Earna Privacy Policy

This privacy policy for Earna Inc. (‘Earna’, ‘we’, ‘us’, ‘our’), elaborates how and why we might collect, store, use, and/or share (‘process’) your information when you use our services (‘services’), such as: - Visit our website https://earna.ca , including, but not limited to, all other sites and mobile applications owned and operated by us, all subdomains provided through such other sites or the website, and all downloadable applications, features, functionality, content, or information that is made available or provided by us (the “Website”). - Visits to the Company’s social media pages that refer to this Privacy Policy (e.g., LinkedIn). - In email, text, and other electronic messages between you and this Website or the Company. - Through mobile and desktop applications you download from this Website, which provide dedicated non-browser-based interaction between you and this Website or the Company. - When you interact with our advertising and applications on third-party websites and services if those applications or advertising include links to this policy. - When you provide business or other professional services to the Company. - In cases of direct interactions with you, for example, by filling in forms, corresponding with us, or entering a contest or promotion sponsored by us. Reading this privacy policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please DO NOT use our services. If you have any questions or concerns, please contact us at [email protected] . By voluntarily and freely providing us with Personal Information (as defined herein) through the use of our Services (including via telephone) using the Website (and corresponding applications), you are consenting to its collection, use, and disclosure in accordance with this Privacy Policy. You acknowledge and agree that such Personal Information may be transferred for processing from your current location to the offices and servers of Earna and authorized third parties referred to herein, that may be located outside the province of Quebec, but within Canada, as well as in the United States and the Philippines. The Website may include links to third-party websites, plug-ins, services, social networks, or applications. Clicking on those links or enabling those connections may allow the third party to collect or share data about you. If you follow a link to a third-party website or engage a third-party plugin, please note that these third parties have their own privacy policies, and we do not accept any responsibility or liability for these policies. We do not control these third-party websites, and we encourage you to read the privacy policy of every website you visit. Please read this policy carefully to understand our policies and practices for collecting, processing, and storing your information. If you do not agree with our policies and practices, it is your choice to cease the use of our Website and corresponding applications. By accessing or using this Website, you indicate that you understand, accept, and consent to the practices described in this policy. This policy may change from time to time. Your continued use of this Website after we make changes indicates that you accept and consent to those changes. We always include the date when this policy was last updated at the very top of this page. YOU ARE RESPONSIBLE FOR REGULARLY REVIEWING THE WEBSITE POLICIES AND PRACTICES TO OBTAIN TIMELY NOTICE OF SUCH CHANGES.

Information We Collect About You

We collect and use several types of information from and about you, including: - Personal Information that we can reasonably use to identify you directly or indirectly, such as your name, mailing address, email address, telephone number, Internet protocol (IP) address used to connect your computer to the Internet, location, username, or other similar identifier, information about loans or accounts, current and historical information, balance and indebtedness, account transaction history and records relating to the handling of any inquiries or complaints, contact or authentication data, and other browsing data, Social Insurance Numbers and income, such information that may be necessary for our identified purposes and that is collected with your consent or as permitted or required by law and any other identifier we may use to contact you ("personal information"). - Non-Personal Information that does not directly or indirectly reveal your identity or directly relate to an identifiable individual, such as associations, distances, comparison between available data sources, demographic information, or statistical or aggregated information. Statistical or aggregated data does not directly identify a specific person, but we may derive non-personal statistical or aggregated data from personal information. For example, we may aggregate personal information to calculate the percentage of users accessing a specific Website feature. - Technical Information including your login credentials, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, or information about your internet connection, the equipment you use to access our Website, location information from your mobile device or browser, and usage details. Some of this information may be stored in our system to better identify clients for future transactions. Failure to provide the Personal Information required for us to provide the Services, such as the assessment of your loan application, may tamper with the provision of the service offered by us. We use Personal Information as required by provincial and federal regulators to comply with applicable law, such as promoting safe and responsible lending.

Third Party Use of Cookies and Other Tracking Technologies

Cookies

We use session ID cookies to confirm that users are logged in. This type of cookie helps us recognize you, if you visit multiple pages on our site during the same session, so that we do not need to require a password to access each page. You can set your browser to notify you when you receive a cookie or refuse cookies altogether. Please note: If you do not accept cookies from us, you will not be able to use our site. We also use persistent cookies that store your login ID (but not the password) to make it easier to login when you come back to us on future visits. We encode our cookies so that only we can interpret the information stored in them, but they do not contain personally identifiable information. You can remove or block persistent cookies using the settings in their browser if they want to disable the feature.

Third Parties

Some content or applications on the Website, including advertisements, are served by third parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use cookies to collect information about you when you use our Website. We do not control these third parties' tracking technologies or how they are used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly. We may use the information we have collected from you to enable us to display advertisements to our advertisers' target audiences. Even though we do not disclose your personal information for these purposes without your consent, if you click on or otherwise interact with an advertisement, the advertiser may assume that you meet its target criteria.

Google Analytics

Google Analytics is a web analysis service that provides statistics and basic analytical tools. We use the data collected through Google Analytics Demographics and Interest Reporting to better understand our website visitors in terms of demographics and interests, to improve our website content in order to cater to our audience, and to customize advertisements based on our audience’s interests and demographics. The information cannot be linked to an individual. Google will never link the information collected with any other data or information that it preserves. To obtain additional information on the information that Google collects and how it is used, consult Google Privacy & Terms . If you so desire, you can prevent Google from recording information pertaining to your navigation by installing on your computer the Google Analytics Opt-out Browser Add-on .

Correspondence Management

By signing up to use our services, you agree to the terms and conditions of this Privacy Policy and give us and/or any of our affiliates permission where permitted by law to use your email address and/or full address in order to send relevant and promotional materials.

Contacting User

When you complete an “information request form,” you are thereby agreeing to the use of your name and email address in a reply to your request as provided through the request form. When you register your name to receive our newsletter and promotions, you consent to receive marketing information at the provided email address. To this end, your email will be added to our email marketing group. Your phone contact will be used mostly to address your request and to provide support.

How We Collect Information About You

We use different methods to collect your information, including through: - Direct interactions with you when you provide it to us, for example, by filling in forms, responding to ads and job postings published on the Website, or corresponding with us by phone, email, or otherwise. - Automated technologies or interactions, as you navigate through our Website. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies. - Third parties or publicly available sources, for example, our business partners. - The Company may also record calls or virtual meetings with You for training and note-taking purposes, in which case your voice and/or images may be captured. - Visitors to the Company’s social media pages that refer to this Privacy Policy (e.g., LinkedIn). - If attending the Company’s offices, We may capture images and recordings of you by video and audio recording devices in order to maintain the physical security of our offices. The Company has no control over cameras that may be placed in the common areas of the buildings its offices are located in. - When you use one of your devices (e.g., laptop, mobile phone, desktop computer) to browse our Website, We receive certain information about your device, including its hardware model, operating system, browser version, IP addresses, and geographic information derived from IP addresses.

When Using Our Mobile App

With your consent, Earna captures precise location data by accessing your device's GPS to deliver services tailored to your whereabouts, including alerts on proximal rewards partners. This feature can be deactivated at any time through your device's location service settings, allowing you full control over your privacy preferences. Additionally, upon opting in, Earna can send push notifications to your device, encompassing welcoming messages, insights into product features, and exclusive promotional offers. Preferences for receiving these notifications can be adjusted by disabling push notifications for the App in your device's settings, ensuring a personalized user experience. The app necessitates the collection of minimal device and usage information, such as device type, operating system, unique identifiers, IP address, language settings, and app access timestamps, to facilitate optimal functionality and an enhanced user experience. This data assists in analyzing app engagement levels, enabling continuous improvements to the app's performance and the personalization of content within the app. To further refine our offerings, Earna may employ third-party services to gather analytical insights regarding app feature usage and engagement duration. Earna is committed to maintaining transparency regarding the collection, utilization, and sharing of information within the constraints imposed by external platforms like Apple and Google. While we strive to clearly communicate our practices, it's important to recognize that certain tracking activities by these platform providers or your telecommunications carrier fall outside our jurisdiction. We advise users to thoroughly review and understand the privacy policies of any third-party providers, including those related to Android and iOS apps, as well as those of their telecommunications provider, before proceeding with any app downloads or making any purchases, ensuring a well-informed app interaction and purchase decision-making process.

Automated Decision Making

When we process your personal information, we may use automated decision-making systems to help provide better products and services to you (i.e., to verify identity, assess internal risk or creditworthiness), for security, anti-money laundering, and fraud detection/prevention purposes. You may contact our Privacy Officer for information regarding our use of these systems, including challenging a decision.

Information You Provide to Us

To access most financial products and services we offer, you need to have an Earna profile. In order to create it, we collect your email address, phone number, and a password that you select. We use this information to administer and authenticate your access to our platform, to enable you to access products and services, and to update you about changes to our platform. Other information we collect directly from you on or through our Website or mobile application may include: - Information that you provide by filling in forms on our Website or mobile application. We may also ask you for information when you report a problem with our Website or mobile application. - Records and copies of your correspondence (including email addresses), if you contact us. If you submit the contact details or identification information of another individual (for example, a counterparty or an authorized user), we may gather their full name, email, and telephone number (including, for business-related contacts, the name of the recipient and their account details). When you apply for financial products and services with us, we may collect additional information from you as follows: - Credit Products and Services: If you apply for a credit product, including, but not limited to, Earna Visa Classic Credit Card, we collect additional financial information, including income-related information, living situation (i.e., move-in date, and whether you rent, own, or live with family), housing costs, living expenses (e.g., utilities) (and, for residents of Quebec, we may collect the name of employer, monthly credit or loan payments, and source of income) to assess your creditworthiness, and to confirm your eligibility for our credit products. We may run a credit check to help assess your eligibility for a credit card and the credit limits. We may also use your financial and transaction information, including card and account usage, payment history, and parties to transactions, to deliver the financial products and services to you, and provide you with relevant information about your account. - Provision of Financial Products and Services: In the event that you possess an Earna profile and have received approval for any product or service provided by Earna, we will utilize your financial and transactional details. This includes usage of cards and accounts, payment records, and transaction participants, for the purpose of furnishing you with the designated financial products and services, along with pertinent account information. To communicate with you regarding updates to these financial products and services, as well as to dispatch critical information concerning the initiation of financial accounts and beneficial notifications about your financial accounts, we may employ various methods of contact such as your telephone number, email, or physical mailing address. These communications may be conveyed through mail, email, SMS (where message and data rates might be applicable), push notifications, or direct calls.

Where We Store Your Information

Personal Information you provide to us is stored in the following locations: in any provinces of Canada, including Quebec, the United States, and the Philippines. The degree of sensitivity of each of these storage sites has been established. All Personal Information stored there is adequately secured and access to them is restricted to authorized persons only. When we transfer your information to other jurisdictions, including to jurisdictions outside of the province in which you reside (which may include transfer outside of Quebec for Quebec residents) and outside of Canada, it will be subject to the laws of that jurisdiction and may be disclosed to or accessed by the courts, law enforcement, and governmental authorities in accordance with those laws. By submitting your information to us, you agree to this transfer, storing, and processing.

How We Use and Share Your Information

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction. We may disclose personal information that we collect, or you provide as described in this Privacy Policy: - To our subsidiaries and affiliates, including those that may be located outside Quebec or Canada. - In accordance with applicable law, to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of the Company's assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by the Company about our customers and users is among the assets transferred. - To advertisers and advertising networks that require the information to select and serve relevant advertisements to you and others. We do not disclose data about identifiable individuals to our advertisers, but we may provide them with aggregate information about our users. We may also use such aggregate information to help advertisers target a specific audience. We may make use of the personal information we have collected from you to enable us to display our advertisers' advertisements to that target audience. - To third parties to market their products or services to you. We contractually require these third parties to keep personal information confidential and use it only for the purposes for which we disclose it to them. To be able to offer and administrate our products and services, we may share your personal information with the plastic card manufacturer to be able to manufacture your card and with a payment processing business, or with print suppliers to be able to provide you our product and services. As well as to share information to Earna’s insurance partners to the extent that it is required to provide our services. - To third-party credit reporting agencies for business purposes that include but are not limited to: investigating and monitoring internal business practices, providing and supplying services to you; for research, testing, and development of products offered by the Company; to detect security breaches and protect against them. Were any of the following to be carried out, prior to any disclosures of personal data, a contract would be entered into that will ensure the protection, security, and use for the above-mentioned purposes between us and any third party. - To detect fraud and monitor your transaction information, especially the behavioral characteristics, to ensure the highest level of fraud protection. - To help us collect debt owed to us, we may share your contact information and financial situation with third parties like collection agencies and law firms specialized in debt collection practices. - To provide, improve, and develop our products and services, which include updating, securing, and troubleshooting. - To contractors, service providers, and other third parties we use to support our business (such as analytics and search engine providers that assist us with Website improvement and optimization, data processing, customer service, security, etc.) and who are contractually obligated to keep personal information confidential, use it only for the purposes for which we disclose it to them, and to process the personal information with the same standards set out in this policy. However, such third parties may not be located in Canada, such as, without limitation, in the United States of America or the Philippines. - To fulfill the purpose for which you provide it. - For any other purpose disclosed by us when you provide the information. - With your consent. We may also disclose your personal information: - To comply with any court order, law, or legal process, including to respond to any government or regulatory request, in accordance with applicable law. - To enforce or apply our terms of use and other agreements, including for billing and collection purposes. - If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of the Company, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction. - We may also use and disclose personal information in connection with the proposed or actual financing, securitization, insuring, sale, assignment, or other disposal of all or part of our business or assets (including your loan and any agreement to which it relates), for the purposes of evaluating and/or performing the proposed transaction. Assignees or successors of our business or assets may use and disclose your personal information for similar purposes as those described in this policy.

Products Offered by Earna

Your personal information may be disclosed to certain third parties as part of specific financial products or services that you apply for, are approved for, and participate in. When you apply for and receive approval to use one of our credit cards, we may disclose your contact, identity, financial, transaction, online, counterparty, and third-party information with our subsidiaries and affiliates and authorized third parties responsible for issuing our cards, including Equitable Bank. We provide this information only to the authorized parties necessary for the purposes of regulatory reporting, compliance, and to inform if we can onboard you as a customer for these products. Our authorized third parties may collect, use, disclose, and otherwise handle your personal information according to their privacy policies. The card sponsoring bank’s handling of your personal information is subject to their own privacy policy and is not governed by this Privacy Policy. We encourage you to review the privacy policy of the sponsoring bank of your card. Equitable Bank’s Privacy Policy can be found here: https://equitablebank.ca/privacy-agreement .

The Use of the Collected Data

We collect and use Personal Information for purposes limited to those related to our businesses, which include providing financial services to our customers. We collect Personal Information primarily from you, for instance through applications and supporting documentation you provide. We may retain phone logs and meeting notes for quality assurance training and record-keeping purposes. We may use the collected data for the purpose of responding to requests made pursuant to this Privacy Policy, including for verification purposes. We may also collect Personal Information about you through your ongoing interactions with us, from references, employers, and other financial institutions you have identified in your application, as well as credit bureaus and other third-party sources.

Anti-Money Laundering and Sanctions Checks

When you apply for financial products and services offered by us, we use service providers to meet our regulatory obligations regarding anti-money laundering and sanctions. We review the final result of anti-money laundering checks in order to comply with applicable legal and regulatory obligations (including those relating to money laundering, terrorist financing, and financial dealings with certain sanctioned individuals).

Third Party Accounts

If you consent and provide account details for bank accounts with other financial services providers in order to fund your account, we collect information about this bank account, including financial institution name and number, account number, transit number, and account balances from a service provider, such as Flinks, to facilitate these transactions.

Credit Checks

When you apply for certain financial products and services offered by us, we collect identity information and financial and transactional information from credit reporting agencies, such as TransUnion and/or Equifax. We use your name, address, SIN, and date of birth to obtain certain credit, financial, personal, and business information contained in your credit report, to the extent provided by a credit bureau, for the purposes of verifying your creditworthiness, assessing, and managing our credit risks, establishing credit and hold limits, qualifying you for other products and services, and detecting and preventing fraud and other decisions about your account. We may also share information with credit reporting agencies on an ongoing basis in order for the credit reporting agencies to maintain accurate credit information within their databases, in accordance with applicable laws.

Rights and Personal Data

We allow you to manage your account and the information you provided. Once you log in, you may update your Personal Information if your account is in good standing and hasn’t been deactivated. In that case, we will retain only the Personal Information required by law or that we deem necessary to fulfill the purpose for which it was collected. We may not be able to provide access to some or all individuals' Personal Information. Reasons for refusing access may include situations where: - The release of the Personal Information may threaten the life or security of a third party; - Personal Information is unreasonably costly to provide; - The request is frivolous or vexatious or made in bad faith; - Personal Information is subject to, or generated in a formal dispute resolution process; - Personal Information cannot be disclosed for legal, security, or commercial proprietary reasons; or - Personal Information is subject to solicitor-client or litigation privilege. All information provided can be used in legal proceedings and/or in the Court of Law if deemed necessary. Additionally, we will release any information if mandated by local, provincial, or federal laws and/or their officers.

Contact Information to Our Privacy Officer

Should you choose to withdraw your consent that permits us to process your Personal Information, please indicate for which purpose(s) you wish Earna to stop processing your Personal Information (e.g., for a particular purpose, or for all purposes). Prior to fulfilling your request, we may inform you of any consequences that withdrawing your consent may have in relation to receiving services pursuant to this Privacy Policy. Please note that withdrawing your consent is not the same as requesting that we delete any Personal Information, and we may continue to hold your Personal Information pursuant to any business (e.g., retention) or legal requirements where deletion has not also been requested. In some cases, withdrawing your consent is not an option because of legal or contractual requirements. If you have authorized us to disclose your loan repayment habits to credit reporting agencies as part of a loan you have requested, you won’t be able to withdraw this consent until you have fully repaid your loan.

Withdrawing Your Consent (i.e., “opting out”)

If you refuse to allow us to collect certain personal information, we may not be able to provide you with the product or service requested and with certain benefits and discounts associated with that product or service. For example, if you don’t allow us to consult your credit report when you apply for a credit product, such as a card or loan, we may not be able to provide you with the requested product.

Destruction and Anonymization of Personal Information

You have the right to request the deletion of certain Personal Information after the initial purpose of providing them to us has been fulfilled. By law, we must store your Personal Information provided for the initial purpose for a specific minimum period. Should there be a dispute or investigation initiated on your Account, the time we must retain information will be extended up to 3 additional years after the dispute is resolved. Should you wish to have your Personal Information deleted, provided that we are not mandated by law to retain them, you may send us a request detailing what kind of information you would like us to delete to: Earna’s Privacy Officer

372 Bertha Street, Hawkesbury, Suite 102,

Ontario, K6A 2A8 To ensure we disclose information to you only, with your request please include photocopies (front and back) of two (2) pieces of government-issued identification so that we may verify your identity. We may charge you a reasonable fee to access your personal information, however, we will notify you of any fee in advance. Once the retention period has expired, we ensure that your personal information is safely disposed of or de-identified. While deletion is a final and irreversible disposal process, de-identification means that your personal information is altered so that it can no longer directly or indirectly identify you. Deletion and de-identification are carried out in a safe and secure manner, in accordance with applicable best practices.

Reasons Why We May Refuse to Delete or De-Identify Your Personal Information:

- For regulatory reasons connected to our licensing requirements. - For reasons of labor law requirements. - For federal and provincial data retention requirements. - For legal reasons in the event of a dispute.

Safeguards

The security of your personal information is very important to us. We use physical, electronic, and administrative measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. We store all information you provide to us behind firewalls on our secure servers. Personal information will be protected by reasonable security safeguards appropriate to the sensitivity of the data collected. Access is restricted to personnel who are authorized as part of their duties. This information will not be made public, sold, or shared with third parties without your consent, except to ensure the service you've registered for or to meet legal obligations. We are committed to providing the highest level of training as far as the protection of your Private Information can go; every employee that may have access to your data is properly trained periodically. We will protect Personal Information disclosed to third parties by means of contractual agreements with respect to the confidentiality of the Personal Information and the purposes for which the Personal Information is to be used. We follow a SOC 2 compliance program to ensure that our systems and infrastructures are securely controlled and effectively operated. Controls are reviewed regularly to ensure operating effectiveness and security. We have implemented processes to respond to data subject requests and complaints in a timely and effective manner. We have implemented a framework for the retention and destruction of personal information to ensure compliance with legal obligations and to securely destroy personal information once no longer required.

Children Under the Age of 14

Our Website and our Services are not intended for people under the age of majority in their respective jurisdiction. No such person may provide any information to or on the Website. Without limiting the foregoing, we do not knowingly collect personal information from children under 14. If you are under 14, DO NOT USE OR PROVIDE any information on the Website or on or through any of its features/register on the Website, use our Services, or provide any information about yourself to us, including your name, address, telephone number, or email address. If we learn we have collected or received personal information from a child under 14 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 14, please contact our Privacy Officer.

Language (Quebec Residents Only / Résidents du Québec Seulement)

You acknowledge that the French and English versions of this policy are available to you. You expressly request and agree to be bound exclusively by the English version of this policy and that all related documents, including any notices, be drafted in English only. Vous reconnaissez que les versions françaises et anglaises de cette politique sont disponibles. Vous demandez expressément et acceptez d’être lié exclusivement par la version anglaise de cette politique et que tous les documents qui s’y rattachent, y compris tout avis, soient rédigés en anglais seulement.

Privacy Policy Updates

All additions and modifications will be clearly marked on our website located at https://www.earna.ca/privacy . We reserve the right to make changes to this Policy without prior notice and at any time. The updated version will be indicated by the ‘Last updated’ date and the updated version will be effective as soon as it is accessible. It is therefore strongly recommended that you visit and review our Privacy Policy frequently so that you stay informed on how we are protecting your information. Your use of our services and products following any changes to the Privacy Policy indicates your acceptance of the revised Privacy Policy. You also have a right to access the personal data belonging to you that is under our control subject to any legal restrictions or rights of refusal. Such a request for access must be made in writing stating the details of the personal data you are requesting to our Privacy Officer. To ensure we disclose information to you only, with your request please include photocopies (front and back) of two (2) pieces of government-issued identification so that we may verify your identity. We may charge you a reasonable fee to access your personal information, however, we will notify you of any fee in advance. Copies of records containing Personal Information may be subject to a fee. If this is the case, we will inform you of the amount of the fee in advance. We will use our best efforts to ensure that Personal Information is as accurate, complete, and up-to-date as necessary for the identified purposes. If you successfully demonstrate the inaccuracy or incompleteness of Personal Information, we will amend the information as required. If we refuse access to Personal Information or disagree with an assertion that information held by us is incorrect, we will provide a written explanation for such refusal and a description of our complaints procedure should you decide to challenge such written explanation. Your right to access or correct Personal Information is subject to applicable legal restrictions. To prevent fraudulent access to the Personal Information stored by Earna, we may take reasonable steps to verify your identity before granting access or making corrections.

Contact

Should you have any complaints or questions regarding this Privacy Policy, we urge you to forward them to [email protected] by email or by mail at: Earna’s Privacy Officer

1751 Rue Richardson, Suite 1.100, Montréal, QC H3K 1G5 To ensure we disclose information to you only, with your request please include photocopies (front and back) of two (2) pieces of government-issued identification so that we may verify your identity. We may charge you a reasonable fee to access your personal information, however, we will notify you of any fee in advance.