Privacy
Policy

2. Definitions

2.1 Personal Information
“Personal Information” means information about an identifiable individual, as defined under PIPA and PIPEDA. This includes, but is not limited to, an individual’s name, address, telephone number, email address, date of birth, financial records, employment information, and any other information that can be used to identify an individual, either alone or in combination with other available data.

2.2 Sensitive Personal Information

“Sensitive Personal Information” refers to a subset of Personal Information that, due to its nature, requires enhanced protection and handling. This includes, without limitation:

• • Social Insurance Number (SIN)
• • Government-issued identification documents (e.g., driver’s licence, passport)
• • Financial account numbers, credit history, and credit scores
• • Income and employment verification records
• • Investment account details and transaction histories
• • Mortgage application and loan servicing records

Right Avenue applies heightened safeguards to Sensitive Personal Information and collects such information only where required for legitimate business purposes, legal obligations, or regulatory compliance, including Know Your Client (“KYC”) and Anti-Money Laundering (“AML”) requirements.

3. Information We Collect

Right Avenue collects Personal Information that is necessary for the purposes identified in this Policy. The categories of information we may collect include the following:

3.1 Contact Information
Full legal name, residential and mailing addresses, telephone numbers, email addresses, and preferred methods of communication.

3.2 Financial and Investment Information
Bank account details, investment account information, net worth and asset declarations, investment objectives and risk tolerance, transaction records, tax residency status, and other financial data necessary to assess eligibility, process transactions, or manage investment accounts.

3.3 Identity Verification (KYC/AML Data)
Social Insurance Number (SIN), government-issued photo identification, date of birth, citizenship and immigration status, and any other information required to verify identity and comply with applicable KYC and AML legislation, including the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (Canada).

3.4 Employment and Income Information
Current and previous employer details, job title, employment status, income verification documents (e.g., pay stubs, notices of assessment, T4 slips), and self-employment records, as required for creditworthiness assessment and mortgage underwriting.

3.5 Technical and Digital Data
Internet Protocol (IP) address, browser type and version, device identifiers, operating system, referring URLs, pages visited, time and date of access, and other technical data collected automatically when you interact with our website or digital platforms.

3.6 Voluntary Information
Any additional information you choose to provide to us voluntarily, including through correspondence, surveys, feedback forms, or other communications.

4. Purpose of Collection, Use, and Disclosure

Right Avenue collects, uses, and discloses Personal Information only for purposes that a reasonable person would consider appropriate in the circumstances, and as required or permitted by applicable law. Our purposes include, but are not limited to:

4.1 Service Delivery
To process mortgage applications, manage investment accounts, administer loan servicing, and provide the financial products and services requested by you.

4.2 Identity Verification and Regulatory Compliance
To verify your identity and comply with KYC, AML, and other regulatory obligations imposed by applicable federal and provincial legislation, including requirements under the British Columbia Financial Services Authority (BCFSA), the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), and other regulatory bodies.

4.3 Creditworthiness and Risk Assessment
To evaluate your creditworthiness, assess mortgage eligibility, conduct underwriting analysis, and manage lending risk, including through the use of credit bureau inquiries and third-party verification services.

4.4 Investment Eligibility and Suitability
To determine your eligibility and suitability for investment products offered by Right Avenue, including assessing risk tolerance, investment objectives, and financial capacity.

4.5 Fraud Prevention and Security
To detect, investigate, and prevent fraudulent activity, unauthorized access, and other illegal or harmful conduct, and to protect the rights, property, and safety of Right Avenue, its clients, investors, and the public.

4.6 Legal and Regulatory Compliance
To comply with applicable laws, regulations, court orders, subpoenas, and lawful requests from government authorities, and to establish, exercise, or defend legal claims as required or permitted by law.

4.7 Internal Operations and Risk Management
To manage internal business operations, including audit, record-keeping, quality assurance, corporate governance, and risk management activities, to the extent necessary for the proper administration of Right Avenue.

4.8 Marketing and Communications
To communicate with you about products, services, and opportunities that may be of interest to you. Marketing communications are provided only with your express consent, or where implied consent is applicable under PIPA or PIPEDA. You may opt out of marketing communications at any time by contacting us using the information provided in Section 15 of this Policy, without affecting the provision of core services.

5. Consent

5.1 Express Consent
Right Avenue obtains express consent when collecting, using, or disclosing Sensitive Personal Information, or when the intended purpose is not one that a reasonable person would expect in the circumstances. Express consent may be obtained orally, in writing, or electronically, and will be documented by Right Avenue.

5.2 Implied Consent
In certain circumstances, consent may be reasonably implied from your actions or the context of your interaction with Right Avenue. For example, by submitting a mortgage application or an investment subscription form, you implicitly consent to the collection, use, and disclosure of the Personal Information contained therein for the purposes of processing your application and providing the requested services.

5.3 Withdrawal of Consent
You have the right to withdraw your consent to the collection, use, or disclosure of your Personal Information at any time, subject to legal or contractual restrictions, by providing written notice to Right Avenue. Right Avenue will inform you of the implications of such withdrawal, which may include the inability to provide certain services, process pending applications, or maintain your investment account. Withdrawal of consent does not apply retroactively and does not affect the lawfulness of any collection, use, or disclosure made prior to the withdrawal.

5.4 Exceptions to Consent
Right Avenue may collect, use, or disclose Personal Information without consent where permitted or required by law, including for the purposes of complying with a subpoena, court order, or lawful demand made by a regulatory authority; investigating a contravention of a federal or provincial law; or acting in an emergency that threatens an individual’s life, health, or security, as permitted under PIPA and PIPEDA.

6. Disclosure of Information

Right Avenue may disclose your Personal Information to the following categories of recipients, to the extent necessary and as required or permitted by law:

6.1 Service Providers
Third-party service providers engaged by Right Avenue to assist in the delivery of our services, including but not limited to technology providers, data processors, document management services, and professional advisors. Right Avenue requires all service providers to implement commercially reasonable safeguards for the protection of Personal Information; however, Right Avenue does not assume liability for the independent acts or omissions of such third parties.

6.2 Financial Institutions and Credit Bureaus
Banks, credit unions, other mortgage lenders, and credit reporting agencies, as required for the purpose of processing your application, verifying creditworthiness, or facilitating transactions.

6.3 Legal and Regulatory Authorities
Government agencies, regulators (including BCFSA, FINTRAC, and the Canada Revenue Agency), law enforcement agencies, and courts, as required or permitted by law, or where disclosure is necessary to comply with a legal obligation or to protect Right Avenue’s legal rights.

6.4 Business Transactions
In connection with a proposed or completed merger, acquisition, reorganization, sale of assets, financing, securitization, or other business transaction involving Right Avenue, your Personal Information may be disclosed to the parties involved and their advisors, subject to confidentiality obligations. In such event, the acquiring entity will be bound by the terms of this Policy with respect to any Personal Information transferred.

6.5 Fraud Prevention and Legal Enforcement
To other financial institutions, industry associations, or law enforcement agencies for the purposes of preventing, detecting, or investigating fraud or other illegal activity, or where disclosure is necessary to establish, exercise, or defend legal claims.

6.6 With Your Consent
To any other third party where you have provided express consent to such disclosure.

7. Cross-Border Data Transfer

In the course of our operations, your Personal Information may be transferred to, stored in, or processed in jurisdictions outside of Canada, including the United States. When your Personal Information is transferred to a foreign jurisdiction, it may be subject to the laws of that jurisdiction and may be accessible to the courts, law enforcement, and regulatory authorities of that jurisdiction.

Right Avenue takes commercially reasonable steps to ensure that any foreign service providers or data processors with access to your Personal Information are contractually bound to maintain safeguards that are comparable to those required under Canadian privacy legislation. However,

Right Avenue cannot guarantee that a foreign jurisdiction will provide the same level of protection as Canadian law.
Where feasible, Right Avenue prioritizes the storage and processing of Personal Information within Canada. By providing your Personal Information to Right Avenue, you consent to its transfer and processing in jurisdictions outside of Canada, as described in this Section.

8. Data Security

Right Avenue implements administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, collection, use, disclosure, copying, modification, disposal, or destruction. These measures include, but are not limited to:

• Encryption of data in transit and at rest, using industry-standard protocols
• Role-based access controls and multi-factor authentication for internal systems
• Regular security assessments, vulnerability testing, and incident response planning
• Confidentiality agreements and privacy training for all employees and contractors
• Physical security measures for offices and data storage facilities, including restricted access and surveillance
• Secure document disposal and data sanitization procedures

Sensitive Personal Information, including SIN, financial account numbers, and identity verification documents, is subject to enhanced access restrictions and encryption standards.

No method of transmission or storage is completely secure. While Right Avenue strives to use commercially reasonable means to protect your Personal Information, we cannot guarantee absolute security. Right Avenue disclaims liability for any breach of security that occurs despite the implementation of commercially reasonable safeguards, to the extent permitted by applicable law.

9. Data Retention and Destruction

Right Avenue retains Personal Information only for as long as necessary to fulfill the purposes for which it was collected, or as required or permitted by applicable law and regulatory obligations. Retention periods are determined on a case-by-case basis, taking into account the following factors:

• The nature and sensitivity of the Personal Information
• The purposes for which the information was collected and used
• Legal, regulatory, and contractual retention requirements (including tax, securities, and mortgage brokerage record-keeping requirements)
• The need to retain information for the establishment, exercise, or defence of legal claims
• Industry standards and best practices

Upon expiry of the applicable retention period, or when Personal Information is no longer necessary for the identified purposes, Right Avenue will securely destroy, erase, or anonymize such information using commercially reasonable methods, including but not limited to secure shredding, cryptographic erasure, and permanent deletion from electronic systems.

Notwithstanding the foregoing, Right Avenue reserves the right to retain Personal Information as required or permitted by applicable law, including where retention is necessary for the resolution of disputes, enforcement of agreements, or compliance with audit or regulatory requirements.

10. Your Rights

Subject to applicable law and certain exceptions, you have the following rights with respect to your Personal Information:

10.1 Right of Access
You have the right to request access to the Personal Information Right Avenue holds about you. Upon receipt of a written request and verification of your identity, Right Avenue will provide you with access to your Personal Information within a reasonable timeframe, as required by PIPA and PIPEDA.

10.2 Right of Correction
You have the right to request that Right Avenue correct any inaccuracies or omissions in your Personal Information. Right Avenue will make the requested corrections where the information is demonstrated to be inaccurate or incomplete, and will notify any third parties to whom the information has been disclosed, where practicable.

10.3 Right to Withdraw Consent
As described in Section 5.3 of this Policy, you have the right to withdraw your consent to the collection, use, or disclosure of your Personal Information, subject to legal or contractual restrictions.

10.4 Right to Complain
If you are dissatisfied with Right Avenue’s handling of your Personal Information or believe that Right Avenue has not complied with this Policy or applicable privacy legislation, you may submit a written complaint to Right Avenue’s Privacy Officer using the contact information provided in Section 15. Right Avenue will investigate all complaints and respond within a reasonable timeframe. If you are not satisfied with Right Avenue’s response, you may file a complaint with the Office of the Information and Privacy Commissioner for British Columbia (OIPC) or the Office of the Privacy Commissioner of Canada (OPC), as applicable.

10.5 Response Timelines
Right Avenue will respond to access and correction requests within thirty (30) business days of receipt, or such other period as required by applicable law. Where a request requires additional time due to complexity or volume, Right Avenue will notify you of the extension and the reasons therefor.

11. Cookies and Tracking Technologies

Right Avenue’s website and digital platforms may use cookies, web beacons, pixel tags, and similar tracking technologies to collect Technical Data, as described in Section 3.5 of this Policy. These technologies are used for the following purposes:

• To enable the functionality and security of our website and digital platforms
• To analyze website traffic, usage patterns, and user behaviour for the purpose of improving our services and user experience
• To deliver content and advertising that is relevant to your interests, where applicable

You may manage your cookie preferences and opt out of certain tracking technologies by adjusting the settings in your web browser. Please note that disabling certain cookies may impair the functionality of our website or digital platforms.

Right Avenue may engage third-party analytics and advertising providers who may set their own cookies and tracking technologies on our website. Right Avenue does not control these third-party technologies and is not responsible for the privacy practices of such third parties. We encourage you to review the privacy policies of any third-party providers whose technologies may be used on our website.

12. Third-Party Links

Our website and communications may contain links to websites, applications, or services operated by third parties. Right Avenue is not responsible for the privacy practices, content, or security of any third-party websites or services. Accessing a third-party website through a link on our website is at your own risk, and we encourage you to review the privacy policy of any third-party website before providing any Personal Information.

13. Limitation of Liability

To the maximum extent permitted by applicable law, Right Avenue Mortgage Investment Corporation, its directors, officers, employees, agents, and affiliates shall not be liable for any loss, damage, or harm arising from or in connection with:

• The unauthorized access, use, or disclosure of your Personal Information by third parties, including service providers, where such access, use, or disclosure occurs despite the implementation of commercially reasonable safeguards
• Any breach of security affecting systems, networks, or platforms operated by third parties over which Right Avenue has no control
• Any loss or damage resulting from events beyond Right Avenue’s reasonable control, including but not limited to natural disasters, acts of war, terrorism, cyberattacks, government action, or other force majeure events
• Your failure to maintain the confidentiality of your own account credentials, passwords, or access information
• Any reliance on the privacy practices or security measures of third-party websites, applications, or services linked from Right Avenue’s website

Nothing in this Policy shall be construed to limit or exclude liability that cannot be limited or excluded under applicable law.

14. Policy Updates

Right Avenue reserves the right, at its sole discretion, to amend, modify, supplement, or replace this Policy at any time, without prior notice, to reflect changes in our business practices, legal requirements, or technological capabilities. Any revisions to this Policy will be effective immediately upon posting the updated Policy on our website, with the revised “Last Updated” date indicated at the top of this document.

Your continued use of Right Avenue’s services, website, or platforms following the posting of any changes to this Policy constitutes your acceptance of such changes. It is your responsibility to review this Policy periodically to remain informed of any updates. Where required by applicable law, Right Avenue will provide direct notice of material changes to this Policy.

15. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or Right Avenue’s handling of your Personal Information, or if you wish to exercise any of your rights described herein, please contact:

Privacy Officer

Right Avenue Mortgage Investment Corporation

Suite 300, 22420 Dewdney Trunk Road

Maple Ridge, British Columbia, V2X 3J5

Telephone: 778-240-0726

Email: info@rightavenuemic.ca