FINHAVEN GROUP PRIVACY POLICY

Finhaven Technology Inc, (“Finhaven”), Finhaven Capital Inc. – operating as Finhaven Private Markets – (“Private Markets”), and Finhaven Gateway Inc. (“Gateway”) (collectively, “Finhaven Group”, “we”, “us”, “our”) respect and uphold individual rights to privacy and the protection of personal information while balancing such rights with our need to process your personal information to manage our businesses and deliver our services to you. Based on applicable privacy and data protection principles common to Canada and the provincial jurisdictions to which we are subject we have developed this privacy policy (the “Policy”) to explain our practices for processing your personal information.

This Policy does not apply to our employees’ personal information or any anonymized information.

This Policy describes our practices with respect to how we may collect, use, disclose, retain, dispose of, and otherwise process (collectively, “process”) and how you may correct, update, and access your personal information that you provide as a user of:

the websites operated by:
1. Finhaven at https://www.finhaven.com;
2. Private Markets at https://www.finhaven.ca;
3. Gateway at https://token.finhaven.com
or other locations from time to time (the “Websites”),
any front-end software, including any applications, we provide you that interacts or interfaces with the Website and proprietary software that supports and records your:
1. investing, trading, deposit, and withdrawal activity on the Finhaven Distributed Network ledger, in the case of Private Markets;
2. your purchase, sale, or exchange activity on the Ethereum mainnet, in the case of Gateway; or
3. your communications activity, in the case of Finhaven (collectively, the “Software”),
excluding third party software that may interact with the Websites or the Services as defined below, and
the services we provide through the Websites and/or the Software (collectively, the “Services”).

This Policy references the general Terms of Use:

for Finhaven, located at https://www.finhaven.com/Finhaven_Technology_Terms_of_Use.pdf;
for Private Markets, located at https://www.finhaven.ca/Website_Terms_of_Use.pdf; and
for Gateway located at https://token.finhaven.com (collectively, the “Terms of Use”)

and forms an integral part of it.

All capitalized terms not otherwise defined herein have the meaning provided in the Terms of Use or are brand names for Finhaven, Private Markets, or Gateway products or services.

Our Websites and Software may contain links to other websites or Internet resources that are provided solely for your convenience and information. When you click on one of those links, you are contacting another Internet resource. We have no responsibility or liability for, or control over, those other Internet resources or their collection, use, and disclosure of your personal information. We encourage you to read the privacy policies of those other Internet resources to learn how they collect and use your personal information.

One example is when a person applies to be an investor client on Private Markets or a customer on Gateway. Our application interfaces on those Websites link you to the customer identification and verification platform owned and operated by Sum&Substance, a service provider the Finhaven Group has retained to enable us to comply with security dealer and money services business obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (Canada) and regulations made under it.

PLEASE READ THIS PRIVACY POLICY CAREFULLY. By using our Websites, Software, or Services, or otherwise by choosing to provide us with your personal information, you acknowledge and consent to us processing your personal information in Canada in accordance with this Policy (and as may be further identified when the personal information is collected).

If you are located or reside outside of Canada, please be aware that this Policy is intended for and directed to users in Canada, and the privacy laws and principles in Canada may differ and not offer the same level of protection as those in your location or country/region of residence. Through your continued use of our Websites, Software, or Services, you are transferring your personal information to Canada and you expressly consent to that transfer. We will use this consent as the legal basis for such data transfer, unless otherwise stated in this Policy.

If you do not consent to us processing your personal information in accordance with this Policy, please do not access or continue to use any of the Websites, Software, or Services or otherwise provide any personal information to us.

1. Personal Information

For the purposes of this Policy, “personal information” means any identifiable information about an individual, including but not limited to an individual’s name, home address, telephone number, social insurance number, gender, income, and family status, except any other information otherwise exempted by the applicable laws of Canada.

When you use our Websites, Software, or Services, we may collect the following personal information from you so that we can meet our obligations under applicable securities laws, tax laws, and laws designed to prevent, detect, and deter money laundering, terrorist financing, and bribery and corruption:

In the cases of both Private Markets and Gateway:
- Demographic information from you and from your government-issued photo identification including but not limited to gender, age, marital status, citizenship, phone number, date of birth, and home address and mailing address (street address/city/province/country), so that we can identify you and verify your identity;
- Biometric information from an online liveness check, so that we can verify we are dealing with an individual who is the individual whose photo appears in your- government issued photo identification;
- Employment status information and employment or business information, including but not limited to name of employer or business, your occupation, and number of years with employer or business;
- Sources of your income and wealth;
- Whether you or a member of your family are or have been politically exposed persons, heads of international organizations, or close associates of such persons;
- Account information such as the public key and its encryption password that pairs with your private key, account ID, customer ID, username and password with us and with Canadian financial institutions from which you send us deposits or payments, or to which we send you funds when you make a withdrawal or sell us Finhaven Tokens;
- Transaction information such as deposits to and withdrawals from your Private Markets account, receipts of funds or tokens from you, purchases of digital securities from issuers, purchases of Finhaven Tokens from us or sales of FIN to us, offers and acceptances for trades of digital securities, trades of digital securities, payment information, credit information, and product preferences; and
In the case of Private Markets:
- Financial information from you and from documents supporting the information you provide, including but not limited to the name of the Canadian financial institution you will use for your transactions on Finhaven Private Markets, your financial statements, bank or investment account statements, Notices of Assessment, employer verification of salary, (e.g., pay stubs), or other third-party issued documents that support your qualification as an “accredited investor” under applicable securities laws;
- Social Insurance Number, Tax Identification Number, or any similar unique identifier for you in a foreign jurisdiction;
- Whether you have borrowed money to invest through Finhaven Private Markets;
- Your family and household, including marital status and dependents;
- Your net assets and your net financial assets;
- Your investment activities and relationships, including but not limited to your primary intended purpose for your account with us, investments elsewhere (including, and specifically, outside of Canada) and other persons who may have a financial interest in your account;
- Whether you have ever been the subject of a sanction, decision, judgment, finding or order in any criminal, civil, regulatory, securities or fraud-related matter;
- Whether you have ever been the subject of a bankruptcy or insolvency proceeding, or a director or officer of a business that has been the subject of a bankruptcy or insolvency hearing;
- Whether you are, or your spouse or a member of your household is, an “insider” (as defined in applicable securities laws) of a publicly-traded issuer;
- Your experience as a director, officer, founder or security holder of a non-reporting issuer;
- Whether you reside with or are related to an employee, director, or shareholder of Finhaven Capital;
- Your investment objectives, time horizons, risk tolerance, risk capacity, investment knowledge, and experience,
In the case of all members of the Finhaven Group:
- Contact information such as name, email address, mailing address, and phone number;
- Any additional information that you may provide to us in a free form collection box.

We only collect personal information that we need to serve your investment and trading needs, or your token purchase, sale, and exchange needs, and to meet our obligations under applicable securities laws, tax laws, and laws designed to prevent, detect and deter money laundering, terrorist financing, bribery, and corruption. We encourage you to refrain from providing us with any personal information beyond what is necessary for the purpose for which we collect it.

Collection from Third Parties

We do not knowingly collect your personal information from a third party unless you consent or we are otherwise exempted, required, or permitted by applicable laws to do so. For example, we may collect your personal information from the following third parties:

Your authorized representative(s);
Organization(s) that you previously consented to collect your personal information; and
Public sources in which your personal information is publicly available.

If we collect your personal information from a third party, we will only process that information for the specific purpose for which it was provided to us in accordance with this Policy and the policy under which that information was collected.

Cookies and Log Files

Our Website uses “cookies” and similar technologies like single-pixel GIFs and web beacons. A “cookie” is a text file that is sent to your computer or device and from your computer each time you use the site. Cookies can track how and when you use the Websites and which site you visited immediately before. A cookie does not damage your system and identifies your browser, not you personally.

We use cookies to collect information such as the server your computer is logged onto, the domain name of your internet service provider, your browser type and version (for example, Netscape or Internet Explorer), and your IP address. We may also derive the general geographic area associated with an IP address.

Sometimes, we use cookies in combination with “web beacons” or similar technology to collect information about how our Website is used, such as: your IP address and location data, weblogs, time zone, date, your language preferences, browsers used, web addressees visited, other communication data, searches conducted, pages visited, and any other relevant information about your online experience.

If you are an anonymous visitor, the information in this paragraph does not personally identify you but rather numerically identifies your device, and we share this cookie’s information with a third party marketing provider that will use it to deliver marketing about us to you while you visit other sites on the internet.

If you do not wish to receive cookies, you may be able to disable them. Although this may provide you with enhanced anonymity, it may affect the functioning of our Websites.

To the extent that our Websites contain links to other sites, the owners of those sites are responsible for the privacy practices or content of those other sites. We do not endorse and will not be responsible for the privacy practices on third party websites.

Third Party Advertising

We use third-party advertising companies to strengthen, manage, and improve our online and email advertising campaigns. These companies may collect information about your activity on our Websites and other websites (such as web pages you visit and your interaction with our advertising and other communications) and/or apps in order to make predictions about your preferences, develop personalized content, and deliver advertisements about goods and services of interest to you. We may also partner with ad networks and other companies that serve ads on behalf of us and others on non-affiliated digital properties. Some of those ads may be personalized, meaning that they are intended to be relevant to you based on information these ad networks collect about your visits to our websites and other non- affiliated websites or apps over time. This information may also be used to evaluate the effectiveness of our online advertising campaigns. Cookies set by these third parties may be used by those companies to build a profile of your interests and show you relevant advertisements on other sites. They do not directly store personal information (such as name or government identification numbers) but are based on uniquely identifying your browser and internet device. Accordingly, information collected by such cookies, alone or in combination with other available information, could potentially be linked to you. If you do not allow these cookies, you will experience less targeted advertising.

You may visit https://www.aboutads.info/choices or www.youradchoices.ca/choices to learn more about third party advertising and how to opt-out of this form of advertising on your web browser by companies participating in the Digital Advertising Alliance (“DAA”) or the Digital Advertising Alliance of Canada (“DAAC”) self-regulatory programs. If you wish to opt-out of interest-based advertising in mobile apps on your device by companies that participate in the DAA’s AppChoices app, you may download that app onto your device and exercise your choice. AppChoices is available at: https://youradchoices.com/appchoices

Information about Minors

This site is intended solely for users who are not minors (13 years of age or older). We do not knowingly collect personal information about any minor. No such minor, nor any parent or guardian as it relates to such minor, should submit such minor’s personal information to us through the Websites, Software, or otherwise for any reason and under any circumstances.

2. Purpose for Which Personal Information is Processed

We may process your personal information for the following purposes (the “Purposes”):

Create and administer your account with us;
Assess your eligibility for access to our Services, including whether you are qualified for direct investing in non-reporting issuers and for an automated, rather than human- generated, suitability assessment;
Assess the risk you present to us and to securities and cryptocurrency markets for money laundering or terrorist financing;
Respond to your comments, questions, and complaints and provide customer service;
Conduct research and surveys used to measure our performance and improve our Services and customer experience;
Operate and improve our Services;
Facilitate the provision of updates to our Software and other services related to our mobile applications and other products;
Prevent, investigate, or provide notice of fraud, breaches of applicable securities law, breaches of our requirements for a Private Markets investor client using our Services (as set out in our agreement with an investor client and as published on our website, from time to time), breaches of applicable laws to prevent, detect, and deter money laundering, terrorist financing, bribery and corruption, or other unlawful or criminal activity;
Enforce and carry out contracts and agreements;
Conduct research and surveys used to understand market interest in and responses to Finhaven Group Members, the Websites, and Services; and
Comply with legal obligations.

3. Private Markets Information

In order to access our Private Markets Services, we must assess whether you are qualified for direct investing in digital securities of non-reporting issuers conducting your own due diligence. We must provide a recommendation to you about whether an investment is suitable for you and we do that by using our automated suitability algorithm when you propose to invest or trade. As outlined above, we must obtain personal information that will help us make that assessment.

We may ask for additional information if we need it to meet our obligations. We require third- party issued documentation to confirm your accredited investor status. We request your consent to retrieve your credit file (excluding an actual credit report) to verify your identity.

We will only process your personal information for the Purposes for which we intend to process such information. Otherwise, we will not process your personal information without your consent.

4. Disclosure of Your Personal Information

We may disclose your personal information for the Purposes as described in this Policy in the following ways:

To our employees and contractors who need to know the information in order to provide the Software or Services to you, or in order to carry out specific terms and conditions imposed by securities regulatory authorities or securities regulators on our authority to operate as an exempt market dealer, marketplace and clearing agency in Canada, or to carry out specific obligations under laws to prevent, detect, and deter money laundering, terrorist financing, and bribery and corruption;
To our affiliates, in the event disclosure is necessary to provide you with effective Software and Services;
To our legal counsel, in the course of seeking advice about an event or circumstance involving you and for which we require advice;
To our service providers, including web hosting providers:
In the case of Private Markets, to the Canadian financial institution holding funds in trust for you and to your credit in your account with us, and customer service agencies; and
To law enforcement, government or regulatory bodies or other lawful authorities.

Your personal information that we collect may be processed outside of Canada. As a result, your personal information may be accessible to law enforcement and regulatory authorities in accordance with the following jurisdictions’ laws:

Australia;
Germany;
Ireland;
Singapore;
United States of America.

5. Legal Basis for Processing Your Personal Information

Consent

We will process your personal information only with your knowledge and consent, except where exempted, required, or permitted by applicable laws. The form of consent may vary depending on the circumstances and the type of information being requested. Your consent may be express with clear options to say “yes” or “no”, such as by being asked to check a box to indicate your consent, or implied, such as when you provide us with your address through a form or email seeking information and we use those means to respond to your request. Your consent can also be provided by your authorized representative. Taking into account the sensitivity of your personal information, purposes of collection and your reasonable expectations, we will obtain the form of consent that is appropriate to the personal information being processed.

By using our Websites, Software, or Services, or otherwise by choosing to provide us with your personal information, you acknowledge and consent to the processing of your personal information in accordance with this Policy and as may be further identified when the personal information is collected. When we process your personal information for a new purpose, we will document that new purpose and ask for your consent again.

If you do not consent to the processing of your personal information in accordance with this Policy, please do not access or continue to use any of the Websites, Software, or Services or otherwise provide any personal information to us.

You may refuse to provide consent or may notify us at any time that you wish to withdraw or change your consent to the processing of your personal information without penalty, subject to legal or contractual restrictions and reasonable notice by:

deleting your account with the Website(s) or Software and stopping use of the Website(s) or Software, or
opting out of the use of your personal information such as unsubscribing to any newsletter or mailing list subscription that we provide through the Website(s) or Software. However, if you withdraw or change your consent, we may not be able to provide you with the Services through the Websites or Software.

Other Legal Bases

Aside from consent, we may also process your personal information under other legal bases, as permitted by the applicable laws.

6. Security of Personal Information

The security of your personal information is important to us. We protect personal information using physical, technological, and organizational safeguards. We regularly review our practices to ensure they align with reasonable industry practices appropriate to the level of sensitivity to safeguard personal information against loss or theft, unauthorized access, alteration, or disclosure.

However, no method of transmission over the Internet, or method of electronic storage, is completely secure; as such, despite our safeguards and protocols, we cannot fully guarantee the security of your personal information and you should always exercise caution when disclosing personal information over the Internet.

6. Requests for Access to and Correction of Personal Information

Applicable privacy laws allow, to varying degrees, individuals the right to access and/or request the correction of errors or omissions in the individual’s personal information that is in our custody or under our control. You may request access to and review of your personal information in our possession. However, access may be declined where permitted or required by applicable law.

You may request that we change or delete your personal information in our possession. We reserve the right not to change any personal information if we do not agree that it is inaccurate or outdated, but will add to our records any alternative text you believe is appropriate.

If access cannot be provided, we will notify you within 30 days, in writing, of the reasons for the refusal.

7. Retention of Your Personal Information

We generally keep personal information for only as long as it is needed to accomplish the purposes for which it was collected, or as needed for authorized or legitimate purposes. More specifically, we retain personal information as long as necessary for the fulfillment of the identified purposes for its collection or as otherwise necessary to comply with applicable laws or protect our interests. When personal information is no longer necessary or relevant for the identified purposes, or is no longer required to be retained by applicable laws, we will take steps to have it deleted, destroyed, erased, aggregated, or made anonymous. We use reasonable industry practices to ensure we have adequate controls, schedules, and practices for information and records retention and destruction, which apply to personal information.

8. Updates or Changes to this Policy

This Policy was last approved for use by the CEO of each company in the Finhaven Group on September 22, 2021. The history of updates to this Policy appears in a table at the end of this Policy.

If we make any material changes we will either (a) notify you by email (sent to the email address listed in your account), or (b) provide a notice on the appropriate Website(s) or otherwise through the Services before the change becomes effective. Any change to this Policy will apply to existing information, as well as information collected onwards from the date that this Policy is posted or on the date as specified in the notification. We encourage you to periodically review this page for the latest information on our privacy practices to ensure you are aware of any changes.

9. Contact Information for Privacy Officer

You can direct any questions or concerns regarding our compliance with this Policy and our processing of your personal information to our Privacy Officer by emailing privacy@finhaven.com.

End of Policy

2021-09-22 – Finhaven Group – Privacy Policy – V. 1.0 – APPROVED

FINHAVEN GROUP PRIVACY POLICY