Privacy Policy

This Policy applies to personal information controlled by Backers Securities Inc. in connection with backers.ca, accounts, issuer and investor workspaces, offerings, business financing, payments, support, communications, profiles, channels, video, and live events. It does not govern an external website or service acting independently under its own privacy policy.

Backers is accountable for personal information under its control, including information processed for Backers by a service provider. We use information only for identified, reasonable purposes, with consent where required, or as otherwise permitted or required by applicable Canadian privacy law.

The Privacy Officer can be reached at team@backers.ca. Put "Privacy request" in the subject line so it can be routed correctly.

The information depends on how you use Backers and may include:

• Account and contact information: name, email, phone number, profile image, authentication identifier, account status, notification choices, and referral information.
• Investor identity and eligibility: legal name, date of birth, residential address, jurisdiction, telephone number, government-identification type and images, selfie or liveness evidence where required, verification results, accreditation or dealer-advice information, investment preferences, and financial ranges you provide.
• Issuer, principal, and organization information: company and registry details, ownership and capitalization, team roles, authority, biographies, business and financial information, bank information, background-check materials, agreements, and supporting documents.
• Offering and transaction records: document versions and access events, acknowledgements, electronic signatures, subscriptions, amounts, payment references, trust-ledger entries, bank reconciliation, withdrawals, closing records, notes, debit mandates, repayments, defaults, returns, fees, and tax records.
• Content and communications: profile copy, documents, images, video, live-event participation, posts, comments, follows, inquiries, messages, support requests, Bootcamp work, and Gwen instructions or outputs.
• Technical and evidence information: IP address, browser and device details, user agent, timestamps, security events, audit records, integration status, and information needed to diagnose or prevent errors and abuse.

We do not need every item from every user. We seek to limit collection to information reasonably needed for the feature, transaction, legal obligation, or purpose explained at collection.

We may receive personal information:

• directly from you through forms, uploads, signatures, payments, messages, and media;
• from an organization that invites or authorizes you to act in its workspace;
• from an issuer, investor, adviser, or counterparty involved in a transaction;
• from authentication, identity-verification, background-check, bank, payment, media, communications, or other service providers involved in the workflow;
• from public registries, regulators, sanctions sources, and other lawful public sources;
• automatically from your browser, device, and interaction with the Platform; and
• from calculations, checks, classifications, drafts, and audit evidence created while administering the Platform.

If you provide information about another person, you must have authority to do so and must not provide more than the workflow requires.

Backers may use personal information to:

• create, authenticate, secure, support, and administer accounts and organization roles;
• verify identity, age, residence, authority, eligibility, and bank-account ownership;
• detect, investigate, and prevent fraud, misuse, sanctions exposure, and security incidents;
• prepare, review, publish, amend, administer, close, and report crowdfunding distributions;
• receive, reconcile, safeguard, release, or return purchaser assets;
• assess and administer business-financing applications, notes, debits, repayments, and defaults;
• provide issuer workspaces, Bootcamp, profiles, channels, media, live events, and support services;
• send transaction, legal, security, service, company-specific, and optional marketing communications;
• answer inquiries, resolve disputes, enforce agreements, and maintain evidence and audit trails;
• operate, test, maintain, troubleshoot, measure, and improve the Platform; and
• comply with securities, privacy, tax, corporate, court, regulatory, and other legal obligations.

If we propose a materially different purpose that is not required or already permitted by law, we will explain it and seek consent where required before using the information for that purpose.

Information placed in a public issuer profile, offering page, channel, post, comment, video, replay, live session, or public team biography can be seen and copied by others and may be indexed by search engines. The workspace identifies which material is private, submitted for review, or published. Issuers must obtain appropriate permission before publishing another person's image, name, biography, or personal information.

Investor identity records, government-identification images, bank coordinates, private documents, internal reviews, and non-public messages are not intended for public profiles. Do not place sensitive information in a public or free-form content field. If you publish something unintentionally, contact us promptly.

We may disclose information where reasonably necessary to:

• operate the Platform through authentication, identity, background-check, hosting, storage, security, communications, media, AI, bank, payment, accounting, legal, or other professional service providers acting for Backers;
• provide an issuer with purchaser and transaction information required for securities records, investor communications, a closing, or legal reporting;
• provide a purchaser with issuer information and transaction records;
• submit or respond to securities regulators, tax authorities, courts, law enforcement, or other lawful authorities;
• investigate fraud, security, legal claims, complaints, defaults, or misuse;
• complete a corporate financing, reorganization, merger, sale, or transfer, subject to appropriate protections; or
• carry out another purpose you direct or consent to.

Providers receive only the access reasonably needed for their role and are expected to protect information and use it for the authorized service. Backers does not sell or rent personal information for data-brokerage or third-party advertising purposes.

Backers may use Gwen and other automated tools to organize submitted information, generate drafts, extract or compare fields, check completeness, triage queues, identify exceptions, route work, communicate, and execute operations under defined Backers roles and controls. Inputs, outputs, approvals, and consequential actions may be recorded for review, security, quality, and audit purposes.

Automated output can be incomplete or wrong. Issuers remain responsible for verifying and approving their disclosure and attestations. Investors remain responsible for reviewing the offering documents and making their own decisions. Backers does not use automation to turn the exempt funding portal into an adviser or to represent that an investment is suitable.

Water may process media, participation, and engagement data for Backers channels, videos, live rooms, clips, and replays. An identity or authorization provider, including SEDL where enabled and identified in the workflow, may process evidence or claims needed to establish a person, organization, role, or permission.

Backers uses essential cookies and browser storage to keep authentication working, remember the funding-portal acknowledgement, preserve an in-progress Get Backers path, associate a referral, and maintain security and session state. Google or Firebase and an embedded service may also use storage needed to provide the feature you request under its own notice.

Backers does not currently place advertising cookies. Disabling essential cookies, local storage, or session storage may prevent sign-in, acknowledgements, saved form progress, or other core functions from working. If Backers introduces non-essential analytics or advertising technology, this Policy and any required choice mechanism must be updated before that use.

Backers and its service providers may process or store information in Canada and other countries. Information processed outside your province or outside Canada can be subject to the laws and lawful-access requirements of that jurisdiction. Backers remains accountable for information transferred to a provider for processing and uses contractual, access, and other measures appropriate to the service and sensitivity.

Contact the Privacy Officer if you need more information about a category of service provider or processing location relevant to your information.

We retain personal information only as long as reasonably needed for the identified purpose, an active account or transaction, security and dispute resolution, or a legal, tax, audit, regulatory, or contractual requirement. Retention is based on the record type, not one blanket period.

National Instrument 45-110 requires an exempt funding portal to maintain specified financial, client-transaction, and compliance records for eight years from the date each record is created. Signed agreements, offering documents, acknowledgements, trust and settlement records, audit evidence, and records under a legal hold may therefore remain after an account is closed or consent for an optional use is withdrawn.

When information is no longer required, it is deleted, destroyed, or de-identified under the applicable process. Copies may persist temporarily in protected backups or remain in a legally required record until the relevant period expires.

Backers uses administrative, technical, and organizational safeguards appropriate to the sensitivity and use of the information. These include role and organization access controls, purpose-bound workflows, authentication, audit records, provider controls, secure transport, review and reconciliation steps, and procedures for investigating suspected misuse or unauthorized access.

No website, transmission, storage system, or provider can be guaranteed perfectly secure. Protect your sign-in links and devices, use only payment instructions displayed in your Backers transaction, and report suspected account compromise or a privacy incident to team@backers.ca. Backers will assess and report or notify about a breach where applicable law requires.

Subject to applicable law, identity verification, and permitted exceptions, you may:

• ask whether Backers holds personal information about you and request access to it;
• request correction of inaccurate or incomplete personal information;
• withdraw consent for an optional use, including optional marketing;
• change account and notification preferences available in the Platform;
• ask for account closure or deletion of information no longer required; and
• raise a privacy concern or challenge our compliance.

A request may be limited where disclosure would reveal another person's information, confidential commercial information, privileged material, security controls, or where retention or refusal is permitted or required by law. Withdrawing a necessary consent may mean we cannot provide the associated service or complete a requested transaction.

To make a request, email team@backers.ca from the address associated with your account. We may need to verify your identity before responding. You may also contact the privacy regulator with jurisdiction over your concern.

We may update this Policy as the Platform, providers, or legal requirements change. The effective date and version will change when the Policy changes. We will provide additional notice or seek consent where a material new use or disclosure requires it.

Privacy questions, access or correction requests, and complaints can be sent to the Privacy Officer at team@backers.ca or through the Contact page. Do not send government-identification images, banking credentials, or other sensitive evidence by ordinary email; we will direct you to the appropriate secure workflow if it is needed.