Privacy and Cookies Policy

This Privacy and Cookies Policy (“Policy”) describes the personal information that Simple Compliance Ltd. (“Simple Compliance”, “our”, “we” or “us”) collects from or about you when you use our online portal, mobile app, and services (collectively, our “Services”), apply for credit, provide a personal guarantee, or otherwise interact with us. It also describes how we use that information, and to whom we disclose it. As used in this Policy, “personal information” means information about an identified or identifiable individual and, in some jurisdictions, household. An identifiable individual is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual. Personal information does not include general, statistical, anonymized or aggregated information, or any other information exempted under applicable privacy legislation.

We value your privacy, and recognize our role in protecting your personal information. Please read this Policy carefully and contact us if you have any questions. By submitting an application or using our Services (other than to review this Policy or other documents on our website), or otherwise providing us with personal information, you will be deemed to have agreed to this Policy. If you do not agree with our collection, use or disclosure of your personal information in accordance with this Policy, you should not access or use the Services or otherwise provide any personal information to us.

QUEBEC RESIDENTS: Please review the jurisdiction-specific terms set out below.

RESIDENTS OF CALIFORNIA: Alternate or additional terms may apply to you. Please review the “Additional Information for California Consumers” set out at the end of this Policy, which includes additional information about the categories of personal information that we collect, and your rights under California privacy legislation.

RESIDENTS OF OTHER U.S. STATES: Please review the section entitled “Other U.S. Jurisdictions” set out at the end of this Policy, which provides additional information about your rights.

---

Changes and Updates

Simple Compliance reserves the right to revise this Policy from time to time and, as such, you should review its terms each time that you visit our website or otherwise use the Services. We will notify you about any significant changes in the way we handle personal information by sending a notice to the primary email address specified in your account, by placing a prominent notice on the website or app, and/or by updating the privacy information in this Policy. Any changes to this Policy will not go into effect until at least five (5) days after they are posted or otherwise communicated to you. Your continued use of the Services signifies your acceptance of any changes to this Policy.

---

Accountability and Openness / Privacy Officer

Simple Compliance is responsible for personal information under our control, and we are accountable to you for our collection, use and disclosure of all personal information that you provide to us or that we collect about you. We have established policies and procedures to safeguard any personal information that we have on file or that we collect, and to deal with complaints and inquiries. We will only collect, use and disclose personal information as described in this Policy.

Simple Compliance has designated a privacy officer (the “Privacy Officer”) who is accountable for the protection of personal information, and for our compliance with this Policy and applicable privacy laws. If you have questions or concerns regarding this Policy, our compliance with it, or about any of our processes and procedures relating to the collection, use and disclosure of your personal information, you may direct them in writing to the Privacy Officer at [email protected] or Suite 201 – 5668 192 St., Surrey, British Columbia, Canada V3S 2V7.

Collection of Personal Information

What Information is Collected and How?

We collect personal information only to the extent that it is necessary for the purposes set out below (see: Purpose – Why We Collect, Use and Disclose Information). In most cases, we will collect personal information directly from you when you apply for credit, provide a guarantee, use the Services, or otherwise interact with us. We encourage you not to provide us with any personal information beyond what is required or requested by us for the purposes we have described below. Personal information will always be collected using means that are transparent, fair and lawful.

A. Direct Collection

The primary means by which we collect information from you is by having you complete a credit application and other documentation related to the opening of an account for the use of the Services, such as a personal guarantee.

When you apply for an account, we may collect, use and disclose include your name, operating name, date of birth, email address, drivers’ license number, social insurance number, physical location and address, business type, language, passport number, Nexus or other “trusted traveller” program identifier, banking, financial and credit card information, and any other information reasonably required for the purposes of setting up and administering your account..

If you provide comments or other feedback to us regarding our Services, those comments or other feedback become the property of Simple Compliance and we may use, disclose and share them for any purpose provided that we do not associate them with your personal information without your express consent.

If you provide us with personal information about a third party (“Third-Party Personal Information”), you are wholly responsible for ensuring that the information has been collected, used and disclosed only as permitted under applicable law. Without limitation, you must ensure that all required consents have been obtained for the disclosure to, and use of the Third-Party Personal Information by Simple Compliance, and provide proof of such consents to Simple Compliance upon request. Do not provide Simple Compliance with any personal information that you are not legally permitted to disclose. Further, you must advise Simple Compliance in writing of any limits or restrictions on the use of any personal information that you disclose to us, and if permission to collect, use or disclose the personal information is subsequently withdrawn or altered.

B. Collection from Third Parties

We may gather information about you from credit bureaux, lien registries, financial institutions and any references that you provide, but will not collect personal information from a third party unless we receive assurance that all necessary consents have been obtained, or unless we are required or permitted to do so by applicable law. Any personal information collected from a third party will be used only for the purposes for which it was collected.

C. Information Collected Through Automated Means

Cookies

Simple Compliance uses cookies, pixels, tags, web beacons, and similar tracking technologies (“Cookies”) on our websites and digital services to help us operate our sites, improve your user experience, and understand how our services are used. Cookies are small data files stored on your device that allow the website to recognize you when you return and to remember your preferences and settings.

We use Cookies for the following purposes:

• To save you time and facilitate browsing by recalling your information and preferences on subsequent visits.
• To determine and authenticate your access privileges and to allow you to access your personal or account pages more efficiently.
• To complete and support a current activity (for example, maintaining your session as you navigate the site).
• To track website usage and analyze how visitors interact with our services.
• To implement security features, detect malicious activity, and enforce our Terms of Service.
• To generally improve and personalize your user experience.

When you first visit our website, a banner or notice will inform you of our use of Cookies, explain the categories of Cookies used, and request your consent where required by law. You may withdraw your consent or manage your Cookie preferences at any time through the Cookie settings link or your browser controls.

Data Analytics and Pixels

Simple Compliance uses web analytics services such as Google Analytics and similar tools to help us understand how visitors use our websites. These services may use cookies and other tracking technologies to collect information about your visits, such as pages viewed, time spent on site, and referral sources. The information collected is aggregated and anonymized where possible and is used to improve our website, content, and user experience.

Our websites may also use advertising and conversion tracking pixels (for example, Meta Pixel and Microsoft Advertising) to measure the effectiveness of our marketing campaigns and to show you more relevant advertising on other websites and platforms. These pixels may collect information about your interactions with our site and may be linked to identifiers used by the relevant advertising platform. You may manage or opt out of certain advertising related tracking through your browser settings or via the platform’s own opt out mechanisms (for example, the Network Advertising Initiative or each platform’s ad preference settings).

Do Not Track

Your browser or device may include “Do Not Track” functionality. “Do Not Track” is a concept that has been promoted by regulatory agencies such as the U.S. Federal Trade Commission (FTC), for the Internet industry to develop and implement a mechanism for allowing Internet users to control the tracking of their online activities across websites by using browser settings. The World Wide Web Consortium (W3C) has been working with industry groups, Internet browsers, technology companies, and regulators to develop a standard for “Do Not Track” technology. No standard has been adopted to date. At this time, Simple Compliance does not respond to browser “Do Not Track” signals.

Consent

Consent for the collection, use or disclosure of personal information may be express or implied.

Typically, when you provide personal information to us, we will seek your consent at the time of collection, and efforts will be made to ensure that you understand the purpose(s) for which the information will be used or disclosed. If you choose to complete and submit an application for credit or a personal guarantee, your consent for our use of the information to review and process that application or guarantee in accordance with this Policy may be implied.

The information that we collect directly from you via the credit application process, or via third parties such as credit rating organizations, is never sold or licensed.

In certain circumstances, we may seek your consent for use or disclosure after the information has been collected, but before use, such as when Simple Compliance wishes to use or disclose personal information already in its possession for a purpose that was not previously identified.

Part of providing meaningful consent is understanding the risk of harm and other consequences of the disclosure of personal information. While Simple Compliance endeavours to continually use best practices to minimize the risk of harm (See: Safeguards – How Personal Information is Protected), technology is constantly evolving, and no safeguards can be guaranteed to be failsafe or to provide absolute protection against malfeasors. Significant harm that may result from the unauthorized use of the personal information that you disclose includes identity theft and the risk of fraudulent transactions by third parties using your information.

Withdrawal of Consent

You may always choose not to disclose personal information, although to do so may affect the processing and approval of your credit application.

When we are already using personal information on the basis of your consent, you may withdraw or change that consent at any time. To withdraw or change your consent to our collection or use of your personal information, please send your request in writing, along with details of the use of the information that you wish to change or withdraw your consent for, to the Privacy Officer using the contact information set out above (see: Accountability and Openness / Privacy Officer). Note that where our processing of your personal information is not based on your consent (but is based on another legal ground), we may not be able to comply with your request. We will endeavour to inform you of this in writing if this situation arises.

In some circumstances, particularly where our use of certain personal information that you have provided to us is integral to our approval of your credit application or your use of the Services, your refusal to provide consent, or to change or withdraw consent, may adversely affect your interactions with us and/or our ability to review, approve, process or continue to extend credit, or to provide you with Services.

Purpose - Why We Collect, Use and Disclose Information

Except as specified below, will not use or disclose your personal information for any purpose other than the purpose(s) for which it was collected from you, without first obtaining your consent.

Uses for which Simple Compliance may use your personal information include:

• to review, process, verify, and approve or reject your application;
• to create a user account for you, to verify and authenticate your identity, and to administer your account;
• to process payments;
• to offer, operate and maintain our website, and to respond to your requests, questions and concerns;
• to make the Services available to you, and generally to perform our obligations and exercise our rights arising from any contract between you and us;
• to support our advertising and marketing activities;
• to obtain feedback regarding our business, which may include inviting you by email to write a review of the Services. This allows us to continually improve the services that we offer;
• to verify that any information submitted by you is accurate and complete;
• to generally communicate with you for reasons related to our business, such as to provide you with announcements, updates, alerts, confirmations and corrections;
• to create a record of your involvement with us;
• for legal purposes, which may include the handling and resolution of claims and legal disputes, and for regulatory investigations and approvals;
• to detect and prevent error, fraud, theft and other illegal or unwanted activities;
• internal business purposes, including data analysis, to administer or improve our services, market research, to enhance the user experience, and to improve the functionality and quality of our website and online content;
• to comply with any legal, accounting and regulatory requirements, including reporting requirements; and
• any other reasonable purpose for which you provide consent, or for which consent may be implied in accordance with this Policy or applicable law.

Where personal information that has been collected is to be used for a purpose not previously identified, we will notify you of the new purpose and, where necessary, obtain your consent, prior to the use of that information for the new purpose unless otherwise permitted by law.

Commercial Electronic Messages

Simple Compliance complies with Canadian and US “anti-spam” legislation, and will only send electronic communications as permitted by law. We may send you email or SMS messages in connection with the Services. Note that you may always unsubscribe from our electronic communications by following the “unsubscribe” link clearly included in each communication, or by notifying the Privacy Officer using the contact information set out above (see: Accountability and Openness / Privacy Officer). We will promptly comply with all “unsubscribe” requests.

Disclosure to Third Parties

Except as specifically provided in this Policy or permitted by law, your personal information will not be shared with third parties unless we provide you with both prior notice and choice.

Simple Compliance may disclose your personal information to third party subcontractors and service providers in connection the operation of our business and the provision of our Services. Third party service providers to which we may disclose personal information include banks, credit rating companies, payment processors, login authentication services, web hosts, and parties that we engage to send out marketing materials. Given the nature of cloud services and the Internet, personal information may be transmitted, accessed and stored outside Canada and the United States, and may be accessible to foreign courts, law enforcement and national security authorities in the jurisdiction(s) where it is transferred or stored.

Prior to disclosing your information to third parties, Simple Compliance will have written contracts in place with those third parties to ensure that any personal information that you disclose to us is protected, and is used only in accordance with this Policy and applicable laws. In all cases, disclosures to third parties will only be as described in this Policy. We may change or add service providers at any time, at our discretion. Details regarding the personal information that we make available to our third-party service providers, and how it is used, is available by contacting the Privacy Officer using the contact information set out above (see: Accountability and Openness / Privacy Officer). Any request made by you to correct, change or erase personal information will be promptly communicated to any third parties to which we have disclosed that information (see: Individual Access / Accuracy / Erasure).

We may collect, use or disclose personal information without your knowledge or consent where we are permitted or required to do so by applicable law, government request, request of a law enforcement agency, search warrant, subpoena or court order, or based upon our good faith belief that it is necessary to do so in order to comply with such law, request, warrant, subpoena or court order, or to enforce our rights or to protect our assets, you or other users of the Services, or the public.

We may transfer to another entity, or its affiliates or third-party data processors, some or all information about you in connection with, or during negotiations of, any merger, acquisition, sale of assets or any line of business, change in ownership control, or financing transaction. In each such case, Simple Compliance and the other part(ies) to the transaction or proposed transaction will enter into a written agreement limiting the period and purposes for which your personal information may be used and disclosed.

Retention of Personal Information

Subject to any legal or accounting requirements, we will retain personal information only as long as your account is active, or as is otherwise necessary to fulfill the purposes for which the information was collected. Personal information that is no longer required will be destroyed, deleted from all integrated technology solutions, or made anonymous, although copies of deleted information may continue to exist on back-up media. In certain circumstances, you may request the erasure of your personal information that you have provided to us, which we will endeavour to do without undue delay as required by applicable law.

Written requests for the erasure of information should be sent to the Privacy Officer using the contact information set out above (see: Accountability and Openness / Privacy Officer). We use reasonable industry practices to ensure we have adequate controls, schedules and practices for information and records retention and destruction which apply to personal information.

Once personal information has been destroyed, erased or anonymized, any rights regarding access to that information, erasure, rectification and data portability cannot be enforced.

Safeguards – How Personal Information is Protected

We have implemented physical, organizational, contractual and technological security measures to protect personal information in our possession or under our control from loss or theft, and from unauthorized access, disclosure, copying, use or modification, regardless of the format in which the information is held. The safeguards applied will depend on the sensitivity of the personal information, with the highest level of protection given to the most sensitive information such as personal health information and financial information.

Our data systems use user IDs and passwords, and we will only store data on secure servers located on our premises in Canada and on remote servers hosted by reputable companies in Canada and the United States. Personal information is protected through layered security across infrastructure, access and operations. We employ encryption, fire walls and multi-factor authentication. Access to personal information is limited to authorized personnel on a “need to know” basis. Credentials and privileged access are handled using approved secure tools and practices. Staff and contractors who have access to personal information receive privacy training, and are bound by confidentiality obligations to ensure that information is handled and stored in a confidential and secure manner. Any payment information that you submit will not be stored on our servers, but rather will be sent to a PCI Level 1-compliant payment processor for storage. When destroying personal information, we delete electronically stored personal information on servers owned or controlled by us, and shred any physical materials containing personal information. We will instruct third party services providers to destroy all copies of your personal information in their possession. While we will endeavour to ensure the destruction of all copies of your personal information under our control, you acknowledge that deleted information may continue to exist on back-up media but will not be used unless permitted or required by law.

We will continually review and update our security policies and controls as technology evolves. However, no security technology can be guaranteed to be failsafe. Using the Internet or other public means of communication to collect and process personal information may involve the transmission of data on an international basis and across networks not owned and/or controlled by Simple Compliance. Accordingly, we cannot guarantee that personal information will not be lost, or that it will not be altered, intercepted or stored by an unauthorized third party.

In the event of a security breach concerning personal information, we will endeavor to notify affected individuals promptly upon discovering the breach, as required by applicable law, and to use commercially reasonable means to mitigate its effects. In any event, if a breach is likely to affect the rights or freedoms of the affected individual, we will ensure that the notification is made without undue delay. In the event of actual or potential data or systems breach, Simple Compliance will have no obligations beyond those required under applicable laws.

Individual Access / Accuracy / Destruction

We will endeavour to ensure that personal information contained in our records or which is disclosed to third parties for the purposes described above will be as accurate, complete and up-to-date as is necessary for the purposes for which it is used. You may request information about the personal information that we hold about you by submitting a written request to the Privacy Officer using the contract information set out above (see: Accountability and Openness / Privacy Officer). Including “Request personal information” in the subject line of your email or letter will facilitate compliance with your request. We will endeavour to inform you of your personal information held by us, and to provide an account of the use that has been made of the information, as well as to identify any third parties to whom we have disclosed the information. You may also be entitled to receive a copy of your personal information in a structured, commonly-used, machine-readable format (or request that it be transferred to a third party where technically possible). In certain circumstances, Simple Compliance may not be able to provide you with access to some or all of your personal information, in which case you will be advised in writing of the reasons for our inability to provide you with the information.

You have the right to request that we correct or rectify any personal information that we hold about you that is out of date or incorrect. We will amend the information provided that you advise us in writing as to the inaccuracy or incompleteness, and provide satisfactory proof of your identity. Notices and requests regarding inaccuracies or changes can be sent to the Privacy Officer using the contact information set out above (see: Accountability and Openness / Privacy Officer).

In certain circumstances, you have the right to require that we erase, limit and/or cease processing your personal information. You may also request the closure of your account at any time. All notices and requests asking us to erase, limit or stop processing your personal information should be made via request in writing sent via email to the Privacy Officer using the contact information set out above (see: Accountability and Openness / Privacy Officer).

Links to Other Websites

If our website contains links to third-party websites, the owners of those websites are responsible for the privacy practices and content for their sites. If you click on those links, you will leave the Simple Compliance website, and third parties may collect personal information from you or your electronic devices. The accessing and use of any third-party websites is at your own risk. Simple Compliance does not provide or endorse any information, goods or services available through third party websites, and we cannot assume responsibility for the privacy practices, policies or actions of the third parties who operate those websites. This Policy applies only to the Simple Compliance website, and we encourage you to review the privacy policies contained on each Internet site that you access.

International Transfer and Storage of Information

Simple Compliance is based in Canada, and operates in both Canada and the United States. However, given the nature of the Internet and international commerce, personal information may be transmitted, transferred, processed, backed-up and/or stored in other jurisdictions. In particular, certain parties to which we disclose your personal information (see: Disclosure to Third Parties) may use and store that information outside of Canada or the United States. We will use reasonable means to ensure that your information is only used in accordance with this Policy, including entering into written agreements with the third parties to which we disclose your information, but cannot guarantee that the laws of any foreign jurisdiction will accord the same degree of protection as the laws of Canada or the United States, or that your personal information will not be accessible to foreign courts, law enforcement or national security authorities in the jurisdiction(s) where it is transferred or stored.

Minors

Simple Compliance’s primary business activities are not directed at persons under the age of majority. Simple Compliance will never knowingly collect personal information from persons under the age of 18. If we are advised or otherwise discover that personal information has been collected from someone under the age of 18 without the express consent of a parent or guardian, we will take all commercially reasonable steps to delete that information.

Compliance and Governing Law

Inquiries, requests and complaints regarding our compliance with this Policy should be directed to the Privacy Officer (see: Accountability and Openness / Privacy Officer). Complaints may also be made to the Privacy Commissioner of Canada. If you are entitled to data protection rights under the laws of Quebec, the laws of California or certain other US states, you are also be entitled to lodge a complaint with the relevant supervisory authority that deals with data protection matters in your jurisdiction.

Every complaint or challenge regarding our compliance with this Policy will be investigated, and where a deficiency is found to exist, we will take appropriate measures to address it. This may include amending our policies and procedures as necessary. We will also cooperate with regulatory authorities to resolve any complaints that cannot be resolved between us and an individual.

The Simple Compliance website is operated from British Columbia, Canada. Except as required by applicable privacy laws, your use of the Services, this Policy and the protection of your personal information will be governed by the applicable laws of the Province of British Columbia and of Canada. Additional rights may apply to users who are subject to the laws of other jurisdictions.

QUEBEC RESIDENTS: The provisions of this Policy are applicable to the personal information we collect about and from Quebec residents. This section sets out additional details regarding the rights of Quebec residents and our obligations when we collect their personal information in the Province of Quebec. In the event of a conflict between the terms set out in this Policy and the Act respecting the Personal Information in the Private Sector (“APPIPS”), APPIPS will prevail. Without limitation:

• EXCEPT WHERE WE REQUEST YOUR CONSENT AT THE TIME OF COLLECTION AS DESCRIBED HEREIN, BY VISITING OR USING THE WEBSITE OR OUR SERVICES, OR OTHERWISE COMMUNICATING WITH US, YOU AGREE TO BE BOUND BY THIS POLICY AND CONSENT TO THE COLLECTION, USE, RETENTION, DISCLOSURE AND DESTRUCTION OF YOUR PERSONAL INFORMATION IN ACCORDANCE WITH THE TERMS DESCRIBED HEREIN. IF OTHER TERMS APPLY, WE WILL DESCRIBE THEM AT THE TIME OF COLLECTION. If you do not want your personal information to be collected, used or disclosed in this manner, then please either refrain from providing us with any personal Information, or exercise your right to withdraw your consent.
• Your personal information may be disclosed outside the province of Québec, including in other Canadian provinces and the in United States of America.
• In addition to the measures set out in the section of this Policy entitled Safeguards – How Personal Information is Protected, please note that our internal policies and practices provide for: (a) a framework applicable to the use, communication, retention and destruction of personal information; (b) a definition of the roles and responsibilities of our employees throughout the life cycle of the information; and (c) a process for handling complaints regarding the protection of the information.
• You have the right to access, rectify, and port your data, and to request that it be deleted (right to be forgotten). We will respond to any request within thirty (30) days of receipt, except where the law permits an extension of that time. If we refuse to provide or correct the information, we will provide you with the reasons for the refusal, the applicable sections of the law and information about your remedies, all subject to the limitations of the law. If we refuse to rectify your personal information, we will allow you to place comments in your file in respect of the personal information for which rectification has been refused. We will also retain the personal information that has been the subject of an access request for as long as necessary to allow you to exhaust any recourse provided by law.
• Simple Compliance will only collect your personal information using technology that allows you to be located, tracked or profiled if we have informed you in advance of our use of such technologies, and you have chosen to activate them.
• Any breach of personal information that poses a “risk of serious injury” will be reported to all affected individuals and to the Commission d’accès à l’information (CAI).

ADDITIONAL INFORMATION FOR CALIFORNIA CONSUMERS:

This section applies to consumers residing in the State of California, USA, in accordance with the California Consumer Privacy Act of 2018 (the “CCPA”), as amended, and its implementing regulations. For such persons, this information supersedes any divergent or conflicting information elsewhere in this Policy. Capitalized terms used in this section that are not otherwise defined in this Policy will have the meanings ascribed to them in the CCPA.

Our Collection of Personal Information.

The following table lists the categories of personal information we have collected in the last twelve months in the fashion required by Cal. Civ. Code § 1798.130(a)(5)(B)(i).

Category under the California Consumer Privacy Act	Specific Legal Description	Collected
A. Identifiers	Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.	Yes
B. Customer records (as defined in Cal. Civ. Code § 1798.80(e))	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information or health insurance information.	Yes
C. Protected classifications	Characteristics of protected classifications under California or federal law, such as race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information), and age over 40.	Yes
D. Commercial information	Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	Yes
E. Biometric information	An individual’s physiological, biological, or behavioral characteristics, including DNA information that is used or is intended to be used to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a face print, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.	No
F. Usage data	Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement.	Yes
G. Geolocation data	Data intended to locate a consumer within a geographic area.	Yes
H. Sensory data	Audio, electronic, visual, thermal, olfactory, or similar information.	No
I. Professional or employment information	Your job role, professional and educational qualifications, employment and education history, compensation information and similar data.	Yes
J. Education information	Information that is not publicly available personally identifiable information as defined in the California Family Educational Rights and Privacy Act, including education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	Yes
K. Inferences	Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	Yes

Our collection of Sensitive Personal Information.

As required by Cal. Civ. Code § 1798.100(a)(2), we disclose that we have collected the following categories of sensitive personal information in the last year.

Disclosures of Personal Information.

As required by Cal. Civ. Code § 1798.130(a)(5)(C), the following table lists the categories of personal information that we have “sold” or “shared for cross-context behavioral advertising” with third parties or disclosed for our business purposes in the past twelve months.

Category under the California Consumer Privacy Act	Sold or Shared in the Last 12 Months	Disclosed for a Business Purpose in the Last 12 Months
A. Identifiers	Yes	Yes
B. Customer records (as defined in Cal. Civ. Code § 1798.80(e))	No	Yes
C. Protected classifications	No	Yes
D. Commercial information	Yes	Yes
E. Biometric information	Not collected	No
F. Usage data	Yes	Yes
G. Geolocation data	Yes	Yes
H. Sensory data	No	No
I. Professional or employment information	Yes	Yes
J. Education information	Yes	Yes
K. Inferences	Not collected	No

Your Opt-out Rights under CCPA.

The CCPA provides rights to opt-out of certain kinds of personal information processing:

• The Right to Opt Out of Sale or Sharing of Personal Information – You may opt of the sale or sharing of your personal information by clicking the Do Not Sell or Share My Personal Information link displayed on our website or by contacting the Privacy Officer at the address set out above (see: Accountability and Openness / Privacy Officer). You may also exercise this right automatically using the Global Privacy Control or other universal opt-out mechanism. You may also access your account to confirm that your opt-out preference signal has been honored.

Your Other Rights under the CCPA

• The Right to Access Personal Information; the Right to Know – You have the right to
  request that we disclose to you:

• The categories of personal information that we collect about you
• The categories of sources from which the personal information was collected
• The purposes for which we use your information
• To categories of third parties to whom we disclose such information
• The specific pieces of personal information that we have collected about you

The disclosures described above will be limited to the personal information collected or used by Simple Compliance in the preceding 12 month period.

• Portability. If we deliver our response electronically, the information enclosed will be “portable”, i.e. delivered in an easily usable format to enable you to transmit the information to another entity without hindrance provided that it is technically feasible to do so.
• The Right to Request The Deletion Of Your Personal Information – You have the right to request that we delete any of your personal information under our control, subject to applicable legal exceptions. These include, but are not limited to: where the information is used to identify and repair errors, to detect security incidents and protect against fraudulent or illegal activities, and to exercise certain rights. If no legal exception applies, upon request, Simple Compliance will delete your personal
  information, and instruct any of our service providers, Purchasers and other third parties with whom we have shared your personal information to do so, provided that this is technically feasible and does no involve disproportionate effort.
• The Right to Correct Inaccurate Personal Information – You may request that Simple Compliance correct or update your personal information by contacting the Privacy Officer in writing as described below.

• The Right to Limit the Use of Your Sensitive Personal Information – You have the right to request that we limit our use and disclosure of your sensitive personal information to that use which is necessary given the nature of your interaction with us. You can do so by contacting our Privacy Officer as described below. For California consumers “sensitive personal information” includes information that may reveal: (a) your social security, driver’s license, state identification card, or passport number; (b) your account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (c) your precise geolocation; (d) your racial or ethnic origin, religious or philosophical beliefs, or union membership; (e) the contents of your mail, email, and text messages unless the business is the intended recipient of the communication; and (f) your genetic data. “Sensitive personal information” also includes (A) the processing of biometric information for the purpose of uniquely identifying a consumer; (B) personal information collected and analyzed concerning a consumer’s health; and (C) personal information collected and analyzed concerning a consumer’s sex life or sexual orientation.
• The Right to be Free from Retaliation – Simple Compliance will not discriminate against you for exercising your CCPA rights. Specifically, we will not deny you goods or services, compensate you differently, or provide a different quality of service simply because you exercised your rights. However, if you do not provide consent or withdraw consent for the use of information that is necessary for you to use our website or for us to provide certain services to you, your ability to use the website or for us to provide the Services will be affected.

How to Exercise Your Rights. You may exercise these rights by contacting the Privacy Officer using the contact information set out above (see: Accountability and Openness / Privacy Officer). Your request must: (a) provide sufficient information that allows Simple Compliance to reasonably verify you are the person about whom we collected personal information (or an authorized representative); and (b) describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. If you cannot personally submit a verifiable request, you can authorize a person registered with the California Secretary of State to act on your behalf. If you are an adult, you can make a verifiable request on behalf of a child under your parental authority.

You may appeal our decision with respect to your request to exercise your legal rights with regard to your personal information. To submit such an appeal, you may contact the Privacy Officer using the contact information set out above (see: Accountability and Openness / Privacy Officer). You must include sufficient information to allow us to reasonably verify your identity, reference the date and time of your previous request to exercise your legal rights, and explain why you believe our decision was insufficient or improper. We will respond to your appeal in accordance with the timelines set forth in applicable law.

Shine the Light Law. California’s “Shine the Light” law, Cal. Civ. Code § 1798.83, entitles California residents to request certain information regarding Simple Compliance’s disclosure of personal information to third parties for their direct marketing purposes. Any inquiries regarding personal information sharing with third parties may be directed to the Privacy Officer using the contact information set out above (see: Accountability and Openness / Privacy Officer).

OTHER US JURISDICTIONS:
If you live in a state of the United States of America other than California, depending on the law in the state where you live, you may have certain rights regarding your personal information under the law. To exercise your rights, please contact the Privacy Officer using the contact information set out above (see: Accountability and Openness / Privacy Officer).

Your rights may include the following:

• the right to opt-out of the use of personal information for targeted advertising, personal information sales, or profiling resulting in significant consequences (note, however, that we do not engage in such profiling);
• the right to confirm whether we process your personal information and to access a copy (from which we may, for security purposes, exclude certain personal information), including a copy that is in a portable data format;
• the right to the correction of inaccurate personal information;
• the right to the deletion of your personal information; and
• the right to appeal the action we take in response to any request to exercise these rights.

You can exercise your right to opt-out of the use of personal information for targeted advertising and personal information sales by using an opt-out preference signal such as the Global Privacy Control or by accessing your account.

With respect to your other rights, only you, or someone legally authorized to act on your behalf, may make a request related to your personal information. We will verify that any requests from persons other than you have your legal authorization. You may also make a request on behalf of your child.

Your request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or a legally authorized representative; and
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

You may also appeal the decision we make on your request by using the contact information set out above (see: Accountability and Openness / Privacy Officer). When you contact us to appeal, please tell us why you believe we erred in responding to your request. We will respond to your appeal in accordance with the timelines set forth in applicable law.