[TROVY INC.] PRIVACY POLICY

OVERVIEW

Trovy is committed to protecting your personal information, and has created this Privacy Policy to provide you with information about its privacy practices. This Privacy Policy applies to all Trovy companies now existing or in the future created. In this Privacy Policy, the words "you" and "your" mean any person who has signed up with us on our website or at one of our participating merchant sites or stores ("Merchant Partners"), and in this context you may sometimes also be referred to as a "Member", or visited our website, contacted Trovy or any one of our third party providers who help maintain or power our website, products, or services ("Provider Partners"). The words "Trovy", "we", "us" and "our" mean the Trovy group of companies.

COLLECTION, USE AND DISCLOSURE OF PERSONAL INFORMATION

At Trovy, we collect, use and disclose your personal information for the following purposes:

• Offering and providing products and services;
• Establishing and maintaining communications with you;
• Communicating with Merchant Partners, Provider Partners and other third parties about you;
• Verifying personal information, you provide;
• Providing you with support;
• Conducting market research;
• Reporting to regulatory or industry entities;
• Acting as required or authorized by law;
• Information about you and your interactions with our products, services, websites, and platform, such as device details, IP addresses, browser types, timestamps, and browsing behaviour;
• Information about you and your transactional data, including but not limited to purchases and cashback rewards earned and redeemed with our Merchant Partners.

These are our "Identified Purposes".

We only collect, use and disclose your personal information for our Identified Purposes. When we collect your personal information, we are doing so not just for any one of the Identified Purposes, but for all of the Identified Purposes. For example, personal information we initially use for the purpose of onboarding you as a Member may subsequently be used to provide you with support. Similarly, personal information we initially use for the purpose of providing you with support may subsequently be used for the purpose of conducting market research. Should we wish to collect, use or disclose your personal information for a new purpose, we will explain the new purpose to you and obtain your consent before the information is collected, used or shared. We will only collect your personal information by fair and lawful means, and will not collect, use, disclose or retain your personal information without a valid reason for doing so.

TYPE OF PERSONAL INFORMATION COLLECTED

Personal information is information about an identifiable individual. The type of personal information that we collect, and use depends upon the nature of your relationship with us, and may include:

• Name, address, e-mail address, and telephone number;
• Date of birth, gender, family and marital status;
• Education and lifestyle information;
• Banking, credit, and financial information;
• Employment and income information.

CONSENT

Your knowledge and consent are required before we may collect, use or disclose your personal information, except in situations permitted or required by the law, such as where we are compelled to disclose information by court order.

You may provide your consent in a variety of ways. By signing up with us or one of our Merchant Partners, you provide us with your express or implied consent for the collection, use, and disclosure of personal information necessary for the Identified Purposes. For example, you provide your express or implied consent when you voluntarily provide personal information to us through one of our Merchant Partners or seek support through or use the goods or services of one of our Provider Partners.

Consent can also be given by one individual on behalf of another individual.

While we may rely on implied consent in certain circumstances, we will not collect, use or disclose your employment and income information, or your banking, credit or financial information, without your express written or verbal consent. When you sign up to be a Member, you will be asked to provide your express written consent to collection of this information.

You may withdraw your consent, subject to our legal or contractual obligations, and on reasonable notice, but this may limit our ability to provide you with the requested product or service. In the event that you wish to withdraw your consent, you should contact our Privacy Officer for information regarding the implications of such withdrawal, and then if you choose to proceed, give the requisite notice.

MAINTAINING ACCURATE INFORMATION

Trovy may take steps from time to time to ensure that your personal information is as accurate, complete and up to date as is necessary for our Identified Purpose.

PROTECTING YOUR PRIVACY

We are committed to protecting your privacy. We maintain physical, electronic and procedural safeguards to protect your personal information from unauthorized access. We review our policies and practices, monitor our computer networks, test the strength of our security, and monitor our compliance with relevant laws in order to help us ensure the safety of your personal information. We restrict access to your personal information to those employees whom we have determined need to know that information to provide products or services to you. All employees of Trovy are required to comply with this Privacy Policy. Employees who violate this Privacy Policy are subject to disciplinary measures.

As part of maintaining our relationship with you, we may share your personal information within the Trovy group of companies, or share or collect your personal information with or from our Merchant Partners and Provider Partners but only for the Identified Purposes, and in accordance with this Privacy Policy.

We may also disclose your personal information to third parties in accordance with our Identified Purposes. For example, as part of the Member onboarding or products and services provided to or for Members, we may transfer personal information to our Merchant Partners and Provider Partners. Additionally, personal information may be disclosed to government agencies, and reporting agencies. We may also disclose personal information to businesses that do or may provide goods and services to us or to you, as well as to their customers, such as delivery services. We use Google Cloud APIs on our sites, and our site is hosted by Google and Vercel (Google and Vercel being Provider Partners who may sometimes also be referred to as "Hosting Partners"), and as a result the Google and Vercel privacy policies, terms of use, and other policies will apply, all of which may be found at each of their respective websites (https://google.com/, and https://vercel.com/). The Hosting Partners policies, including privacy policy, as well as the terms of use and other policies are hereby incorporated by reference in this Privacy Policy. As well, we may disclose personal information to government and regulatory agencies as required by law. If we discover that our Merchant Partners or Provider Partners are improperly handling your personal information, we will take appropriate action to protect your personal information having regard to the commercial reasonableness and legal requirements of such actions in the specific context.

We may use Provider Partners located outside of Canada to collect, use, disclose or store personal information, or to provide support to you, or to enhance our products or services. Where we do so, we will use reasonable commercial efforts to contractually require such Provider Partner to employ the appropriate security safeguards to protect your personal information, subject to the law in the third party jurisdiction. While the personal information is in another jurisdiction it may be accessed by the courts, law enforcement and national security authorities of that jurisdiction. The jurisdictions where personal information may be collected, used, disclosed and stored include the United States of America, Europe, the United Kingdom, Asia, the Middle East and elsewhere. If you have any questions specifically relating to privacy, you may contact our Privacy Officer as indicated below.

If you conclude your relationship with us, we will continue to safeguard the privacy of your personal information in accordance with this policy and as required by law. Your personal information will be retained by us only as long as it is needed, or to meet any legal, regulatory, tax, or other requirements.

ACCESSING YOUR PERSONAL INFORMATION

You have the right to access your personal information that is in our possession or under our control in order to verify the accuracy and completeness of the personal information. To request access, please send your written request to Trovy's Privacy Officer. We will respond to your request within thirty (30) days or advise you if additional time is required to respond to your request.

There may be situations in which we are legally prohibited from allowing you access to your personal information. If this is the case, we will advise you of why, subject to any legal restrictions.

We may charge you for providing access to your personal information; however, we will only do so after first advising you of the approximate cost.

If you believe that any of your personal information is incorrect, you can request that it be amended. We will amend personal information that is demonstrated to be inaccurate or incomplete and will make reasonable efforts to advise other parties to whom we have supplied your personal information of corrections that are needed. There is no charge for verifying and correcting information.

CONTACTING US

If you have a question, complaint, or wish to provide feedback regarding our Privacy Policy or procedures, please contact our Chief Privacy Officer:

If we do not resolve your questions or complaint to your satisfaction, you may address your concerns to:

This Privacy Policy may be amended from time to time. Please check our website for any amendments and for the current version of this Privacy Policy.