Privacy and personal information protection policy

Preamble

This policy applies to the company that operates the technology solution under the trade name Mortgage Fox (hereinafter "Mortgage Fox"). Mortgage Fox designs and operates digital tools intended in particular for mortgage brokerage professionals. Depending on the features used, the platform may allow users to create and manage accounts, prepare files, perform calculations, manage or extract information, produce summaries or recommendations, and use automation or artificial intelligence ("AI") features.

Mortgage Fox processes information that may be highly sensitive, including financial information and documents submitted in the context of mortgage files. Protecting this information is part of the requirements for designing, developing, operating and improving the platform.

1. Purpose and scope

This policy explains, in simple and clear terms, how Mortgage Fox governs personal information it collects, holds, uses, discloses, retains, destroys, de-identifies or anonymizes in the course of its activities. It applies whether the information is retained directly by Mortgage Fox or by a supplier acting on its behalf.

• registered users, brokers, firms, account administrators and other organizations using Mortgage Fox;
• prospects, partners and persons who communicate with Mortgage Fox or request support;
• website visitors and users of Mortgage Fox electronic services;
• persons whose information is entrusted to the platform by an authorized user in the context of a file;
• employees, candidates, consultants or suppliers, to the extent Mortgage Fox processes personal information concerning them.

2. Legal framework

In Quebec, Mortgage Fox applies in particular the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), the Civil Code of Quebec, the Act to establish a legal framework for information technology, the Regulation respecting confidentiality incidents and the Regulation respecting the anonymization of personal information. When circumstances require, PIPEDA or other Canadian provincial laws may also apply to interprovincial, international activities or to certain persons and organizations outside Quebec.

This policy is also one of the governance measures required by Quebec legislation. It must be read together with Mortgage Fox's internal security, retention, supplier management, privacy impact assessment ("PIA"), incident and complaints handling practices.

3. Accountability and governance

Mortgage Fox remains accountable for personal information it holds or processes in the course of its own activities, including when a supplier processes it on its behalf. The privacy officer oversees the application of this policy, rights requests, incidents, privacy impact assessments ("PIAs"), technology project governance and supplier oversight.

Privacy officer
Mr. Jean-François Choquette

Address 1
1060 Michèle-Bohec Blvd., Suite 101, Blainville, Quebec J7C 5E2

Address 2
893 Taniata Ave., Lévis, Quebec G6Z 2E3

Phone
418-204-7738

Email
info@consortiumhypothecaire.com

The privacy officer is consulted from the outset of any project to acquire, develop or redesign an information system or electronic service delivery involving personal information.

4. Respective roles of Mortgage Fox and users

Mortgage Fox may process (i) information it collects for its own activities, such as account administration, billing, security or support, and (ii) information that a user or client organization entrusts to the platform in the course of its own professional services.

When a broker, firm or other organization deposits information concerning its own clients in Mortgage Fox, that organization remains responsible for determining whether its collection, use and disclosure are permitted, providing required notices and obtaining consents or authorizations required by the laws, regulations and professional rules applicable to it. Mortgage Fox then processes that information according to service parameters, authorized instructions and its own legal obligations.

5. Useful definitions

Personal information: any information concerning a natural person that allows that person to be identified directly or indirectly.

Sensitive personal information: information that, by its nature or the context of its use or disclosure, gives rise to a high reasonable expectation of privacy, including financial, medical, biometric or otherwise intimate information.

Inferred or derived information: information deduced, predicted, classified or generated from other data about a person. When it allows a person to be identified, directly or indirectly, it remains personal information.

De-identification: a measure by which information no longer allows a person to be identified directly, without making re-identification irreversible. De-identified information remains protected by law.

Anonymization: a regulated process making it reasonably foreseeable, at all times and irreversibly, that a person can no longer be identified directly or indirectly.

Confidentiality incident: unauthorized access, use or disclosure of personal information under applicable law, loss of information or any other breach of its protection.

AI feature: a function using in particular statistical, algorithmic, machine learning or generative AI models to extract, classify, summarize, suggest, analyze, generate or recommend information.

6. Categories of information that may be processed

• identity and contact information: name, address, phone, email, language of communication and information necessary for identity verification;
• professional information: organization, role, title, licence or professional identifiers, account settings and rights;
• authentication and security: identifiers, connection logs, IP address, device data, audit trails, security events and anti-fraud data;
• commercial administration: subscription, billing, payments, service history, communications, support and complaints;
• mortgage file entrusted by a user: identity, employment, income, assets, liabilities, properties, mortgages, down payment, financial information, supporting documents, credit reports when their processing is authorized, and other elements necessary to the file;
• submitted documents and information extracted, structured or summarized from those documents;
• technical data: browser, operating system, performance, errors, metadata and telemetry necessary for operation, security or service improvement;
• interactions with AI features: instructions, questions, input data, attachments, outputs, summaries, classifications, recommendations and other generated results;
• inferred or derived information when the platform performs analysis, calculation, classification, inconsistency detection or recommendation.

Users must avoid inserting sensitive information that is not necessary to the purpose of the service into a free-text field, attachment or AI function.

7. Sources and means of collection

• directly from the person concerned;
• from an authorized user or organization processing that person's file;
• through the website, platform, forms, document imports, APIs or authorized integrations;
• from partners, suppliers or third parties when the law permits collection or appropriate authorization exists;
• automatically, from systems, devices, technical logs, cookies and mechanisms necessary for operation and security.

Upon direct collection, Mortgage Fox provides information required by law, including purposes, means of collection, access and rectification rights, withdrawal of consent where relevant, categories of necessary third parties and the possibility that information may be disclosed outside Quebec.

8. Purposes of use

• create, authenticate, administer and secure accounts;
• provide requested features and execute authorized instructions related to a file;
• extract, structure, classify, summarize, present or validate information;
• perform calculations, consistency checks, assisted recommendations and other authorized processing;
• provide support, respond to requests, handle complaints and resolve problems;
• administer subscriptions, billing and commercial relationships;
• prevent and detect fraud, abusive access and security incidents;
• maintain, diagnose, test and improve platform performance, reliability, accessibility and security;
• comply with legal, regulatory, contractual and record-keeping obligations;
• assert or defend rights and protect Mortgage Fox, its users and its systems.

A new use that is not compatible with initially stated purposes and is not otherwise permitted by law requires new consent when consent is required.

9. Consent and choices

Consent is requested when required by law. It must be clear, free, informed, given for specific purposes and presented in simple and clear terms. Consent concerning sensitive information is express when the law requires it.

A person may withdraw consent to a future use or disclosure when the law permits. Withdrawal may limit or prevent provision of a feature when the information is necessary to perform the service, contract or a legal obligation. Reasonably foreseeable consequences are explained when relevant.

10. Artificial intelligence: no-training rule and governance

Mortgage Fox may use AI to assist the user, including in data extraction, synthesis, classification, content preparation, inconsistency detection, recommendation and decision support. AI systems are probabilistic: an output may be incomplete, inaccurate, inconsistent or vary despite similar data.

When an AI feature processes personal information, Mortgage Fox applies in particular the following rules:

• limit data transmitted to the AI function to what is reasonably necessary;
• conduct a PIA when the project, integration, redesign or transfer is covered by law, and in all cases before integrating a new AI supplier that will have access to sensitive personal information;
• govern in writing any supplier receiving personal information and require guarantees provided by law;
• disable or prohibit, when technically possible and contractually relevant, use of production data for the supplier's general training purposes;
• document functions, data categories, suppliers, versions or material changes and applicable controls when the risk level warrants it;
• provide for human review when a result is likely to have a significant impact on a person;
• allow correction, suspension or withdrawal of a feature that presents an unreasonable risk of privacy, security, bias or inaccuracy.

An AI-generated result is an assistance tool. It does not, on its own, constitute credit approval, a lender commitment, legal or tax advice, or a guarantee of compliance. The professional user remains responsible for verifying source data, relevance and accuracy of the result before using it.

11. Exclusively automated decisions

If Mortgage Fox uses personal information so that a decision based exclusively on automated processing is made, the person concerned is informed no later than when the decision is communicated to them. Upon request, Mortgage Fox informs them of the information used, the reasons and main factors and parameters that led to the decision, as well as their right to have the information used rectified. The person may submit observations to a staff member able to review the decision.

A recommendation, extraction, summary, validation or decision support provided to a professional who actually retains decision-making power is not automatically treated as an exclusively automated decision.

12. Profiling, cookies, identification and privacy by default

When a technology includes functions allowing a person to be identified, located or profiled, Mortgage Fox provides in advance the information required by law and indicates the means offered to activate functions that must be activated by the person concerned.

Privacy settings for a technology product or service offered to the public are configured, by default, to the highest privacy level when the law requires it. Mortgage Fox may use cookies strictly necessary for authentication, security, session maintenance and operation. Optional analytics, personalization or profiling cookies or technologies are subject to applicable notices and choices.

13. Accuracy, quality and retention of data used to decide

Mortgage Fox takes reasonable measures so that information it uses itself to make a decision concerning a person is up to date and accurate. Information used for such a decision is retained for at least one (1) year following the decision, in accordance with Quebec law.

When information is provided by a user or automatically extracted from documents, the user must verify source data and extractions before relying on them in their professional practice.

14. Internal access and confidentiality

Access to personal information is limited to authorized employees, officers, consultants and suppliers who need it to perform their functions or deliver the service. Access rights are granted according to roles, need-to-know and least-privilege principles, and are modified or revoked when no longer necessary.

Authorized persons are subject to confidentiality obligations and security rules adapted to their functions.

15. Suppliers, subcontractors and service contracts

Mortgage Fox may entrust certain tasks to suppliers, including for cloud hosting, backups, cybersecurity, payments, messaging, support, document processing, communications, analytics or AI. A disclosure necessary to perform a mandate or service contract is governed in writing when the law requires it.

The mandate or contract provides in particular applicable confidentiality and security measures, use limited to mandate purposes, prohibition on retaining information after mandate expiry except legal requirement or authorized instruction, obligation to notify without delay of any breach or attempted breach of confidentiality obligations, and the privacy officer's ability to perform verifications relating to that confidentiality.

Mortgage Fox does not sell personal information entrusted to the platform. Except on a distinct legal basis or with appropriate consent, Mortgage Fox does not use a user's clients' personal information to solicit those persons directly for its own commercial benefit.

16. Disclosure or processing outside Quebec

Before disclosing personal information outside Quebec or entrusting a person or organization outside Quebec with the task of collecting, using, disclosing or retaining information on its behalf, Mortgage Fox conducts a PIA when Quebec law applies.

The assessment takes into account in particular the sensitivity of the information, the purpose, contractual and technical protection measures and the legal regime applicable in the state concerned. Disclosure is made only if the assessment demonstrates adequate protection with regard to generally recognized principles, and is subject to a written agreement taking into account assessment results and required mitigation measures.

17. Information security

Mortgage Fox implements reasonable administrative, technical and physical measures taking into account in particular sensitivity, purpose, quantity, distribution and medium of the information. Depending on context, these measures may include in particular:

• role-based access controls, separation of privileges and access revocation;
• authentication mechanisms and secure credential management;
• encryption or equivalent protections for transmissions and, where relevant, stored data;
• logging, monitoring, alerts and security event detection;
• backups, continuity, recovery and service-appropriate testing;
• vulnerability management, patches, updates and security testing proportionate to risk;
• logical separation of environments and data where relevant;
• structured access management during hiring, role changes and departures;
• supplier assessment and contractual security requirements;
• training and awareness for persons with system access.

No computer system is risk-free. Mortgage Fox reassesses its measures in light of evolving threats, technologies, uses and information sensitivity.

18. Privacy impact assessments (PIAs)

Mortgage Fox conducts a PIA for any project to acquire, develop or redesign an information system or electronic service delivery involving personal information, in circumstances provided by law. The privacy officer is consulted from the outset of the project.

The PIA is proportionate to the sensitivity of the information, purposes, quantity, distribution and medium. It takes into account in particular access, suppliers, data flows, AI functions, retention, portability, re-identification risks, transfers outside Quebec and mitigation measures.

19. Retention and destruction

Mortgage Fox retains personal information only for the period necessary to achieve determined purposes, subject to deadlines imposed or permitted by law, contractual obligations, and reasonable security, audit, fraud prevention, evidence or rights defence needs.

When purposes are achieved, information is securely destroyed or, if Mortgage Fox wishes to retain it for serious and legitimate purposes, it is anonymized in accordance with applicable regulatory requirements.

• information used by Mortgage Fox to make a decision concerning a person is retained for at least one year after the decision;
• the confidentiality incident register is retained for at least five years after the date or period when the incident became known;
• complaint files are retained according to the internal schedule and, unless otherwise justified, for a minimum period of five years after closure;
• contractual, tax, accounting information or information necessary to defend rights is retained for applicable periods;
• operational data entrusted by a user is retained according to the service, authorized instructions and applicable obligations, without undue extension.

After authorized deletion or account closure, certain copies may temporarily remain in backups, logs or recovery systems. They become inaccessible for ordinary use and are eliminated according to applicable backup cycles, unless longer retention is required or permitted.

20. Regulatory anonymization

When it chooses anonymization rather than destruction, Mortgage Fox applies a process compliant with Quebec regulation. This process includes at minimum:

1. determining, before anonymization, the serious and legitimate purposes for using anonymized information;
2. placing the process under the supervision of a competent person;
3. removing direct identifiers and performing a preliminary re-identification risk analysis, in particular according to individualization, correlation and inference criteria;
4. choosing anonymization techniques consistent with best practices and protection measures aimed at reducing risks;
5. performing a final analysis demonstrating that residual re-identification risks are very low;
6. recording in the anonymization register the required information, purposes, techniques, protection measures and analysis dates;
7. periodically reassessing anonymized information, in particular with regard to technological advances that may increase re-identification risks.

21. Rights of persons concerned

Subject to exceptions provided by law, a person may in particular:

• request confirmation of the existence of personal information concerning them and access to it;
• obtain a copy or, when the law provides and this does not raise serious practical difficulties, receive certain computerized information collected from them in a structured, commonly used technological format;
• request rectification of inaccurate, incomplete or ambiguous information, or information whose collection, disclosure or retention is not authorized;
• request, when legal conditions are met, cessation of dissemination or de-indexing or re-indexing of a hyperlink;
• withdraw consent to a future use or disclosure when the law permits;
• obtain the information and review opportunity provided when a decision is based exclusively on automated processing;
• file a complaint concerning Mortgage Fox practices.

22. Access and rectification procedure

In Quebec, an access or rectification request must be made in writing by a person who proves their identity and must be addressed to the privacy officer. When the request is imprecise or a person requires it, the privacy officer assists them in identifying the information sought.

The privacy officer responds in writing diligently and no later than thirty (30) days following receipt of the request. Any refusal is reasoned in accordance with law and specifies applicable remedies and deadlines. Information subject to refusal is retained for the time required to allow exercise of remedies provided by law.

Privacy officer
Mr. Jean-François Choquette

Address 1
1060 Michèle-Bohec Blvd., Suite 101, Blainville, Quebec J7C 5E2

Address 2
893 Taniata Ave., Lévis, Quebec G6Z 2E3

Phone
418-204-7738

Email
info@consortiumhypothecaire.com

23. Minors

Mortgage Fox is designed primarily for professionals and organizations. Users must not deposit information concerning a minor when it is not necessary to a legitimate and authorized file.

When personal information concerning a minor under 14 years of age is collected directly from the minor, consent of the holder of parental authority or the tutor is obtained, except where an exception is provided by law.

24. Confidentiality incidents

Any known or suspected incident must be reported without delay to the privacy officer. Mortgage Fox takes reasonable measures to reduce the risk of harm and prevent a similar incident from recurring.

Risk assessment takes into account in particular the sensitivity of the information, anticipated consequences of its use and the probability it will be used for harmful purposes. When the incident presents a risk that serious injury will be caused, Mortgage Fox diligently notifies the Commission d'accès à l'information and persons concerned, according to modalities provided by applicable law and regulation.

Mortgage Fox maintains a register of all confidentiality incidents containing regulatory information and retains it for at least five (5) years after the date or period when the incident became known.

25. Commercial solicitation and communications

When Mortgage Fox uses personal information for commercial solicitation purposes, it identifies itself and informs the person of their right to withdraw consent to that use when the law requires it. A withdrawal applicable to solicitation is respected.

26. Commercial transactions and restructurings

In the context of an actual or contemplated commercial transaction, including a merger, acquisition, financing, asset sale or reorganization, Mortgage Fox may disclose personal information within limits permitted by law and subject to required agreements and confidentiality measures.

27. Questions, concerns and complaints

Any question, rights request or complaint concerning personal information protection may be addressed to the privacy officer. Complaints are handled according to the Mortgage Fox Complaints management policy without limiting rights and remedies provided by law.

Privacy officer
Mr. Jean-François Choquette

Address 1
1060 Michèle-Bohec Blvd., Suite 101, Blainville, Quebec J7C 5E2

Address 2
893 Taniata Ave., Lévis, Quebec G6Z 2E3

Phone
418-204-7738

Email
info@consortiumhypothecaire.com

A person may also exercise remedies before the Commission d'accès à l'information when Quebec law applies. When PIPEDA applies, the Office of the Privacy Commissioner of Canada may also have jurisdiction.

28. Amendments, approval and review

Mortgage Fox may update this policy to reflect the evolution of its services, practices, suppliers, technology architecture, AI functions or legal framework. Any significant change is brought to the attention of persons concerned by an appropriate means. The published version indicates its effective date.

The policy and accompanying governance practices are reviewed at least annually and whenever a significant change warrants it. They are approved by the privacy officer in accordance with applicable requirements.

---

Main legal references

Text	Sections / elements	Scope in the policy
Act respecting the protection of personal information in the private sector (Quebec)	1, 3.1 to 3.8, 4 to 14, 17, 18.3, 20, 22, 23, 27 to 36	Accountability, governance, PIAs, incidents, collection, consent, automated AI, suppliers, transfers, security, retention and rights.
Regulation respecting confidentiality incidents	3 to 8	Notice content, incident register and minimum five-year retention.
Regulation respecting the anonymization of personal information	3 to 9	Purposes, supervision, re-identification analyses, techniques, reassessment and register.
Civil Code of Quebec	35 to 40	Respect for privacy and rights relating to files and personal information.
Act to establish a legal framework for information technology	As applicable	Integrity, legal value and management of technological documents.
PIPEDA, where applicable	Part 1	Certain interprovincial, international or federally regulated commercial activities.

Responsible authority: Mr. Jean-François Choquette, privacy officer.