Privacy Policy

1. Introduction

TryBree Technologies Ltd. ("TryBree") enters into agreements with borrowers and issues this Privacy Policy in connection with those agreements. Bree Technologies Ltd. ("Bree"), an affiliate of TryBree, collects, uses, discloses, retains, and safeguards personal information, and performs loan servicing and related operational functions, on behalf of TryBree. In this Privacy Policy, "we", "us", and "our" refer to TryBree and, where the context requires in relation to the handling of personal information or the operation of the Services, Bree acting on TryBree's behalf. This Privacy Policy describes how personal information is handled in connection with loan-related products and services (collectively, the "Services").

This Policy applies to anyone who:

• visits or uses our website or mobile application;
• applies for or uses our Services;
• has previously been our customer; or
• communicates with us in any manner.

This Policy is intended to comply with Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and, where applicable, the Personal Information Protection Acts of Alberta and British Columbia (together with PIPEDA, the "Applicable Privacy Laws").

We encourage you to read this Policy carefully. By using our Services or providing us with personal information, you consent to the collection, use, and disclosure of your personal information in accordance with this Policy.

2. Accountability

TryBree is responsible for personal information in its possession or control, including personal information handled by Bree on TryBree's behalf. Bree handles personal information in connection with the Services as a service provider acting for TryBree under contractual arrangements requiring the protection of personal information in accordance with this Privacy Policy and Applicable Privacy Laws. For additional information regarding Bree’s broader privacy practices, you may also review Bree’s privacy policy. TryBree has designated a Privacy Officer responsible for overseeing compliance with this Privacy Policy and Applicable Privacy Laws. Contact information for the Privacy Officer is set out in Section 14.

3. Personal Information We Collect

"Personal information" means information about an identifiable individual, as defined under Applicable Privacy Laws. In connection with the Services, personal information is collected by Bree on TryBree's behalf. The categories of personal information handled in connection with the Services include the following:

(a) Information You Provide Directly

• Identity and contact information, such as your name, date of birth, address, phone number, and email address;
• Financial information, including information about your income, employment, bank accounts, and payment history;
• Communications you send us, including support requests, chat transcripts, and responses to interviews, surveys or promotions.

(b) Information We Collect Automatically

• Bank account and transaction history, collected through third-party bank connection services (see Section 5(b));
• Device and technical information, including IP address, device identifiers, browser type, operating system, and related metadata;
• Usage and behavioural information, such as pages visited, features used, and time spent on our website or application;
• Cookies and similar tracking technologies (see Section 10).

(c) Information Collected from Third Parties

• Identity verification information obtained from third-party identity verification providers;
• Information provided by referral or affiliate partners where you have accessed our Services through such a partner.

(d) Sensitive Personal Information

We do not intentionally collect sensitive personal information beyond what is necessary to provide our Services. Where sensitive information is collected we apply heightened security and access controls.

(e) Children's Privacy

Our Services are not directed at individuals under the age of 18, and we do not knowingly collect personal information from minors. If we become aware that we have collected personal information from a minor, we will take steps to delete it as soon as practicable.

4. Why We Collect Personal Information

Personal information is collected, used, disclosed, and retained only for purposes that a reasonable person would consider appropriate in the circumstances and only to the extent reasonably necessary to fulfil those purposes. Those purposes include entering into borrower agreements through TryBree and the related collection, use, disclosure, retention, administration, and servicing activities carried out by Bree on TryBree's behalf. These purposes may include the following:

(a) Providing and Managing Our Services

• Processing your application for a loan-related product or service, determining your eligibility and loan amount, and entering into borrower agreements through TryBree, with related operational processing carried out by Bree on TryBree's behalf;
• Verifying your identity and assessing your creditworthiness, including through automated underwriting (see Section 11);
• Setting up, managing, administering, and servicing your account through Bree on TryBree's behalf;
• Processing disbursements, collecting repayments, and carrying out all loan servicing activities through Bree acting on TryBree's behalf;
• Communicating with you about your account, transactions, borrower agreement, and the status of your Services through Bree acting on TryBree's behalf;

These purposes also include fraud prevention, security, legal compliance, service improvement, and marketing activities carried out by Bree on TryBree's behalf, as further described below.

(b) Fraud Prevention and Security

• Detecting, investigating, and preventing fraud, identity theft, unauthorized access, and other harmful or unlawful activity;
• Maintaining the security and integrity of our platform and systems.

(c) Legal and Regulatory Compliance

• Complying with applicable laws and regulations, including anti-money laundering and know-your-customer requirements;
• Responding to lawful requests, court orders, or government investigations;
• Exercising or defending our legal rights.

(d) Improving Our Services

• Conducting internal analytics, research, and testing to improve our business, the performance, reliability, and user experience of our Services, or our marketing strategy;
• Training and quality assurance, including review of support interactions;
• Developing new products and features.

(e) Marketing and Affiliate Offers

• Sending you marketing communications about our products and services, subject to your consent where required;
• Presenting you with affiliate offers for third-party products and services that may be of interest to you (see Section 5(d));
• Conducting targeted advertising through third-party platforms, subject to your consent where required (see Section 10).

We will not use your personal information for a new purpose that is not described in this Policy without first identifying the new purpose and obtaining your consent, except where otherwise permitted by Applicable Privacy Laws.

5. How We Share Personal Information

We do not sell personal information to third parties. We may disclose personal information only in the following circumstances:

(a) Service Providers

TryBree makes personal information available to Bree, an affiliated company, because Bree carries out the collection, use, disclosure, retention, safeguarding, and other processing of personal information, and performs loan servicing and related operational functions, on TryBree's behalf. This includes the activities described in Section 4. Bree may use personal information only for those purposes and must protect it in accordance with this Privacy Policy, applicable contractual obligations, and Applicable Privacy Laws.

Personal information processed in connection with our Services may be stored or processed outside of Canada, including in the United States. Please see Section 7 for further information about cross-border transfers.

(b) Bank Connection and Payment Providers

To assess eligibility for loan-related products and services, Bree, on TryBree's behalf, connects to bank accounts through third-party bank connection services such as Flinks Technology Inc. or Plaid Inc. These providers retrieve bank account information and transaction history for use in connection with the Services. Banking credentials are maintained by these providers and are not stored by us.

Bree, on TryBree's behalf, also uses third-party payment processors to disburse funds and collect repayments through your debit card or bank account. By using the Services, you authorize TryBree, Bree, and the applicable third-party provider to access and transmit your financial information for these purposes.

(c) Affiliate Offers

We or Bree may present you with offers for products and services from trusted third-party partners, including other financial services providers and non-financial products and services. These are affiliate arrangements under which we or Bree may receive a commission if you register or purchase through the referral. We do not share your personal information with affiliate partners without your consent. If you choose to engage with an affiliate offer, any personal information you provide to that third party is governed by the third party's own privacy policy.

(d) Advertising Partners

We or Bree may share information with third-party advertising platforms to deliver targeted advertisements and measure the effectiveness of our marketing campaigns. This may include sharing identifiers or hashed contact information with platforms such as Meta, Google, and TikTok. Please see Section 10 for further information, including your choices regarding targeted advertising.

(e) Legal Compliance and Protection of Rights

We or Bree may disclose personal information where required or permitted by law, including in response to a court order, subpoena, or lawful request by a government authority, or where necessary to protect our legal rights or the safety of any person.

(f) Business Transactions

If we or Bree are involved in a merger, acquisition, financing, sale of assets, or other corporate transaction, personal information may be disclosed to the parties involved as part of that transaction. We will provide notice of any such transfer and the acquiring entity will be required to handle your personal information in a manner consistent with this Policy.

(g) Aggregated and De-identified Data

We or Bree may share aggregated or de-identified information that cannot reasonably be used to identify you with third parties for research, analytics, or other purposes.

6. Consent

TryBree obtains consent to the collection, use, and disclosure of personal information, except where collection, use, or disclosure without consent is permitted or required by Applicable Privacy Laws. In practice, the related handling of personal information is carried out by Bree on TryBree's behalf. Consent may be express or implied, depending on the circumstances and the sensitivity of the personal information. For example, by submitting a loan application, you consent to the collection and use of your financial information to assess eligibility for the Services.

Where we intend to use your personal information for marketing communications or to present affiliate offers, we will seek your express consent where required by Applicable Privacy Laws. You may withdraw your consent to marketing at any time using the unsubscribe mechanism in our communications or by contacting our Privacy Officer. Withdrawing consent to marketing will not affect your ability to use our Services.

You may also withdraw consent to other uses of your personal information by contacting TryBree’s Privacy Officer, subject to legal and contractual restrictions and reasonable notice. Withdrawal of consent may limit or prevent Bree from providing operational aspects of the Services on TryBree’s behalf.

7. Cross-Border Transfers of Personal Information

Personal information handled in connection with the Services may be transferred to, stored in, or processed in jurisdictions outside Canada, including the United States, where Bree or other service providers maintain infrastructure or conduct operations on TryBree's behalf. The privacy laws of those jurisdictions may differ from those of your province or territory and may not provide the same level of protection.

When personal information is transferred outside Canada, TryBree takes steps to ensure that it receives a comparable level of protection, including through contractual arrangements with Bree and other receiving parties. By using the Services, you acknowledge that your personal information may be transferred outside Canada as described in this Policy.

If you wish to obtain further information about the transfer of your personal information outside Canada, please contact our Privacy Officer.

8. Data Retention

Personal information is retained only for as long as reasonably necessary to fulfil the purposes for which it was collected and to comply with legal, regulatory, and legitimate business requirements. In practice, retention activities are carried out by Bree on TryBree's behalf. General retention practices include the following:

• Active account information is retained for the duration of your relationship with us;
• Following account closure, certain records are anonymized or deleted in accordance with our account deletion process (see below), with remaining records retained as required by applicable law, including anti-money laundering legislation, and for fraud detection purposes;
• Application and transaction records, including loan application details, payment history, and related metadata, are retained following the end of the relevant transaction or relationship for fraud detection purposes;
• Operational logs, including security and access logs, are retained for limited periods consistent with their operational purpose;
• Interview and survey responses are kept for limited periods consistent with their operational purpose, and then anonymized and deidentified;
• Marketing consent records are retained for as long as necessary to evidence your consent preferences.

Account Deletion

When you request deletion of your account, Bree takes the following steps on TryBree's behalf:

• Certain identifiers, including your IP address and device user agent, are hard deleted;
• Profile personal information is erased or replaced with anonymized values;
• Records across transaction, payment, messaging, identity verification, and other operational tables are scrubbed of personal identifiers;
• Certain non-identifying records, including anonymized transaction metadata, device and fraud-detection identifiers, and account structure records, are retained for fraud prevention, legal compliance, and audit purposes.

When personal information is no longer required, it is securely destroyed or irreversibly anonymized, subject to any applicable legal or regulatory retention requirements.

9. Protecting Personal Information

We implement reasonable technical, physical, and organizational safeguards designed to protect personal information against loss and unauthorized access, use, disclosure, alteration, or destruction. Where Bree handles personal information on TryBree's behalf, those safeguards are implemented operationally through Bree and applicable service providers. These safeguards include the following:

• Encryption of personal information in transit using Transport Layer Security (TLS) and, where applicable, at rest;
• Role-based access controls limiting access to personal information to authorized personnel with a need to know;
• Regular security assessments, vulnerability testing, and monitoring of our systems;
• Employee training on privacy and information security obligations;
• Contractual security requirements imposed on service providers and processors.

Despite these measures, no method of electronic transmission or storage is completely secure. You can help protect your information by using a strong, unique password for your account, not disclosing your password to anyone, and contacting TryBree immediately if you suspect unauthorized access to your account. Neither TryBree nor Bree will ask for your password in an unsolicited communication. You will only be asked for your password through the official trybree.com website or the official Bree mobile application made available through the Apple App Store or Google Play Store.

If a privacy breach involving personal information under our control creates a real risk of significant harm, we will provide any notices required by Applicable Privacy Laws to affected individuals and the applicable regulator within the time required by law.

10. Cookies and Online Tracking

Bree, on TryBree's behalf, uses cookies, web beacons, pixel tags, and similar tracking technologies on the website and mobile application used in connection with the Services to collect information about your device and how you interact with the Services. This information is used to:

• operate and secure our platform;
• remember your preferences and settings;
• analyze usage patterns and improve the user experience;
• deliver and measure the effectiveness of marketing campaigns, including targeted advertising through third-party platforms.

Bree, on TryBree's behalf, may share certain identifiers or hashed contact information with advertising platforms such as Meta, Google, and TikTok to enable targeted advertising and to identify users with similar characteristics to existing customers. These platforms may use this information in accordance with their own privacy policies.

You may manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of our Services. Where required by Applicable Privacy Laws, we will seek your consent before using tracking technologies for marketing or advertising purposes.

Bree, on TryBree's behalf, also uses third-party analytics tools to understand how users interact with the Services. These tools may collect information about your device and usage in accordance with their own privacy policies.

11. Automated Decision-Making

Bree, on TryBree's behalf, uses automated processing, including machine learning models, to assess applications for the Services, including to verify identity, determine eligibility for a loan-related product or service, and calculate the amount that may be offered. These automated processes analyze information such as bank transaction history and other data you provide or that is collected in connection with the Services.

Automated decisions regarding eligibility or loan amount may have a significant effect on you. Where automated processing results in an adverse decision, such as a decline of your application or a reduction of your loan limit, you may contact TryBree's Privacy Officer to request review by a person.

Bree, on TryBree's behalf, also uses automated tools, including artificial intelligence, to assist with fraud detection and the management of customer alerts and communications. These tools are used to support, not replace, human oversight.

12. Your Privacy Rights

Subject to applicable law, you have the following rights with respect to your personal information:

(a) Right to Access

You have the right to request access to the personal information TryBree holds about you, including information about the purposes for which it is used and the third parties to whom it has been disclosed. This includes personal information handled by Bree on TryBree's behalf in connection with the Services. TryBree will respond to access requests within 30 days, subject to any extensions permitted by Applicable Privacy Laws. In certain circumstances, TryBree may charge a nominal fee for access, in which case you will be notified in advance.

(b) Right to Correct

You have the right to request correction of personal information that is inaccurate, incomplete, or out of date. This includes personal information handled by Bree on TryBree's behalf. Please contact TryBree's Privacy Officer or update your information directly through your account settings where available.

(c) Right to Withdraw Consent

You may withdraw consent to the collection, use, or disclosure of your personal information at any time, subject to legal and contractual restrictions and reasonable notice, as described in Section 6.

To exercise any of these rights, submit a written request to the Privacy Officer using the contact information in Section 14. We may take reasonable steps to verify your identity before processing your request. We will respond within the time required by Applicable Privacy Laws, generally within 30 days after receipt of a complete request.

13. Third-Party Links and Services

Our website and mobile application may contain links to third-party websites or services that we do not own or operate. This Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party service before providing personal information. We are not responsible for the privacy practices or content of third-party services.

14. Privacy Officer and How to Contact Us

Note: The information below is only for privacy and personal information-related requests and queries. For all other support requests and any other information, please contact support@trybree.com.

TryBree has designated a Privacy Officer responsible for overseeing compliance with this Policy and Applicable Privacy Laws. If you have questions, concerns, or complaints about privacy practices under this Policy, or wish to submit a request to exercise your rights, please contact TryBree's Privacy Officer:

Privacy Officer
TryBree Technologies Ltd.
Email: privacy@trybree.com

We will acknowledge receipt of your request and respond within the time required by Applicable Privacy Laws.

If you are not satisfied with our response, or wish to escalate your concern, you may contact the applicable regulatory authority:

• Office of the Privacy Commissioner of Canada: priv.gc.ca
• Office of the Information and Privacy Commissioner of Alberta: oipc.ab.ca
• Office of the Information and Privacy Commissioner for British Columbia: oipc.bc.ca

15. Changes to This Policy

We may amend this Privacy Policy from time to time to reflect changes in our practices, the Services, or Applicable Privacy Laws. The updated version will be posted on our website and the effective date at the top of this Privacy Policy will be revised accordingly. Where required by law, or where changes are material and we have a reasonable means of contacting you, we will provide additional notice before the changes take effect.

We encourage you to review this Policy periodically to stay informed about how we protect your personal information.