Privacy Policy

1. Introduction#

BrokerPlus Technologies Inc. ("BrokerPlus", "we", "us", "our") is committed to protecting the privacy of personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

This policy describes how we collect, use, disclose, and protect personal information in connection with the BrokerPlus platform and services.

2. Scope#

This policy applies to all personal information collected, used, or disclosed by BrokerPlus in the course of its commercial activities, including information about:

• Mortgage brokers and brokerage staff who use the BrokerPlus platform
• Borrowers whose information is processed through the platform on behalf of brokers
• Prospective clients and other individuals who submit information through a broker's lead capture forms, booking pages, or calculators, or who are added to a broker's contact records without becoming clients
• Referral partners, referral sources, and other third parties a broker records in the platform, and participants on calls or meetings captured through the platform
• Business contacts at lender and partner organizations
• Employees and contractors of BrokerPlus

3. Definitions#

Personal Information means information about an identifiable individual, including but not limited to: name, address, email, phone number, date of birth, Social Insurance Number, employment information, income, financial data, and property details.

Sensitive Personal Information means personal information that requires a higher degree of protection due to its nature, including financial records, government-issued identification data, identity verification imagery, credit information, and recordings of calls and meetings.

4. Accountability#

The Chief Security Officer (CSO) is the designated individual responsible for BrokerPlus's compliance with this policy and PIPEDA. Questions, concerns, or complaints regarding privacy can be directed to:

Amir Agassi, Chief Security Officer
Email: amir@getbrokerplus.ca

5. Information We Collect#

5.1 Broker and Platform User Information

• Full name, email address, phone number
• Organization and role information
• Login credentials (passwords stored in hashed form only), passkeys, and two-factor settings
• Session data (IP address, user agent, login timestamps)

5.2 Borrower Information (Processed on Behalf of Brokers)

Brokers upload and input borrower information into the platform, and borrowers submit information directly through the borrower portal, for the purpose of managing mortgage deals. BrokerPlus processes this information solely on behalf of the broker. Borrower information collected through the platform may include:

• Full name, date of birth, contact information
• Social Insurance Number. Where a credit check or a lender submission requires it, the platform collects the full Social Insurance Number. It is encrypted at rest and is disclosed only to the credit reporting agency or lender the broker directs us to, as described in Sections 12 and 15.
• Employment details (employer, job title, income, tenure)
• Financial information (income, assets, liabilities, down payment details)
• Property information (address, purchase price, property type)
• Supporting documents (pay stubs, T4s, notices of assessment, bank statements, letters of employment)
• Government-issued identification and identity verification imagery, including document images and a live photograph, where the broker uses the platform's identity verification features (Section 16)
• Credit reports and credit history obtained on the broker's instruction (Section 15)
• Recordings and transcripts of calls, text messages, and meetings conducted through the platform (Section 17)
• Correspondence between the broker and the borrower sent or received through the platform, including email and text message content

Brokers are responsible for obtaining all necessary consents from borrowers before uploading their personal information to the platform.

5.3 Prospective Client and Contact Information

Brokers may publish lead capture forms, calculators, and booking pages that collect information from members of the public who are not yet the broker's clients, and may record contacts, referral partners, and referral sources in the platform. Information collected this way may include name, contact information, and any details the individual provides about their mortgage or property. This information is processed on behalf of the broker, and the broker is responsible for the lawfulness of its collection.

5.4 Automatically Collected Information

• IP addresses and browser/device information for security monitoring
• Platform usage data for service improvement
• Audit logs of significant actions within the platform
• Engagement data for client-facing reports and messages, such as whether a report or email was opened and which elements were interacted with
• Session recordings capturing interactions with platform interfaces, including the borrower portal, as described in Section 6.2

6. Cookies, Tracking Technologies, and Third-Party Scripts#

6.1 Cookies and Similar Technologies Used by BrokerPlus

BrokerPlus uses the following cookies and similar technologies to operate the platform:

Session cookies. These are essential cookies that maintain your authenticated session while you are logged into the platform. They expire when you close your browser or after a period of inactivity. Without session cookies, you will be unable to log in or use the platform.

Authentication tokens. We use secure, HTTP-only tokens to verify your identity across requests. These are necessary for the platform to function and cannot be disabled.

User preference cookies. These cookies store your interface preferences (such as display settings and notification preferences). Disabling these cookies will reset your preferences to defaults on each visit but will not prevent you from using the platform.

Security cookies. We use cookies to support security features including CSRF protection and rate limiting. These are essential to protecting your account and data.

6.2 Third-Party Cookies, Analytics, and Session Recording

BrokerPlus uses the following third-party services that set cookies or collect data:

Analytics. We may use analytics services to understand how the platform is used and to improve its features. Analytics tools collect usage data such as pages visited, time spent on features, and general interaction patterns. This data is aggregated and is not used for advertising or to build profiles about individuals.

Session recording. We use a session recording service to capture interactions with platform interfaces so that we can diagnose errors and improve usability. This applies both to the broker dashboard and to the borrower portal, which means a recording may capture a borrower's session while they complete an application or upload documents. Recordings are used solely for troubleshooting and product improvement, are never used for marketing or advertising, and are retained only as long as needed for those purposes.

Error monitoring. We use error monitoring services to detect and diagnose technical issues with the platform. These services may collect technical data about your browser, device, and the actions that preceded an error. We apply automated filtering intended to remove sensitive identifiers such as Social Insurance Numbers, dates of birth, email addresses, and phone numbers from error reports before they are transmitted. This data is used solely for troubleshooting and is not used for marketing or profiling purposes.

Bot protection. Public-facing forms, such as a broker's lead capture forms, use a bot protection service that assesses browser and network signals to distinguish genuine submissions from automated ones.

Infrastructure providers. Our hosting and infrastructure providers may set technical cookies necessary for content delivery, load balancing, and security. These are essential to platform operation.

BrokerPlus does not use third-party advertising cookies or tracking pixels. We do not participate in ad networks or share user data with advertisers.

Some of the service providers described in this section process data outside Canada. See Section 13 and Section 20.

6.3 Managing Cookie Preferences

You can manage cookies through your browser settings. Most browsers allow you to block or delete cookies, or to be notified before a cookie is set. Please note that blocking essential cookies (session, authentication, and security cookies) will prevent you from using the platform. Blocking preference cookies will reset your display and notification settings to defaults on each visit but will not affect core functionality.

7. Purpose of Collection#

We collect and use personal information for the following purposes:

Providing the BrokerPlus platform - mortgage deal workflows, document management, and submission preparation.

Document processing - automated classification, data extraction, and validation.

Communication - facilitating communication between brokers and their borrowers by email, text message, and telephone, including automated and scheduled messages a broker configures.

Client-facing analysis and reporting - preparing mortgage calculations, scenario projections, and reports that a broker reviews and sends to their clients.

Credit reporting - obtaining credit reports from a credit reporting agency on the broker's instruction and with the individual's consent (Section 15).

Identity verification and anti-money laundering - verifying identity, screening against sanctions and politically exposed person lists, assessing risk, and maintaining records, so that brokers can meet their obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (Section 16).

Security - protecting accounts, detecting fraud, monitoring for unauthorized access.

Compliance - meeting legal and regulatory obligations.

Service improvement - analyzing platform usage to improve features.

8. Consent#

Brokers consent to the collection and use of their personal information when they create an account and agree to the Terms of Service.

Borrower consent is the responsibility of the broker. Brokers must obtain all necessary consents from borrowers before uploading borrower personal information to the platform, in compliance with PIPEDA and applicable provincial privacy legislation.

8.1 Withdrawing Consent

How to withdraw. You may withdraw your consent by contacting the CSO at amir@getbrokerplus.ca or by using the account settings in the platform. BrokerPlus will acknowledge receipt of a withdrawal request within five (5) business days.

Before processing. Before processing a consent withdrawal request, BrokerPlus will inform you of the specific consequences of withdrawing consent so that you can make an informed decision. These consequences may include:

• Inability to continue processing active mortgage deals that require the use of your personal information
• Loss of access to historical deal data and documents stored on the platform
• Inability to use communication features
• Deactivation of your account

Response time. BrokerPlus will process consent withdrawal requests within thirty (30) days of receiving the request. Where withdrawal affects active mortgage transactions, BrokerPlus will work with the broker to minimize disruption.

9. CASL Compliance#

BrokerPlus's communication features are subject to Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23). The following provisions govern how the platform handles broker-to-borrower communications.

9.1 Express and Implied Consent

Express consent is obtained when a borrower affirmatively opts in to receive electronic communications from the broker. Express consent remains valid until the borrower withdraws it.

Implied consent may exist where the broker has an existing business relationship with the borrower, such as where the borrower has made an inquiry about mortgage services within the preceding six (6) months, or where the broker has an ongoing mortgage transaction with the borrower. Implied consent is time-limited and expires as provided under CASL.

9.2 Broker Responsibilities

Brokers are solely responsible for ensuring that valid consent (whether express or implied) exists before using BrokerPlus's communication features to send electronic messages to borrowers. BrokerPlus provides the communication infrastructure but does not independently verify the existence of consent between the broker and the borrower.

Every electronic message sent through BrokerPlus must include the broker's identifying information, the applicable brokerage's contact information, and a functioning unsubscribe mechanism, all of which the platform provides by default.

9.3 Automated and Scheduled Messages

The platform includes automation features that allow a broker to configure messages that send on a schedule or in response to an event, such as a mortgage anniversary, a birthday, a renewal window, or a change in a property's estimated equity. It also includes campaign features that send email or text messages to a segment of the broker's contacts.

A broker may configure these features either to prepare a draft for their review or to send automatically without a person approving each individual message. Where a broker enables automatic sending, the broker remains solely responsible for ensuring that valid consent exists for every recipient, and for the content of every message sent under their account. BrokerPlus does not review the content or the recipient list of messages a broker configures.

9.4 Unsubscribe Mechanism

BrokerPlus includes an unsubscribe mechanism in commercial electronic messages sent through the platform, together with the sending broker's and brokerage's identifying and contact information. When a borrower exercises their right to unsubscribe, the platform will process the request within ten (10) business days and notify the applicable broker. Brokers must not send further commercial electronic messages to borrowers who have unsubscribed.

For text messages, recipients may reply STOP, UNSUBSCRIBE, CANCEL, END, or QUIT to stop further messages from that number, and START to resume. Suppression is applied at the platform level so that a recipient who opts out is excluded from subsequent automated and campaign sends.

10. Marketing and Commercial Electronic Messages#

10.1 Communications from BrokerPlus

BrokerPlus may send electronic communications to registered brokers and platform users for the following purposes:

Transactional messages. Emails and notifications related to your account, subscription, platform updates, security alerts, and service-related announcements. These are sent as part of our contractual relationship and do not require separate marketing consent.

Marketing communications. By creating an account, you are automatically opted in to receive promotional emails about new features, product updates, educational content, industry insights, and partnership opportunities. You may opt out at any time as described in Section 10.2. Receipt of marketing communications is not a condition of using the platform, and opting out will not affect your access to or use of the Service.

10.2 Opting Out of Marketing

You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link included in every marketing email
• Updating your communication preferences in your account settings
• Contacting us at hello@getbrokerplus.ca

Opt-out requests will be processed within ten (10) business days. Opting out of marketing communications will not affect transactional messages necessary for the operation of your account.

10.3 Borrower Marketing

BrokerPlus does not send marketing communications directly to borrowers. All marketing communications to borrowers are the responsibility of the broker and are governed by the CASL provisions in Section 9.

11. Limiting Collection#

BrokerPlus limits the collection of personal information to what is necessary for the identified purposes. Certain sensitive fields are collected only where a specific function requires them. A full Social Insurance Number, for example, is collected where it is needed to obtain a credit report or to complete a lender submission, and is not required to use the platform generally.

12. Use, Disclosure, and Retention#

We may disclose personal information to:

• Lender and lender network systems, as directed by the broker, for the purpose of submitting a mortgage application
• Credit reporting agencies, as directed by the broker and with the individual's consent, to obtain a credit report (Section 15)
• Identity verification and sanctions screening providers, where the broker uses those features (Section 16)
• Electronic signature providers, where a document is sent for signature through the platform
• Service providers who process personal information on our behalf to operate the platform, as described in Section 13
• Law enforcement or regulators when required by law or court order
• An acquirer or successor in the event of a merger, acquisition, financing, or sale of assets, subject to that party being bound to protect the information consistently with this policy

We do not sell, rent, or trade personal information.

We do not use personal information to train our own machine learning models. Our contractual arrangements with the third-party providers described in Section 13 and Section 21 are intended to prohibit them from using personal information transmitted to them to train their models. We do not otherwise use personal information to develop models.

Personal information is retained only as long as necessary to fulfill the purposes for which it was collected, or as required by law. See Section 27.

13. Service Providers and Sub-Processors#

BrokerPlus engages third-party service providers to operate the platform. These providers process personal information on our behalf and are permitted to use it only to provide their service to us. We engage providers in the following categories:

• Cloud hosting, database, storage, and content delivery
• Credit reporting (Section 15)
• Identity verification, sanctions and politically exposed person screening (Section 16)
• Lender submission networks and mortgage application platforms
• Electronic signature
• Telephony, text messaging, call recording, and transcription (Section 17)
• Meeting recording and transcription (Section 17)
• Email delivery and email or calendar account connectivity
• Artificial intelligence and machine learning processing (Section 21)
• Property valuation and property listing data
• Payment processing for subscriptions
• Error monitoring, analytics, session recording, and bot protection (Section 6.2)

Some of these providers process personal information outside Canada. Where that is the case, the information is subject to the laws of the jurisdiction in which it is processed, including lawful access by courts, law enforcement, and government authorities in that jurisdiction. See Section 20.

A current list of the sub-processors we engage, identifying each provider and the country in which it processes personal information, is available on request from the Chief Security Officer at amir@getbrokerplus.ca.

14. Borrower Data Protection#

BrokerPlus recognizes that borrower data is entrusted to the platform by brokers, and we are committed to protecting it with the highest standard of care. The following commitments apply:

No sharing between competing brokers. Borrower data submitted by one broker will never be shared with, disclosed to, or made accessible to any other broker or brokerage on the platform. Each broker's data is logically segregated at the organization level, and access controls prevent any cross-organization access to borrower information.

No ownership claim. BrokerPlus does not claim ownership of borrower data. Borrower data remains the property of the borrower and is processed by BrokerPlus solely on behalf of the broker for the purposes described in this policy.

Borrower data upon broker termination. When a broker's account is terminated:

• During the 30-day export window (Section 27), the broker may export all borrower data associated with their account.
• After the export window, BrokerPlus will delete borrower data associated with the terminated account, subject to any legal or regulatory retention requirements.
• If the borrower has an active relationship with another broker on the platform, any data independently submitted through that separate relationship is unaffected.
• BrokerPlus will not transfer, reassign, or make available a terminated broker's borrower data to any other broker or third party, except as required by law or as directed by the borrower.

15. Credit Reporting#

The platform allows a broker to obtain a credit report about an individual from a credit reporting agency. The following applies to that feature:

Consent is required. A credit report is requested only where consent has been captured and recorded. The platform records the scope of the consent, how and when it was given, the text the individual was shown, and the identity of the person who obtained it. A request cannot proceed without a recorded consent.

What is disclosed. To obtain a credit report, identifying information about the individual, which may include their full name, date of birth, address history, and Social Insurance Number, is disclosed to the credit reporting agency.

Effect on the individual. A credit report obtained through the platform may be recorded as an inquiry on the individual's credit file by the credit reporting agency. The credit reporting agency handles that information under its own privacy policy and under applicable consumer reporting legislation.

Broker responsibility. The broker determines whether and when to obtain a credit report, and is responsible for having a lawful purpose and valid consent for doing so.

16. Identity Verification and Anti-Money Laundering#

The platform includes features that support brokers in meeting their obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and its regulations. Where a broker uses these features, BrokerPlus processes the following on the broker's behalf:

• Identity verification, which may include images of a government-issued identity document and a live photograph of the individual, processed by a third-party verification provider
• Screening against sanctions lists and politically exposed person and head of international organization determinations
• Declarations completed by the individual, risk assessments, third-party determinations, and records of receipt of funds
• Ongoing monitoring and periodic rescreening, which may generate alerts for the broker to review

Retention. Records created for anti-money laundering purposes are subject to statutory retention periods, which currently require retention for at least five years. These records are retained for the required period even where other information has been deleted, as described in Section 27.

Automated screening is not a decision about the individual. Screening results are presented to the broker for review. The platform does not independently decline a transaction or make a determination about an individual; the broker exercises judgment on every result.

17. Call, Message, and Meeting Recording#

The platform includes telephone, text messaging, and meeting features. Where a broker uses them, the following applies:

Call recording and transcription. Calls placed or received through the platform may be recorded and transcribed. Recording is configurable by the broker and may be enabled by default on a broker's account. Recordings and transcripts are stored in the broker's account and are processed by third-party telephony and transcription providers.

Automated voice answering. A broker may enable an automated voice feature that answers inbound calls and speaks with the caller. The call opens with the greeting the broker has written, and it is the broker's responsibility to include in that greeting any notice that the caller is speaking with an automated system and that the call is recorded, as required where the caller is located. If a caller asks whether they are speaking with a person or whether the call is recorded, the feature answers truthfully. The feature can take limited actions such as arranging a callback, transferring the call to a person, or sending a text message. It does not provide mortgage, financial, or eligibility advice.

Meeting recording. A broker may permit a notetaking service to join an online meeting in order to record it and produce a transcript and summary. Where this is used, the recording captures all participants in the meeting, not only the broker.

Text messages. The content of text messages sent and received through the platform is stored in the broker's account and is processed by third-party messaging providers.

Notice and consent are the broker's responsibility. Recording a conversation and transcribing it engages privacy and, in some circumstances, criminal law obligations. The broker is responsible for providing any notice and obtaining any consent required from participants before recording, in the jurisdiction where the participants are located. BrokerPlus provides the recording infrastructure and does not independently verify that notice was given or consent obtained.

18. Safeguards#

• Encryption at rest using AES-256 for all stored data
• Application-level encryption of designated sensitive fields, including Social Insurance Numbers, in addition to encryption at rest
• Encryption in transit using TLS 1.2+ on all connections
• Access control through role-based permissions and organization-level data scoping
• Multi-factor authentication enforced on all employee accounts
• Endpoint security via SentinelOne EDR and Kandji MDM on all company devices
• Audit logging of significant data access and modifications

No method of transmission or storage is completely secure. While we work to protect personal information using the measures described above, we cannot guarantee absolute security.

19. BrokerPlus Personnel Access#

A limited number of authorized BrokerPlus personnel can access customer accounts and the personal information they contain, through internal administrative tools. This access is used only to operate and support the platform, including:

• Investigating and resolving a support request or a technical fault
• Performing account, billing, and provisioning administration
• Investigating suspected security incidents or misuse of the platform
• Complying with a legal obligation

Access is restricted to personnel whose role requires it, and administrative actions are recorded in our audit logs. Personnel are bound by confidentiality obligations.

20. Data Residency#

All personal information processed by BrokerPlus is stored and processed within Canada:

• Database: AWS ca-central-1 (Montreal)
• File storage: AWS S3 ca-central-1 (Montreal)
• AI processing: Canadian regions of the providers described in Section 21

21. AI-Powered Features#

BrokerPlus uses artificial intelligence and machine learning technologies across a range of platform features. The following disclosures apply to how personal information is handled by these features.

Processing scope. AI Features process personal information for purposes including: classifying uploaded documents and extracting data fields from them; summarizing and classifying email, text messages, calls, and meetings; transcribing audio; drafting correspondence for the broker's review; answering a broker's questions about their own data through an in-platform assistant; answering a borrower's questions in the borrower portal; and identifying and ranking outstanding work on a deal.

Assistive agent features. The platform includes an agent feature that can prepare and, where a broker enables it, carry out routine actions within that broker's own account, such as drafting an email, creating or completing a task, updating the status of a deal condition, or issuing a portal link. A broker controls the level of autonomy, from proposing drafts for review to acting automatically. Sensitive actions, including obtaining a credit report and submitting an application to a lender, require explicit confirmation by a person and are never taken automatically.

No automated decisions about individuals. AI Features are designed to assist mortgage professionals. They do not decide whether an individual qualifies for a mortgage, approve or decline an application, set pricing, or make any other decision that produces a legal or similarly significant effect about an individual. Those determinations are made by lenders and by the broker exercising professional judgment.

No guarantee of accuracy. AI-generated outputs, including extracted data, transcripts, summaries, and drafted messages, may contain errors or inaccuracies. Personal information produced or processed by AI Features should be verified by the broker before being relied upon or disclosed to third parties, including lenders and clients.

Human oversight. Brokers retain responsibility for reviewing AI-processed personal information and exercising professional judgment before acting on it or sending it to a client.

Third-party processing. AI Features are delivered using third-party artificial intelligence providers, which process the content submitted to them, including personal information contained in documents, messages, and transcripts. These providers are engaged as service providers under Section 13, and some process this information outside Canada.

No secondary use. Personal information processed by AI Features is used solely to provide the Service. It is not used for profiling, and our arrangements with these providers are intended to prohibit its use to train their models. It is not used for automated decision-making beyond the assistive functions described in this section.

22. Geographic Scope#

The BrokerPlus platform is designed for use by licensed mortgage professionals operating in Canada. The following provisions apply to the geographic scope of our privacy practices:

• Personal information is stored and processed as described in Sections 13 and 20.
• BrokerPlus's privacy practices are designed to comply with Canadian federal and provincial privacy legislation. We do not guarantee compliance with the data protection requirements of any non-Canadian jurisdiction.
• Users located outside of Canada who access the platform are solely responsible for compliance with applicable data protection laws in their jurisdiction. BrokerPlus makes no representations regarding the adequacy of its privacy practices under non-Canadian data protection frameworks.

23. Quebec (Law 25)#

Where personal information about individuals in Quebec is processed through the platform, the Act respecting the protection of personal information in the private sector, as amended by Law 25, applies in addition to the provisions of this policy. The following supplemental disclosures apply:

Person in charge. The Chief Security Officer identified in Section 4 acts as the person in charge of the protection of personal information.

Transfers outside Quebec. Personal information may be communicated to service providers located outside Quebec, as described in Sections 13 and 20. Before entrusting personal information to such a provider, we assess whether the information will receive adequate protection, having regard to the sensitivity of the information, the purposes for which it is to be used, the protection measures in place, and the legal framework of the jurisdiction concerned.

Sensitive information. Certain information processed through the platform, including financial information, government identification and identity verification imagery, and credit information, is sensitive. Express consent is required for its collection and use, and obtaining that consent from the individual is the responsibility of the broker.

Automated processing. As described in Section 21, the platform does not render decisions about individuals based exclusively on automated processing. Where that changes, we will inform affected individuals at or before the time the decision is made and provide the opportunity to submit observations to a person able to review the decision.

Portability and de-indexing. Individuals in Quebec may request that the computerized personal information we hold about them be communicated in a structured, commonly used technological format, and may request that we cease disseminating their personal information or de-index a link to it where the conditions in the Act are met. Requests may be directed to the contact in Section 4.

24. Children and Minors#

The BrokerPlus platform is designed for use by licensed mortgage professionals and is not intended for individuals under the age of 18. BrokerPlus does not knowingly collect personal information from children or minors.

If we become aware that we have collected personal information from an individual under the age of 18, we will take steps to delete that information promptly. If you believe that a minor has provided personal information to BrokerPlus, please contact the CSO at amir@getbrokerplus.ca so that we can investigate and take appropriate action.

25. Accessibility and Accommodations#

BrokerPlus is committed to providing an accessible platform in accordance with the Accessibility for Ontarians with Disabilities Act, 2005 (AODA) and the Integrated Accessibility Standards Regulation (Ontario Regulation 191/11).

We work toward conformance with the Web Content Accessibility Guidelines (WCAG) 2.0 Level AA, and design and develop the platform with consideration for users who rely on assistive technologies. If you encounter a barrier, we want to hear about it so we can address it.

If you require an accommodation to access or use the BrokerPlus platform, or if you encounter an accessibility barrier, please contact us and we will work with you to provide an appropriate accommodation in a timely manner:

Accessibility and Accommodations Contact
Email: amir@getbrokerplus.ca

We welcome feedback on the accessibility of the BrokerPlus platform. Feedback can be directed to the contact above and will be reviewed and addressed in accordance with our obligations under the AODA.

26. Individual Access#

Individuals have the right to request access to their personal information held by BrokerPlus, to challenge its accuracy, and to request correction. Access requests should be directed to the CSO at amir@getbrokerplus.ca. We will respond within 30 days.

Where the personal information is held in a broker's account and processed on that broker's behalf, we will refer the request to the broker, who is the organization responsible for that information, and assist them in responding. If you are a borrower or other client, the most direct route is to contact your broker.

27. Retention and Post-Termination Data Handling#

Retention while your account is active. We retain personal information for as long as it is needed for the purposes described in this policy, or for as long as the law requires. Certain records are subject to statutory retention periods that we cannot shorten, including anti-money laundering records, which must be retained for at least five years (Section 16). Those records are retained for the required period even where a deletion request is made.

Upon termination or expiry of a user's subscription, the following provisions apply to personal information:

Data export window. The user will have thirty (30) days from the effective date of termination to export their data from the platform using the available export functionality. BrokerPlus will provide reasonable assistance with data export requests during this period.

Data deletion. Following the 30-day export window, BrokerPlus will delete or anonymize the user's personal information in accordance with this policy, subject to any legal or regulatory retention requirements.

Borrower data. Borrower data processed on behalf of the user will be handled in accordance with the commitments in Section 14.

Cached materials. Upon termination, users must promptly delete all locally stored copies of personal information obtained through the platform. This obligation does not apply to borrower files retained for regulatory recordkeeping purposes.

28. Challenging Compliance#

Individuals may challenge BrokerPlus's compliance with this policy by contacting the CSO at amir@getbrokerplus.ca. If the matter is not resolved to the individual's satisfaction, they may file a complaint with the applicable privacy commissioner:

29. Changes to This Policy#

We may update this policy from time to time. Material changes will be communicated to affected individuals. The effective date at the top of this document indicates when the policy was last updated.