PRIVACY POLICY — OKIFF

Effective Date: October 24, 2026

Operating Entity: 9453-7313 Québec inc. d/b/a “Okiff” (“Okiff”, “Company”, “we”, “us”, “our”)

Supported Applications & Interfaces: Web Platform, Okiff Google Chrome Extension, and Okiff Mobile Application.

Corporate Headquarters: Montreal, Quebec, Canada

Applicable Legislation: Quebec Act Respecting the Protection of Personal Information in the Private Sector (CQLR c. P-39.1, as amended by Law 25); Charter of the French Language (CQLR c. C-11).

1. Linguistic Scope & French-First Access

In compliance with the Charter of the French Language (as amended by Bill 96), this Privacy Policy is available in French (Politique de confidentialité) on terms at least as favorable in quality, display, and accessibility as this English version. If you are reviewing this policy in English, you acknowledge that the French version was made accessible to you prior to or simultaneously with this version.

Les parties confirment leur volonté expresse que la présente politique ainsi que tout document s'y rattachant soient rédigés en langue anglaise après avoir eu un accès complet et préalable à la version française correspondante.

2. Person in Charge of the Protection of Personal Information (Privacy Officer)

In accordance with Section 3.2 of the Quebec Private Sector Act (Law 25), 9453-7313 Québec inc. has designated a Person in Charge of the Protection of Personal Information (Privacy Officer):

• Title: Person in Charge of Personal Information Protection / Privacy Officer

• Entity: 9453-7313 Québec inc.

• Email: [email protected]

• Mailing Address:

  • Attn: Privacy Officer

  • 9453-7313 Québec inc. (Okiff)

  • Montreal, Quebec, Canada

The Privacy Officer is directly responsible for overseeing organizational compliance with Law 25, approving Privacy Impact Assessments (PIAs), handling inquiries and individual rights requests, and coordinating incident responses with the Commission d’accès à l’information du Québec (CAI).

3. Collection of Personal Information

We apply strict principles of data minimization and proportionality. We only collect personal information necessary to deliver, bill, secure, and operate the Okiff platform, Google Chrome Extension, Mobile Application, and integrated Services.

Note on Minors: Okiff does not knowingly collect or solicit personal information from individuals under fourteen (14) years of age without verifiable parental or tutor consent.

4. Privacy by Default & Tracking Technologies

In accordance with Section 9.1 of Law 25, Okiff operates under a strict “Privacy by Default” (Confidentialité par défaut) standard:

• No Pre-Activated Tracking: All non-essential telemetry, performance profiling, and analytics tools remain deactivated by default.

• Granular Opt-In: Tracking, localization, or profiling technologies will only activate if you provide affirmative, unbundled, opt-in consent through our Consent Management interface.

• Essential Cookies: We only set strictly necessary session cookies required for authentication, CSRF security tokens, and edge load distribution. These do not require opt-in consent under Law 25.

5. Automated Decision-Making & Transparency

Under Section 12.1 of Law 25, if Okiff relies on automated processing or algorithmic evaluation (including machine learning models) to make decisions that significantly affect you (e.g., automated fraud blocking, suspicious tenant suspension, or dynamic credit checks):

1. You will be informed prior to or at the time the automated decision is rendered.

2. You have the statutory right to request:

   • The personal information used to reach the decision;

   • The principal factors, criteria, and parameters that produced the result;

   • A manual review by a qualified human team member with the authority to modify or overturn the decision.

To request an automated decision explanation or review, contact [email protected].

6. Subprocessors and Cross-Border Data Transfers (Section 17 PIA)

Okiff prioritizes Quebec-sovereign edge infrastructure. However, where cloud infrastructure or specialized service providers process personal data outside Quebec, we comply strictly with Section 17 of ARPPIPS:

• Mandatory Privacy Impact Assessment (PIA): Before transferring any personal information outside Quebec, Okiff conducts a formal PIA evaluating:

  1. The sensitivity and proportionality of the transferred data;

  2. The legal regime of the recipient country/state (including exposure to foreign access laws such as the US CLOUD Act or FISA 702);

  3. Contractual safeguards and encryption frameworks applied to the pipeline.

• Contractual Safeguards: All external vendors and subprocessors must execute written Data Processing Agreements guaranteeing confidentiality, strict breach notification within 48 hours, and security safeguards comparable to Quebec standards.

• On-Premise & Public SaaS Integrations: When our Google Chrome Extension or Mobile Application interfaces with connected on-premise systems or third-party public SaaS applications, Keycloak manages authentication using encrypted, short-lived tokens to ensure cross-system data security and compliance with applicable data protection regulations.

7. Data Retention, Destruction, and Anonymization

• Retention Lifecycle: We retain personal information only for as long as necessary to fulfill the specific purposes for which it was collected or to satisfy statutory tax and legal obligations.

• Compliant Anonymization: When retention purposes are fulfilled, 9453-7313 Québec inc. will either permanently destroy the data or anonymize it in strict accordance with Section 23 of ARPPIPS and the 2024 Regulation respecting the anonymization of personal information. Data is considered anonymized only after undergoing an 8-step risk analysis ensuring the re-identification risk is virtually non-existent (analyzing individualization, correlation, and inference risks).

8. Confidentiality Incidents & Breach Notification

In accordance with Sections 3.5 to 3.8 of Law 25 and the Regulation respecting confidentiality incidents:

• Immediate Mitigation: Upon detecting any unauthorized access, loss, or disclosure of personal information, Okiff takes immediate reasonable measures to contain the breach and reduce potential injury.

• 72-Hour Mandatory Reporting: If an incident presents a Risk of Serious Injury (ROSI) to affected individuals, Okiff will immediately notify both:

  1. The Commission d’accès à l’information du Québec (CAI);

  2. All affected data subjects.

• Breach Register: Okiff maintains a detailed internal Confidentiality Incident Register documenting all incidents (regardless of severity) for a minimum of five (5) years, available for inspection by the CAI upon request.

9. Your Statutory Privacy Rights

Under Law 25, individuals residing in Quebec hold the following non-negotiable rights regarding their personal information:

1. Right to Information & Access: You may request confirmation of whether we hold personal information about you and obtain a copy of that data.

2. Right to Rectification: You may demand the correction of inaccurate, incomplete, or outdated personal information.

3. Right to Erasure (De-indexation): You may request that Okiff delete your personal data when the purpose of collection has ended or if processing violates the law.

4. Right to Data Portability: You have the statutory right to receive a copy of your computerized personal data in a structured, commonly used technological format, or request that Okiff transmit it directly to an authorized third party.

5. Right to Withdraw Consent: You may withdraw your consent to data processing or secondary uses at any time, subject to legal or contractual restrictions.

Response Timeline: We will respond to all verified statutory rights requests within thirty (30) days of receipt, as mandated by Quebec law.

10. Regulatory Oversight & Recourse

If you are dissatisfied with our handling of your personal information or our response to a rights request, you have the right to lodge a formal complaint with Quebec’s independent supervisory authority:

Commission d’accès à l’information du Québec (CAI)

Bureau 1.10, 900, boulevard René-Lévesque Est

Québec (Québec) G1R 6C9

Website: www.cai.gouv.qc.ca

Toll-free: 1-888-528-7741

11. Amendments to this Policy

We reserve the right to amend this Privacy Policy to reflect evolving technical, legal, and operational realities. Any material modification will be announced via platform notice or direct email thirty (30) days before the changes take effect, with the revised version published on our website alongside its new effective date.