PRIVACY POLICY

INTRODUCTION AND PRIVACY COMMITMENT

Overview of this Policy

URIGHTCOMPANY FINANCE LIMITED hereinafter — the "Company", "we", "us", or "our" — is committed to protecting the privacy, confidentiality, integrity, and security of personal information collected in the course of providing financial, payment, money services, and related digital services.

This Privacy Policy explains how the Company collects, uses, discloses, stores, protects, and retains personal information in connection with its services, website, onboarding processes, customer due diligence procedures, transaction monitoring, compliance obligations, and customer communications.

Regulatory Framework

The Company is a registered Money Services Business (MSB) in Canada and processes personal information in accordance with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA), as well as applicable provincial privacy requirements where relevant.

The Company also processes information where required to comply with Canadian anti-money laundering, counter-terrorist financing, sanctions, fraud prevention, and regulatory reporting obligations, including obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), FINTRAC requirements, and applicable Canadian sanctions legislation.

Where the Company provides services to individuals or entities located outside Canada, additional privacy and data protection requirements may apply, including the UK GDPR, EU GDPR, and other applicable international privacy laws.

Relationship with Other Policies

This Privacy Policy should be read together with the Company's AML/CTF Policy, KYC Policy, Sanctions Policy, Cookie Policy, Terms and Conditions, Security Policy, and other applicable legal and compliance documents.

SCOPE OF APPLICATION

Persons Covered

This Policy applies to personal information relating to:

• individual customers;
• corporate customers' directors, officers, shareholders, partners, trustees, and employees;
• Ultimate Beneficial Owners (UBOs);
• authorized representatives and persons acting on behalf of customers;
• payers, payees, beneficiaries, counterparties, and other persons involved in transaction flows;
• website visitors and users of the Company's digital services;
• persons who communicate with the Company by email, phone, website forms, customer support channels, or other means;
• service providers, business partners, and other third parties, where applicable.

Services Covered

This Policy applies to personal information collected or processed in connection with the Company's services, including:

• customer onboarding and account administration;
• identity verification and KYC procedures;
• AML/CTF and sanctions compliance;
• payment processing and money transfer services;
• foreign exchange services;
• virtual currency services, where applicable;
• fraud prevention and security monitoring;
• customer support and communications;
• website use, cookies, and digital interactions;
• regulatory reporting and legal compliance.

PERSONAL INFORMATION WE COLLECT

Identification Information

The Company may collect identification information, including:

• full legal name;
• date of birth;
• residential address;
• nationality or citizenship, where relevant;
• government-issued identification documents;
• passport, national ID card, driver's licence, or equivalent identity documents;
• photographs, selfie images, liveness check data, or biometric verification results, where applicable;
• signatures and authorization documents.

Business and Corporate Information

For corporate customers and business relationships, the Company may collect information relating to individuals associated with the entity, including:

• names, titles, roles, and contact details of directors, officers, shareholders, partners, trustees, and authorized representatives;
• information about Ultimate Beneficial Owners;
• ownership and control information;
• company registration and incorporation documents;
• corporate registry extracts;
• business licences, regulatory registrations, and tax identification information;
• information about business activities, industry, source of funds, and expected transaction activity.

Contact and Communication Information

The Company may collect:

• email address;
• phone number;
• business address;
• billing address;
• mailing address;
• customer support communications;
• records of correspondence, inquiries, complaints, and responses.

Financial and Transaction Information

The Company may collect financial and transaction-related information, including:

• bank account details;
• payment method information;
• transaction history;
• transaction amounts, dates, currencies, and counterparties;
• payment references and identifiers;
• source of funds and source of wealth information;
• wallet addresses and virtual currency transaction information, where applicable;
• chargeback, refund, withdrawal, and settlement information.

The Company does not store full payment card details where tokenization or secure payment processing infrastructure is used.

Technical, Device, and Security Information

The Company may collect technical and security-related information, including:

• IP address;
• browser type and version;
• device type and operating system;
• device identifiers and device fingerprinting data;
• login timestamps and session data;
• geolocation indicators based on IP address;
• VPN, proxy, Tor, or similar access indicators;
• BIN-code and payment method consistency information;
• website usage data;
• fraud prevention and cybersecurity signals.

Compliance and Risk Information

The Company may collect and process information necessary for compliance and risk-management purposes, including:

• KYC verification results;
• sanctions screening results;
• Politically Exposed Person (PEP) and Head of International Organization (HIO) screening results;
• adverse media information;
• customer risk ratings;
• fraud indicators;
• internal compliance notes;
• escalation records;
• information required for FINTRAC or other regulatory reports.

PURPOSES OF COLLECTION AND USE

Providing Services

The Company collects and uses personal information to provide, manage, and maintain its services, including:

• onboarding customers;
• opening and administering accounts or service relationships;
• processing payments, transfers, exchanges, refunds, withdrawals, or settlements;
• providing customer support;
• communicating with customers and representatives;
• maintaining operational records.

KYC, AML/CTF, and Sanctions Compliance

The Company collects and uses personal information to comply with legal and regulatory obligations, including:

• identifying and verifying customers;
• confirming corporate existence and beneficial ownership;
• conducting KYC and customer due diligence;
• applying Enhanced Due Diligence where required;
• screening against sanctions, PEP, HIO, and adverse media sources;
• monitoring transactions and business relationships;
• detecting suspicious activity;
• preparing and submitting required reports to FINTRAC or other competent authorities;
• maintaining records required under applicable law.

Fraud Prevention and Security

The Company uses personal information to protect customers, transactions, systems, and services against fraud, unauthorized access, misuse, cyber threats, identity theft, account takeover, sanctions evasion, and other financial crime risks.

This may include device fingerprinting, IP and geolocation checks, VPN or proxy detection, BIN-code verification, velocity checks, transaction monitoring, and other technical security controls.

Legal and Regulatory Purposes

The Company may use personal information to:

• comply with applicable laws, regulations, court orders, and lawful requests;
• respond to regulatory inquiries or examinations;
• enforce contractual rights;
• manage legal claims or disputes;
• protect the rights, property, and safety of the Company, customers, employees, and third parties.

Service Improvement and Business Operations

The Company may use information to:

• improve website functionality and user experience;
• maintain and improve service quality;
• monitor system performance;
• develop internal reporting and analytics;
• manage risk and compliance processes;
• conduct audits and independent reviews;
• improve security, fraud prevention, and operational resilience.

Communications

The Company may use contact information to send service-related communications, legal notices, compliance requests, security alerts, customer support responses, and other operational messages.

Where marketing communications are sent, the Company will comply with applicable consent and electronic communication requirements.

CONSENT AND LEGAL BASIS FOR PROCESSING

Consent

Where required by applicable law, the Company obtains consent for the collection, use, or disclosure of personal information.

By using the Company's services, submitting information, communicating with the Company, or entering into a business relationship with the Company, customers acknowledge that the Company may collect, use, and disclose personal information as described in this Policy and as required or permitted by law.

Withdrawal of Consent

A person may withdraw consent where processing is based on consent, subject to legal, regulatory, contractual, security, and operational restrictions.

Withdrawal of consent may limit the Company's ability to provide services. The Company may be required to continue processing and retaining certain information where necessary to comply with AML/CTF, sanctions, fraud prevention, record keeping, regulatory reporting, legal, or audit obligations.

Legal and Compliance Processing

In many cases, the Company processes personal information because it is required or permitted by law, including for KYC, AML/CTF, sanctions screening, suspicious activity reporting, terrorist property reporting, fraud prevention, transaction monitoring, and record keeping.

Where the Company is required by law to collect, use, disclose, or retain personal information, consent may not be required or may not be capable of withdrawal.

DISCLOSURE OF PERSONAL INFORMATION

Disclosure to Authorities

The Company may disclose personal information to regulatory authorities, law enforcement agencies, courts, government bodies, financial intelligence units, or other competent authorities where required or permitted by law.

This may include disclosure to FINTRAC in connection with reports, examinations, inquiries, or other legal obligations.

Disclosure to Service Providers

The Company may disclose personal information to trusted service providers that support the Company's operations, including:

• identity verification and KYC providers;
• sanctions, PEP, HIO, and adverse media screening providers;
• payment processors and financial institutions;
• banking, settlement, and card processing partners;
• cloud hosting and technology providers;
• cybersecurity and fraud prevention providers;
• analytics and website service providers;
• customer support tools;
• legal, audit, compliance, and professional advisors.

Such service providers may process information only for authorized purposes and are expected to apply appropriate confidentiality, privacy, and security safeguards.

Disclosure in Business Transactions

The Company may disclose personal information in connection with a merger, acquisition, financing, restructuring, sale of assets, due diligence process, or similar business transaction, provided that appropriate confidentiality and privacy safeguards are applied.

No Sale of Personal Information

The Company does not sell or rent personal information to third parties.

INTERNATIONAL TRANSFERS

Processing Outside Canada

Personal information may be processed, stored, or accessed outside Canada by the Company's service providers, partners, or affiliates where necessary to provide services, support technology infrastructure, process payments, conduct compliance checks, or maintain security.

Safeguards

Where personal information is transferred outside Canada, the Company applies contractual, technical, and organizational safeguards designed to protect the information in accordance with applicable privacy standards.

Users acknowledge that information processed outside Canada may be subject to the laws of the jurisdiction in which it is processed and may be accessible to foreign courts, law enforcement, regulators, or government authorities where legally required.

RETENTION OF PERSONAL INFORMATION

Retention Period

The Company retains personal information only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law.

For AML/CTF, KYC, transaction monitoring, and reporting purposes, the Company generally retains relevant records for a minimum period of five (5) years after the end of the business relationship or completion of the relevant transaction, unless a longer period is required or permitted by law.

Criteria for Retention

Retention periods may depend on:

• legal and regulatory requirements;
• FINTRAC record-keeping obligations;
• contractual obligations;
• audit and compliance needs;
• fraud prevention and security requirements;
• dispute resolution and legal limitation periods;
• ongoing investigations or regulatory inquiries.

Secure Disposal

When personal information is no longer required, the Company securely deletes, anonymizes, or disposes of it in a manner designed to prevent unauthorized access or recovery, unless continued retention is required or permitted by law.

SECURITY MEASURES

Technical and Organizational Measures

The Company implements appropriate technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, misuse, loss, or destruction.

These measures may include:

• encryption of data in transit and at rest;
• secure servers and firewalls;
• access controls and role-based permissions;
• multi-factor authentication for sensitive systems;
• employee confidentiality obligations;
• secure document storage;
• monitoring of unauthorized access attempts;
• fraud and cybersecurity detection tools;
• vendor security reviews;
• incident response procedures.

Access Limitation

Access to personal information is limited to authorized personnel and service providers who require access for legitimate business, technical, security, compliance, legal, or regulatory purposes.

No Absolute Guarantee

While the Company applies strong safeguards, no method of transmission or storage is completely secure. The Company continuously works to maintain and improve its information security practices.

RIGHTS OF INDIVIDUALS

Access to Personal Information

Individuals may request access to personal information held by the Company, subject to legal, regulatory, security, and confidentiality restrictions.

Correction of Information

Individuals may request correction of inaccurate or incomplete personal information. The Company may require supporting documentation before making corrections.

Withdrawal of Consent

Where processing is based on consent, individuals may withdraw consent subject to legal, contractual, compliance, and operational restrictions.

Complaints

Individuals may submit privacy-related complaints to the Company. The Company will review and respond to complaints in accordance with applicable privacy requirements.

Individuals may also have the right to file a complaint with the Office of the Privacy Commissioner of Canada or another applicable privacy authority.

Requests

Requests relating to access, correction, withdrawal of consent, or complaints should be submitted to the Company using the contact details provided in this Policy.

COOKIES AND TRACKING TECHNOLOGIES

Use of Cookies

The Company may use cookies and similar technologies on its website and digital services to support functionality, security, fraud prevention, analytics, user preferences, and service improvement.

Cookie Categories

The Company may use:

• strictly necessary cookies;
• security and fraud prevention cookies;
• functional cookies;
• analytics and performance cookies;
• limited marketing or communication cookies;
• third-party cookies provided by service providers.

Cookie Management

Users may manage cookie preferences through browser settings or other tools made available by the Company, where applicable.

Further details are provided in the Company's Cookie Policy.

AML/CTF, SANCTIONS, AND PRIVACY INTERACTION

Compliance Use of Personal Information

The Company may collect, use, disclose, and retain personal information for AML/CTF, sanctions, fraud prevention, and regulatory reporting purposes.

This may include information about customers, UBOs, directors, authorized representatives, counterparties, transaction participants, and related persons.

Restrictions on Disclosure

Where the Company submits a report to FINTRAC or another competent authority, or conducts an AML/CTF, sanctions, fraud, or compliance investigation, the Company may be legally prohibited from disclosing this fact to the customer or any third party.

Priority of Legal Obligations

Where privacy rights or consent preferences conflict with mandatory AML/CTF, sanctions, terrorist property, fraud prevention, record-keeping, or regulatory reporting obligations, the Company will comply with applicable legal requirements.

CHILDREN'S PRIVACY

The Company's services are intended for business and adult users. The Company does not knowingly collect personal information from minors unless required or permitted by law and with appropriate authorization.

If the Company becomes aware that personal information of a minor has been collected without appropriate authority, the Company will take reasonable steps to delete or restrict such information, unless retention is required by law.

POLICY REVIEW AND UPDATES

Periodic Review

This Privacy Policy is reviewed periodically to ensure that it remains aligned with applicable laws, regulatory expectations, business operations, technology, products, services, and the Company's risk profile.

Publication of Updates

The Company may update this Privacy Policy from time to time. Any updated version will be published on the Company's website with a revised effective date.

Where required by applicable law, the Company may provide additional notice or request renewed consent for material changes.

CONTACT INFORMATION

For privacy inquiries, access or correction requests, complaints, or questions regarding this Privacy Policy, please contact:

• Email: [email protected]
• Address: 1 - 4903 54 STREET, LLOYDMINSTER, SASKATCHEWAN, CANADA, S9V 0N6
• Regulatory Reference: FINTRAC MSB Registration #C100000462