PREAMBLE

Welcome to the Social Finance Hub, a national bilingual platform created to strengthen and connect Canada's social finance ecosystem.

The Social Finance Hub operates under the stewardship of Boann Social Impact, in collaboration with Cap Finance and Realize Partners, as part of the $755 million Social Finance Fund. Our mission is to support social purpose organizations, investors, intermediaries, researchers, and practitioners working to create positive social and environmental impact across Canada.

Your privacy matters to us. We are committed to protecting your personal information and being transparent about how we collect, use, store, and share your data. This Privacy Policy explains our practices and outlines your rights and choices.

We operate in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and all applicable Canadian privacy legislation. We believe that trust is fundamental to building a strong social finance ecosystem, and respecting your privacy is central to earning and maintaining that trust.

What you'll find in this policy:

- What information we collect and how we collect it (automatically and through your direct input)

- Why we collect information and how we use it to operate and improve the Hub

- Who we share data with and under what circumstances

- How long we keep your information and when we securely delete it

- Your rights to access, correct, delete, and control your personal information

- How we protect your data through security measures and safeguards

- What happens in a data breach and how we'll notify you

- How to contact us with questions or concerns

This policy applies to all users of the Social Finance Hub website, including visitors, registered users, organizations with profiles, and pre-onboarding participants.

We encourage you to read this policy carefully. If you have any questions or would like to exercise your privacy rights, please contact our Privacy Administrator at hbezad@boann.ca.

By using the Social Finance Hub, you acknowledge that you have read and understood this Privacy Policy.

SECTION 1: INFORMATION WE COLLECT

We collect certain information directly from users and automatically when you interact with the Social Finance Hub. This information helps us operate the platform securely, improve user experience, and better understand and document the development of the social finance ecosystem in Canada.

All personal information collected by Boann Social Impact and its partners of the Social Finance Hub is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable Canadian privacy legislation. This means that you will be informed of the purpose for which your personal information is being collected and how to exercise your right of access to that information

1.1 Information Collected Automatically

1.1.1 IP Addresses and Technical Data

The nature of the Internet is such that Web servers automatically collect certain information about a visit to a website, including the visitor's Internet Protocol (IP) address. IP addresses are unique numbers assigned by Internet Service Providers (ISP) to all devices used to access the Internet. Web servers automatically log the IP addresses of visitors to their sites. The IP address, on its own, does not identify an individual. However, in certain circumstances, such as with the co-operation of an ISP for example, it could be used to identify an individual using the site. For this reason, IP addresses are considered personal information under Canadian privacy law, particularly when combined with other data automatically collected when a visitor requests a Web page such as the page or pages visited, date and time of the visit.

We also collect log information such as:

- Browser type and version

- Device identifiers

- Language preference

- Referring site

- Access time

- Operating system

- Mobile network information

1.1.2 Cookies and Similar Technologies

Cookies are small data files stored on your device that help us remember your preferences and analyze website traffic. You may adjust your browser settings to refuse cookies; however, some features of the site may not function properly without them.

(a) Comment Cookies

If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

(b) Login Page Cookies

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

(c) Login and Screen Display Cookies

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select "Remember Me", your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

(d) Article Editing Cookies

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

1.1.3 Usage and Analytics Data

We collect information about how you use the Hub to analyze traffic and improve usability, including:

- Pages visited, links clicked, and features used

- Time spent on pages and general site interaction patterns

- User activity data, analytics event data, and aggregated interaction trends

- Search terms and navigation patterns

This data is collected for purposes such as data analytics, research, and continuous improvement of the Service. Where such data includes or could be linked to personal information, we will obtain your consent or rely on another lawful basis under PIPEDA before collection.

1.1.4 Geographic Location Information

We collect approximate geographic location derived from your IP address to help us understand usage by region and better serve Canada's diverse social finance ecosystem.

1.1.5 Third-Party Service Collection

In cases where services are provided by third-party organizations, such as social media platforms or mobile applications, IP addresses may be recorded by the Web server of the third-party service provider. These third-parties have their own privacy policies. We encourage you to review them.

1.2 Information You Provide Directly

Unless otherwise noted, Boann Social Impact and its partners of the Social Finance Hub do not automatically gather any specific information from you, such as your name, telephone number or email address. Boann Social Impact and its partners of the Social Finance Hub would obtain this type of information only if you supply it to us, for example, by email, through contact forms, account registration, organizational profile creation, or other interactive features of the Hub. In such cases, how your personal information is handled will be provided in a Personal Information Collection Statement at or before the time of collection.

1.2.1 Account Registration and User Profiles

To access detailed organizational profiles and full Hub features, users must create an account and provide:

- Name and email address

- Organizational affiliation (if applicable)

- Role or interest in the social finance ecosystem

- Agreement to the Hub's Terms of Use and Privacy Policy

1.2.2 Comments and User-Generated Content

When visitors leave comments on the site, we collect the data shown in the comments form, and also the visitor's IP address and browser user agent string to help with spam detection. We will notify you at the time of collection about the specific purposes for which this information will be used.

Visitor comments or form submissions may be screened through an automated spam detection service to prevent misuse and maintain site integrity.

1.2.3 Forms and Communications

When you submit forms, subscribe to updates, or participate in consultations, we collect the personal information you provide — such as your name, email address, organization, and comments — and use it only for the purposes stated at the time of collection.

1.2.4 Media Uploads

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

1.2.5 Embedded Content Interactions

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

1.3 Platform-Specific Collection

The Social Finance Hub includes several specialized features that collect and process information as described below:

1.3.1 Directory and Organizational Profiles

(a) Profile Information

The Hub maintains a searchable directory of social purpose organizations participating in Canada's social finance ecosystem. Organizations may create profiles that include information such as:

- Organization name, legal structure, and registration details

- Mission, sector focus (using IRIS+ standards), and SDG alignment

- Geographic location and service areas

- Leadership and governance information, including representation data

- Fundraising status and organizational stage

- Contact information and website links

- Organizational achievements, impact metrics, and case studies

(b) Visibility and Access

Basic directory information (organization name, location, sector focus) is publicly visible to all website visitors. Detailed profile information, including contact details and in-depth organizational data, requires user account creation and login.

(c) Organizational Control

Organizations control what information they include in their profiles and may update or remove information at any time through their account dashboard.

1.3.2 Job Board

(a) Job Postings

The Hub provides a job board where participating organizations may post employment opportunities and users may browse and apply for positions.

(b) Applicant Information

Organizations posting jobs may collect applicant information directly through external application processes. The Hub does not collect, store, or process job applications or applicant personal information unless explicitly stated in the posting.

(c) Publicly Visible Information

Job postings may include employer contact information, which becomes publicly visible once posted.

(d) Usage Analytics

We collect usage data about job board interactions (such as views, clicks, and search terms) for analytics purposes, but do not link this data to individual users without consent.

1.3.3 Networking and Connection Features

(a) Connection Functionality

Users may connect with other Hub members, send messages, or request introductions through platform features designed to facilitate collaboration within the social finance ecosystem.

(b) When You Connect

When you initiate or accept a connection:

- Your basic profile information (name, organization, role) becomes visible to the connected user

- You may exchange messages through the platform's secure messaging system

- Connection activity may be used to improve AI-powered suggestion algorithms as described in Section 1.3.6

- You retain control over your connections and may remove connections at any time

(c) Messaging

Messages sent through the Hub are stored for delivery and may be retained in accordance with our data retention policy. We do not read, analyze, or use message content for purposes other than delivery, spam detection, and platform security unless required by law or with your explicit consent.

1.3.4 Pre-Onboarding and Early Access

(a) Pre-Launch Programs

Prior to the Hub's full public launch, select organizations may be invited to participate in pre-onboarding and early access programs.

(b) Information Collected

Pre-onboarding participants may be asked to provide:

- Organizational information for profile creation

- Feedback on platform usability and features

- Consent for use of anonymized data in case studies or platform improvement reports

- Agreement to confidentiality terms regarding pre-launch features

(c) Privacy Protections

Participation in pre-onboarding is voluntary. Early access participants are subject to the same privacy protections as all Hub users, and their data will not be shared publicly until they explicitly authorize profile publication.

1.3.5 Learning Hub and Resource Library

(a) Access to Resources

The Hub provides access to curated educational resources, research materials, and learning content relevant to the social finance ecosystem.

(b) Usage Analytics

We collect information about your interaction with learning resources (such as downloads, bookmarks, and time spent) to improve content curation and recommend relevant materials.

(c) External Resources

Some learning resources may link to external websites or require separate registration. Those external resources are governed by their own privacy policies.

1.3.6 AI-Powered Features

The Social Finance Hub uses artificial intelligence (AI) and automated systems to enhance user experience, facilitate connections within the social finance ecosystem, and provide bilingual access to content. This section explains how these technologies process your information.

(a) AI-Powered Connection Suggestions

The Hub employs an AI algorithm to suggest potential connections, collaborations, or networking opportunities between users and organizations based on factors such as:

- Sector focus and SDG alignment

- Geographic location

- Organizational stage and fundraising status

- Leadership representation and mission alignment

- User engagement patterns and expressed interests

These suggestions are informational only and do not constitute securities promotion, investment advice, or endorsement. Users retain full control over whether to pursue suggested connections.

The algorithm uses aggregated profile data and interaction patterns to generate suggestions only. It does not make automated decisions that:

- Produce legal effects concerning you

- Determine your eligibility for funding, partnerships, or opportunities

- Significantly affect your rights or access to services

- Replace human decision-making in matters that materially affect you

Connection suggestions are informational only. All decisions about whether to pursue connections, collaborations, or opportunities rest entirely with you and with the other party. Boann Social Impact, Cap Finance, and Realize Partners do not make funding, investment, or partnership decisions through the Hub platform.

Connection suggestion processing is performed using Google Gemini hosted in the United States. By using this feature, you consent to this processing.

(b) AI-Powered Translation

To support our commitment to bilingual service in English and French, the Hub uses AI-powered translation technology to translate user-generated content, organizational profiles, and platform communications. Translation processing is performed by Google Gemini, which processes data in the United States. By using translation features, you consent to this cross-border transfer.

While we strive for accuracy, automated translations may not always perfectly capture nuance, technical terminology, or cultural context. Users are encouraged to review translated content for accuracy, particularly for legally significant communications.

Translation processing may temporarily store content for quality improvement purposes, but such data is anonymized and retained only as long as necessary for system optimization.

(c) Your Rights Regarding Automated Processing

You have the right to:

- Understand how AI systems process your information

- Opt-out of AI-powered connection suggestions through your account settings

- Request human review of any algorithmically generated suggestion or decision that affects your use of the Hub

- Challenge the accuracy of AI translations and request correction

To exercise these rights or for more information about our AI systems, please contact our Privacy Administrator at hbezad@boann.ca.

(d) Transparency and Accountability

- We regularly audit our AI systems for fairness, accuracy, and compliance with privacy obligations

- We do not use AI systems to make decisions about creditworthiness, eligibility for funding, or other matters that would produce legal or similarly significant effects without meaningful human involvement

- We will notify you of any material changes to how AI systems process your personal information in accordance with our policy update procedures

1.3.7 Bilingual Platform and Translation Services

(a) Commitment to Bilingual Access

The Social Finance Hub is committed to providing full bilingual access in English and French, in accordance with our mandate to serve Canada's diverse social finance ecosystem.

(b) Translation Methods

To facilitate bilingual access, we use a combination of:

- Professional human translation for core platform content, policies, and official communications

- AI-powered automated translation for user-generated content, organizational profiles, and community discussions

- User-selected language preferences stored in your account settings

(c) Translation Accuracy

While we strive for high-quality translation, automated translations may not always capture nuances, technical terminology, or cultural context with perfect accuracy. Users are encouraged to:

- Review translated content, particularly for legally significant matters such as contracts, agreements, or binding commitments

- Contact us if they identify translation errors or require human translation for important communications

- Be aware that in case of dispute, the original language version of official Hub policies and terms will govern

(d) Translation Data Processing

When content is translated using AI-powered systems:

- Text is processed temporarily to generate translations

- Translation interactions may be used to improve translation quality and system performance

- Personal information contained in translated content remains subject to the same privacy protections as the original content

- Translation processing may involve third-party translation service providers who are bound by data protection agreements consistent with PIPEDA requirements

(e) Language Preferences

Your language preference selection is stored as part of your account profile and is used to:

- Display the Hub interface in your preferred language

- Determine the default language for communications sent to you

- Improve the relevance of translated content suggestions

You may change your language preference at any time through your account settings.

1.4 Stewardship and Use Limitations

All data collection and processing are conducted under the stewardship of Boann Social Impact, in collaboration with Cap Finance and Realize Partners, in compliance with Canadian privacy laws.

We do not sell personal information, and we do not use tracking technologies for targeted advertising.

SECTION 2: HOW WE USE YOUR INFORMATION

We use the information we collect to operate the Hub website responsibly, improve our services, and advance our mission to strengthen the social finance ecosystem in Canada. All processing of personal information is conducted under the stewardship of Boann Social Impact, in collaboration with Cap Finance and Realize Partners, in accordance with Canadian privacy laws.

2.1 To Provide and Maintain the Service

We use your information to operate, secure, and maintain the Hub website and its features. This includes:

- Enabling you to access and interact with the site and its resources

- Responding to inquiries, contact forms, and user feedback

- Managing access permissions and administrator functions

- Ensuring technical performance and website security

2.2 For Research, Learning, and Ecosystem Documentation

We may use aggregated or anonymized data to analyze user engagement and document trends that help us better understand and support the growth of the social finance ecosystem in Canada. This research may inform public reporting, knowledge-sharing activities, and evidence-based decision-making — always without identifying individual users.

2.3 For Analytics and Continuous Improvement

We analyze usage patterns (such as page visits, site navigation, and traffic metrics) to improve the accessibility, usability, and relevance of the Hub. These analytics help us ensure the website meets the evolving needs of social finance practitioners, researchers, and partners.

2.4 To Communicate with Users

We may use your contact information to share updates about the Hub, invitations to events, consultations, or opportunities for collaboration. You may unsubscribe from these communications at any time using the opt-out link included in our messages.

2.5 To Protect the Integrity of the Service

We use technical, procedural, and security measures to protect the website, its users, and our partners from unauthorized access, spam, misuse, or fraudulent activity. This may include automated spam detection and cybersecurity monitoring.

2.6 To Meet Legal and Accountability Obligations

We may retain and use certain information as required by law or to comply with audit, accountability, or reporting obligations related to the stewardship of public and philanthropic resources.

2.7 Use Limitations

We do not sell, rent, or trade personal information. All data use and sharing follow the principles of necessity, proportionality, and transparency.

2.8 Your Responsibility for Accuracy

You are responsible for ensuring that the personal information you provide to the Hub is accurate, complete, and up-to-date. Please notify us promptly of any changes to your contact information or organizational profile data. Inaccurate information may affect your ability to use Hub features or connect with relevant ecosystem partners.

SECTION 3: WHO WE SHARE YOUR DATA WITH

3.1 Stewardship and Administrator Access

This website operates under the stewardship of Boann Social Impact, alongside the other two wholesalers of the Social Finance Fund — Cap Finance and Realize Partners — who hold administrator access to the website. These parties may have access to personal information as necessary to fulfill their administrative functions and are bound by the same privacy obligations outlined in this policy.

3.2 Service Providers

(a) How We Work with Service Providers

The Hub may share limited personal or aggregated information with trusted third-party service providers who assist in operating, maintaining, and improving the website and its related functions.

These service providers are carefully vetted and are granted access only to the information necessary to perform their tasks. They are contractually required to comply with PIPEDA and other applicable Canadian privacy laws, and to maintain security, confidentiality, and data-retention standards consistent with those of Boann Social Impact. We conduct due diligence on all service providers and maintain written agreements that include provisions for data protection, use limitations, security safeguards, breach notification, and the return or destruction of personal information upon termination of services.

(b) Current Service Providers

Our current service providers with access to user data include:

- Invoke: Technical platform development and maintenance

- Spring: Newsletter and email communication services

- Propel: Content curation and resource management

- Amazon Web Services (AWS Canada): Cloud hosting and data storage

- Cybersecurity and spam-protection services

- Other technical support providers as required for platform functionality

The following service providers process data outside of Canada: Google Gemini. When we transfer your personal information to these providers, we ensure comparable protections through contractual safeguards. See Section 6.4 for more information about cross-border transfers.

All service providers listed above are bound by written agreements requiring:

- Compliance with PIPEDA and applicable Canadian privacy laws

- Implementation of security safeguards including encryption and access controls

- Notification to Boann Social Impact of any data breaches within 48 hours

- Use of data only for specified purposes and prohibition on use for the provider's own business purposes

- Deletion or return of personal information upon termination of services

- Submission to audit of compliance upon Boann's request

A detailed list of service provider locations and the specific services they provide is available upon request by contacting hbezad@boann.ca.

(c) Types of Service Providers

Examples of service provider categories include:

- Website hosting and storage providers, including AWS Canada

- Analytics and performance monitoring tools (for aggregated, anonymized data)

- Cybersecurity and spam-protection services

- Email communication and event-management tools

- Technical support or system maintenance providers

3.3 Research and Ecosystem Partners

We may also, where relevant and with appropriate consent where required, share anonymized or aggregated data with partners for the purposes of research, learning, and documentation of the social finance ecosystem in Canada. All such partnerships are governed by formal data sharing agreements that require compliance with PIPEDA and include provisions for data security, confidentiality, use limitations, and accountability.

A current list of partners with whom anonymized or aggregated data may be shared is available upon request and will be provided within 30 days of such request.

For purposes of this policy, 'anonymized data' means information that has been processed to remove all identifying elements such that it is no longer reasonably possible to identify an individual, even when combined with other available information. 'Aggregated data' means information combined from multiple sources in a way that does not identify individuals (e.g., '65% of organizations in the directory are located in Ontario').

3.4 Data-Sharing Governance

All data-sharing partnerships are formalized through written agreements before any personal or organizational information is shared. We do not share data with partners whose agreements have not been finalized and approved by Boann Social Impact's governance process. Current partnership agreements are reviewed annually and updated as necessary to maintain compliance with evolving privacy standards.

All data-sharing agreements with strategic partners will be confirmed, executed, and available for reference. Any new partnerships established after launch will follow the same rigorous approval and documentation process.

3.5 Disclosure to Authorities

We will disclose personal information only when legally required to do so by valid legal process (such as court order, warrant, or subpoena), or if disclosure is necessary to protect the rights, safety, or security of individuals or the public, in accordance with PIPEDA exceptions to consent requirements. Where legally permitted, we will notify affected individuals of such disclosures.

The Hub does not provide user data to any government or third party for surveillance or profiling purposes.

3.6 No Commercial Data Sharing

We do not share personal data for advertising or commercial marketing purposes.

3.7 Business Transfers

In the event that Boann Social Impact undergoes a business transition such as a merger, acquisition, reorganization, or sale of assets, or if the stewardship of the Social Finance Hub is transferred to another organization, your personal information may be among the assets transferred.

We will provide notice to you (via email and prominent website notice) before your personal information is transferred and becomes subject to a different privacy policy. You will have the opportunity to delete your account and data before the transfer takes effect.

SECTION 4: HOW LONG WE RETAIN YOUR DATA

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required to comply with applicable laws and regulatory obligations in Canada. This includes, but is not limited to:

4.1 User Accounts and Profiles

Retained for as long as the account remains active or until the user requests deletion.

4.2 Comments, Forms, and Communications

Retained for a maximum of seven (7) years unless a longer period is specifically required by applicable law, regulatory requirement, or legitimate audit necessity, in which case we will document the legal basis for extended retention.

4.3 Analytics, Cookies, and Anonymized Usage Data

Retained for as long as needed to support performance monitoring, research, or system improvements, and then either deleted or anonymized permanently.

4.4 Secure Deletion

When personal information is no longer required, it is securely deleted or anonymized in accordance with recognized data protection standards.

4.5 User-Initiated Deletion

Users may request the deletion or correction of their personal information at any time, subject to legal and contractual limitations.

SECTION 5: WHAT RIGHTS YOU HAVE OVER YOUR DATA

In accordance with Canadian privacy laws, you have several rights concerning your personal data collected and processed through this website. These rights ensure transparency, control, and accountability in how your information is managed.

5.1 Your Rights

You have the right to:

(a) Access your data: Request a copy of the personal information we hold about you, including any data you have provided directly (for example, through account registration, forms, or comments).

(b) Correct your data: Request that we correct or update any inaccurate or incomplete personal information.

(c) Delete your data ('right to be forgotten'): Request the deletion of your personal information when it is no longer necessary for the purposes for which it was collected, except where retention is required by law, regulation, or for security reasons.

(d) Port your data: Request to receive your personal information in a structured, commonly used, and machine-readable format.

(e) Withdraw your consent: Withdraw consent for any data processing that relies on your prior consent, at any time, without affecting the lawfulness of processing carried out before withdrawal.

(f) Restrict or object to processing: Request that we limit or cease certain types of data processing, subject to legal or contractual obligations.

5.2 How to Exercise Your Rights

Privacy inquiries are managed by our Privacy Administrator, Hanae Bezad, who can be reached at hbezad@boann.ca

Please note: Boann Social Impact does not currently have a dedicated Privacy Officer. Privacy inquiries are managed by our administrative team, who will respond to your requests in accordance with the timelines specified in this policy and as required by PIPEDA. For complex matters, we may engage legal or privacy expertise to ensure appropriate handling of your request.

5.3 Response Timeline

We will respond to all verified requests within 30 days of receipt, or notify you if an extension is required due to the complexity or volume of the request. Any extension will not exceed an additional 30 days and will be communicated to you in writing along with the reasons for the delay, in accordance with PIPEDA requirements.

5.4 Right to File a Complaint

If you have concerns about the way your personal information is being handled, you also have the right to contact the Office of the Privacy Commissioner of Canada (OPC) or your provincial privacy authority.

SECTION 6: WHERE YOUR DATA IS SENT

6.1 Canadian Hosting

The Hub website is hosted with Amazon Web Services (AWS) in Canada, ensuring that primary data storage and processing take place within Canadian jurisdictions subject to Canadian privacy legislation.

6.2 Additional Service Providers

In addition to AWS, we may use other trusted service providers to support the operation, maintenance, analytics, and communication functions of the website. These providers are carefully selected for their robust security standards and are contractually required to comply with Canadian privacy laws and best practices in data protection.

6.3 Spam Detection Services

Visitor comments and form submissions may also be verified through automated spam detection services to maintain the integrity and security of the website.

6.4 Cross-Border Data Transfers

In certain cases, some technical or analytic services may involve limited data processing outside of Canada. When this occurs, we ensure that your personal information receives a level of protection comparable to that required under Canadian law, through the use of written data protection agreements, confidentiality clauses, and secure transfer protocols. We will obtain your consent before transferring your personal information outside of Canada, except where such transfer is necessary for the performance of a contract between you and us, or where otherwise permitted by law. You may withdraw such consent at any time, subject to legal or contractual restrictions.

When your personal information is transferred outside of Canada, it is subject to the laws of the foreign jurisdiction and may be accessible to law enforcement and national security authorities in that jurisdiction.

We ensure that your personal information receives a level of protection comparable to that required under Canadian law through:

- Written data protection agreements with all cross-border service providers

- Contractual requirements for security safeguards, use limitations, and breach notification

- Prohibition on use of your data for the provider's own purposes

- Secure transfer protocols and encryption

Your Consent to Cross-Border Transfers: By creating an account and using the Social Finance Hub, you consent to these cross-border transfers. You may withdraw your consent at any time by discontinuing use of the Hub and requesting deletion of your data under Section 5. However, withdrawal of consent may prevent you from accessing Hub features that rely on these services.

A complete list of countries where your data may be processed is available upon request by contacting hbezad@boann.ca.

Current countries where data may be processed: Canada, [ADD OTHERS: United States, European Union member states, etc.]

6.5 Security Safeguards

We also maintain strong technical and organizational safeguards to protect your information against unauthorized access, disclosure, alteration, or destruction during collection, transfer, and storage.

SECTION 7: HOW WE TRANSFER, STORE, AND PROTECT YOUR DATA

7.1 Storage and Processing Location

All information collected through the Social Finance Hub is stored and processed in Canada, primarily through secure cloud hosting provided by Amazon Web Services (AWS Canada). Data storage and processing take place under the stewardship of Boann Social Impact, in collaboration with Cap Finance and Realize Partners, the three wholesalers of the Social Finance Fund.

7.2 Security Safeguards

We are committed to maintaining the confidentiality, integrity, and security of your information. To do so, the Hub implements technical, organizational, and contractual safeguards that meet or exceed industry standards, including:

(a) Encryption and secure transmission of data to prevent unauthorized access during transfer or storage

(b) Access controls and authentication measures to limit data access to authorized personnel only

(c) Regular monitoring and system updates to protect against vulnerabilities and potential breaches

(d) Data minimization and retention practices ensuring information is kept only as long as necessary for the purposes described in this policy

(e) Formal agreements with all service providers requiring compliance with privacy and security obligations consistent with Canadian law

7.3 Cross-Border Processing

As described in Section 6.4 above, certain third-party tools used for analytics, communication, translation, or maintenance process data outside of Canada. Please refer to Section 6.4 for a complete list of cross-border service providers and the countries where your data may be processed.

7.4 Compliance Framework

The Social Finance Hub adheres to all relevant Canadian privacy and data-protection frameworks, including:

(a) The Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5) (PIPEDA)

(c) Applicable provincial privacy laws, including Québec's Act respecting the protection of personal information in the private sector (as amended by Bill 64, commonly known as Law 25), and British Columbia's Personal Information Protection Act (PIPA), where applicable based on the location of our operations and users.

SECTION 8: DATA BREACH NOTIFICATION AND SECURITY INCIDENTS

8.1 Our Commitment to Security

Boann Social Impact takes the security of your personal information seriously and maintains robust technical, organizational, and contractual safeguards as described in Section 7 of this Privacy Policy. Despite these measures, no system can be completely secure. This section explains our procedures in the event of a data breach.

8.2 What Constitutes a Breach

A data breach occurs when there is unauthorized access to, collection, use, disclosure, disposal, or destruction of personal information, or when personal information is lost in circumstances where unauthorized access, collection, use, disclosure, or disposal is likely to occur.

Breaches that pose a real risk of significant harm to individuals will be handled in accordance with PIPEDA requirements and applicable provincial privacy legislation.

8.3 Our Response to Breaches

If we become aware of a data breach affecting the Social Finance Hub, we will:

(a) Immediate containment: Take prompt action to contain the breach, secure affected systems, and prevent further unauthorized access

(b) Assessment: Conduct a thorough investigation to determine:

- The nature and extent of the breach

- The personal information affected

- The number of individuals affected

- The cause of the breach

- The potential risk of harm to affected individuals

(c) Remediation: Implement measures to prevent recurrence and mitigate harm, which may include:

- Strengthening security controls

- Resetting passwords or access credentials

- Enhancing monitoring and detection capabilities

- Working with law enforcement if criminal activity is suspected

8.4 Notification to Affected Individuals

(a) When We Notify

If a breach creates a real risk of significant harm to you, we will notify you as soon as feasible by:

- Direct email to the address associated with your account

- Prominent notice on the Hub website homepage

- Direct phone contact for high-risk situations

- Other appropriate means based on the circumstances

(b) What We Include

Our notification will include:

- A description of the breach and when it occurred

- The type of personal information involved

- The steps we have taken to contain the breach and mitigate harm

- The steps you can take to reduce risk or protect yourself

- Contact information for our Privacy Administrator

- Information about your right to file a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy authority

(c) Timing

We will provide notice as soon as feasible after determining that a real risk of significant harm exists, and in accordance with timelines required by applicable law (typically without unreasonable delay).

8.5 Notification to Regulators

(a) Required Reporting

We will report breaches that pose a real risk of significant harm to:

- The Office of the Privacy Commissioner of Canada (as required by PIPEDA)

- Applicable provincial privacy regulators, including the Commission d'accès à l'information du Québec where required by Quebec's Law 25

(b) Report Contents

Reports will be made as soon as feasible after becoming aware of the breach, including:

- A description of the breach and affected personal information

- The date or time period of the breach

- The number of individuals affected or potentially affected

- The steps taken to reduce risk of harm

- The steps taken or planned to notify affected individuals

8.6 Record-Keeping

We maintain records of all privacy breaches, including:

- The circumstances of the breach

- The personal information involved

- The individuals and regulators notified

- The steps taken to contain and remediate

- The assessment of risk of harm

These records are maintained for accountability purposes and may be requested by privacy regulators.

8.7 Your Responsibilities

To help protect your information, we encourage you to:

- Use strong, unique passwords for your Hub account

- Enable two-factor authentication if available

- Keep your contact information up to date so we can reach you if needed

- Report suspicious activity or potential security concerns to hbezad@boann.ca immediately

- Review your account activity regularly

- Log out of your account when using shared or public devices

8.8 Third-Party Breaches

If a breach occurs at a third-party service provider (such as our hosting provider, email service, or analytics platform), we will:

- Require immediate notification from the service provider under our data protection agreements

- Conduct our own assessment of the risk to Hub users

- Fulfill our notification obligations to affected individuals and regulators as required

- Review and strengthen our contractual safeguards with the provider as necessary

8.9 Contact for Security Concerns

If you believe you have identified a security vulnerability in the Hub, or if you suspect your account has been compromised, please contact us immediately at:

hbezad@boann.ca

Subject line: 'URGENT: Security Concern'

We take all security reports seriously and will respond promptly to investigate and address the issue.

SECTION 9: CHILDREN'S PRIVACY AND AGE REQUIREMENTS

9.1 Platform Purpose

The Social Finance Hub is designed for use by professionals, organizations, researchers, and individuals actively engaged in or supporting Canada's social finance ecosystem. The platform is not directed at children under the age of majority in their province or territory of residence.

9.2 Age Requirements

- Users must be at least the age of majority in their province or territory (18 or 19 years old, depending on location) to create an individual account

- Organizational accounts may be created by authorized representatives of registered organizations, regardless of whether the organization serves or is led by youth

- We do not knowingly collect personal information from individuals under the age of majority without appropriate consent from a parent, guardian, or authorized organizational representative

9.3 Youth-Led Organizations

- Youth-led social purpose organizations may participate in the Hub through organizational profiles managed by adult representatives or with appropriate parental/guardian consent

- If a youth under the age of majority wishes to access Hub features, they should do so under the supervision of a parent, guardian, or authorized adult representative from their organization

9.4 Parental Rights

- Parents or guardians who believe their child has provided personal information to the Hub without appropriate consent may contact us at hbezad@boann.ca to request review and deletion of such information

- We will respond to such requests within 30 days and take appropriate steps to verify the identity of the requesting parent or guardian before taking action

9.5 Verification

- While we do not routinely verify the age of account holders, we reserve the right to request age verification if we have reason to believe a user may be under the age of majority

- If we become aware that we have inadvertently collected personal information from an individual under the age of majority without appropriate consent, we will take reasonable steps to delete such information promptly

9.6 Educational Use

Educational institutions or youth-serving organizations that wish to use the Hub as part of educational programming must ensure appropriate consent, supervision, and privacy protections are in place in accordance with applicable provincial education privacy legislation.

SECTION 10: LINKS TO OTHER WEBSITES AND SERVICES

10.1 Third-Party Links

The Social Finance Hub may include links to websites, platforms, or online services operated by partner organizations, funders, research collaborators, or other ecosystem participants. It may also include links to external learning resources hosted on the Learning Hub or by third parties.

10.2 No Endorsement

These links are provided for information, learning, and collaboration purposes only. While we strive to include reliable and reputable sources, the Hub does not control or endorse the content, security, or privacy practices of these third-party websites or services.

10.3 When You Leave the Hub

When you follow a link from the Hub to another website, please note that:

- This Privacy Policy no longer applies once you leave the Hub website

- Your browsing and interaction on third-party sites are governed by their own terms, conditions, and privacy policies

- We are not responsible for the collection, use, or disclosure of your information by these third parties

10.4 Review Third-Party Policies

We encourage all users to review the privacy and cookie policies of any linked website before providing personal information or engaging with interactive features.

10.5 Third-Party Services

Additionally, if you access third-party services (for example, by signing in with or sharing content through a social media account), you do so at your own discretion and in accordance with the third party's terms of service and privacy policy.

SECTION 11: CHANGES TO THIS POLICY

11.1 Updates

The Social Finance Hub may update this Privacy Policy from time to time to reflect evolving practices, technological developments, or changes in applicable laws and regulations.

11.2 Notice of Changes

When updates are made, we will revise the "Last Updated" date at the top of this page. We will provide notice of any changes to this Privacy Policy at least thirty (30) days before they take effect through one or more of the following methods:

(a) Posting a clear and prominent notice on the Hub website homepage and in user account dashboards (where applicable)

(b) Sending a communication through official Hub channels or mailing lists

(c) Contacting users directly by email, when appropriate

11.3 Your Responsibility

We encourage all visitors and users to review this page periodically to stay informed about how we protect and manage personal information. However, we will not rely solely on your obligation to check this page for changes, and will provide direct notice as described above for any material changes to this Privacy Policy.

11.4 Your Options

If you do not agree with any changes to this Privacy Policy, you may discontinue use of the Hub website and request deletion of your personal information in accordance with Section 5 (What rights you have over your data). Continued use of the Hub website after the effective date of changes constitutes acknowledgment and acceptance of the updated Privacy Policy, provided that for any changes that require new or expanded consent under applicable privacy laws, we will obtain your express consent before applying such changes to your personal information.