARY

In practical terms:

• We collect the information necessary to provide and secure AddressSync.
• We use it to authenticate users, process address changes, communicate authorized information, maintain transaction integrity, secure the platform, and comply with law.
• We communicate it only to authorized institutions, service providers, or other recipients where permitted or required by law.
• We minimize retention and apply different controls according to the sensitivity and purpose of the information.
• We protect it using administrative, technical, physical, and organizational safeguards appropriate to the risks.
• You have privacy rights including applicable rights of access, correction, withdrawal of consent, and other rights provided by law.
• We remain accountable for personal information under our custody or control.