Privacy with
clear boundaries.

1. Scope of this Policy

At Belvoraine, we take the privacy of your personal information seriously.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and disclose it, how we protect it, and the choices and rights available to you.

This Policy applies to personal information collected through the Belvoraine website, platform, account-opening process, products, services and other interactions with us.

Our privacy practices are designed to comply with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, substantially similar provincial privacy legislation.

2. Accountability

For the purposes of applicable privacy laws, Belvoraine Inc. is responsible for personal information under its control.

Where applicable, our designated privacy officer is responsible for overseeing our privacy practices and responding to privacy-related questions and requests. Canadian privacy guidance recommends identifying the person or role responsible for privacy compliance and making that information available to individuals.

3. Information we collect

The information we collect depends on how you interact with Belvoraine.

This may include:

• name;
• email address;
• telephone number;
• residential address;
• date of birth;
• identification documents;
• account information;
• information provided during onboarding;
• financial or source-of-funds information where required;
• communications with our support team;
• information included in complaints; and
• other information you choose to provide.

Where required, we may collect information necessary for KYC, AML, sanctions screening, fraud prevention and other compliance requirements.

This may include government-issued identification, verification information, source-of-funds information and other information required by law or our compliance procedures.

When you use our website or platform, we may collect technical information such as:

• IP address;
• browser type;
• device information;
• operating system;
• login and session information;
• approximate location derived from technical information;
• website activity;
• security events; and
• information collected through cookies and similar technologies.

4. Purposes of collection

We collect personal information for purposes that are reasonable and appropriate in the circumstances.

These purposes may include:

• To create and maintain your account, provide requested services, process transactions and operate the platform.
• To verify your identity, meet KYC and AML obligations, conduct sanctions screening and comply with applicable legal and regulatory requirements.
• To protect accounts, detect unauthorized activity, investigate fraud and maintain the security of our systems.
• To respond to questions, troubleshoot technical issues and manage complaints.
• To understand how our platform is used, identify technical issues and improve our products and user experience.
• To send service-related notices, security alerts, account notifications and other communications necessary to provide our services.

Where permitted and where required, we may also send marketing communications. You can unsubscribe from promotional communications at any time.

5. Consent

We seek meaningful consent when required by applicable privacy law.

The form of consent depends on the nature and sensitivity of the information and the purpose for which it is collected, used or disclosed.

For sensitive information or uses outside your reasonable expectations, express consent may be required.

In some circumstances, we may collect, use or disclose personal information without consent where permitted or required by law, including for legal, security, fraud-prevention or regulatory purposes.

Where you withdraw consent, we will explain any consequences or limitations that may apply. Some information must continue to be retained or processed where required by law or necessary to maintain an existing legal or contractual relationship.

6. Limiting collection

We collect personal information that is reasonably necessary for the purposes described in this Policy or otherwise permitted by law.

We do not collect personal information simply because it may be useful in the future.

Where we request information that is not necessary to provide a particular service, we will explain the purpose for requesting it and, where required, provide an appropriate choice.

Canadian privacy principles require organizations to limit collection to information needed for identified purposes.

7. How we use personal information

We may use personal information to:

• provide and administer our services;
• verify identity;
• conduct KYC and AML checks;
• detect and prevent fraud;
• protect our platform and users;
• process transactions;
• communicate with you;
• respond to support requests;
• investigate complaints and security incidents;
• maintain records;
• comply with legal and regulatory requirements;
• enforce our agreements;
• improve our products and services; and
• carry out other purposes described at the time information is collected or otherwise permitted by law.

We will not use personal information for a new purpose that is incompatible with the original purpose unless permitted or required by law or appropriate consent has been obtained.

8. How we disclose personal information

We may disclose personal information where reasonably necessary to provide our services, meet legal obligations or operate our business.

Depending on the service, recipients may include:

• identity verification providers;
• KYC and AML service providers;
• payment processors;
• technology and cloud service providers;
• cybersecurity providers;
• custody or transaction service providers;
• professional advisers;
• auditors;
• insurers;
• regulators and government authorities; and
• other service providers acting on our behalf.

We require service providers that handle personal information for us to use appropriate safeguards and handle information in accordance with applicable requirements.

We do not sell personal information as a business practice.

9. Processing outside Canada

Some service providers may process or store personal information outside Canada.

Where personal information is transferred to another jurisdiction, it may be subject to the laws of that jurisdiction and may be accessible to courts, law enforcement or regulatory authorities in accordance with those laws.

We take reasonable steps to select service providers and contractual arrangements appropriate to the nature and sensitivity of the information.

10. Cookies and similar technologies

We may use cookies, pixels, analytics tools and similar technologies to:

• operate the website;
• remember preferences;
• maintain sessions;
• understand website usage;
• improve performance;
• detect security issues; and
• measure the effectiveness of communications.

Some cookies are necessary for the website to function. Others may be used for analytics or optional purposes.

Where required, we will provide appropriate choices regarding non-essential cookies and similar technologies.

You can also manage cookie settings through your browser.

11. Safeguards

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information we hold.

These may include:

• access controls;
• authentication measures;
• encryption;
• monitoring and logging;
• secure infrastructure;
• employee confidentiality requirements;
• security training;
• incident-response procedures; and
• controls over third-party service providers.

No security measure can guarantee absolute security.

Canadian privacy guidance requires safeguards appropriate to the sensitivity of personal information and recommends regularly reviewing those safeguards as risks and technology change.

12. Privacy breaches

We maintain procedures for identifying, assessing and responding to privacy breaches.

Where required by applicable law, we will report a breach to the relevant privacy regulator and notify affected individuals when the breach creates a real risk of significant harm.

We also maintain records of privacy breaches as required by applicable law. Under PIPEDA, organizations must keep records of breaches of security safeguards involving personal information and assess whether reporting and notification obligations are triggered.

13. Retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, meet legal and regulatory requirements, resolve disputes, enforce agreements and maintain appropriate business records.

Retention periods vary depending on the nature of the information and the reason it was collected.

When personal information is no longer required, we will securely delete, destroy or anonymize it in accordance with our retention practices and applicable legal requirements.

Canadian privacy principles require organizations to limit retention and establish appropriate retention and destruction practices.

14. Your privacy rights

Subject to applicable law and certain exceptions, you may have the right to:

• request access to personal information we hold about you;
• ask how your information is being used or disclosed;
• request correction of inaccurate or incomplete information;
• withdraw consent where consent is the legal basis for processing;
• ask questions about our privacy practices; and
• challenge our compliance with applicable privacy requirements.

Under PIPEDA, access requests generally must be answered within 30 days, subject to permitted extensions and exceptions.

Some privacy rights and procedures vary by province and applicable legislation.

15. Access and correction requests

To request access to or correction of your personal information, contact:

Email: [email protected]

Please include enough information for us to identify you and locate the relevant records.

For security reasons, we may need to verify your identity before responding to an access or correction request.

We will not ask you to send passwords, private keys, seed phrases or MFA codes as part of a privacy request.

16. Privacy complaints

If you have a concern about how we handle your personal information, please contact us first.

Email: [email protected]

We will review your concern and provide a response in accordance with our privacy procedures and applicable law.

If you are not satisfied with our response, you may have the right to bring a complaint to the privacy regulator with jurisdiction over your situation.

For matters subject to federal privacy law, complaints may be made to the Office of the Privacy Commissioner of Canada.

17. Minors

Belvoraine's services are intended for individuals who meet the applicable legal age requirements in their jurisdiction.

We do not knowingly collect personal information from individuals who are not legally permitted to use our services.

If you believe a minor has provided us with personal information in connection with an account, please contact us.

18. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes to our services, legal requirements or privacy practices.

When we make material changes, we will provide notice in an appropriate manner.

The updated Policy will include a revised Last updated date.

We encourage you to review this Policy periodically.

19. Contact

If you have questions about this Privacy Policy or our privacy practices, contact:

Email: [email protected]