iPostal1 Canada Inc. Privacy Policy

iPostal1 Canada Inc. (“iPostal1 Canada”, “we” or “us”) provides digital mailbox services (the “Services”). We respect and seek to protect the privacy of visitors to our websites and our customers. This Privacy Policy sets out how and why we collect, store, use and share personal information generally, our dedication to protect it, as well as your rights in relation to your personal information and details of how to contact us and supervisory authorities if you have a complaint.

This Privacy Policy applies solely to individuals who are residents of Canada and who (i) visit our website, our online platform or mobile app, and any other websites, pages, features, or content we own or operate (together the “Sites”); (ii) engage with us in connection with the Services via email, our Sites and/or social media accounts; or (iii) we otherwise deal with in their business capacity, including representatives of our customers, prospective customers, suppliers, investors, contractors, and agents (“you”, “your”). It is important that you read this Privacy Policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing your personal information so that you are fully aware of how and why we are using your personal information.

This Privacy Policy describes our information handling practices when you access our services, which includes our websites, and any other websites, pages, features, or content we own or operate and from which we link this Privacy Policy. It also applies when you use our mobile app and/or any other mobile apps we own or operate, our API or third-party applications relying on such an API, and related services.

Please read this Privacy Policy carefully. Questions about this Privacy Policy and how we use your personal information may be submitted to our global Privacy Officer via the contact information provided below under “20. Contact Us”.

1. Acknowledgement and acceptance of this privacy policy

PLEASE READ THIS PRIVACY POLICY CAREFULLY. BY ACCESSING AND USING OUR SERVICES, YOU SIGNIFY THAT YOU HAVE READ, ACKNOWLEDGED AND ACCEPTED THE TERMS OF THIS PRIVACY POLICY.

This Privacy Policy does not constitute a contract, and mere use of our Services does not amount to consent to the collection, use and disclosure of your personal information. Where we rely on consent as a basis for handling personal information, we will obtain that consent in accordance with applicable laws and as described below.

In addition to this Privacy Policy, we may provide you with supplemental periodic disclosures or other information about our data processing practices pertaining to specific Services. These notices may supplement or clarify our privacy practices or may provide you with additional choices about how we process your information.

If you do not agree with or are not comfortable with any aspect of this Privacy Policy, you may exercise the various notice options described in this Privacy Policy. If you remain uncomfortable with our data collection, use and disclosure practices you should immediately discontinue access or use of our Services.

2. Changes to this privacy policy

We may modify this Privacy Policy from time to time which will be indicated by changing the “Last Updated” date at the top of this page. If we make any material changes to this Privacy Policy, we may notify you by email (sent to the email address specified in your account), or by means of a notice on our Services or Sites prior to the change becoming effective, or as otherwise required by law. Your continued engagement with us constitutes your acknowledgement of the terms of any update to this Privacy Policy.

We will seek your fresh consent where required by law before any material change to how we process your personal information takes effect.

3. Our relationship to you

We are committed to handling your personal information in accordance with this Privacy Policy and all applicable laws.

We are formed under the Ontario Business Corporations Act (Business Corporations Act, R.S.O. 1990, c. B. 16), registration reference number 1001277627. In Canada, all Services are provided to you through iPostal1 Canada, pursuant to licensing arrangements with one or more affiliated entities who may be formed and/or are resident outside of Canada.

We currently operate legal entities in the United States in order to provide Services to our global customers, including customers in Canada.

You may be asked to provide personal information anytime you are in contact with us. We may share your personal information internally across affiliated entities and use it consistent with this Privacy Policy. For example, even if you do not reside in the United States, your information may be shared with the appropriate company within our corporate family, including with USZoom, LLC, which provides global support for all Services including technical infrastructure, product development, security, compliance, fraud prevention, and customer support.

4. Personal information we collect

In Canada, “personal information” is primarily defined under the Personal Information Protection and Electronic Documents Act (“PIPEDA”) as information about or that relates to an identifiable individual. This includes information you provide to us or our service partners and information that is collected by us or our service partners about you. Personal information includes, without limitation, factual information about you, biometrics, digital markers, employment information, and certain subjective information, such as individualized opinions. Business contact information used solely for a business purpose, anonymized data and certain information contained in public records are notable exceptions to protected personal information under Canadian law.

Information you provide to us

To establish an account and access our Services, we'll ask you to provide us with some important information about you. This information is either required by law (e.g. to verify your identity), necessary to provide the requested services (e.g. you will need to provide your bank account number if you'd like us to perform check deposit services (in jurisdictions where we offer this service)), or is relevant for certain specified purposes, described in greater detail below. As we add new features and Services, you may be asked to provide additional information.

Please be advised that we may not be able to serve you as effectively or offer you our Services if you choose not to share certain information with us. Any information you provide to us that is not required is voluntary.

We will indicate where any personal information we have requested is mandatory. Where we need to collect personal information by law, or under the terms of an agreement we have with you, and you fail to provide that data when requested, we may not be able to perform the agreement we have or are trying to enter into with you (for example, to provide you with our Services). In this case, we may have to cancel a service you have with us, but we will notify you if this is the case at the time.

We may collect and use the following types of information about you. Some of this information is required to establish and maintain your account and to provide the Services, and you will not be able to use the Services without it. Other categories are optional, and you may choose not to provide them; where this is the case, we will indicate that the information is optional at the point of collection:

• Personal Identification Information: Full name, date of birth, nationality, gender, signature, utility bills, photographs, phone number, home and email addresses.
• Formal Identification Information: Government issued photo identity documentation such as Passport or Driver's License, and/or any other information deemed necessary to comply with our legal obligations under applicable postal, financial, export or anti-fraud and other similar laws and regulations.
• Institutional Information: Employer Identification number (or comparable number issued by a government), proof of legal formation (e.g. Articles of Incorporation), personal identification information for all material beneficial owners.
• Financial Information: Bank account information, transaction history with us, and/or tax identification.
• Transaction Information: Information about the transactions you make on our Services, such as the name and address of the recipient (in case of mail forwarding).
• Employment Information: Office location, job title, and/or description of role.
• Business Information: The name of the organisation you represent, your position, department and business ID numbers.
• Marketing and Communications Data: Your preferences in receiving marketing from us and your communication preferences.
• Correspondence: Survey responses, information provided to our support team or user research team.

Information we collect from you automatically

We receive and store certain types of information automatically, such as whenever you interact with the Sites or use the Services. This information helps us address customer support issues, improve the performance of our Sites and applications, provide you with a streamlined and personalized experience, and protect your account from fraud by detecting unauthorized access. Information we automatically collect includes:

• Online Identifiers / Your Technical Data: This includes your browser name and version, geolocation data, and IP address.
• Usage Data: This includes authentication data, security questions, click-stream data, via cookies and similar technologies.

For example, we may automatically receive and record the following information on our server logs:

• How you came to and use the Services;
• Device type and unique device identification numbers;
• Device event information (such as crashes, system activity and hardware settings, browser type, browser language, the date and time of your request and referral URL);
• How your device interacts with our Sites and Services, including pages accessed and links clicked;
• Broad geographic location (e.g., country or city-level location); and
• Other technical data collected through cookies, pixel tags and other similar technologies, as further described in our Cookie Policy.

We may also use identifiers to recognize you when you access our Sites via an external link, such as a link appearing on a third-party site.

5. How your personal information is used

Our primary purpose in collecting personal information is to provide you with a secure, smooth, efficient, and customized experience. We generally use personal information as necessary to create, develop, operate, deliver, and improve our Services, content and advertising; and for loss prevention and anti-fraud purposes. We collect and use such personal information in a manner intended to minimize the nature and scope of the personal information we secure from you for these purposes.

We may use this information in the following ways:

• To maintain legal and regulatory compliance: Most of our core Services are subject to laws and regulations requiring us to collect, use, and store your personal information in certain ways. If you do not provide personal information required by law, we will have to close your account.
• To enforce our terms in our user agreement and other agreements: We handle sensitive information, such as your scanned mail, identification and financial data, so it is important for us and our customers that we actively monitor, investigate, prevent, and mitigate any potentially prohibited or illegal activities, enforce our agreements with our sales partners / subcontractors fulfilling the Services, and/or prevent and detect violations of our posted user agreement or agreements for other Services. In addition, we need to collect fees based on your use of our Services. We collect information about your account usage and closely monitor your interactions with our Services. We may use any of your personal information collected as necessary for these purposes. The consequences of not processing your personal information for such purposes is the termination of your account.
• To detect and prevent fraud and/or funds loss: We process your personal information as necessary consistent with applicable laws in order to help detect, prevent, and mitigate fraud and abuse of our Services and to protect you against account compromise or funds loss.
• To provide Services: We process your personal information to provide the Services to you. We cannot provide you with Services without such information.
• To provide Service communications: We send administrative or account-related information to you to keep you updated about our Services, inform you of relevant security issues or updates, or provide other transaction-related information. Without such communications, you may not be aware of important developments relating to your account that may affect how you can use our Services. You may not opt-out of receiving critical service communications, such as emails or mobile notifications sent for legal or security purposes.
• To provide customer service: We process your personal information when you contact us as necessary to resolve any questions, disputes, collect fees, or to troubleshoot problems. Without processing your personal information for such purposes, we cannot respond to your requests and ensure your uninterrupted use of the Services.
• To ensure quality control: We process your personal information as necessary for quality control and staff training to make sure we continue to provide you with accurate information. If we do not process personal information for quality control purposes, you may experience issues on the Services such as inaccurate transaction records or other interruptions.
• To help ensure network and information security: We process your personal information as necessary in order to enhance security, monitor and verify identity or service access, combat spam or other malware or security risks and to comply with applicable security laws and regulations. The threat landscape on the internet is constantly evolving, which makes it more important than ever that we have accurate and up-to-date information about your use of our Services.
• For research and development purposes: We process your personal information as necessary to better understand the way you use and interact with our Services. In addition, we use such information to customize, measure, and improve our Services and the content and layout of our website and applications, and to develop new services. Without such processing, we cannot ensure your continued enjoyment of our Services.
• To facilitate corporate acquisitions, mergers, or transactions: We may process any information regarding your account and use of our Services as is necessary in the context of corporate acquisitions, mergers, or other corporate transactions. You have the option of closing your account if you do not wish to have your personal information processed for such purposes.
• To engage in marketing activities: Based on your communication preferences, we may send you marketing communications (e.g., emails or mobile notifications) to inform you about our events or our partner events; to deliver targeted marketing; and to provide you with promotional offers. If you are an existing customer, where permitted by law, we may send you marketing communications unless you opt-out. Our marketing will be conducted in accordance with your advertising marketing preferences and as permitted by applicable law.
• Consent based usage: Your personal information, any use or disclosure of your personal information is subject to your consent (unless consent is not required under the applicable law). We will not use or disclose your personal information for purposes other than those purposes we have disclosed to you, without your permission. From time to time, and as required under the applicable law, we may request your permission to allow us to share your personal information with third-parties. You may opt out of or withhold consent having your personal information shared with third-parties or allowing us to use your personal information for any purpose. If you choose to limit the use of your personal information, certain features or Services may not be available to you.

6. How we protect and store your personal information

We maintain (and require subcontractors and third-parties we share your information with to maintain) physical, technical and administrative safeguards to help protect the security and confidentiality of the personal information you entrust to us. We may collect, transfer and store all or part of your personal information outside of Canada, including without limitation in the United States. Personal information transferred, processed and/or stored in a country/countries outside of Canada may be subject to disclosure or access requests by the governments, courts or law enforcement or regulatory agencies in that country according to its laws.

By using our website and Services or by providing us with personal information, you consent to any such transfer of information outside of Canada. If you have any questions about our use of service providers outside of Canada, you may contact us using the information below.

We protect your personal information by maintaining physical, electronic, and procedural safeguards in compliance with the applicable laws and regulations. Whenever we transfer, process or store your personal information internationally, we will take steps which are reasonably necessary to ensure that adequate safeguards are in place to protect such information and to make sure it is treated securely and in accordance with this Privacy Policy.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. For example, we use computer safeguards such as firewalls and data encryption, we enforce physical access controls to our buildings and files, and we authorize access to personal information only for those employees, agents and contractors who require it to fulfil their job responsibilities. Full credit card data is securely transferred and hosted off-site by qualified payment vendors.

However, no security measures can provide absolute protection, and we cannot guarantee that loss, misuse, unauthorized acquisition, or alteration of your information will not occur. Please recognize that you play a vital role in protecting your own personal information. When registering with our Services, it is important to choose a password of sufficient length and complexity, to not reveal this password to any third-party, and to immediately notify us if you become aware of any unauthorized access to or use of your account.

Furthermore, we cannot ensure or warrant the security or confidentiality of information you transmit to us or receive from us by Internet or wireless connection, including email, phone, or SMS, since we have no way of protecting that information once it leaves and until it reaches us. If you have reason to believe that your information is no longer secure, please contact us using the contact information provided in this Privacy Policy.

We will, from time to time, include links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies.

Whenever we transfer your information internationally, we will take steps which are reasonably necessary to ensure that adequate safeguards are in place to protect your personal information and to make sure it is treated securely and in accordance with this Privacy Policy.

You may contact us for a copy of the safeguards which we have put in place to protect your personal information and privacy rights at: https://ipostal1.com/contact-subscriber.php.

7. Data security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We take steps to ensure that your information is treated securely and in accordance with this Privacy Policy. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal information, for example, by encryption or by using pseudonyms, we cannot guarantee the security of your information transmitted via the internet; any transmission is at your own risk.

We have appropriate technical and organisational measures to ensure a level of security appropriate to the risk of varying likelihood and severity for the rights and freedoms of you and other individuals. For example, we use computer safeguards such as firewalls and data encryption, we enforce physical access controls to our buildings and files, and we authorise access to personal information only for those employees, agents and contractors who require it to fulfil their job responsibilities. We maintain these technical and organizational measures and will amend them from time to time to improve the overall security of our systems.

In addition, we limit access to your personal information to those employees, agents, contractors and other third-parties who have a business need to know.

However, no security measures can provide absolute protection, and we cannot guarantee that loss, misuse, unauthorised acquisition, or alteration of your data will not occur. Please recognise that you play a vital role in protecting your own personal information. When registering with our Services, it is important to choose a password of sufficient length and complexity, to not reveal this password to any third-party, and to immediately notify us if you become aware of any unauthorised access to or use of your account.

8. Retention of personal information

We retain your personal information securely throughout the life of your account(s) and for as long as it is necessary for the purposes for which it was collected and used, including for the purposes of satisfying any legal, regulatory, accounting, or reporting obligations or to resolve disputes. Where we do not need your information taking account of the purpose(s) for which it was collected, we retain it only for so long as we have a legitimate purpose in keeping such data.

There are occasions where we are likely to keep your personal information for longer in accordance with our legal obligations, or where it is necessary for the establishment, exercise or defence of legal claims. Please note that this will be assessed on a case-by-case basis.

While retention requirements vary by jurisdiction, information about our typical retention periods for different aspects of your personal information are as follows:

• Personal information collected to comply with our legal obligations under postal, financial, export, or anti-fraud and similar laws may be retained after account closure for as long as required under such laws.
• Contact Information such as your name, email address and telephone number for internal marketing purposes is retained on an ongoing basis until you unsubscribe and retain such records for a reasonable time thereafter.
• Recording of our telephone calls with you may be kept for a reasonable time thereafter.
• Information collected via technical means such as cookies; webpage counters and other analytics tools is kept for a reasonable time period of time.

We may likewise store your information in an aggregated and anonymised format.

In determining appropriate retention periods, we take into account several factors, including:

• the nature, sensitivity, and volume of the personal information;
• the potential risk of harm from unauthorised use or disclosure;
• the purposes for which we process the data and whether those purposes can be achieved by other means;
• applicable legal, regulatory, tax, accounting, or reporting obligations; and
• relevant statutory limitation periods for bringing legal claims.

Once the applicable retention period has expired, we will take steps to ensure that the personal information is securely deleted, anonymised, or otherwise disposed of, unless we are required to retain it for a longer period in order to comply with legal obligations or to establish, exercise, or defend legal claims.

Where personal information is handled on the basis of consent, it will generally be retained until consent is withdrawn, unless we are required to retain it for another lawful purpose.

9. Children

We do not knowingly collect personal information from users deemed to be children under their respective national laws. Our Services are not directed at children and we do not knowingly collect or process personal information of individuals under the age of eighteen (18). If we become aware that we have inadvertently collected personal information from a child under the age of eighteen (18), then we will take steps to delete such information promptly.

We will require parental consent when required to do so under applicable national laws prior to establishing an account for a minor child. If a user submitting personal information is suspected of being a minor child and is unable to satisfy the parental consent requirement, we will require such user to close his / her account and will not allow the user to continue using our Services. We will also take steps to delete the information as soon as possible. Please notify us if you are the parent of a minor child using our Services so that we can take action to prevent access to our Services.

10. Information collected from third-parties

From time to time, we may obtain information about you from third-party sources as required or permitted by applicable law. These sources may include:

• Public Databases, Credit Bureaus & ID Verification Partners: We obtain information about you from public databases and ID verification partners for purposes of verifying your identity in accordance with applicable law and helping combat fraud. Our ID verification partners use a combination of government records and publicly available information about you to verify your identity. Such information may include your name, address, job role, public employment profile, credit history, status on any sanctions lists maintained by public authorities, and other relevant data. We obtain such information to comply with our legal obligations, such as postal, financial, export, and anti-money laundering laws, and for our legitimate business interests. In some cases, we may process additional data about you to ensure our Services are not used fraudulently or for other illicit activities. In such instances, processing is necessary for us to continue to perform our contractual obligations with you and others.
• Advertising Networks & Analytics Providers: We work with these providers to provide us with de-identified information about how you found our Sites and how you interact with the Sites and Services. This information may be collected prior to account creation.

11. Anonymized and aggregated data

Anonymization is a data processing technique that removes or modifies personal information so that it cannot be associated with a specific individual. Except for this section, none of the other provisions of this Privacy Policy applies to anonymized or aggregated customer data (i.e. information about our customers that we combine so that it no longer identifies or references an individual customer). For Quebec residents, we anonymize personal information in accordance with generally accepted best practices, on an irreversible basis, as required under applicable Quebec law.

We may use anonymized or aggregate customer data for any business purpose, including to better understand customer needs and behaviours, improve our products and services, conduct business intelligence and marketing, and detect security threats. We may perform our own analytics on anonymized data or enable analytics provided by third-parties.

Types of data we may anonymize include, transaction data, click-stream data, performance metrics, and fraud indicators.

12. Basis for processing personal information

We will only collect, process, use and disclose your personal information where we have a lawful basis to do so. The lawful basis will depend on the purposes for which we have collected and use your personal information. In almost every case, the lawful basis will be one of the following:

• Our legitimate business interests. Where we have a legitimate interest to use personal information regarding you in relation to the operation of our business, including the monitoring and improving of our service. Also, where it is necessary for system administration purposes and for internal operations.
• Performance of an agreement with you. For example, where you have provided your information in order to receive a service from us.
• Compliance with the law. Where we are subject to a legal obligation and need to use your personal information in order to comply with that obligation.
• Consent. Where you have given consent for us to process your personal information for a specific purpose.

13. Marketing

We may send you marketing materials which we believe may be of interest to you. We will only contact you by electronic means (email or SMS) based on our legitimate interests, as permitted by applicable law, or your consent.

You may receive marketing communications from us if you have engaged with us, requested information from us or used our services and you have not opted out of receiving that marketing.

Third-party marketing. We will not sell or rent your personal information to any third-parties. We will not share your personal information with third-parties for marketing purposes.

Opting out. You can ask us or third-parties to stop sending you marketing messages at any time by contacting us at any time. Where you opt out of receiving these marketing messages, this will not apply to personal information provided to us as a result of a service purchase, service experience or other transactions.

Canada’s Anti-Spam Legislation. In addition to this Privacy Policy, our commercial electronic messages (such as marketing emails and SMS messages) are governed by Canada’s Anti-Spam Legislation (“CASL”). In accordance with CASL, we will only send you commercial electronic messages where we have your express or implied consent to do so, each such message will identify us and include our contact information, and each message will include a working unsubscribe mechanism that we will honour within ten (10) business days and that will remain functional for at least sixty (60) days after the message is sent.

14. How we share your personal information with third-parties

We take care to allow your personal information to be accessed only by those who require access to perform their tasks and duties, and to share only with third-parties who have a legitimate purpose for accessing it. We may share your personal information with our affiliated group companies (including USZoom, LLC, iPostal1 UK, Ltd. and iPostal1 Australia Pty Ltd), suppliers, business partners and other service providers, where they are helping us to market, advertise or supply our Services, for them to use for the purposes set out in this Privacy Policy. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We may disclose your personal information to other third-parties in the following cases:

• for the purposes of research, evaluation, and analysis of our services;
• in the event that we sell any business or assets, in which case we may disclose your personal information to the prospective buyer of such business or assets;
• if we or substantially all of our assets are acquired by a third-party, in which case personal information held by us about our clients, contractors, suppliers and visitors to our Sites will be one of the transferred assets;
• if we are under a duty to disclose or share your personal information in order to comply with any legal or regulatory obligation or request; or
• for the purpose of receiving professional advice (including legal advice);
• to process payments;
• to verify your identity (including for the purposes of registering a customer account with us);
• to prevent crime (including fraud); and
• to protect the rights, property or safety of us or our users, or others, and in order to enforce or apply our terms and conditions.

We require all third-parties to respect the security of your personal information and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions.

15. Your privacy rights

We take your privacy seriously and want you to be aware of your rights. Depending on the applicable law where you reside, you may be able to assert certain rights related to your personal information, including as follows:

• Access and portability. You may request that we provide you a copy of your personal information held by us. This information will be provided without undue delay subject to a potential fee associated with gathering of the information (as permitted by law), and unless there is a basis on which such request may be denied under applicable law. In certain circumstances, you may request to receive your personal information in a structured, commonly used and machine-readable format, and to have us transfer your personal information directly to another data controller.
• Correction of incomplete or inaccurate personal information. You may request that we correct or update any of your personal information that is inaccurate. You may do this at any time by logging in to your account or informing us at service@iPostal1.com.
• Erasure and portability. You may request that we erase your personal information, subject to applicable law. If you close your account, we will mark your account in our database as "Closed," but will keep certain account information, including your request to erase, in our database for a period of time as described above. This is necessary to deter fraud, by ensuring that persons who try to commit fraud will not be able to avoid detection simply by closing their account and opening a new account, and to comply with our legal obligations. However, if you close your account, your personal information will not be used by us for any further purposes, nor shared with third-parties, except as necessary to prevent fraud and assist law enforcement, as required by law, or in accordance with this Privacy Policy.
• Withdrawal of consent. To the extent the processing of your personal information is based on your consent, you may withdraw your consent at any time. Your withdrawal will not affect the lawfulness of our processing based on consent before your withdrawal.
• Restriction of processing. In some jurisdictions, applicable law may give you the right to restrict or object to us processing your personal information under certain circumstances. We may continue to process your personal information if it is necessary for the defence of legal claims, or for any other exceptions permitted by applicable law.
• Automated individual decision-making, including profiling. We rely on automated tools to help determine whether a transaction or a customer account presents a fraud or legal risk. Where a decision about you is made exclusively on the basis of automated processing of your personal information, including profiling, we will inform you of this at or before the time the decision is made. On request, we will inform you of the personal information used to render the decision, the reasons and principal factors that led to the decision, and your right to have that personal information corrected. You may also submit observations to a member of our staff who is in a position to review the decision.
• Complaints. You have the right to lodge complaints before a supervisory authority. See “16. Complaints” below for details of the applicable supervisory authorities.

Before we can respond to a request to exercise one or more of the rights listed above, you may be required to verify your identity or your account details. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Your rights to personal information are not absolute. Where applicable law affords you a right listed above, we will respect that right. Where applicable law does not require us to provide a particular right, we retain discretion as to whether and how to provide it. In addition, depending upon applicable law, privacy rights, including the right of access, may be limited or denied:

• when denial is required or authorized by law;
• when granting your request would have a negative impact on another's privacy;
• to protect our rights and properties; or
• where the request is frivolous or vexatious, or for other reasons.

How to make a privacy request

You can make privacy rights requests relating to your personal information by contacting us via dataprotection@uszoom.com. We will respond to your request within one (1) calendar month of receipt. In limited circumstances, we may extend this period by up to two (2) further months where requests are complex or numerous, where we will inform you of any such extension within one (1) month. Requests are handled free of charge unless manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to respond.

16. Complaints

If you believe that we have infringed your rights, we encourage you to contact us in the first instance at dataprotection@uszoom.com. Alternatively you may contact us through our website at the following https://ipostal1.com/contact-subscriber.php so that we can attempt to resolve the issue or dispute informally. If that does not resolve your issue, you may contact the our privacy officer at legal@uszoom.com.

We will endeavour to deal with your request as soon as possible. We will acknowledge your complaint within a reasonable time and will investigate and respond to your complaint within thirty (30) days, or such longer period subject to providing you with reasonable advance notice.

The above is without prejudice to your right to file a complaint with the relevant supervisory authority in your habitual place of residence. If you are based in Canada, the relevant supervisory authority is the federal Office of the Privacy Commissioner of Canada (the “OPC”). You can file a complaint with the OPC at https://www.priv.gc.ca. The address of the OPC is as follows:

Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
Canada

The OPC’s helpline number is: 1-800-282-1376, and its website is: https://www.priv.gc.ca/en.

If you are a resident of Quebec, you may also (or instead) file a complaint with the Commission d’accès à l’information du Québec (the “CAI”), which is responsible for overseeing compliance with Quebec privacy law. The CAI can be reached at: https://www.cai.gouv.qc.ca.

17. Cookies and tracking technologies

We may utilize cookies and similar tracking technologies (such as web beacons and pixels) on our Sites to operate, improve, and analyze our Services. Cookies are small text files stored on your device when you visit our site. Cookies are small text files placed on your device.

We use the following categories of cookies:

• Strictly Necessary cookies (essential for the Sites to function and cannot be switched off);
• Performance/Analytics cookies (to help us understand how visitors interact with the Sites, for which we will obtain your prior consent before placing);
• Functional cookies (enable enhanced functionality and personalisation); and
• Targeting/Advertising cookies (used to deliver relevant advertising, for which we will obtain your prior consent before placing).

We may share information collected through cookies with trusted third-party service providers. These parties are required to handle your information in accordance with applicable privacy laws.

You can manage your cookie preferences or adjust your consent at any time using our cookie preference tool or by adjusting your browser settings. Please note that disabling certain cookies may affect the functionality of our Sites.

We handle any personal information collected through cookies and similar technologies in accordance with this Privacy Policy and applicable Canadian privacy laws, including under PIPEDA.

18. Data breach notification

We are subject to the mandatory breach reporting requirements under Part 4 of PIPEDA and the Breach of Security Safeguards Regulations. In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm to one or more individuals, we are required to notify both the OPC and the affected individuals as soon as feasible.

We maintain internal procedures for detecting, reporting, and assessing potential breaches of security safeguards. Upon becoming aware of a potential reportable breach, we will:

• promptly assess whether the breach creates a real risk of significant harm to affected individuals, having regard to the sensitivity of the information and the probability that it will be misused;
• if the breach meets the reporting threshold, notify the OPC and affected individuals as soon as feasible; and
• take reasonable steps to contain and remediate the breach, and maintain records of all breaches for a minimum of twenty-four (24) months as required under s. 10.3(1) of PIPEDA.

If you believe your personal information has been compromised, please contact us immediately at https://ipostal1.com/contact-subscriber.php.

19. Withdrawing consent

Where we rely on your consent as the basis for handling your personal information, you have the right to withdraw that consent at any time. You can withdraw consent by:

• clicking the unsubscribe link in any marketing email;
• updating your preferences in your account settings;
• contacting us at: https://ipostal1.com/contact-subscriber.php; or
• writing to us at our registered address.

Withdrawal of consent will not affect the lawfulness of any handling carried out before you withdrew your consent. Following withdrawal, we will cease handling your data for the relevant purpose(s) as soon as reasonably practicable.

20. Contact us

If you have any questions, concerns or complaints about this Privacy Policy or how we handle your personal information, you may contact our Privacy Officer by email at dataprotection@uszoom.com or through our website at https://ipostal1.com/contact-subscriber.php.