forwardBrokers, operating as forwardBrokers ("[forwardBrokers]," "we," "us," or "our"), respects your privacy and is committed to protecting personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable privacy laws, including Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and the Personal Information Protection Acts of Alberta and British Columbia, where applicable.

This Privacy Policy explains what personal information we collect, how we use and disclose it, how we protect it, and the choices and rights available to you.

1. Scope and Our Two Roles

This Policy applies to personal information we handle in two distinct capacities:

1.1 As an organization (we are accountable). When we collect information about visitors to our Website, prospective and current clients, and their representatives, we determine the purposes and are accountable for that information.

1.2 As a service provider (our clients are accountable). When our clients (mortgage and real estate professionals) use our Services, we process personal information about their customers, leads, and applicants ("End User information") on their behalf and under their instructions. In that capacity, our client is the accountable organization, and this Policy describes our practices as their service provider. If you are an End User, please also review the privacy policy of the business you are dealing with, and direct requests about that information to them.

2. What Personal Information We Collect

Depending on your relationship with us, we may collect:

2.1 Information you provide directly:

• identity and contact details (name, business name, email, phone, mailing address);

• account and billing information (and, for payments, information processed by our payment provider);

• communications you send us (inquiries, support requests, feedback);

• information submitted through forms, demos, or onboarding.

2.2 Information collected automatically on our Website:

• device and usage data (IP address, browser type, operating system, pages viewed, referring URLs, timestamps);

• cookies and similar technologies (see our Cookie Policy).

2.3 End User information processed on behalf of clients: Depending on the client's configuration, this may include an End User's name, contact details, messages and communications, scheduling information, and documents or data the End User submits through a client's workflow (which, in a mortgage or real estate context, may include sensitive financial information such as identification, income, banking, or transaction details).

We collect only the personal information reasonably necessary for the purposes described below.

3. How We Collect Personal Information

We collect personal information: (a) directly from you; (b) automatically through your use of the Website; (c) from our clients and their systems (for End User information); and (d) from Third-Party Services and integrations authorized by you or our clients (for example, CRMs, messaging, calendar, and analytics providers).

4. Purposes for Which We Use Personal Information

We use personal information to:

• provide, operate, maintain, secure, and improve our Website and Services;

• set up, configure, and support client accounts and integrations;

• process payments and manage billing;

• respond to inquiries and provide customer support;

• communicate with you about the Services, including service and administrative messages;

• with your consent where required, send marketing communications (you may opt out at any time);

• monitor, analyze, and improve usage, performance, and security;

• detect, prevent, and address fraud, abuse, and security incidents; and

• comply with legal and regulatory obligations.

For End User information, we use it solely to provide the Services to our client and as instructed by that client.

5. Consent

We collect, use, and disclose personal information with your knowledge and consent, except where permitted or required by law. Consent may be express or implied depending on the sensitivity of the information and the circumstances. By providing personal information to us, you consent to its handling as described in this Policy.

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting our Privacy Officer. Withdrawing consent may limit or prevent our ability to provide certain Services. For End User information, consent is obtained and managed by our client.

6. Disclosure of Personal Information

We do not sell personal information. We may disclose personal information to:

6.1 Service providers and sub-processors who perform functions on our behalf — including hosting and infrastructure, artificial-intelligence providers, messaging and communications providers, scheduling tools, analytics, and payment processing — under contractual obligations to protect the information and use it only for the purposes we specify.

6.2 Our clients, with respect to End User information we process for them.

6.3 Professional advisors (such as lawyers, accountants, and auditors) as needed.

6.4 Parties to a business transaction, such as a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

6.5 Authorities and others where required or permitted by law, including to comply with a legal process, enforce our agreements, or protect the rights, safety, and property of forwardBrokers, our clients, or others.

7. Service Providers and Cross-Border Transfers

Some of our service providers and sub-processors store or process personal information outside of Canada, including in the United States and other jurisdictions. While personal information is located in a foreign jurisdiction, it may be subject to the laws of that jurisdiction, including lawful access by courts, law enforcement, and national-security authorities. We use contractual and other measures intended to provide a comparable level of protection while the information is being processed by a service provider. By using our Website and Services, you acknowledge that your personal information may be transferred to and processed in jurisdictions outside your province or country of residence. You may contact our Privacy Officer for more information about our transfer practices.

8. Safeguards and Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against loss, theft, and unauthorized access, disclosure, copying, use, or modification, appropriate to its sensitivity. These measures may include encryption in transit, access controls, role-based permissions, logical separation of sensitive data, monitoring, and contractual protections with service providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Retention

We retain personal information only as long as reasonably necessary to fulfil the purposes for which it was collected, to provide the Services, and to comply with legal, accounting, or reporting requirements. When personal information is no longer required, we will securely destroy, erase, or de-identify it. For End User information, retention is determined by our client's instructions and applicable law.

10. Your Privacy Rights

Subject to applicable law and verification of your identity, you may:

• Access the personal information we hold about you and obtain information about how it has been used and to whom it has been disclosed;

• Correct inaccurate or incomplete personal information;

• Withdraw consent to certain uses or disclosures (subject to limitations);

• Opt out of marketing communications at any time; and

• Make a complaint about our handling of your personal information.

Residents of Quebec may have additional rights under Law 25, including the right to data portability (to receive computerized personal information in a structured, commonly used technological format) and the right to request de-indexing or cease-dissemination in certain circumstances.

To exercise any right, contact our Privacy Officer (Section 14). We will respond within the timeframes required by applicable law. If we cannot fulfil a request, we will explain why, subject to legal restrictions. For End User information, please direct your request to the relevant client; we will assist that client as their service provider.

11. Automated Processing and Artificial Intelligence

Our Services use automation and artificial intelligence to assist with tasks such as responding to inquiries, organizing information, and collecting documents. Where personal information is used to render a decision based exclusively on automated processing, applicable law (including Law 25) may give affected individuals the right to be informed and to request human review. Our clients are responsible for determining how automation is used in their workflows and for providing any required notices to, and honouring any rights of, their End Users. We do not use AI to make legal, financial, or eligibility decisions about individuals on our own behalf.

12. Cookies and Tracking

Our Website uses cookies and similar technologies as described in our Cookie Policy, which forms part of this Privacy Policy. You can manage your preferences as described there.

13. Children's Privacy

Our Website and Services are intended for businesses and are not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us so we can take appropriate steps.

14. Complaints and Escalation

If you are not satisfied with our response to a privacy concern, you may escalate your complaint to the applicable regulator:

• Office of the Privacy Commissioner of Canada (OPC) — priv.gc.ca

• Commission d'accès à l'information du Québec (CAI) — for Quebec residents — cai.gouv.qc.ca

• The Information and Privacy Commissioner of your province, where applicable.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The "Last updated" date indicates the current version, and material changes may be highlighted on our Website. Your continued use of the Website or Services after changes take effect constitutes acceptance of the updated Policy.