Last Updated: October 29, 2020 

Orchid B Inc. (“Orchid B”, “we”, “us” and “our”) is committed to protecting the privacy and security of personal information in our possession and control. This privacy policy (the “Policy”) explains the types of personal information we collect from all visitors, users and others (“users”, “you” and “your”) who access the Website (as defined below) or use our Services (as defined below), how it is used, and the steps we take to ensure customer personal information is handled appropriately.  

By using our website, including the content, information and services provided on or through the website and by email, including all online tools, applications, calculators and email alerts (collectively, the “Website”) or any of the products and services offered by us from time to time (collectively, the “Services”) you accept the terms of this Policy and consent to our collection, use, disclosure and retention of your information as described in this Policy.  

For purposes of this Policy, “Personal Information” means any information, recorded or unrecorded, which, either on its own or in combination with other information, could be used to identify, contact, or locate a specific individual. Personal Information includes, but is not limited to, an individual’s name, residential address, age, income, date of birth, gender, ethnic origin, credit history, employment information, social insurance number (SIN), where applicable, payment records, credit card number, financial information, device geolocation (geographical location), unique identifiers such as user name, account number or password or any other identifying number assigned to the individual, and product or service preferences. 

1. 1. Collection of Your Personal Information 
      1. Collection of Personal Information 

The type of Personal Information we collect will depend on the type of Service that you have requested. We may collect financial and other Personal Information from you such as: 

1. 1. 1. 1. information establishing your identity (e.g. name, residential address, phone number, email address, date of birth, gender, social insurance number (SIN) and, if applicable, account numbers); 
         2. employment information including information about your previous and current employers; 
         3. income information; 
         4. information related to transactions arising from your relationship with and through us, and from other financial institutions; and 
         5. information about financial behaviour such as your payment history and credit worthiness. 
      2. How we Obtain Your Personal Information 

Most of the information we collect about you is received from you directly. We may also collect information from third parties outside Orchid B, including: 

1. 1. 1. 1. lenders and financial institutions holding your external account(s); 
         2. credit bureaus, credit reporting agencies and credit insurers;  
         3. persons authorized to act on your behalf under a power of attorney or other legal authority;  
         4. service providers, agents and other organizations with whom you or we conduct business; and 
         5. government agencies and public registries. 

If you create an account with us, you agree that we may verify your name, address, phone number, and other account details with information about you held by third party sources and your mobile service provider in order to verify your identity and help protect against potential fraud, such as when someone other than you is trying to use your account or conduct a transaction without your permission, and you provide your consent for them to disclose and/or compare your information for this purpose. In these circumstances, this Personal Information will not be shared with any third parties for any other purpose. 

The decision to provide us with your Personal Information always rests with you. We may however be limited in our ability to provide you with certain Services if you decline to provide us with information essential to fulfill your request.  

1. 1. 1. Information We Collect Automatically Through Our Website 

We may collect information about users whenever they interact with our Website. This information may include the browser name, the type of computer and technical information about users’ means of connection to our Website, such as the operating system and the Internet service providers utilized and other similar information. We use this information to understand how users interact with our Website and to make improvements. 

1. 1. 1. 1. Cookies and Similar Technologies. Our Website may use a technology called “cookies”. A cookie is a tiny element of data that the Website can send to your browser, which may then be stored on your hard drive so that you can be recognized when you return. We may use cookies on the Website to enhance user experience and to deliver personalized Services. We may also use cookies to provide us and our service providers with information about your use of the Website that we may use to personalize the Website or other content in accordance with your interests and preferences (e.g. language preference) and improve your user experience. You may set your Web browser to notify you when you receive a cookie or to not accept certain cookies. However, if you decide not to accept cookies from the Website, you may not be able to take advantage of all the features of the Website. 
         2. Tracer Tags & Web Beacons. The Website may also use a technology called “tracer tags” or “web beacons”. This technology allows us to understand which pages you visit on the Website. These tracer tags are used to help us optimize and tailor the Website for you and other future visitors to the Website. 
         3. Online Advertising. We may use third parties to serve our advertisements on our Website or other websites. These companies may use cookies, tracer tags or web beacons to report certain information about your visits to our Website and other websites (such as web pages you visit and your response to ads) in order to measure the effectiveness of our marketing campaigns and to deliver ads that are more relevant and tailored to you, both on and off our Website. 
      2. Monitoring of telephone calls 

Orchid B may monitor and/or record in-bound and out-bound telephone calls as permitted by law for training and quality assurance purposes, to detect and prevent fraud or other losses, and to enforce our contracts. Any recording obtained from monitoring telephone calls is treated as confidential. 

1. 1. How We Use Your Personal Information 

Orchid B collects your Personal Information to manage our relationship with you and to consistently deliver high quality Services. We collect and use your Personal Information for the following purposes: 

1. 1. 1. To provide Services: We use information in order to verify your identity, register you for a Service, to provide and administer our Services and to resolve any issues relating to a Service. 
      2. To respond to inquiries and provide and improve customer service: We use information to respond to your inquiries, questions, and/or other requests. Information users provide helps us respond to customer service requests and support needs more efficiently. 
      3. To personalize user experience: We may use the information we collect to personalize a user’s experience when they visit or use the Website or Services. We may also use information in the aggregate to understand how our users as a group use the services and resources provided on our Website and identify usage trends. 
      4. To improve the Website and the Services: We may use the information we collect, including feedback users provide, to enhance, improve or modify the Website and the Services, develop new Services and expand our business activities. 
      5. To run a promotion, contest, survey or other Website feature: We use information to administer contests, promotions, surveys and other Website features. 
      6. For marketing purposes: We may use personal information to better understand our user’s needs and preferences in order to provide them with information and offers that we believe may be of interest to them. We may provide information and offers by any means, including by e-mail, in-app notifications, push notifications and display advertising. Users may opt out of having their personal information used for these purposes by contacting us as described below. 
      7. For research and analytics: We may use the information we collect to generate aggregate or de-identified data, which is not capable of identifying any particular user. We may use aggregate and de-identified data for any lawful purpose, including research and analytics. 
      8. For our other reasonable business purposes: We may use information to detect and prevent fraud, comply with legal and governmental requirements, to enforce our agreements with users and to maintain business records. We may also use information for other purposes with user consent or as permitted or required by law. 
   2. Sharing Your Personal Information 
      1. We may disclose Personal Information to certain third-party product and service providers retained by us to assist in providing you with services or to perform certain specialized services to assist us in our business. Third Party product and service providers can include customer service and support, marketing and analytics, data hosting or processing services or similar services. Some of these service providers may be located outside of Canada, including in the United States, and as a result your Personal Information may be processed in the United States or elsewhere outside of Canada, where local laws may permit foreign government and national security authorities to access Personal Information in certain circumstances. 
      2. In certain instances, we may be compelled to disclose Personal Information in response to a legally valid demand, enquiry, proceeding or other order. We reserve the right to comply with any third party demand such as Requirements to Pay and Requests for Information which have been issued under applicable laws, or any order of a court or administrative tribunal we receive, in request of your Personal Information.  You agree that we will not be liable to you in any way for complying with any such third party demands or orders of a court or administrative tribunal issued on or against your accounts or products. In these cases, we take steps to ensure the request is valid and we only disclose the specific information necessary to satisfy the enquiry or order. 
      3. We may disclose Personal Information in connection with the proposed or actual financing, securitization, insuring, sale, assignment or other disposal of all or part of Orchid B or our business or assets and for the purposes of evaluating and/or performing the proposed transaction. Assignees or successors of Orchid B or our business or assets may use and disclose your Personal Information for similar purposes as those described in this Policy. 
      4. We may disclose Personal Information in other circumstances with your consent or as required or permitted by law. 
   3. Links to Other Sites 
      1. Our Website may contain links to other websites that we do not own or operate. Also, links to our Website may be featured on third party websites on which we advertise. We provide links to third party websites as a convenience to the user. These links are not intended as an endorsement of or referral to the linked websites. The linked websites have separate and independent privacy policies, notices and terms of use, which we recommend you read carefully. We do not have any control over such websites, and therefore we have no responsibility or liability for the manner in which the organizations that operate such linked websites may collect, use or disclose, secure and otherwise treat your Personal Information. 
      2. You should be aware that off-site pages or other sites might be available only in English or in other languages.  Sachez que les pages qui ne figurent pas sur le site Web du Orchidée B Inc. ou certains autres sites pourraient n’être disponibles qu’en anglais ou dans d’autres langues. 
   4. Collection, Use and Disclosure of Non-Personal Information 
      1. Non-personal information is any information, other than Personal Information, that does not reveal your identity or relates to you as a person. Some examples of non-personal information we may collect from you are demographic information, such as occupation, language, interests, the first three digits of your postal code, unique device identifier, and transactional data. Non-personal information may also include Personal Information we have de-identified or aggregated to the point where it no longer identifies a particular individual. Information relating to business customers may also include your business name, address, phone number, email address, industry type, financial status and details on the owners, operators and directors. 
      2. At times, Orchid B may make certain aggregated non-personal information available to strategic partners and third party service providers that work with Orchid B to provide or support our or their products and services or that help Orchid B or its strategic partners and third party service providers to conduct data analysis, to develop and improve products and services, and determine the effectiveness of promotional campaigns. We reserve the right to use and share any such non-personal information with third parties for any lawful purpose. 
      3. If we ever combine non-personal information with any Personal Information, we will obtain your consent and treat it as Personal Information is treated under this Policy.  
   5. Canada’s Anti-Spam Legislation (“CASL”) 
      1. Orchid B complies with CASL and we are committed to making sure you only receive the email communications that you want from us. Orchid B will never send you unsolicited emails in connection with the marketing of Orchid B, its services or products. 
      2. We may send you emails if you signed up to join our email list at a trade show or conference. We occasionally send emails to members of mailing lists shared with us from other organizations who have received your opt-in consent. Usually, this is from industry related advisory groups. We may occasionally contact you to notify you about updates to the Website or new Services offered by us, or to deliver targeted information that may be of interest to you. 
      3. No matter how you join our list or provide us with your consent to receive communications, at the bottom of all our emails, you will find a clear, easy way to unsubscribe. 
   6. Security 
      1. We adopt appropriate data collection, storage and processing practices and security measures to protect against unauthorized access, alteration, disclosure or destruction of users’ Personal Information. Personal Information is maintained on our servers or those of our service providers and is accessible to authorized employees, representatives and agents who require access in connection with their job responsibilities. We cannot guarantee that unauthorized third parties will never be able to defeat our security measures or use your Personal Information for improper purposes. You acknowledge that you provide your Personal Information at your own risk. 
      2. Your online access to certain of your Personal Information is protected with a password you select. We strongly recommend that you do not disclose your password to anyone. We will never ask you for your password in any unsolicited communication (such as letters, phone calls or email messages). 
   7. Data Retention 

We store the Personal Information we collect about you for as long as is necessary for the purposes for which we originally collected it, or for other legitimate business purposes, including to meet our legal or other regulatory obligations, prevent fraud, resolve disputes, troubleshoot problems, assist with any investigation, enforce our user agreements and other actions permitted by law. There is no single retention period applicable to the various types of Personal Information collected. Please contact us if you would like to delete any Personal Information we hold about you. We also reserve the right to continue to hold Personal Information about you to the extent it is required to be held by us by law, rule or regulation. 

1. 1. Where We Store Your Personal Information 

The Personal Information you provide to us is primarily stored on servers in Canada. However, we maintain secondary disaster data back-up on computer systems that may be located outside of Canada, including the United States. Personal Information collected by us pursuant to our Policy may be stored, whether as part of our secondary disaster data back-up or otherwise, on out-of-country computer systems, and therefore may be subject to disclosure pursuant to the laws of the jurisdictions where such Personal Information data is stored. Orchid B will disclose Personal Information as required by law. 

1. 1. Disclaimer About Sharing Personal Information Online 

You acknowledge that when sharing Personal Information online, there is always a risk of data breaches, including data breaches in which third parties unlawfully access our systems or the systems of our third-party providers, which store Personal Information. 

1. 1. Limitation on Liability 

While we take measures to protect Personal Information, you agree that in no event will Orchid B, our suppliers, partners, licensors, dealers, representatives, associates or affiliates and each of their respective officers, directors, employees, shareholders, representatives and agents (collectively, the “Orchid B Parties”) be liable to you or any other person in any way in contract, tort (including negligence), civil liability or otherwise for any claims, damages, obligations, losses, liabilities, costs, debts or expenses (including but not limited to lawyer’s fees and disbursements), whether direct, indirect, special, economic, incidental, consequential, punitive or exemplary, including without limitation loss of revenue, data, anticipated profits or lost business, howsoever caused, including by way of negligence, arising from, related to or connect with the loss or theft of your Personal Information. You agree that if, notwithstanding the other provisions of this Policy, an Orchid B Party is found to be liable for any claims, proceedings, liabilities, obligations, damages, losses or costs, such Orchid B Party’s liability shall in no event exceed the amount you paid to Orchid B hereunder. 

1. 1. Residents of the European Economic Area 

If you are a resident of the European Economic Area (“EEA”), you have certain rights and protections under the law regarding the processing of your personal data. Any reference to Personal Information in this Privacy Policy should be understood as referring to “personal data”, defined under the General Data Protection Regulation (“GDPR”) as “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”. 

1. 1. 1. Legal Basis for Processing 

If you are a resident of the EEA, when we process your personal data we will only do so in the following situations: 

1. 1. 1. 1. with your consent; 
         2. to perform the Services you have requested from us or, upon your request, to take the steps necessary to provide you with such Services; or 
         3. in the furtherance of our legitimate interests in maintaining business relationships and communicating with you as a business contact, about Orchid B’s activities and Services and providing, securing and improving our Services. 

You have consented to the processing of your personal data for one or more specific purposes. We consider that our legitimate interests comply with the GDPR and your legal rights and freedoms. You have the right to object to any of this processing and, if you want to, please contact us at the contact details indicated below. 

1. 1. 1. Data Subject Requests 

If you are a resident of the EEA, you have the right to access personal data we hold about you and to ask that your personal data be corrected, erased, or transferred. You may also have the right to object to, or request that we restrict, certain processing. If you would like to exercise any of these rights, you can contact us as indicated below. Please note that the limitation or deletion of your personal data may mean we will be unable to provide our Services. You also have the right to receive your personal data in a machine-readable format and have the data transferred to another party responsible for data processing. 

1. 1. 1. Questions or Complaints 

If you are a resident of the EEA and have a concern about our processing of personal data that we are not able to resolve, you have the right to lodge a complaint with the data privacy authority where you reside. For contact details of your local Data Protection Authority, please see: http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm. 

1. 1. Changes to this Privacy Policy 
      1. We may change this Policy at any time. We encourage you to periodically review this page for the latest information on our privacy practices. If we make any changes, we will change the Last Updated date above. 
      2. Any modifications to this Policy will be effective upon our posting of the new terms and/or upon implementation of the changes to the Website (or as otherwise indicated at the time of posting). In all cases, your continued use of the Website or the Services after the posting of any modified Policy indicates your acceptance of the terms of the modified Policy. 
   2. Contact Us 

You may request access to or correction of your Personal Information in our custody or control, by writing to the address below, attention Compliance Officer. Your right to access or correct your personal information is subject to applicable legal restrictions. We may take reasonable steps to verify your identity before granting access or making corrections. If you have any questions about this Policy, or our Personal Information handling practices generally, please contact us at: 

Orchid B Inc. 

www.orchidb.com 

contact@orchidb.com