This Privacy Policy ("Privacy Policy") describes and summarizes the policies and procedures of Salt Edge Inc. ("Salt Edge", "we", "our", "us") with respect to the collection, use, storing, processing, disclosure, sharing and protection of personal data provided or acquired through use of (I) our website located at www.saltedge.com and all related subdomains, including the Salt Edge blog and bulletin board (collectively, the "Website"), and (II) the functionality enabling access to financial account for the purpose of retrieving financial account data and receiving related data enrichment services or initiating payment transactions through the Developer Application (as defined below), delivered via application programming interfaces (including without limitation the Spectre API), software development kits, and any other services, content, tools and features as made available by Salt Edge from time to time (collectively, the "Aggregation Services"), whether the Website or Aggregation Services are accessed via a computer, mobile device, or other technology or means.

Salt Edge takes the privacy of individuals very seriously. We are committed to maintaining the security, confidentiality and integrity of the personal data in our custody or control, and protecting such data in accordance with the applicable legislation. Salt Edge regularly reevaluates its privacy and security practices and adapts them as necessary to deal with new regulatory requirements, changes in legislation and/or security standards.

For the purposes of this Privacy Policy, in addition to the capitalized terms defined elsewhere in this Privacy Policy, the following terms shall have the meanings ascribed to them as follows:

"Consent" of User means any freely given, specific, informed and unambiguous indication of the User's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of Personal Data relating to him or her.

"Controller", "Processing", "Processor", "Supervisory Authority" as used in this Privacy Policy shall have the meanings given to such terms in the GDPR.

"Data Protection Laws" means, as applicable, the GDPR, PIPEDA or any similar or equivalent law, regulation, statute, legislation, directive or ruling, of any government, legislature, parliament, regulatory authority, agency or commission having or purporting to have jurisdiction on behalf of any nation, or province or state or other subdivision thereof, in force from time to time in User's jurisdiction with respect to the privacy, protection, processing, collection, use or disclosure of Personal Data.

"Developer Application" means web, desktop and/or mobile application made available by or on behalf of Developer that is used or intended to be used by Indirect User for the purpose of interacting with the Aggregation Services.

"Developer" means the third-party owner or provider of the Developer Application.

"Financial Account" means a financial account that can be accessed online held in User's name by the Financial Institution.

"Financial Institution" means a legal entity engaged in the business of dealing with financial transactions, including without limitation banks, building societies, credit institutions, payment system providers, loan companies, mortgage companies, investment companies, utilities/bills providers and other financial service providers located worldwide.

"GDPR" means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC.

"Personal Data" means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Personal Data includes without limitation Registration Information, Financial Account Data and Financial Account Credentials, but excludes publicly available business information.

"PIPEDA" means the Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5) of Canada.

"Special Categories of Personal Data" means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and genetic data, biometric data, data concerning health or data concerning a natural person's sex life or sexual orientation.

Salt Edge recommends that Users read this Privacy Policy carefully and entirely to ensure that Users are aware of all the practices and policies of Salt Edge in respect of Personal Data collection, use, disclosure, processing and protection. This Privacy Policy applies to:

1 to 5 collectively reffered to as “Users”

By accessing and using the Website and/or Aggregation Services (together, "Services") User hereby: (I) acknowledges and confirms that User is at least eighteen (18) years old, or of the legal age of majority in the jurisdiction in which User resides; and (II) consents to the collection, use, and processing of his/her Personal Data as described in this Privacy Policy. Except as set forth in this Privacy Policy, Salt Edge will not use User's Personal Data for any other purpose without User's Consent. Salt Edge will only disclose User's Personal Data to third parties strictly for the purposes described in this Privacy Policy. Salt Edge does not, and will not, sell, lease, license or rent User's Personal Data to any third party, nor does Salt Edge use the collected Personal Data for advertising or marketing purposes.

When User uses the Services Salt Edge will collect information, including Personal Data, for the purpose of providing, maintaining and improving the Services, as well as complying with applicable laws or regulations. Salt Edge collects Personal Data primarily in four (4) ways:

Protecting the privacy of young children is especially important to Salt Edge. The Services are not directed to children under the age of eighteen (18) years and Salt Edge does not knowingly solicit, collect or process Personal Data from persons under eighteen (18) years of age. If Salt Edge becomes aware of the fact that Personal Data of persons less than eighteen (18) years of age has been collected via the Services, Salt Edge will take the appropriate steps to delete such information without undue delay.

By using the Services and submitting any Personal Data to Salt Edge, User acknowledges and agrees that their Personal Data may be processed in and transferred to jurisdiction(s) other than User's country of residence which may have different Data Protection Laws than those in User's country. Personal Data may be accessed by authorized staff from Salt Edge offices in Canada, United Kingdom and Moldova for the purposes of troubleshooting and debugging. The Personal Data of any User residing in the EU/EEA will only be stored in EU and will only be transferred outside EU as set forth in the GDPR. Salt Edge will take all steps reasonably necessary to ensure that Personal Data is at all times treated securely and in accordance with this Privacy Policy.

Salt Edge will only transfer and/or disclose Personal Data as specified in this Privacy Policy unless User gives Consent to the disclosure and/or transfer to any other third party.

In all the foregoing cases, Salt Edge will disclose Personal Data only to the extent required or permitted by the applicable Data Protection Laws.

In providing the Services to Visitors, Subscribers, Direct Users and Account Users, Salt Edge acts as Controller of Personal Data collected from such Users. In the case of Indirect Users, Salt Edge acts as a Processor and the respective Developer acts as Controller of collected Personal Data. In performing its obligations as Processor Salt Edge will at all times act on Controller's behalf and according to Controller's lawful instructions.

Furthermore, Salt Edge adheres to the following general principles with respect to Personal Data processing:

In the case of Users from the European Union (EU) and European Economic Area (EEA), Salt Edge's legal basis for processing the Personal Data collected as described in this Privacy Policy will depend on the type of Personal Data and the circumstances under which it is collected. Salt Edge will collect and process Personal Data in its capacity as Controller based on the following legal bases:

If there is another legal basis for Salt Edge to collect and process Personal Data in its capacity as Controller, Salt Edge will provide the required notification to User at or before the time the Personal Data is collected.

If User voluntarily provides Personal Data to Salt Edge when contacting Salt Edge with respect to the Services, such User will be deemed to have given Consent to the collection, use and processing of Personal Data by Salt Edge as reasonably necessary to carry out the specific purpose(s) for which User has provided the Personal Data. Salt Edge will rely on such implied Consent as if it were given to Salt Edge under normal circumstances.

Salt Edge does not solicit from Users, nor does it knowingly collect or process, any Special Categories of Personal Data. Users are requested at all times to refrain from voluntarily providing any Special Categories of Personal Data to Salt Edge.

Salt Edge is committed to controlling unsolicited commercial e-mail, or "spam". In this respect, Salt Edge includes an "unsubscribe" or "opt-out" link in any informational emails sent to Users. Users wishing to opt-out of receiving such informational emails may do so at any time by following the instructions included in such emails. Salt Edge will not sell, lease or rent its e-mail Subscribers lists to any third party, nor will Salt Edge use the collected email addresses for purposes other than that for which they were initially collected. User can't opt-out of receiving emails that Salt Edge is required by law to provide to User in connection with the Services, such as system notification emails, notification on changes or updates to this Privacy Policy or the General Terms of Service, or other important mandatory notifications relating to User's access to and use of the Services.

The Services may include links to, or otherwise direct User's attention towards, websites operated by third parties and not by Salt Edge. Such links are provided solely for User's convenience and informational purposes. The inclusion of any link does not imply an association, support, endorsement, consent, examination, or approval by Salt Edge of such third party and third-party website (including without limitation any content on such website). Salt Edge shall not be liable for the information and content contained in any third-party website or for User's use of or incapacity to use such website. Access to any third-party website is at User's own risk, and User must be aware of the fact that linked websites have terms and privacy policies different from those of Salt Edge and Salt Edge does not control them. If User elects to use any third-party website and/or provide any Personal Data when using such website, User is solely responsible for evaluating the terms and privacy policy that apply. Salt Edge will have no liability for any loss or damage that User may incur through providing any Personal Data on such third-party websites.

Any Personal Data collected from Direct Users in connection with their participation in the Banks Integration Program (governed by the terms set forth in the General Terms of Service) will be treated in accordance with this Privacy Policy and will be used solely to provide the relevant Services for which it was collected. Direct User can cancel their participation in the Banks Integration Program at any time by contacting Salt Edge or deleting their account in Salt Edge's systems created in connection with the provided Aggregation Services. Upon withdrawal from the Banks Integration Program all Personal Data collected and processed in connection therein will be deleted in accordance with this Privacy Policy (see further Section 15 "Data Deletion and Retention").

Taking into account the nature of the processing, Salt Edge will respond (or, when acting as Processor, provide reasonable assistance to Developer for the fulfilment of Developer's obligation to respond) to requests for exercising User's rights under GDPR as set forth below:

User may exercise any of the foregoing rights at any time by contacting Salt Edge at privacy@saltedge.com. Where Users' requests for exercising their rights under GDPR are manifestly unfounded or excessive, in particular because of their repetitive character, or further copies of the Personal Data undergoing processing are requested, Salt Edge may charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested.

Salt Edge will retain Personal Data for no longer than strictly necessary for the purposes for which such Personal Data is collected and processed. The retention period depends on the requirements of the applicable laws or regulations Salt Edge must comply with, the purposes of the collection and processing of Personal Data, and the legitimate interests of Salt Edge to establish, exercise or defend its legal rights. When Salt Edge acts as a Processor of Personal Data, Salt Edge may apply a different retention period if so required by the Controller on whose behalf the Personal Data is being processed by Salt Edge.

Salt Edge will delete User's Personal Data from its production servers when:

As a result, User's Personal Data will be deleted and excised permanently from Salt Edge's production servers, subject to Salt Edge's right to generate Anonymized Data and Anonymized Aggregate Data prior to such deletion. Further use of the corresponding Services will be impossible. Notwithstanding anything to the contrary in this Privacy Policy, Salt Edge will retain User's Personal Data or portions thereof:

Backups and log files containing Personal Data are stored separately from the production servers. All Personal Data retained in backup files and log files will be treated in accordance with the terms of this Privacy Policy for as long as it is retained before being automatically deleted after the retention period has elapsed.

Backup files are stored using strong asymmetric encryption and Salt Edge's authorized personnel does not access such files in the ordinary course of business operations, nor will Salt Edge actively process any Personal Data retained in backup files anymore.

If a security breach causes an unauthorized intrusion into Salt Edge's systems, software or networks that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed by Salt Edge ("Personal Data Breach"), Salt Edge will notify the appropriate data protection authority unless the Personal Data Breach is unlikely to result in a risk to the rights and freedoms of affected Users. Salt Edge will report the Personal Data Breach to the appropriate data protection authority without undue delay after having become aware of it and in any case within the timeframes as provided for in the applicable Data Protection Laws, by including all the pertinent information relating to such Personal Data Breach as required by the applicable Data Protection Laws. When the Personal Data Breach is likely to result in a high risk to the rights and freedoms of affected Users, or if required by the appropriate data protection authority, Salt Edge will also communicate the Personal Data Breach to the affected Users without undue delay.

When Salt Edge acts as Processor for Developer, Salt Edge will notify the Developer of a Personal Data Breach as described above, who in turn will fulfil its Personal Data Breach reporting obligations (towards the relevant data protection authority and Indirect Users) as set forth in the applicable Data Protection Laws.

Salt Edge reserves the right to change this Privacy Policy at any time and from time to time in order to reflect changes in the Services or the applicable laws. If Salt Edge decides to change this Privacy Policy in the future, Salt Edge will post an appropriate notice at the top of this Privacy Policy page and/or give reasonable advance notice to Users through the Services or Website. Any non-material change (such as clarifications) to this Privacy Policy will become effective on the date the change is posted and any material changes will become effective thirty (30) days from their posting on the Website. Unless stated otherwise, this Privacy Policy applies to all Personal Data collected and processed by Salt Edge in connection with the Services. The date this Privacy Policy was last revised appears at the top of this document. User is advised to print a copy of this Privacy Policy for reference and revisit this Privacy Policy from time to time to ensure that User is aware of any changes. User's continued use of the Services after the changes to this Privacy Policy become effective signifies User's acceptance of any such changes.

Salt Edge's data protection officer can be reached at any time by email at dpo@saltedge.com in case of any questions with respect to Salt Edge's collection, use, disclosure or processing of Personal Data.

Any questions, comments or feedback regarding this Privacy Policy or any other privacy or security concern may be sent by email to privacy@saltedge.com.

Salt Edge Inc.

150 Elgin Street, Floor 10, Ottawa, ON, K2P 1L4, Canada