Privacy Policy

This Policy applies to personal information collected through the Enlisted.ca platform, website, and related services (the "Platform") about:

• Executive Users — executives and officers of TSX, TSXV, CSE, and Cboe Canada listed companies; and
• Provider Users — employees, principals, and representatives of service provider firms.

This Policy does not apply to information about corporate entities (which is not personal information) or to third-party websites linked from the Platform.

2.1 Information You Provide Directly

• Account registration: name, email address, password (hashed), job title, company name, exchange listing, stock ticker, sector, fiscal year end;
• Profile information: professional biography, photo, phone number, LinkedIn or website URL, team member details (Provider Users);
• Payment information: billing address and payment card details — collected and stored by Stripe, Inc. on our behalf; we do not store full card numbers;
• Communications: content of RFQs, messages, support requests, and feedback submitted through the Platform; and
• Newsletter and marketing: email address and preferences if you subscribe.

2.2 Information Collected Automatically

• Usage data: pages viewed, features accessed, search queries, time spent, click-through data, and referring URLs;
• Device and log data: IP address, browser type and version, operating system, device identifiers, and error logs; and
• Cookies and similar technologies: as described in Section 8 below.

2.3 Information from Third Parties

• Publicly available information from SEDAR+, exchange websites, and corporate registries to verify executive eligibility and company listings; and
• Payment transaction data from Stripe, Inc.

We use personal information only for the purposes for which it was collected or to which you have consented, including:

• Account management: creating and maintaining your account, verifying eligibility, and authenticating access;
• Platform operation: displaying your profile, enabling directory searches, facilitating RFQs, generating compliance calendars, and delivering AI assistant responses;
• Billing: processing subscription payments, issuing invoices, and managing billing disputes;
• Communications: sending transactional emails (account confirmations, password resets, billing receipts, RFQ notifications), service updates, and, where you have consented, marketing communications;
• Analytics and improvement: understanding how the Platform is used, identifying bugs, and improving features — using aggregated or de-identified data where possible;
• Legal compliance: complying with applicable laws, responding to lawful requests from public authorities, and enforcing our Terms of Service; and
• Safety and security: detecting, investigating, and preventing fraudulent, abusive, or unlawful activity.

We rely on the following legal bases to collect and use personal information:

• Contractual necessity: processing required to perform the agreement with you (account management, Platform delivery, billing);
• Consent: marketing emails, optional profile fields, and cookies requiring consent — which you may withdraw at any time;
• Legitimate interests: analytics, security, fraud prevention, and product improvement, where our interests are not overridden by your privacy rights; and
• Legal obligation: complying with applicable laws and lawful orders.

We do not sell personal information. We may share personal information in the following circumstances:

5.1 With Other Users. When an Executive User sends an RFQ to a Provider User, we share the executive's name, company, and contact information solely to enable the provider to respond. Provider profiles — including contact details for Connected and Featured plans — are displayed to verified Executive Users as part of the directory.

5.2 With Service Providers. We engage trusted third-party processors under written data processing agreements, including:

• Supabase, Inc. — database, authentication, and infrastructure (servers in the United States);
• Stripe, Inc. — payment processing (United States);
• Resend, Inc. — transactional email delivery (United States);
• Anthropic, PBC — AI language model processing for the AI Assistant feature (United States); and
• Vercel, Inc. — web hosting and content delivery (United States).

5.3 Legal Requirements. We may disclose personal information if required by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Enlisted, our users, or the public.

5.4 Business Transfers. In the event of a merger, acquisition, financing, or sale of all or substantially all of our assets, personal information may be transferred as part of the transaction. We will notify affected users before personal information is transferred and becomes subject to a different privacy policy.

Our service providers are primarily located in the United States. By using the Platform, you acknowledge that your personal information may be transferred to and processed in the United States and other countries whose privacy laws may differ from Canadian law.

We take steps to ensure that transfers are protected by appropriate safeguards, including contractual clauses requiring recipients to protect personal information to a standard comparable to PIPEDA.

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, including:

• Active accounts: for the duration of the account;
• Closed accounts: up to 3 years after closure, to resolve disputes, enforce agreements, and comply with legal obligations;
• Billing records: 7 years from the transaction date, as required by Canadian tax law; and
• Marketing consent records: for the period of consent and 3 years thereafter, as required by CASL.

When personal information is no longer required, we securely delete or anonymise it.

We use the following categories of cookies and similar technologies:

• Strictly necessary cookies: required for authentication, security, and session management. These cannot be disabled without impairing Platform functionality.
• Analytics cookies: used to understand how users interact with the Platform (e.g., pages visited, features used). We use aggregated, anonymised analytics.
• Preference cookies: used to remember your settings (e.g., language, display preferences).

You may control non-essential cookies through your browser settings. Note that disabling certain cookies may affect Platform functionality. We do not use advertising or cross-site tracking cookies.

We send commercial electronic messages only with your express or implied consent as defined under CASL. Specifically:

• Transactional messages (account confirmations, billing receipts, password resets, RFQ notifications) do not require separate consent as they are necessary to deliver the Platform;
• Marketing messages (newsletters, product updates, promotional offers) are sent only with your express consent, which you may withdraw at any time by clicking "Unsubscribe" in any email or contacting us at privacy@enlisted.ca.

We maintain records of consent as required by CASL.

We implement administrative, technical, and physical safeguards to protect personal information against unauthorised access, disclosure, alteration, and destruction, including:

• TLS encryption for data in transit;
• AES-256 encryption for data at rest (via Supabase);
• Row-level security policies on all database tables;
• Access controls limiting employee and contractor access to personal information on a need-to-know basis; and
• Regular security reviews.

No method of transmission over the Internet or electronic storage is completely secure. In the event of a privacy breach that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA.

Subject to applicable law, you have the right to:

• Access: request a copy of the personal information we hold about you;
• Correction: request correction of inaccurate or incomplete personal information;
• Withdrawal of consent: withdraw consent for processing based on consent (which may affect your ability to use certain features);
• Deletion: request deletion of your personal information, subject to our legal obligations to retain certain records; and
• Complaint: lodge a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

To exercise these rights, please contact our Privacy Officer at privacy@enlisted.ca. We will respond within 30 days. We may need to verify your identity before processing certain requests.

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us at privacy@enlisted.ca and we will promptly delete it.

The Platform may contain links to third-party websites. This Policy does not apply to those websites. We encourage you to review the privacy policies of any third-party sites you visit. Enlisted is not responsible for the privacy practices of third parties.

We may update this Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting the updated Policy on the Platform and, where required, by email. The date of the most recent update appears at the top of this Policy. Your continued use of the Platform after any update constitutes acceptance of the revised Policy.

Questions, requests, or complaints regarding this Policy or our privacy practices should be directed to our Privacy Officer: