Protection of Personal Information April 2021 Summary The Protection of Personal Information Policy (“Policy”) applies to Personal Information collected from PWL online resources and communications (such as websites, e-mail, and other online tools) that display a link to this Policy. This Policy does not apply to Personal Information collected from offline resources and communications, except in cases where such Personal Information is consolidated with Personal Information collected by PWL online. This Policy also does not apply to third-party online resources to which the websites of PWL may link, where PWL does not control the content or the privacy practices of such resources. Ten interrelated principles form the basis of the PWL Capital Inc. (“PWL”) Protection of Personal Information Policy. Below is a summary of the principles which highlight our Policy. BY ACCESSING THE WEBSITE YOU AGREE TO BE BOUND BY THE TERMS SET OUT BELOW. Please read this Policy carefully. If we decide to change this Policy, we will post those changes at this site so you always will know what information we gather, how we might use that information, and whether we will disclose it to anyone. Accountability At PWL, accountability for compliance with the privacy principles restswith our Chief Privacy Officer, even though other individuals within PWL may be responsible for the day-to-day collection and processing of Personal Information about you. At PWL, we ensure that our employees and Agents (as defined in the Policy) respect your privacy through corporate policies, guidelines and formal and informal training. Identifying purposes PWL will identify the purposes for which Personal Information about you is collected at or before the time it is collected. PWL collects the Personal Information that is necessary for its business functions or services. Unless required by law, PWL shall not use or disclose, for any new or other purpose, the Personal Information that has been collected without first identifying and documenting the new or other purpose and obtaining your consent. Consent Your knowledge and consent are required for the collection, use or disclosure of Personal Information about you. If you provide Personal Information in forms or data fields on our websites, you consent to the collection, use and disclosure of information about you according to the terms of the Policy. Limiting Collection PWL will limit the collection and use of Personal Information to that which is needed for the identified purposes or to comply with applicable law, and any such information will be obtained only by lawful and fair means. Limiting Use PWL uses Personal Information about you only for the identified purposes for which it was collected or for a related purpose one would reasonably expect. Limiting Disclosure In general PWL does not reveal specific information about an individual’s records or other Personal Information to unaffiliated third parties for their independent use without the individual’s consent except in certain limited circumstances when provided by law or when such third parties act as Agents (as defined in the Policy) of PWL. Limiting Retention Personal Information shall be retained only as long as necessary to fulfill the identified purposes or in accordance with applicable laws or corporate policies. Accuracy PWL will strive to maintain Personal Information accurate, complete and up-to-date. In general, PWL will rely upon you to provide accurate and complete information and to advise PWL if circumstances change over time. Safeguards Personal Information about you shall be protected by security safeguards appropriate to the sensitivity of the information. PWL will take appropriate steps to ensure that Personal Information about you is protected from unauthorized access and disclosure, including limiting access to such information only to those who have a business need to know. Openness Upon your written request, PWL will provide you with information about its policies and practices regarding the collection, use, and disclosure of Personal Information about you. Personal Information about you is mainly located at the offices of PWL in Montreal, Québec. However, Personal Information about you may also be located with the Agents (as defined in the Policy) of PWL so that they can process Personal Information about you to meet the identified purposes or for back-up purposes. Individual Access You are entitled to challenge the accuracy and completeness of the Personal Information and have it amended as appropriate, subject to some exceptions as prescribed by law. Upon your written request, we will inform you of the existence, use and disclosure of Personal Information about you, and you shall be given access to that information. A reply will be provided to you within thirty (30) days after the written request for access or rectification has been received. Challenging Compliance: At PWL, we want you to understand our commitment to privacy. For any request or complaint related to the Policy or Personal Information about you, please contact in writing the Chief Privacy Officer at: Privacy Officer Karine Deslandes Phone: (416) 203-0067 x 299 Fax: (416) 203-0544 E-mail: email@example.com When you contact the Chief Privacy Officer, please note the name of the website or other online resource to which you provided the information, as well as the nature of the information that you provided. Scope This PWL policy describes the minimum requirements for the protection of personal information. Any applicable legislation must be considered in implementing these requirements. This Policy applies to all personal information. Policies and practices may vary, depending upon whether the personal information relates to clients, employees or other individuals. Definitions The following definitions apply in this Policy: “Agent” means any third party that collects, uses or retains Personal Information under the instructions of, and solely for, PWL or to which PWL discloses Personal Information for use on its behalf; ”Collection” the act of gathering, acquiring, or obtaining personal information from any source, including third parties, by any means; ”Consent” voluntary agreement with what is being done or proposed. Consent can be either express or implied; ”Express consent” is given explicitly, either orally or in writing. Express consent is unequivocal and does not require any inference on the part of PWL when seeking consent; ”Implied consent” arises where consent may reasonably be inferred from the action or inaction of the individual; ”Disclosure” making personal information available to others outside PWL; ”Personal information” information about an identifiable individual that is recorded in any form; ”PWL” unless specified otherwise in this text, means « PWL Capital Inc. » or « PWL Advisors Inc. »; and ”Use” refers to the treatment and handling of personal information within PWL. General The ten principles that make up this Policy are interrelated. PWL has adopted this Policy and shall adhere to the ten principles as a whole. Each of the principles is followed by a commentary on the principle. The commentaries are intended to help the readers understand the significance and the implications of the principles. Where there is also a note following a principle, it forms an integral part of the principle. Principles Principle 1 — Accountability PWL is responsible for personal information under its control and has designated a Chief Privacy Officer who is accountable for PWL’s compliance with the following principles. Accountability for PWL’s compliance with the principles rests with a Chief Privacy Officer, even though other individuals within the organization may be responsible for the day-to-day collection and processing of personal information. In addition, other individuals within the organization may be delegated to act on behalf of the Chief Privacy Officer. The identity of the Chief Privacy Officer designated by PWL to oversee its compliance with the principles is posted on PWL’s website (www.pwlcapital.com/xtra/privacy); it shall also be made known upon request. PWL is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. PWL uses contractual or other means to provide a comparable level of protection while the information is being processed by a third party. PWL has implemented policies and practices to give effect to the principles, including: implementing procedures to protect personal information; establishing procedures to receive and respond to complaints and inquiries; training staff and communicating to staff information about the organization’s policies and practices; and developing information to explain the organization’s policies and procedures. Principle 2 — Identifying Purposes The purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected. PWL documents the purposes for which personal information is collected in order to comply with the Openness principle and the Individual Access principle. Identifying the purposes for which personal information is collected at or before the time of collection will allow PWL on a continuing basis to determine the information it needs to collect to fulfill these purposes. The Limiting Collection principle requires PWL to collect only that information necessary for the purposes that have been identified. The identified purposes should be specified at or before the time of collection to the individual from whom the personal information is collected. Depending upon the way in which the information is collected, this can be done orally or in writing or through electronic communications. An application form, for example, may give notice of the purposes. When personal information that has been collected is to be used for a purpose not previously identified, the new purpose shall be identified prior to use. Unless the new purpose is required by law, the consent of the individual is required before information can be used for that purpose. For an elaboration on consent, please refer to the Consent principle. Persons collecting personal information will be able at all times to explain to individuals the purposes for which the information is being collected. This principle is linked closely to the Limiting Collection principle and the Limiting Use, Disclosure, and Retention principle. Principle 3 — Consent The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. In certain circumstances personal information can be collected, used, or disclosed without the knowledge and consent of the individual. For example, legal or security reasons may make it impossible or impractical to seek consent. When information is being collected for the detection and prevention of fraud or for law enforcement, seeking the consent of the individual might defeat the purpose of collecting the information. Seeking consent may be impossible or inappropriate when the individual is a minor, seriously ill, or mentally incapacitated. Consent is required for the collection of personal information and the subsequent use or disclosure of this information. Typically, PWL will seek consent for the use or disclosure of the information at the time of collection. In certain circumstances, consent with respect to use or disclosure may be sought after the information has been collected but before use (for example, when PWL needs to use information for a purpose not previously identified). The principle requires “knowledge and consent”. PWL will make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used. To make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed. PWL may not, as a condition of the supply of a product or service, require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfill the explicitly specified, and legitimate purposes. The form of the consent sought by PWL may vary, depending upon the circumstances and the type of information. In determining the form of consent to use, PWL shall take into account the sensitivity of the information. Although some information is almost always considered to be sensitive, any information can be sensitive, depending on the context. In obtaining consent, the reasonable expectations of the individual are also relevant. Consent shall not be obtained through deception. For example, an individual contacting PWL for information on their services should reasonably expect that PWL, in addition to using the individual’s name and address for mailing purposes, would also contact the person to invite them to various company events. In this case, PWL will assume that the individual’s original consent constitutes consent for such purpose. The way in which PWL seeks consent may vary, depending on the circumstances and the type of information collected. PWL will generally seek express consent when the information is likely to be considered sensitive. Implied consent would generally be appropriate when the information is less sensitive. Consent can also be given by an authorized representative (such as a legal guardian or a person having power of attorney). Individuals can give consent in many ways. For example: an application form may be used to seek consent, collect information, and inform the individual of the use that will be made of the information. By completing and signing the form, the individual is giving consent to the collection and the specified uses; except where transfer of the information is required in order to supply appropriate services to the individual, a checkoff box may be used to allow individuals to request that their names and addresses not be given to other organizations. Individuals who do not check the box are assumed to consent to the transfer of this information to third parties; consent may be given orally when information is collected over the telephone; consent may be given through electronic communications; consent may be given at the time that individuals use a service. An individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Upon receiving a withdrawal notice, PWL will inform the individual of the implications of such withdrawal. Principle 4 — Limiting Collection The collection of personal information shall be limited to that which is necessary for the purposes identified by PWL. Information shall be collected by fair and lawful means. PWL shall not collect personal information indiscriminately. Both the amount and the type of information collected shall be limited to that which is necessary to fulfill the purposes identified. PWL will specify the type of information collected as part of its information-handling policies and practices, in accordance with the Openness principle. This principle is linked closely to the Identifying Purposes principle and the Consent principle. Principle 5 — Limiting Use, Disclosure, and Retention Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual, to a Self Regulatory Organization (SRO), or as required by law. PWL, when using personal information for a new purpose, shall document this purpose. PWL has developed guidelines and implemented procedures with respect to the retention of personal information. These guidelines include minimum and maximum retention periods. Personal information that has been used to make a decision about an individual shall be retained long enough to allow the individual access to the information after the decision has been made. An organization may be subject to legislative requirements with respect to retention periods. Personal information that is no longer required to fulfill the identified purposes will be destroyed, erased, or made anonymous. PWL has developed guidelines and implemented procedures to govern the destruction of personal information. This principle is closely linked to the Consent principle, the Identifying Purposes principle, and the Individual Access principle. Principle 6 — Accuracy Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used. The extent to which personal information shall be accurate, complete, and up-to-date will depend upon the use of the information, taking into account the interests of the individual. The information shall be sufficiently accurate, complete, and up-to-date to minimize the possibility that inappropriate information may be used to make a decision about the individual. PWL will complete routine updating of personal information only when such a process is necessary to fulfill the purposes for which the information was collected. Personal information that is used on an ongoing basis, including information that is disclosed to third parties, should generally be accurate and up-to-date, unless limits to the requirement for accuracy are clearly set out. Principle 7 — Safeguards Personal information is protected by security safeguards appropriate to the sensitivity of the information. The security safeguards shall protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. PWL will protect personal information regardless of the format in which it is held. The nature of the safeguards vary depending on the sensitivity of the information that has been collected, the amount, distribution, and format of the information, and the method of storage. More sensitive information is safeguarded by a higher level of protection. The methods of protection include: physical measures, for example, locked filing cabinets and restricted access to offices; organizational measures, for example, security clearances and limiting access on a “need-to-know” basis; and technological measures, for example, firewalls, the use of passwords, etc. PWL commits to make its employees aware of the importance of maintaining the confidentiality of personal information. Care is used in the disposal or destruction of personal information, to prevent unauthorized parties from gaining access to the information. Principle 8 — Openness PWL shall make readily available to individuals specific information about its policies and practices relating to the management of personal information. PWL is open about its policies and practices with respect to the management of personal information. Individuals can acquire information about PWL’s policies and practices simply by consulting its web site (www.pwlcapital.com/privacy) or speaking to any member of its organization. The information made available includes: the name, title and address of the person who is accountable for the PWL’s policies and practices and to whom complaints or inquiries can be forwarded; the means of gaining access to personal information held by PWL; a description of the type of personal information held by PWL, including a general account of its use; and what personal information is made available to related parties (eg, Head or Branch office; carrying broker). PWL makes information on its policies and practices available in a variety of ways. For example, PWL makes paper copies available in its place of business on appointment; according to the inquirer’s choice, information may be mailed; online access is also provided (www.pwlcapital.com); and finally, its toll-free telephone number may be used to request the information (1-800-875-7566). Principle 9 — Individual Access Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Note: In certain situations, PWL may not be able to provide access to all the personal information it holds about an individual. Exceptions to the access requirement are limited and specific. The reasons for denying access will be provided to the individual upon request. Exceptions may include information that contains references to other individuals, information that cannot be disclosed for legal, security, or commercial proprietary reasons, information that is prohibitively costly to provide and information that is subject to solicitor-client or litigation privilege. Upon request, PWL shall inform an individual whether or not it holds personal information about the individual. PWL will indicate the source of this information as long as that is documented. PWL shall allow the individual access to this information. In addition, PWL will provide an account of the use that has been made or is being made of this information and an account of the third parties to which it has been disclosed. An individual may be required to provide sufficient information to permit PWL to provide an account of the existence, use, and disclosure of personal information. The information provided shall only be used for this purpose. In providing an account of third parties to which it has disclosed personal information about an individual, PWL will attempt to be as specific as possible. When it is not possible to provide a list of the third parties to which it has actually disclosed information about an individual, PWL will provide a list of organizations to which it may have disclosed information about the individual. PWL will respond to an individual’s request within a reasonable time and at minimal or no cost to the individual. The requested information shall be provided or made available in a form that is generally understandable. For example, if PWL uses abbreviations or policys to record information, an explanation shall be provided. When an individual successfully demonstrates the inaccuracy or incompleteness of personal information, PWL shall amend the information as required. Depending upon the nature of the information challenged, amendment involves the correction, deletion, or addition of information. Where appropriate, the amended information shall be transmitted to third parties having access to the information in question. When a challenge is not resolved to the satisfaction of the individual, the substance of the unresolved challenge should be recorded by the organization. When appropriate, the existence of the unresolved challenge should be transmitted to third parties having access to the information in question. Principle 10 — Challenging Compliance The Chief Privacy Officer appointed by PWL can be reached by telephone, by facsimile and by email. PWL has put procedures in place to receive and respond to complaints or inquiries about its policies and practices relating to the handling of personal information. The complaint process is easily accessible and simple to use. PWL will inform individuals who make inquiries or lodge complaints of the existence of relevant complaint mechanisms. PWL will investigate all complaints. If a complaint is found to be justified through either the internal or external complaint review process, PWL shall take appropriate measures, including, if necessary, amending its policies and practices.