Privacy for the details you trust us to handle.

For its own website visitors, prospects, clients, and business contacts, the Service Provider determines what is collected and why, and is the accountable organization under PIPA and PIPEDA. Sections 5 through 14 describe this role.

Where the Service Provider builds or administers a system for a business client — a website, a booking flow, a CRM, a messaging platform, a virtual network, a custom application — that client determines what personal information is collected from its own customers, staff, and contacts, and why. In that role the Service Provider is a service provider processing information on the client's instructions, the client is the accountable organization, and the client's own privacy policy governs.

If you are an individual whose information sits in a system operated on behalf of a business — for example, you booked a service or contacted a professional firm — please direct access, correction, and deletion requests to that business. The Service Provider will forward requests it receives to the relevant client and will assist them in responding, but cannot act on their information without instruction. Section 15 sets out what the Service Provider commits to in this role.

• Identity and contact information — name, business name, job title, email, phone, mailing and billing address
• Engagement information — requirements, specifications, correspondence, meeting notes, and approvals
• Billing information — amounts, invoices, payment history, and the last digits and expiry of a payment method. Full card numbers are not stored. Card payments are processed by Square under its own terms, and card details are entered into Square's systems rather than held by the Service Provider
• Credentials and access information — where access to your systems is granted, the credentials, keys, and tokens required to perform the work. Section 10 describes how these are handled
• Identification documents — for virtual identity services, government-issued identification and proof of business registration, as clause D.3 of the CSA requires

• Website and analytics data — IP address, approximate location derived from IP, browser and device type, pages viewed, referring page, and timestamps
• Service and infrastructure logs — access logs, authentication events, error logs, network and firewall logs, and email routing metadata for services hosted or administered
• Cookies and similar technologies — see Section 9

• Referral information from partners or existing clients
• Information from third-party platforms used to deliver services, in respect of accounts administered on your behalf
• Publicly available business information, such as a corporate registry search or a public website

For virtual identity clients, mail and parcels received contain personal information about senders and recipients. Sender, recipient, date, and item type are logged, and where authorized, contents are opened and scanned. This information is treated as sensitive and access is restricted to those who require it.

Sensitive personal information is not sought out. Some clients operate in fields where sensitive information is present in their systems, such as financial records at an accounting firm. Where that occurs, the role described in Section 4(b) applies, the client remains accountable, and the safeguards in Sections 15 and 16 are applied.

For the purposes of this Policy, "sensitive information" means information that carries a meaningful risk of significant harm if disclosed, including: government identifiers such as a Social Insurance Number, driver's licence number, or passport number; financial account, card, and banking details; date of birth; health and medical information; biometric data; credentials, keys, and access tokens; and information about a person's finances, legal matters, or family circumstances. Section 18 restricts what may be done with it.

Personal information is collected, used, and disclosed for the following purposes:

Consent may be express or implied from the circumstances — providing an email address so that a reply can be sent implies consent to use it for that purpose. Express consent is obtained where the information is sensitive or where the purpose would not be obvious.

Consent may be withdrawn at any time under Section 13, subject to legal and contractual limits. A service cannot be delivered if consent is withdrawn for the information required to deliver it, and records required by law must be retained.

Where PIPA or PIPEDA permit collection, use, or disclosure without consent — for example to collect a debt, to investigate a breach of an agreement or of the law, or to respond to an emergency — those provisions may be relied upon.

Commercial electronic messages are sent only where express consent exists, or implied consent arising from an existing business relationship or the publication of a business address without a statement declining messages.

Every commercial message identifies the Service Provider, provides contact information, and includes a working unsubscribe mechanism. Unsubscribes are actioned within ten (10) business days as CASL requires, and in practice as soon as they are processed. Records of consent and unsubscribes are retained as CASL requires.

Where the Service Provider configures or operates email, SMS, or automated messaging for a business client, that client is the sender and is responsible for consent, identification, and unsubscribe handling for its own recipients, as §14(d) of the CSA provides. If you received a message from a client of the Service Provider and wish to stop receiving them, use the unsubscribe link in that message or contact that business directly.

§9(c) to §9(f) of the CSA set out the SMS messaging terms, including opt-out by texting STOP to 587.355.8216. Consent to receive SMS messages is not a condition of purchase, and no SMS message constitutes a formal notice.

Personal information is disclosed to service providers who assist in operating the business, only as required and under contractual obligations to protect it. Categories include:

• cloud hosting and edge network
• CRM, marketing automation, and messaging platforms
• email and productivity providers
• domain registrars
• payment processing — Square
• accounting and bookkeeping
• error monitoring and analytics
• mail handling and courier services

Section 18 describes the use of AI-assisted tooling and the limits that apply to it.

To the client's own systems and accounts, where the client has directed that they be configured or connected.

To lawyers, accountants, and insurers, where required.

Where required or permitted by law. Section 12 describes how lawful access requests are handled.

To a purchaser or successor, in the event of a sale or reorganization of the business, subject to that party agreeing to use the information only for the purposes for which it was collected and to protect it to at least the same standard. Affected clients will be notified. Where the transfer involves Commissioned Software or the intellectual property in it, §12(d) of the CSA also applies and the transfer takes effect only together with the client's rights under F.3, F.4, §5, and §12.

The website uses cookies and similar technologies for essential functions (session handling, security, load balancing) and for analytics. Preference cookies are used only where a preference is offered and set.

Analytics are provided by Matomo and by Cloudflare's own edge analytics. Matomo is configured to respect browser-level privacy signals and to avoid collecting more than is needed to understand site usage. Cloudflare edge analytics operate on request metadata and do not set an identifying cookie.

Cookies can be controlled through browser settings. Blocking essential cookies may prevent parts of the site from functioning.

Third-party advertising and retargeting pixels are not used.

Do Not Track signals are not acted upon, because no common standard exists for interpreting them. Cookies can be controlled through the browser settings described in Section 9(c).

Delivering the services often requires access to client systems. Credentials are treated as highly sensitive.

Credentials are held in a dedicated password manager and not in plaintext files, email, or chat. Unique accounts and multi-factor authentication are used where the platform supports it. The least privilege required for the task is requested. Access is removed or rotated when an engagement ends.

Do not send credentials by email or SMS; use the method provided. Where a platform supports delegated or scoped access instead of shared credentials, that method will be requested.

Confirmation will be provided in writing of which access has been removed, together with identification of any credentials that should be rotated.

The Service Provider is based in Alberta. Some service providers used store and process information outside Canada, principally in the United States. Section 8(a) lists the categories.

While information is outside Canada it is subject to the laws of that country and may be accessible to foreign courts, law enforcement, and government authorities under those laws, including by lawful order of which the Service Provider may not be notified.

Alberta's PIPA requires that individuals be told how to obtain information about policies and practices regarding service providers outside Canada, and the name or position of a person able to answer questions about that. That contact is the Privacy Officer named in Section 1.

Where a client requires that information remain in Canada, this must be raised before the engagement begins, as §14(e) of the CSA provides. Data residency can often be arranged, but it constrains platform choice and may affect cost and functionality. It is not the default.

The Service Provider does not volunteer personal information to law enforcement or a government authority. A production order, warrant, subpoena, summons, or other lawful demand is reviewed before anything is produced, and only what the order requires is produced.

Where the Service Provider receives a lawful demand for information it holds on behalf of a client — including access logs, network logs, email metadata, hosted data, or mail records — it will notify the client promptly so that the client may seek a protective order or other remedy, unless the order or the law prohibits notice. Where notice is prohibited, notice will be given as soon as the prohibition allows.

A record is kept of each demand received, what was produced, to whom, and on what date.

Where PIPA or PIPEDA permit disclosure without consent to address an imminent threat to the life, health, or security of a person, disclosure may be made without prior notice, and the client and affected individuals will be informed afterward to the extent permitted.

Email privacy@getmore.digital or write to the address in Section 1. Identity verification may be required. A reasonable fee may be charged for an access request under PIPA where the law permits, with an estimate provided first so that you can decide whether to proceed.

Responses are provided within forty-five (45) calendar days as PIPA requires, or thirty (30) days where PIPEDA applies. You will be told if an extension is needed and why.

Access may be refused or limited where the law requires or permits — for example where it would reveal another person's personal information, disclose confidential commercial information, is protected by solicitor-client privilege, relates to an ongoing investigation, or where the information is held on behalf of a client under Section 4(b). Where access is refused, the reason will be given together with information on how to complain.

Personal information is retained only as long as necessary for the purposes for which it was collected, or as required by law. When no longer needed it is deleted or irreversibly de-identified.

Where a litigation hold, regulatory obligation, or lawful order requires longer retention, the information is retained for as long as that obligation subsists and for no other purpose.

Administrative, technical, and physical safeguards proportionate to the sensitivity of the information are applied, including:

• encryption in transit (TLS) on all services, and encryption at rest where the platform provides it
• multi-factor authentication on the Service Provider's own accounts, and on client platforms where supported
• a dedicated password manager for credentials, with no plaintext storage
• least-privilege access, with access reviewed when an engagement changes or ends
• logging and monitoring of authentication and administrative events
• prompt application of security patches to infrastructure the Service Provider administers
• full-disk encryption and endpoint protection on devices used to deliver the services
• restricted physical access to premises where mail is handled

Safeguards are reviewed periodically and adjusted as platforms, threats, and practice change. Where a client requires a specific control, certification, or audit standard, that requirement must be stated in the PSA before the engagement begins, as clause H.12 of the CSA provides.

No system is completely secure. It cannot be guaranteed that information will never be accessed, disclosed, altered, or destroyed by breach of these safeguards. Please report immediately any belief that an account or credential has been compromised.

If a breach of security safeguards involving personal information under the Service Provider's control creates a real risk of significant harm to an individual, the Service Provider will:

• Report it to the Office of the Information and Privacy Commissioner of Alberta, as PIPA requires, and to the Office of the Privacy Commissioner of Canada where PIPEDA applies
• Notify affected individuals where required by law or directed by the Commissioner
• Notify any other organization that may be able to reduce the harm
• Maintain records of the breach as Section 14(b) provides

Where the information belongs to a business client under Section 4(b), the client is the accountable organization and makes the notification decision. The Service Provider's obligation is to notify the client under Section 15 and §14(c) of the CSA, and to assist them.

AI-assisted tooling is used in software development and in some internal work, as §10(h) of the CSA describes. The Service Provider remains responsible for the work produced and exercises human skill and judgment in its design, selection, arrangement, and review.

Client personal information, credentials, security configuration, and confidential client data are not submitted to any tool that retains its inputs, trains on them, or makes them available to any other person. Where a tool is used on material connected to a client engagement, it is a tool operating under terms that prohibit training on and retention of inputs, and it is bound by the subcontractor obligations in Section 15.

Sensitive information, as Section 5(e) defines it, is not submitted to an AI tool in any circumstance.

The categories of tooling in use are disclosed on request. Where a client requires that no AI-assisted tooling be used, or that specific tools be excluded, that requirement must be stated in the PSA and will be priced accordingly, as §10(h) of the CSA provides.

Some systems the Service Provider builds include features that use a language model or classification model to process the client's own data — for example, extracting fields from an uploaded document. Where that is the case:

• the feature and the model provider are identified in the applicable PSA
• the provider is engaged on terms that prohibit training on client data
• the processing is carried out in the role described in Section 4(b), with the client as the accountable organization
• where the provider is outside Canada, Section 11 applies

Decisions about individuals having legal or significant effects on them are not made using automated processing alone.

Contact the Privacy Officer at privacy@getmore.digital. Acknowledgment will be provided within five (5) business days, followed by investigation, the outcome, and a description of any changes made.

If you are not satisfied, you may complain to:

Office of the Information and Privacy Commissioner of Alberta 410 – 9925 109 Street NW, Edmonton, Alberta T5K 2J8 Phone: 780-422-6860 · Toll-free: 1-888-878-4044 · Fax: 780-422-5682 oipc.ab.ca

Office of the Privacy Commissioner of Canada 30 Victoria Street, Gatineau, Quebec K1A 1H3 Toll-free: 1-800-282-1376 · Phone: 819-994-5444 · TTY: 819-994-6591 priv.gc.ca