Privacy Policy

1. Introduction

BrokerPlus Technologies Inc. ("BrokerPlus", "we", "us", "our") is committed to protecting the privacy of personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

This policy describes how we collect, use, disclose, and protect personal information in connection with the BrokerPlus platform and services.

2. Scope

This policy applies to all personal information collected, used, or disclosed by BrokerPlus in the course of its commercial activities, including information about:

• Mortgage brokers and brokerage staff who use the BrokerPlus platform
• Borrowers whose information is processed through the platform on behalf of brokers
• Business contacts at lender and partner organizations
• Employees and contractors of BrokerPlus

3. Definitions

Personal Information means information about an identifiable individual, including but not limited to: name, address, email, phone number, date of birth, Social Insurance Number (last four digits only), employment information, income, financial data, and property details.

Sensitive Personal Information means personal information that requires a higher degree of protection due to its nature, including financial records, government-issued identification data, and credit information.

4. Accountability

The Chief Security Officer (CSO) is the designated individual responsible for BrokerPlus's compliance with this policy and PIPEDA. Questions, concerns, or complaints regarding privacy can be directed to:

Amir Agassi, Chief Security Officer
Email: amir@getbrokerplus.ca

5. Information We Collect

5.1 Broker and Platform User Information

• Full name, email address, phone number
• Organization and role information
• Login credentials (passwords stored in hashed form only)
• Session data (IP address, user agent, login timestamps)

5.2 Borrower Information (Processed on Behalf of Brokers)

Brokers upload and input borrower information into the platform for the purpose of managing mortgage deals. BrokerPlus processes this information solely on behalf of the broker. Borrower information collected through the platform may include:

• Full name, date of birth, contact information
• Last four digits of Social Insurance Number (full SIN is never stored)
• Employment details (employer, job title, income, tenure)
• Financial information (income, assets, liabilities, down payment details)
• Property information (address, purchase price, property type)
• Supporting documents (pay stubs, T4s, bank statements, letters of employment)

Brokers are responsible for obtaining all necessary consents from borrowers before uploading their personal information to the platform.

5.3 Automatically Collected Information

• IP addresses and browser/device information for security monitoring
• Platform usage data for service improvement
• Audit logs of significant actions within the platform

6. Cookies, Tracking Technologies, and Third-Party Scripts

6.1 Cookies and Similar Technologies Used by BrokerPlus

BrokerPlus uses the following cookies and similar technologies to operate the platform:

Session cookies. These are essential cookies that maintain your authenticated session while you are logged into the platform. They expire when you close your browser or after a period of inactivity. Without session cookies, you will be unable to log in or use the platform.

Authentication tokens. We use secure, HTTP-only tokens to verify your identity across requests. These are necessary for the platform to function and cannot be disabled.

User preference cookies. These cookies store your interface preferences (such as display settings and notification preferences). Disabling these cookies will reset your preferences to defaults on each visit but will not prevent you from using the platform.

Security cookies. We use cookies to support security features including CSRF protection and rate limiting. These are essential to protecting your account and data.

6.2 Third-Party Cookies and Tracking

BrokerPlus may use the following third-party services that set cookies or collect data. All third-party analytics and monitoring services used by BrokerPlus are hosted within Canada:

Analytics. We may use analytics services to understand how the platform is used and to improve its features. Analytics tools collect anonymized usage data such as pages visited, time spent on features, and general interaction patterns. This data is aggregated and is not used to identify individual users.

Error monitoring. We use error monitoring services to detect and diagnose technical issues with the platform. These services may collect technical data about your browser, device, and the actions that preceded an error. This data is used solely for troubleshooting and is not used for marketing or profiling purposes.

Infrastructure providers. Our hosting and infrastructure providers (AWS, Azure) may set technical cookies necessary for content delivery, load balancing, and security. These are essential to platform operation.

BrokerPlus does not use third-party advertising cookies or tracking pixels. We do not participate in ad networks or share user data with advertisers.

6.3 Managing Cookie Preferences

You can manage cookies through your browser settings. Most browsers allow you to block or delete cookies, or to be notified before a cookie is set. Please note that blocking essential cookies (session, authentication, and security cookies) will prevent you from using the platform. Blocking preference cookies will reset your display and notification settings to defaults on each visit but will not affect core functionality.

7. Purpose of Collection

We collect and use personal information for the following purposes:

Providing the BrokerPlus platform - mortgage deal workflows, document management, and submission preparation.

Document processing - AI-powered classification, data extraction, and validation.

Communication - facilitating communication between brokers and their borrowers.

Security - protecting accounts, detecting fraud, monitoring for unauthorized access.

Compliance - meeting legal and regulatory obligations.

Service improvement - analyzing platform usage to improve features.

8. Consent

Brokers consent to the collection and use of their personal information when they create an account and agree to the Terms of Service.

Borrower consent is the responsibility of the broker. Brokers must obtain all necessary consents from borrowers before uploading borrower personal information to the platform, in compliance with PIPEDA and applicable provincial privacy legislation.

8.1 Withdrawing Consent

How to withdraw. You may withdraw your consent by contacting the CSO at amir@getbrokerplus.ca or by using the account settings in the platform. BrokerPlus will acknowledge receipt of a withdrawal request within five (5) business days.

Before processing. Before processing a consent withdrawal request, BrokerPlus will inform you of the specific consequences of withdrawing consent so that you can make an informed decision. These consequences may include:

• Inability to continue processing active mortgage deals that require the use of your personal information
• Loss of access to historical deal data and documents stored on the platform
• Inability to use communication features
• Deactivation of your account

Response time. BrokerPlus will process consent withdrawal requests within thirty (30) days of receiving the request. Where withdrawal affects active mortgage transactions, BrokerPlus will work with the broker to minimize disruption.

9. CASL Compliance

BrokerPlus's communication features are subject to Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23). The following provisions govern how the platform handles broker-to-borrower communications.

9.1 Express and Implied Consent

Express consent is obtained when a borrower affirmatively opts in to receive electronic communications from the broker. Express consent remains valid until the borrower withdraws it.

Implied consent may exist where the broker has an existing business relationship with the borrower, such as where the borrower has made an inquiry about mortgage services within the preceding six (6) months, or where the broker has an ongoing mortgage transaction with the borrower. Implied consent is time-limited and expires as provided under CASL.

9.2 Broker Responsibilities

Brokers are solely responsible for ensuring that valid consent (whether express or implied) exists before using BrokerPlus's communication features to send electronic messages to borrowers. BrokerPlus provides the communication infrastructure but does not independently verify the existence of consent between the broker and the borrower.

Every electronic message sent through BrokerPlus must include the broker's identifying information, the applicable brokerage's contact information, and a functioning unsubscribe mechanism, all of which the platform provides by default.

9.3 Unsubscribe Mechanism

BrokerPlus includes an unsubscribe mechanism in all electronic messages sent through the platform. When a borrower exercises their right to unsubscribe, the platform will process the request within ten (10) business days and notify the applicable broker. Brokers must not send further commercial electronic messages to borrowers who have unsubscribed.

10. Marketing and Commercial Electronic Messages

10.1 Communications from BrokerPlus

BrokerPlus may send electronic communications to registered brokers and platform users for the following purposes:

Transactional messages. Emails and notifications related to your account, subscription, platform updates, security alerts, and service-related announcements. These are sent as part of our contractual relationship and do not require separate marketing consent.

Marketing communications. By creating an account, you are automatically opted in to receive promotional emails about new features, product updates, educational content, industry insights, and partnership opportunities. You may opt out at any time as described in Section 10.2. Receipt of marketing communications is not a condition of using the platform, and opting out will not affect your access to or use of the Service.

10.2 Opting Out of Marketing

You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link included in every marketing email
• Updating your communication preferences in your account settings
• Contacting us at hello@getbrokerplus.ca

Opt-out requests will be processed within ten (10) business days. Opting out of marketing communications will not affect transactional messages necessary for the operation of your account.

10.3 Borrower Marketing

BrokerPlus does not send marketing communications directly to borrowers. All marketing communications to borrowers are the responsibility of the broker and are governed by the CASL provisions in Section 9.

11. Limiting Collection

BrokerPlus limits the collection of personal information to what is necessary for the identified purposes. We do not collect full Social Insurance Numbers - only the last four digits for verification purposes.

12. Use, Disclosure, and Retention

We may disclose personal information to:

• Lender systems (e.g., Filogix) as directed by the broker for mortgage submission
• Cloud infrastructure providers for hosting and processing (Canadian regions only)
• Law enforcement or regulators when required by law or court order

We do not sell, rent, or trade personal information. We do not use personal information for AI model training.

Personal information is retained only as long as necessary to fulfill the purposes for which it was collected, or as required by law.

13. Borrower Data Protection

BrokerPlus recognizes that borrower data is entrusted to the platform by brokers, and we are committed to protecting it with the highest standard of care. The following commitments apply:

No sharing between competing brokers. Borrower data submitted by one broker will never be shared with, disclosed to, or made accessible to any other broker or brokerage on the platform. Each broker's data is logically segregated at the organization level, and access controls prevent any cross-organization access to borrower information.

No ownership claim. BrokerPlus does not claim ownership of borrower data. Borrower data remains the property of the borrower and is processed by BrokerPlus solely on behalf of the broker for the purposes described in this policy.

Borrower data upon broker termination. When a broker's account is terminated:

• During the 30-day export window (Section 21), the broker may export all borrower data associated with their account.
• After the export window, BrokerPlus will delete borrower data associated with the terminated account, subject to any legal or regulatory retention requirements.
• If the borrower has an active relationship with another broker on the platform, any data independently submitted through that separate relationship is unaffected.
• BrokerPlus will not transfer, reassign, or make available a terminated broker's borrower data to any other broker or third party, except as required by law or as directed by the borrower.

14. Safeguards

• Encryption at rest using AES-256 for all stored data
• Encryption in transit using TLS 1.2+ on all connections
• Access control through role-based permissions and organization-level data scoping
• Multi-factor authentication enforced on all employee accounts
• Endpoint security via SentinelOne EDR and Kandji MDM on all company devices
• Audit logging of all significant data access and modifications

15. Data Residency

All personal information processed by BrokerPlus is stored and processed within Canada:

• Database: AWS ca-central-1 (Montreal)
• File storage: AWS S3 ca-central-1 (Montreal)
• AI processing: Azure OpenAI, Canada Central (Toronto)

16. AI-Powered Document Processing

BrokerPlus uses artificial intelligence and machine learning technologies to process personal information contained in borrower documents, including document classification, data extraction, and field validation. The following disclosures apply to how personal information is handled by these features:

Processing scope. AI Features process personal information contained in uploaded documents (such as pay stubs, T4s, bank statements, and letters of employment) for the purpose of extracting relevant data fields and classifying document types. This processing occurs within our Canadian infrastructure (Section 15).

No guarantee of accuracy. AI-generated outputs may contain errors or inaccuracies. Personal information extracted by AI Features should be verified by the broker before being relied upon or disclosed to third parties, including lenders.

Human oversight. AI Features are designed to assist mortgage professionals, not to make autonomous decisions about individuals. Brokers retain responsibility for reviewing all AI-processed personal information and exercising professional judgment before acting on it.

No secondary use. Personal information processed by AI Features is used solely to provide the Service. It is not used for AI model training, profiling, or automated decision-making beyond the specific document processing functions described in this section.

17. Geographic Scope

The BrokerPlus platform is designed for use by licensed mortgage professionals operating in Canada. The following provisions apply to the geographic scope of our privacy practices:

• All personal information is stored and processed within Canada, as described in Section 15.
• BrokerPlus's privacy practices are designed to comply with Canadian federal and provincial privacy legislation. We do not guarantee compliance with the data protection requirements of any non-Canadian jurisdiction.
• Users located outside of Canada who access the platform are solely responsible for compliance with applicable data protection laws in their jurisdiction. BrokerPlus makes no representations regarding the adequacy of its privacy practices under non-Canadian data protection frameworks.

18. Children and Minors

The BrokerPlus platform is designed for use by licensed mortgage professionals and is not intended for individuals under the age of 18. BrokerPlus does not knowingly collect personal information from children or minors.

If we become aware that we have collected personal information from an individual under the age of 18, we will take steps to delete that information promptly. If you believe that a minor has provided personal information to BrokerPlus, please contact the CSO at amir@getbrokerplus.ca so that we can investigate and take appropriate action.

19. Accessibility and Accommodations

BrokerPlus is committed to providing an accessible platform in accordance with the Accessibility for Ontarians with Disabilities Act, 2005 (AODA) and the Integrated Accessibility Standards Regulation (Ontario Regulation 191/11).

We strive to ensure that the BrokerPlus platform meets the Web Content Accessibility Guidelines (WCAG) 2.0 Level AA, as required by the AODA for web-based content and applications. This includes designing and developing the platform with considerations for users who rely on assistive technologies.

If you require an accommodation to access or use the BrokerPlus platform, or if you encounter an accessibility barrier, please contact us and we will work with you to provide an appropriate accommodation in a timely manner:

Accessibility and Accommodations Contact
Email: amir@getbrokerplus.ca

We welcome feedback on the accessibility of the BrokerPlus platform. Feedback can be directed to the contact above and will be reviewed and addressed in accordance with our obligations under the AODA.

20. Individual Access

Individuals have the right to request access to their personal information held by BrokerPlus and to challenge its accuracy. Access requests should be directed to the CSO at amir@getbrokerplus.ca. We will respond within 30 days.

21. Post-Termination Data Handling

Upon termination or expiry of a user's subscription, the following provisions apply to personal information:

Data export window. The user will have thirty (30) days from the effective date of termination to export their data from the platform using the available export functionality. BrokerPlus will provide reasonable assistance with data export requests during this period.

Data deletion. Following the 30-day export window, BrokerPlus will delete or anonymize the user's personal information in accordance with this policy, subject to any legal or regulatory retention requirements.

Borrower data. Borrower data processed on behalf of the user will be handled in accordance with the commitments in Section 13.

Cached materials. Upon termination, users must promptly delete all locally stored copies of personal information obtained through the platform. This obligation does not apply to borrower files retained for regulatory recordkeeping purposes.

22. Challenging Compliance

Individuals may challenge BrokerPlus's compliance with this policy by contacting the CSO at amir@getbrokerplus.ca. If the matter is not resolved to the individual's satisfaction, they may file a complaint with the applicable privacy commissioner:

23. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated to affected individuals. The effective date at the top of this document indicates when the policy was last updated.