Privacy Policy

1. Introduction

Bree Technologies Ltd. ("Bree", "we", "us", or "our") is committed to protecting the privacy and confidentiality of the personal information of the individuals we serve. This Privacy Policy (the "Policy") explains how we collect, use, disclose, retain, and protect personal information in connection with our website, mobile application, and cash advance services (collectively, the "Services").

This Policy applies to anyone who:

• visits or uses our website or mobile application;
• applies for or uses our Services;
• has previously been our customer; or
• communicates with us in any manner.

This Policy is intended to comply with Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and, where applicable, the Personal Information Protection Acts of Alberta and British Columbia (together with PIPEDA, the "Applicable Privacy Laws").

We encourage you to read this Policy carefully. By using our Services or providing us with personal information, you consent to the collection, use, and disclosure of your personal information in accordance with this Policy.

2. Accountability

Bree is responsible for the personal information in its possession and control, including personal information transferred to third parties for processing on our behalf. We have designated a Privacy Officer who is responsible for overseeing our compliance with this Policy and Applicable Privacy Laws. You may contact our Privacy Officer at any time using the contact information in Section 14.

We maintain a privacy management program that includes policies and procedures for the handling of personal information, employee training, and regular review of our privacy practices. We incorporate privacy by design principles into the development and improvement of our Services, consistent with our obligations under Applicable Privacy Laws.

3. Personal Information We Collect

"Personal information" means information about an identifiable individual, as defined under Applicable Privacy Laws. We collect the following categories of personal information:

(a) Information You Provide Directly

• Identity and contact information, such as your name, date of birth, address, phone number, and email address;
• Government-issued identification, such as a driver's licence or passport, collected to verify your identity;
• Social Insurance Number, collected where required for credit or tax purposes;
• Financial information, including information about your income, employment, bank accounts, debit card details, and payment history;
• Communications you send us, including support requests, chat transcripts, and responses to surveys or promotions.

(b) Information We Collect Automatically

• Bank account and transaction history, collected through third-party bank connection services (see Section 5(b));
• Device and technical information, including IP address, device identifiers, browser type, operating system, and related metadata;
• Usage and behavioural information, such as pages visited, features used, and time spent on our website or application;
• Cookies and similar tracking technologies (see Section 10).

(c) Information Collected from Third Parties

• Identity verification information obtained from third-party identity verification providers;
• Information provided by referral or affiliate partners where you have accessed our Services through such a partner.

(d) Sensitive Personal Information

We do not intentionally collect sensitive personal information beyond what is necessary to provide our Services. Where sensitive information is collected, such as government identification, Social Insurance Number, or financial account credentials, we apply heightened security and access controls.

(e) Children's Privacy

Our Services are not directed at individuals under the age of 18, and we do not knowingly collect personal information from minors. If we become aware that we have collected personal information from a minor, we will take steps to delete it as soon as practicable.

4. Why We Collect Personal Information

We collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances, and only to the extent necessary to fulfil those purposes. These purposes include:

(a) Providing and Managing Our Services

• Processing your application for a cash advance and determining your eligibility and loan amount;
• Verifying your identity and assessing your creditworthiness, including through automated underwriting (see Section 11);
• Setting up, managing, and administering your account;
• Processing disbursements to your bank account or debit card and collecting repayments;
• Communicating with you about your account, transactions, and the status of your Services.

(b) Fraud Prevention and Security

• Detecting, investigating, and preventing fraud, identity theft, unauthorized access, and other harmful or unlawful activity;
• Maintaining the security and integrity of our platform and systems.

(c) Legal and Regulatory Compliance

• Complying with applicable laws and regulations, including anti-money laundering and know-your-customer requirements;
• Responding to lawful requests, court orders, or government investigations;
• Exercising or defending our legal rights.

(d) Improving Our Services

• Conducting internal analytics, research, and testing to improve the performance, reliability, and user experience of our Services;
• Training and quality assurance, including review of support interactions;
• Developing new products and features.

(e) Marketing and Affiliate Offers

• Sending you marketing communications about our products and services, subject to your consent where required;
• Presenting you with affiliate offers for third-party products and services that may be of interest to you (see Section 5(d));
• Conducting targeted advertising through third-party platforms, subject to your consent where required (see Section 10).

We will not use your personal information for a new purpose that is not described in this Policy without first identifying the new purpose and obtaining your consent, except where otherwise permitted by Applicable Privacy Laws.

5. How We Share Personal Information

We do not sell your personal information to third parties. We may disclose personal information in the following limited circumstances:

(a) Service Providers

We share personal information with third-party service providers that help us operate, deliver, and improve our Services. These providers are permitted to use your personal information only to perform services on our behalf and are bound by contractual obligations to protect it. Our service providers include providers of the following types of services:

• Cloud infrastructure and data hosting;
• Data analytics and business intelligence;
• Customer communications, including email, SMS, and push notifications;
• Customer support and ticketing;
• Fraud detection and monitoring, including providers that use machine learning and artificial intelligence;
• Software development, deployment, and operational tooling;
• Payment processing and fund disbursement;
• Identity verification.

Personal information processed in connection with our Services may be stored or processed outside of Canada, including in the United States. Please see Section 7 for further information about cross-border transfers.

(b) Bank Connection and Payment Providers

To assess your eligibility for a cash advance, we connect to your bank account through third-party bank connection services, which may include Flinks Technology Inc. and Plaid Inc. These providers retrieve your bank account information and transaction history on our behalf. Your banking credentials are maintained by these providers and are not stored by us.

We also use third-party payment processors to disburse funds to and collect repayments from your debit card or bank account. By using our Services, you authorize us and the applicable third-party provider to access and transmit your financial information for these purposes. Each provider's handling of your information is governed by its own privacy policy, which we encourage you to review.

(c) Affiliate Offers

We may present you with offers for products and services from trusted third-party partners, including other financial services providers and non-financial products and services. These are affiliate arrangements under which we may receive a commission if you register or purchase through our referral. We do not share your personal information with affiliate partners without your consent. If you choose to engage with an affiliate offer, any personal information you provide to that third party is governed by the third party's own privacy policy.

(d) Advertising Partners

We may share information with third-party advertising platforms to deliver targeted advertisements and measure the effectiveness of our marketing campaigns. This may include sharing identifiers or hashed contact information with platforms such as Meta, Google, and TikTok. Please see Section 10 for further information, including your choices regarding targeted advertising.

(e) Legal Compliance and Protection of Rights

We may disclose personal information where required or permitted by law, including in response to a court order, subpoena, or lawful request by a government authority, or where necessary to protect our legal rights or the safety of any person.

(f) Business Transactions

If we are involved in a merger, acquisition, financing, sale of assets, or other corporate transaction, personal information may be disclosed to the parties involved as part of that transaction. We will provide notice of any such transfer and the acquiring entity will be required to handle your personal information in a manner consistent with this Policy.

(g) Aggregated and De-identified Data

We may share aggregated or de-identified information that cannot reasonably be used to identify you with third parties for research, analytics, or other purposes.

6. Consent

We collect, use, and disclose your personal information with your consent, except where collection, use, or disclosure without consent is permitted or required by Applicable Privacy Laws. Your consent may be express (given explicitly in writing or verbally) or implied by the circumstances (for example, by submitting a loan application, you consent to the collection and use of your financial information to assess your eligibility).

Where we intend to use your personal information for marketing communications or to present affiliate offers, we will seek your express consent where required by Applicable Privacy Laws. You may withdraw your consent to marketing at any time using the unsubscribe mechanism in our communications or by contacting our Privacy Officer. Withdrawing consent to marketing will not affect your ability to use our Services.

You may also withdraw consent to other uses of your personal information by contacting our Privacy Officer, subject to legal and contractual restrictions and reasonable notice. Please be aware that withdrawing consent to certain uses may limit or prevent us from providing the Services to you.

7. Cross-Border Transfers of Personal Information

Personal information we collect may be transferred to, stored in, or processed in jurisdictions outside Canada, including the United States, where our service providers maintain infrastructure or operations. Privacy laws in those jurisdictions may not provide the same level of protection as the laws of your province or territory.

When we transfer personal information outside Canada, we take steps to ensure that it receives a comparable level of protection, including through contractual arrangements with the receiving party. By using our Services, you acknowledge that your personal information may be transferred outside Canada as described in this Policy.

If you wish to obtain further information about the transfer of your personal information outside Canada, please contact our Privacy Officer.

8. Data Retention

We retain personal information for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal and regulatory obligations. Our general retention practices are as follows:

• Active account information is retained for the duration of your relationship with us;
• Following account closure, certain records are anonymized or deleted in accordance with our account deletion process (see below), with remaining records retained as required by applicable law, including anti-money laundering legislation, and for fraud detection purposes;
• Application and transaction records, including loan application details, payment history, and related metadata, are retained following the end of the relevant transaction or relationship for fraud detection purposes;
• Operational logs, including security and access logs, are retained for limited periods consistent with their operational purpose;
• Marketing consent records are retained for as long as necessary to evidence your consent preferences.

Account Deletion

When you request deletion of your account, we take the following steps:

• Certain identifiers, including your IP address and device user agent, are hard deleted;
• Profile personal information is erased or replaced with anonymized values;
• Records across transaction, payment, messaging, identity verification, and other operational tables are scrubbed of personal identifiers;
• Certain non-identifying records, including anonymized transaction metadata, device and fraud-detection identifiers, and account structure records, are retained for fraud prevention, legal compliance, and audit purposes.

When personal information is no longer required, we destroy it securely or render it irreversibly anonymized.

9. Protecting Personal Information

We implement reasonable technical, physical, and organizational security measures designed to protect personal information from unauthorized access, use, disclosure, alteration, or destruction. Our security measures include:

• Encryption of personal information in transit using Transport Layer Security (TLS) and, where applicable, at rest;
• Role-based access controls limiting access to personal information to authorized personnel with a need to know;
• Regular security assessments, vulnerability testing, and monitoring of our systems;
• Employee training on privacy and information security obligations;
• Contractual security requirements imposed on service providers and processors.

Despite these measures, no method of electronic transmission or storage is completely secure. You can help protect your information by using a strong, unique password for your account, not disclosing your password to anyone, and contacting us immediately if you suspect unauthorized access to your account. We will never ask for your password in an unsolicited communication.

In the event of a privacy breach that creates a real risk of significant harm to you, we will notify you and report the breach to the applicable regulatory authority without unreasonable delay, as required by Applicable Privacy Laws.

10. Cookies and Online Tracking

We use cookies, web beacons, pixel tags, and similar tracking technologies on our website and mobile application to collect information about your device and how you interact with our Services. This information is used to:

• operate and secure our platform;
• remember your preferences and settings;
• analyze usage patterns and improve the user experience;
• deliver and measure the effectiveness of marketing campaigns, including targeted advertising through third-party platforms.

We may share certain identifiers or hashed contact information with advertising platforms such as Meta, Google, and TikTok to enable targeted advertising and to identify users with similar characteristics to our existing customers. These platforms may use this information in accordance with their own privacy policies.

You may manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of our Services. Where required by Applicable Privacy Laws, we will seek your consent before using tracking technologies for marketing or advertising purposes.

We also use third-party analytics tools to understand how users interact with our Services. These tools may collect information about your device and usage in accordance with their own privacy policies.

11. Automated Decision-Making

We use automated processing, including machine learning models, to assess applications for our Services, including to verify your identity, determine your eligibility for a cash advance, and calculate the loan amount we are able to offer you. These automated processes analyze information such as your bank transaction history, and other data you provide or that we collect about you.

Automated decisions regarding your eligibility or loan amount may have a significant effect on you. Where our automated processes result in an adverse decision (for example, declining your application or reducing your loan limit) you may contact our Privacy Officer to request that the decision be reviewed by a member of our team.

We also use automated tools, including artificial intelligence, to assist with fraud detection and the management of customer alerts and communications. These tools are used to support, not replace, human oversight of our operations.

12. Your Privacy Rights

Subject to applicable law, you have the following rights with respect to your personal information:

(a) Right to Access

You have the right to request access to the personal information we hold about you, including information about the purposes for which it is used and the third parties to whom it has been disclosed. We will respond to access requests within 30 days, subject to any extensions permitted by Applicable Privacy Laws. In certain circumstances, we may charge a nominal fee for access, in which case we will notify you in advance.

(b) Right to Correct

You have the right to request correction of personal information that is inaccurate, incomplete, or out of date. Please contact us or update your information directly through your account settings where available.

(c) Right to Withdraw Consent

You may withdraw consent to the collection, use, or disclosure of your personal information at any time, subject to legal and contractual restrictions and reasonable notice, as described in Section 6.

To exercise any of these rights, please submit a written request to our Privacy Officer using the contact information in Section 14. We will verify your identity before processing your request. We will respond within the timeframe required by Applicable Privacy Laws, generally 30 days from receipt of a complete request.

13. Third-Party Links and Services

Our website and mobile application may contain links to third-party websites or services that we do not own or operate. This Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party service before providing personal information. We are not responsible for the privacy practices or content of third-party services.

14. Privacy Officer and How to Contact Us

We have designated a Privacy Officer responsible for overseeing compliance with this Policy and Applicable Privacy Laws. If you have questions, concerns, or complaints about our privacy practices, or wish to submit a request to exercise your rights, please contact our Privacy Officer:

Privacy Officer
Bree Technologies Ltd.
Email: [privacy@trybree.com]

We will acknowledge your request within five (5) business days and respond substantively within the time required by Applicable Privacy Laws.

If you are not satisfied with our response, or wish to escalate your concern, you may contact the applicable regulatory authority:

• Office of the Privacy Commissioner of Canada: priv.gc.ca
• Office of the Information and Privacy Commissioner of Alberta: oipc.ab.ca
• Office of the Information and Privacy Commissioner for British Columbia: oipc.bc.ca

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or Applicable Privacy Laws. We will post the updated Policy on our website and update the date first noted above. Where changes are material for you and we have the ability to contact you, we will provide you with advance notice, for example by email or through a notice within our application, before the changes take effect. Your continued use of our Services following notice of material changes will constitute your acceptance of the revised Policy, to the extent permitted by law.

We encourage you to review this Policy periodically to stay informed about how we protect your personal information.

‍