Konek Project Spark Privacy Notice

What is Personal Information?

“Personal Information” means information about an identifiable individual.

What Personal Information We Collect

Personal Information about you shall be collected from a variety of different sources when you download and use the Spark App, including from your financial institution, from Your Device, and from you directly.

Information Collected from Your Financial Institution

Personal Information collected from your financial institution may include your:

• First and last name
• Phone number
• Email address
• Address
• Financial institution’s name
• Bank account number (last four digits only)
• Feedback regarding the Spark App

Information Collected from Your Device

Information collected from Your Device may include its:

• Operating system type and version
• Language and region settings
• Manufacturer
• Model

In addition to the forgoing, we may collect information about your use of the Spark App, such as if you initiate a money request, the date and time you initiated the request, the amount you entered, and the status of your request.

Information Collected from You Directly

We may collect Personal Information directly from you from time-to-time, including if you contact us and voluntarily provide it to us, respond to a questionnaire or survey about the Spark App, or decide to make changes to your Konek profile.

How We Use Your Personal Information

Your Personal Information shall only be used by Interac for explicitly specified and legitimate purposes, or as otherwise permitted by applicable law, including for the purposes of:

• Administering your participation in the Konek Spark Pilot
• Operating and facilitating your use of Konek and the Spark App
• Verifying and authenticating your identity
• Contacting and communicating with you, including regarding notices, updates, and opportunities to provide feedback about the Konek Spark Pilot, Konek, and the Spark App
• Investigating, managing, and responding to complaints, inquiries, disputes, and other service-related issues, including requests for assistance and technical support
• Detecting, preventing, and suppressing fraud
• Maintaining the security, integrity, and availability of Konek and the Spark App, including our networks and platforms
• Assessing, managing, mitigating, and responding to operational, financial, legal, regulatory, and security risks
• Carrying out any obligations that may arise by virtue of any agreement that we may have with you or our business partners
• Complying with applicable laws, regulations, and legal processes, including to exercise our legal rights and defend against legal claims
• Managing our business needs, including to monitor, analyze, test, maintain, support, troubleshoot, and improve the performance, reliability, security, usability, and functionality of our products and services
• Evaluating, assessing, and reporting on the effectiveness, usability, functionality and outcomes of the Spark App and the Konek Spark Pilot
• Generating anonymized and aggregated statistical data for the purposes described above

For greater certainty, the Spark App may utilize technologies that enable us to identify, locate, and/or profile you for the purposes described above.

Why We Share Your Personal Information

We may share your Personal Information with your financial institution, our service providers, and/or other third parties for the purposes set out below.

Your Financial Institution

We may share your Personal Information with your financial institution to administer your participation in the Konek Spark Pilot, operate and facilitate your use of Konek and the Spark App, and for other purposes as described under section 3 of this Privacy Notice (“How we use your personal information”).

Service Providers

We may share your Personal Information with our service providers who support the Spark App and the Konek Spark Pilot, including technology, security, cloud, platform, customer support, and analytics service providers. These service providers shall only process your Personal Information for the purposes described under section 3 of this Privacy Notice (“How we use your Personal Information”).

Third Parties

We may disclose your Personal Information to third parties where necessary to:

• Comply with legal, regulatory, law enforcement, judicial, and governmental requirements, including subpoenas, warrants, and production orders
• Investigate, prevent, detect, suppress, and respond to security incidents, fraud, unlawful activities, and other events that may threaten individuals, organizations, or the integrity of our services
• Protect the rights, property, safety, and security of Interac, our employees, agents, customers, end users, and other persons
• Prevent, mitigate, or respond to emergencies or situations involving a risk of serious harm to an individual or group of individuals
• Facilitate or finalize a prospective business transaction
• Fulfill other purposes that are permitted, authorized, or required by applicable law

How Long We Keep Your Personal Information

Interac retains Personal Information for as long as it is needed to fulfill our identified purposes and in accordance with our legal, regulatory, and internal recordkeeping requirements. You can submit a request for Interac to delete your Konek profile at any time. Konek profiles are automatically deleted 12 months after continuous inactivity.

How We Protect Your Personal Information

Interac is committed to protecting your Personal Information and maintaining appropriate safeguards to prevent unauthorized access, collection, use, disclosure, modification, loss, theft, and destruction. We maintain physical, technical, and administrative safeguards that are appropriate to the sensitivity of the Personal Information that is in our custody and under our control. Where Personal Information is processed by third-party service providers on our behalf, we exercise due diligence and require such service providers to implement and maintain appropriate privacy and security controls.

While no method of transmission over the internet or electronic storage is completely secure, Interac takes reasonable steps to safeguard Personal Information throughout its lifecycle and to continuously assess and enhance its security controls.

Your Rights and Choices Over Your Personal Information

Interac is committed to providing you with meaningful control over your Personal Information. Subject to applicable laws and certain exceptions, you may have the right to:

• Upon request, be informed of the existence, use, and disclosure of your Personal Information and to be given access to such information
• Upon request, have your Personal Information amended if it is inaccurate or incomplete
• Withdraw your consent to the collection, use, or disclosure of your Personal Information, where consent is the legal basis for its processing and subject to legal, contractual, and operational restrictions
• Challenge our compliance with applicable privacy laws

If you are a resident of the Province of Quebec, you may be entitled to additional rights with respect to your Personal Information.

If you wish to exercise any of your rights described above, please contact us as set out in this Privacy Notice. For more information, see section 11 (“How to contact us”).

When We Transfer Your Personal Information

Some of the information you provide to us may be transferred or disclosed to third parties that are located outside of your province of residence and/or Canada. You should be aware that information that is transferred or stored outside Canada may be accessible to courts, law enforcement and national authorities in other jurisdictions. For more information, see section 4 of this Privacy Notice (“Why We Share Your Personal Information”).

Updates to this Privacy Notice

Interac may amend this Privacy Notice periodically to reflect changes in privacy regulations and our practices. We will post a prominent notice of any relevant and material changes to this Privacy Notice when they occur and indicate when this Privacy Notice has been most recently updated. We will obtain consent prior to collecting, using, or disclosing your Personal Information for any new purposes, in accordance with applicable laws.