Privacy Policy

Introduction and scope

Aurum Technologies Inc. (the "Company", "we", "us" or "our") provides a consumer mobile and web application (the "Service"). This Privacy Policy (the "Policy") describes how we collect, use, disclose, retain and protect Personal Information when you use the Service, visit our websites, or otherwise interact with us.

This Policy applies to individuals located in Canada, the United States and other countries in which the Service is made available. It is intended to comply with PIPEDA (Canada), Law 25 (Quebec), the CCPA/CPRA (California), the Gramm-Leach-Bliley Act, US State Privacy Laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana), the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, Brazil's LGPD, and Australia's Privacy Act 1988.

By using the Service, you acknowledge that you have read and understood this Policy. Capitalised terms not defined here have the meanings given in Section 02 (Definitions).

Definitions

Personal Information means information about an identifiable individual, or information that can reasonably be associated with an identifiable individual, and includes "personal data" and "personal information" as defined under Applicable Privacy Laws.

Sensitive Personal Information means Personal Information treated as sensitive under Applicable Privacy Laws, including government-issued identifiers, financial account information, precise geolocation, account credentials, racial or ethnic origin, health information, biometric data, and information concerning a known child.

Applicable Privacy Laws means PIPEDA, Law 25, the CCPA, GLBA, the US State Privacy Laws, EU GDPR, UK GDPR, Swiss FADP, Brazil's LGPD, Australia's Privacy Act 1988, and any other applicable privacy law.

Service Provider has the meaning given under the CCPA and includes processors and service providers as used in the US State Privacy Laws and PIPEDA.

Personal Information we collect

We collect the following categories of Personal Information, depending on how you interact with the Service:

• Identifiers — name, email address, mobile telephone number, username and account credentials, IP address, device identifiers and online identifiers.
• Account and profile information — date of birth, profile photo, preferences and content you submit to the Service.
• Commercial information — transaction history, subscription status and records of products or services purchased.
• Financial information — payment card information, billing address and, where applicable, bank account information. Payment card information is collected and processed by our payment processor and is not stored on our servers.
• Internet or network activity — device and browser type, operating system, referring URL, pages viewed, in-app actions, crash logs and diagnostic data.
• Geolocation data — approximate location derived from IP address and, with your consent, precise geolocation from your device.
• Audio, electronic, or visual information — content you upload to the Service.
• Inferences — drawn from any of the foregoing to create a profile reflecting your preferences, characteristics and behaviour.

We do not knowingly collect Sensitive Personal Information except where you provide it voluntarily or where required to deliver a requested feature. We do not use or disclose Sensitive Personal Information beyond purposes permitted under the CCPA without your consent.

How we collect Personal Information

• Directly from you — when you create an account, complete forms, make a purchase, contact us, or submit information through the Service.
• Automatically — through cookies, SDKs, pixels and similar technologies as described in Section 12 (Cookies).
• From third parties — identity verification providers, payment processors, analytics providers, advertising partners, social media platforms if you connect your account, and publicly available sources.

Why we use your information

• To provide, operate, maintain and improve the Service
• To create and manage your account and authenticate your identity
• To process transactions, including billing and refunds
• To communicate with you — customer support, service announcements, security alerts
• To personalise content, features and recommendations
• To measure performance, conduct research and develop new features
• To detect, prevent and investigate fraud, abuse, security incidents and violations of our terms
• To comply with legal obligations, respond to lawful requests and enforce our legal rights
• To send marketing communications where you have consented (see Section 13)

We rely on your consent, the necessity of processing to perform a contract with you, our legitimate interests in operating and improving the Service, and compliance with legal obligations.

Disclosure to third parties

• Service Providers — hosting, payment processing, analytics, customer support, communications and identity verification, each bound by written agreements restricting their use of Personal Information.
• Professional advisors — legal counsel, auditors and insurers.
• Governmental authorities — where required or permitted by law, including in response to a subpoena, court order or regulatory request.
• Corporate transaction parties — in connection with a merger, acquisition, financing or sale of assets, subject to confidentiality obligations.
• Other parties — with your consent or at your direction.

International transfers and storage

The Company is based in Ontario, Canada. Personal Information may be stored and processed in Canada, the United States and other jurisdictions where we or our Service Providers operate. We use contractual, technical and organisational safeguards to protect transferred Personal Information.

Quebec residents: we conduct a privacy impact assessment before transferring Personal Information outside Quebec as required by Law 25. For transfers from the EEA, UK or Switzerland to countries without recognised adequate protection, we implement Standard Contractual Clauses or equivalent mechanisms. You may request a copy by contacting us at Section 19.

Retention

We retain Personal Information only as long as necessary to fulfil the purposes for which it was collected, to comply with legal, accounting and tax obligations, to resolve disputes and to enforce our agreements. When no longer required, we securely destroy, erase or de-identify it in accordance with our records retention schedule and Applicable Privacy Laws.

Safeguards and security

We maintain administrative, technical and physical safeguards appropriate to the sensitivity of the Personal Information in our custody, including access controls, encryption in transit, secure software development practices, employee training and incident response procedures.

No method of transmission over the internet is fully secure. If we become aware of a security incident affecting your Personal Information, we will notify you and applicable regulators as required by Applicable Privacy Laws.

Financial information (GLBA)

If and to the extent the Company is a "financial institution" under GLBA, we collect nonpublic personal information from applications, transactions and interactions with our Service Providers. We disclose such information only as permitted by GLBA — to Service Providers performing services on our behalf, to complete authorised transactions, and as required by law. We do not disclose nonpublic personal information to non-affiliated third parties for their own marketing purposes. We maintain physical, electronic and procedural safeguards compliant with applicable federal and state standards.

Children's privacy

The Service is not directed to children under 13 (under 14 in Quebec), or under any higher minimum age applicable in the child's jurisdiction (16 in the EEA and UK; 18 in India). If we learn we have collected Personal Information from a child without verified parental consent, we will delete it promptly. Parents or guardians may contact us at Section 19 to request deletion.

Cookies and tracking technologies

We and our Service Providers use cookies, SDKs, pixels, local storage and similar technologies to operate the Service, remember preferences, measure usage and, where required consent exists, deliver targeted advertising. You may control these through your browser settings, mobile device settings (including Limit Ad Tracking or App Tracking Transparency), and opt-out mechanisms within the Service. We honour Global Privacy Control signals where required by law.

Marketing communications

Where required by law, we obtain your consent before sending commercial electronic messages. In Canada we comply with CASL. In the US we comply with the CAN-SPAM Act and, for telephone and SMS marketing, the TCPA and applicable state laws. You may withdraw consent or opt out at any time by following the unsubscribe instructions in any message, updating your account settings, or contacting us at Section 19. Withdrawal does not affect transactional or service-related communications.

Your rights and choices

Depending on your jurisdiction, you may have the right to access, correct, delete, or port your Personal Information; opt out of the sale, sharing or targeted advertising of your information; limit the use of Sensitive Personal Information; withdraw consent; and be free from unlawful discrimination for exercising these rights.

Quebec residents also have the right to data portability, to be informed of automated decision-making, and to request cessation of dissemination or de-indexing where dissemination contravenes the law or a court order.

EEA, UK and Switzerland residents also have the right to object to processing based on legitimate interests or for direct marketing, to restrict processing in certain circumstances, and to lodge a complaint with your local supervisory authority.

California residents have the right to know the specific pieces of Personal Information collected, categories of sources, business purposes for collection, and categories of third parties receiving your information.

To exercise any right, contact us at Section 19. We respond within applicable legal timeframes, verify your identity before acting, and will explain any denial. You may appeal any denial by writing to our Privacy Officer, or lodge a complaint with the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the California Privacy Protection Agency, the relevant state Attorney General or other supervisory authority.

Do Not Track and opt-out preference signals

We process recognised opt-out preference signals, including the Global Privacy Control, as a valid request to opt out of the sale or sharing of Personal Information and targeted advertising where required by law. We do not otherwise respond to "Do Not Track" browser signals.

De-identified and aggregate information

We may de-identify or aggregate Personal Information so it can no longer reasonably be used to identify an individual. We maintain and use de-identified information without attempting to re-identify it, except as permitted by law to test our de-identification processes.

Privacy Officer and accountability

The Company has appointed a Privacy Officer accountable for our compliance with this Policy and Applicable Privacy Laws. The Privacy Officer may be contacted as set out in Section 19.

Changes to this Policy

We may amend this Policy from time to time. The amended Policy will be posted with a revised effective date. Where required by Applicable Privacy Laws, we will notify you of material changes and, if necessary, obtain your consent before those changes apply to you.

Contact

Questions, requests and complaints may be directed to our Privacy Officer: