Privacy Statement At Duo Bank of Canada (the “Bank”, “we”, “us” or “our”), we are committed to protecting the privacy and security of any of your personal information obtained by reason of your customer relationship with us. Our Privacy Statement explains the types of personal information we collect, how it is used, and the steps we take to ensure that it is handled appropriately. Personal information is information about an identifiable individual, as more particularly described under applicable privacy legislation. Our policies and practices have been put in place to comply with the federal Personal Information Protection and Electronic Documents Act and any applicable provincial privacy legislation. This statement applies to our collection, use and disclosure of personal information in Canada. This statement does not apply to information about our employees or to information that is not personal information. Personal Information We Collect The Bank and its agents and representatives collect personal information in a number of circumstances in the course of providing credit card and other financial services. We collect personal information primarily from you, for instance through credit card and other account applications and supporting information and documentation you provide. In connection with our account opening process, we may collect personal information from references, employers and other financial institutions you have identified in your application as well as credit bureaus and other third party sources. Personal information we collect may include: name, address, telephone number, cell phone, email, and other contact information; additional identity matching and credit check information, such as your occupation, name of your employer, rent or mortgage details, assets, income, previous address, Social Insurance Number, date of birth or government issued identification document details; information about your credit card or financial account(s), such as your current and historical account information, balance and indebtedness, account transaction history and similar information, and records relating to the handling of any inquiries or complaints you make; payment-related and bank account information; the types of products and services that you purchase from our partner retail stores and online; how often and under what circumstances you make purchases using your credit card; and such other information we may collect with your consent or as permitted or required by law. Use of Personal Information The Bank may use your personal information, both personal information that we collect directly, as well as and combined with, personal information that is collected by our partners and service providers, for a variety of purposes, including: to verify your identity and the accuracy and completeness of other information you provide to the Bank; to evaluate your application, and to assess your eligibility, for requested products and services offered by the Bank; to open, administer and service your account and to provide and administer any requested products or services; to provide you with replacement credit cards, from time to time, at our discretion; to detect and prevent fraud and unauthorized or illegal activities; for the collection or payment of a debt owed to the Bank or affiliates of the Bank; to correct errors or omissions in your personal information; to understand and assess your ongoing creditworthiness, behavioural characteristics and financial and other requirements and to determine your eligibility or suitability for products or services offered by the Bank, affiliates of the Bank, our partners or other selected third parties; to understand and assess your behavioural characteristics (including your browsing history on partner websites, information of which is collected automatically, such as via cookies); unless you have opted out, to provide you with information about products or services offered by the Bank, affiliates of the Bank, our partners or other selected third parties, which may be offered by way of relevant/targeted advertising, as described in more detail in the “Additional Marketing Purposes” section below; to maintain business records for reasonable periods to meet legal and regulatory records retention requirements, and generally manage and administer the Bank’s business; to share your Personal Information with affiliates of the Bank, our partners and service providers for administrative and marketing purposes including relevant/targeted advertising; for obtaining services from agents, professionals, insurers, or service providers; to monitor and/or record mail, telephone, email and internet communications between you and the Bank, or you and our representatives or service providers; to measure the quality of customer service; to extend contest offers or for the administration of contest you may have entered into or were automatically qualified for; to analyze business results, compile statistics and conduct marketing research and modeling, and to contact you for related surveys; to comply with applicable tax, legal, security or regulatory requirements; in connection with certain business transactions involving the assets or business of the Bank (and portions thereof), as further described in the “Disclosure of Personal Information” section below; or for any other purpose to which you consent or that is permitted or required by privacy law or any other applicable law. Disclosure of Your Personal Information The Bank may disclose your personal information in a number of circumstances, including: to credit bureaus, credit reporting agencies and to your current or future creditors for the purpose of maintaining your credit history and providing credit references; to financial institutions for payment processing purposes; to third parties as reasonably necessary: to enforce your contracts with us and otherwise for the collection or payment of a debt owed to the Bank or affiliates of the Bank; for the purposes of detecting and preventing fraud; in connection with audits; for the purposes of meeting legal, regulatory, industry self-regulatory, risk management and security requirements; unless you have opted out, to affiliates of the Bank, our partners or other selected third parties to enable them to offer you additional products and services, as described in more detail in the “Additional Marketing Purposes” section below; or for any other purpose to which you consent or that is permitted or required by privacy law or any other applicable law. Service Providers. The Bank may transfer personal information to outside agents or service providers (including affiliates of the Bank acting in this capacity, and service providers of such affiliates) that perform services on our behalf or on our affiliates’ behalf, for example card production, statement preparation, mailing, customer service, marketing (including relevant/targeted advertising), risk assessments, strategic business advice, collections, information technology and/or data hosting or processing services or similar services, or otherwise to collect, use, disclose, store or process personal information on our behalf for the purposes described in this Privacy Statement. Some of these service providers or affiliates may be located outside of Canada, including in the United States, and your personal information may be collected, used, disclosed, stored and processed in the United States or elsewhere outside of Canada for the purposes described in this Privacy Statement. Reasonable contractual or other measures we may take to protect your personal information while processed or handled by these service providers are subject to legal requirements in Canada, the United States and other foreign countries applicable to our affiliates, agents and service providers, for example lawful requirements to disclose personal information to government authorities in those countries. Business Transactions. Personal information may be used by the Bank and disclosed to parties connected with the proposed or actual financing, securitization, insuring, sale, assignment or other disposal of all or part of the Bank or our business or assets, for the purposes of evaluating and/or performing the proposed transaction. These purposes may include, as examples: permitting those parties to determine whether to proceed or continue with the transaction fulfilling reporting, inspection or audit requirements or obligations to those parties Assignees or successors of the Bank or portions of our business or assets may use and disclose your personal information for similar purposes as those described in this Privacy Statement. Legal, Regulatory, etc. The Bank may disclose your personal information as necessary to meet legal, regulatory, industry self-regulatory, insurance, audit, and security requirements, and as otherwise with your consent or as permitted or required by law (including as required by applicable Canadian and foreign laws applicable to us or our agents and service providers, and including lawful requirements to disclose personal information to government authorities in those countries). Additional Marketing Purposes Unless you have opted-out, in addition to the above uses and disclosures, we may consult and use your personal information (such as your contact information, gender, information about your income, assets, expenses, the transactions on your account and your payment and purchase details), including personal information that we have collected from our partners (such as the types of products that you purchase in their retail stores and online and your browsing history on their websites, information of which is collected automatically, such as via cookies), from time to time, in order to determine your suitability for and occasionally offer you additional products or services of the Bank, our partners and/or those of our affiliates that may be relevant or of interest to you. We may also disclose the above types of information to our affiliates, our partners or other selected third party partners for their use for similar purposes and to send you relevant/targeted information about their products and services. If you no longer want your personal information used or disclosed for these purposes, you may contact us at any time by mail or by phone at the address or telephone number provided in the “Access, Correction and Contacting Us” section below. Aggregate Information We may perform statistical analysis and modeling using the personal information that we collect in aggregated form, in order to better understand the behaviour and characteristics of our customers and to assess and improve our product and service offerings and business strategies, as well as those of our affiliates and partners. Your Consent Consent to the collection, use and disclosure of personal information may be given in various ways. Consent can be express (for example, orally, electronically or on a form you may sign describing the intended uses and disclosures of personal information) or implied (for example, when you provide information necessary for a service you have requested). You may provide your consent in some circumstances where notice has been provided to you about our intentions with respect to your personal information and you have not withdrawn your consent for an identified purpose, such as by using an opt out option provided, if any. Consent may be given by your authorized representative (such as a legal guardian or a person having a power of attorney). Generally, by providing us with personal information, we will assume that you consent to our collection, use and disclosure of such information for the purposes identified or described in this Privacy Statement, if applicable, or otherwise at the time of collection. You may withdraw your consent to our collection, use and disclosure of personal information at any time, subject to contractual and legal restrictions and reasonable notice. Note that if you withdraw your consent to certain uses of your personal information, we may no longer be able to provide certain of our products or services. Note also that where we have provided or are providing services to you, your consent will be valid for so long as necessary to fulfil the purposes described in this Privacy Statement or otherwise at the time of collection, and you may not be permitted to withdraw consent to certain necessary uses and disclosures (for example, but not limited to, maintaining reasonable business and transaction records, disclosures to Canadian and foreign government entities as required to comply with laws, and reporting on credit information after credit has been granted, if applicable). The Bank collects, uses and discloses your personal information with your consent, except as permitted or required by law. We may be required or permitted under statute or regulation to collect, use or disclose personal information without your consent, for example to comply with a court order, to comply with local or federal regulations or a legally permitted inquiry by a government agency, or to collect a debt owed to us. Security We take the security of your personal information very seriously. We take steps to protect your personal information using physical, electronic or procedural security measures appropriate to the sensitivity of the personal information we have in our custody or control. These steps include safeguards to protect against loss or theft, as well as unauthorized access, disclosure, copying, use or modification of your personal information. Only Bank authorized associates, agents and service providers who require access to your personal information in order to fulfil their job requirements will have access to your personal information. Protecting Your Personal Information You can protect yourself against identity theft and fraud by taking some simple steps to protect your personal information and to ensure that it remains confidential: Protect your PIN and passwords: You must keep your personal identification number (PIN), passwords and personal verification answers secret. Only you should know them. Use your hand or body to prevent anyone from seeing you enter your PIN at point-of-sale terminals, bank machines or when using telephone banking in a public area. Never disclose any PIN, password or verification answer to anyone, including anyone claiming to be from the Bank. Keep track of your account: Check your account statement every month to ensure that there are no unauthorized transactions. If you have online access to your account, check it frequently for unauthorized activities. Keep your contact information up to date: Make sure that we have your most current address, telephone numbers and email address so that communications to you are not misdirected or lost. Keep your personal information confidential: Identity theft occurs when criminals obtain information about you that allows them to build a profile. Ensure that documents that contain information about you are shredded or otherwise securely disposed of. Don’t disclose your personal information over the telephone or online unless you know and trust the recipient. Be careful online: Personal information that you provide online can be accessed by other users of that computer or through insecure communications. Always clear the cache and internet history of computers that might be used by others. Use a secure firewall to protect your computer, especially when connecting wirelessly, and install software to protect against viruses, spyware and other methods used by online criminals to try to access your personal information. Contact us: If you have any concerns about the security of your personal information or your account with the Bank, if you have received a suspicious communication seeking information about you, or if you think you have been the victim of fraud or attempted fraud involving your account with the Bank, contact us immediately at the contact information provided below. Access, Correction and Contacting Us If you wish to request access or correction of your personal information in our custody or control or if you wish to make an inquiry, complaint or have other concerns about our personal information practices, you may write to us at P.O. Box 217, Orangeville, ON, L9W 2Z6, attention Duo Bank of Canada – Privacy Officer or send an email to Privacy@duobank.com. Your right to access or correct your personal information is subject to applicable legal restrictions. We may take reasonable steps to verify your identity before granting access or making corrections. Privacy Statement Changes This Privacy Statement may be revised from time to time. If we intend to use or disclose Personal Information for purposes materially different than those described in this statement, we will make reasonable efforts to notify affected individuals, if necessary, including by revising this Privacy Statement. If you are concerned about how your personal information is used, you should contact us as described above or checking at our website periodically at www.duobank.com to obtain a current copy of this statement. We urge you to request and review this Privacy Statement frequently to obtain the current version. Your continued provision of Personal Information or use of our services following any changes to this Privacy Statement constitutes your acceptance of any such changes. This Privacy Statement is effective as of April 15th 2019. 33 Yonge Street, Suite 810 Toronto, Ontario Canada M5E 1G4 More ways to contact us Duo Bank of Canada is a member of Canada Deposit Insurance Corporation (CDIC) Legal & Regulatory Privacy Statement Contact Us