CPA roundtable: Planning an AI roadmap for 2019

PRIVACY POLICY

MindBridge Analytics Inc. (“we”/”us”) make the website, www.mindbridge.ai (the “Website”) and its proprietary anomaly detection software application (the “App”) available to companies who subscribe to use our services either through the Website or through an on-premises deployment. This Privacy Policy describes how we collect, store, use and distribute information about visitors and users of our Website and the App and personal information contained in User Content (collectively the “Services”). Terms used in this Privacy Policy have the same meaning as given to them in our Terms of Use.

This policy only applies to information that is provided to us by visitors of our Website or users of our Services about themselves. We act as the controller of that information. To the extent that our Services are used to process any Personal Information (as defined below) we act as a data processor, and the terms of our Data Processing Addendum applies in respect of our processing that personal information on behalf of the data controller.

Except as set forth in this Privacy Policy, your Personal Information will not be used for any other purpose without your consent. We do not sell contact lists.

Collection of Information: We aim to collect, use and disclose only such information as is required to enable us to manage your subscription and account, to provide the Services, to maintain our customer/visitor lists, to respond to your inquiries or provide feedback, for identification and authentication purposes and for service improvement. We will maintain the confidentiality of any Personal Information you provide to us on signing up for our Services or contacting us with questions or for further information and we will use it only for the purposes for which we have collected it (subject to the exclusions and disclosures we have listed below), unless you agree that we may disclose it to other third parties.

Two types of information may be collected through the Website and our Services: Personal Information and Non-Personal Information. This Privacy Policy does not extend to the collection, use or disclosure of Non-Personal Information (as defined further below) which is currently not limited by applicable privacy laws.

“Personal Information” is personally identifiable information, such as your name, address, e-mail address, credit card information, birth date and gender, or information associated with that personally identifiable information. It is always your choice whether or not to provide Personal Information but if you choose not to provide certain requested Personal Information, in some instances you may not be able to register to use the Website or App or be able to access and use the Website or App at all. In other instances, your choice not to provide certain other Personal Information may mean that you will not be able to use certain features of the Website or App. We may collect Personal Information in respect of the Website or App through registration processes; communications with you; information downloads; service purchases; user support; and surveys.

“Non-Personal Information” is information of an anonymous nature, and may include information such as the type and version of browser or operating system being used by visitors to the website where it is otherwise stored on an anonymous basis. It also includes aggregate information, such as demographic statistics of our users (e.g. average age or geographical allocation of our users), number of visitors, what pages users access or visit, and average time spent on the Website. In certain jurisdictions, business contact information such as the name, title, business address, e-mail address, or telephone number of a business or professional person or an employee of an organization is not considered Personal Information.

Although the use of certain Non-Personal Information collected, used or disclosed through the Internet as described herein is not restricted (and to the extent that such is the case, the obligations under this Privacy Policy do not apply to such information), we provide information in this Privacy Policy about the collection of such information for the sake of transparency with respect to the operation of the Website. Such Non-Personal Information is collected or derived by us in the course of operating this Website. For example, our web servers may automatically collect Non-Personal Information that is provided through your browser or stored in a cookie when you choose to visit the Website.

Use of Information: We collect information for the following purposes:

• Registration and access to the Services: In order to order our Services you must provide certain Personal Information to us such as your full name, address and email address. This allows us to know who you are, ensure that you can access your account for the Services, and provide both support and monitor security. Account registration information will not be shared with any other users of the Services.

• Transactional Notifications: We may provide notifications for certain activities through the Website and the App such as product and service updates and alerts (if you are logged into the Application). Despite your indicated e-mail preferences, we may send you notices of any updates to our Terms of Service or Privacy Policy.

• Statistics: we collect statistics about use of the Services through the Website. This information will be kept confidential, however, aggregate statistics that do not personally identify an individual will be kept by us and such aggregate statistics may be made available to other members or third parties.

Cookies: Cookies are used by us to track content usage and traffic on the Website. A cookie is a feature of your web browser that consists of a text file that is placed on your hard disk by a web server. The Website uses cookies to help it compile aggregate statistics about usage of this Website, such as how many users visit the Website, how long users spend viewing the Website, and what pages are viewed most often. This information is used to improve the content of the Website. You can set your browser to notify you when you are sent a cookie. This gives you the chance to decide whether or not to accept it. You may also wish to refer to http://www.allaboutcookies.org/manage-cookies/index.html If you disable cookies, you may not be able to take advantage of all the features of the Website. We do not link any of the information we use in cookies to any personally identifiable information submitted by you when you are on the Website.

We may use both session ID cookies and persistent cookies. A session ID cookie expires when you close your browser. A persistent cookie remains on your hard drive for an extended period of time. Persistent cookies enable us to track and target the interest of our users to enhance the experience on our site. Functional cookies, persistent and session type, store information to enable core site functionality. Analytics cookies allow us to count page visits and traffic sources so we can measure and improve the performance of our site and our marketing campaigns.

In addition, we may collect your Personal Information through the following logs:
• Website System Logs: System logs of website activity may be collected by the web hosting provider. MindBridge may access these logs to identify and resolve security issues with the Website.
• Application System Logs: The App records events of user activity. These event records may include the user identifier and the users IP address. This information is used to monitor the security of the application, troubleshoot problems, and improve the APP

Your IP address is reported by your web browser whenever you visit a page on the Website. This information is recorded together with your registration information on our databases for security and fraud prevention purposes.

We will only use your personal information when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
• Where we need to perform the contract we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation.

Generally we do not rely on consent as a legal basis for processing your personal information other than in relation to sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us using the details set out below.

If we plan to use your Personal Information in future for any other purposes not identified above, we will only do so after informing you by updating this Privacy Policy and, if necessary, obtaining your consent. See further the section of this Privacy Policy entitled ‘Amendment of this Policy’.

Disclosures & Transfers: We use cloud-hosting service providers to provide hosting to us in different jurisdictions (including Canada and the USA), which may include hosting your personal information in those jurisdictions. This means that your personal information may be available to foreign government or its agencies under a lawful order, irrespective of the safeguards we have put in place for the protection of your personal information. We have put in place contractual and other organizational safeguards with our agents (see further below) to ensure a proper level of protection of your Personal Information (see further Security below). In addition to those measures, we will not disclose or transfer your Personal Information to third parties without your permission, except as specified in this Privacy Policy (see further Important Exceptions below).

On-premises deployments of our App result in your data being hosted and stored on your own servers. However, if your use of the App is through the Website, your data will be hosted and stored using our cloud-based servers and accordingly your data may be available to government or its agencies under a lawful order, irrespective of the safeguards we have put in place for the protection of that data.

From time to time we may employ third parties to help us improve the Website and/or the Services. These third parties may have limited access to databases of user information solely for the purpose of helping us to improve the Website and/or the Services and they will be subject to contractual restrictions prohibiting them from using the information about our members for any other purpose.

Important Exceptions: We may disclose your Personal Information to third parties without your consent if we have reason to believe that disclosing this information is necessary to identify, contact or bring legal action against someone who may be causing injury to or interference with (either intentionally or unintentionally) our rights or property, other Website members, other users of the Services, or anyone else (including the rights or property of anyone else) that could be harmed by such activities. We may disclose Personal Information when we believe in good faith that such disclosure is required by and in accordance with the law.

We may also disclose your Personal Information in connection with a corporate re-organization, a merger or amalgamation with another entity, a sale of all or a substantial portion of our assets or stock, including any due diligence exercise carried out in relation to the same, provided that the information disclosed continues to be used for the purposes permitted by this Privacy Policy by the entity acquiring the information.

Security: The security of your Personal Information is important to us. We use commercially reasonable efforts to store and maintain your Personal Information in a secure environment. We take technical, contractual, administrative, and physical security steps designed to protect Personal Information that you provide to us. We have implemented procedures designed to limit the dissemination of your Personal Information to only such designated staff as are reasonably necessary to carry out the stated purposes we have communicated to you.

You are also responsible for helping to protect the security of your Personal Information. For instance, never give out your email account information for the Services to third parties password.

Retention: We will keep your Personal Information for as long as it remains necessary for the identified purpose or as required by law, which may extend beyond the termination of our relationship with you. We may retain certain data as necessary to prevent fraud or future abuse, or for legitimate business purposes, such as analysis of aggregated, non-personally-identifiable data, account recovery, or if required by law. All retained personal information will remain subject to the terms of this Privacy Policy. If you request that your name be removed from our databases, it may not be possible to completely delete all your Personal Information due to technological and legal constraints.

Your Legal Rights: Under certain circumstances, you have rights under data protection laws in relation to your personal information. You may have the right to:
• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected, though we may need to verify the accuracy of the new information you provide to us.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your personal information. This enables you to ask us to suspend the processing of your personal information in the following scenarios: (a) if you want us to establish the information's accuracy; (b) where our use of the information is unlawful but you do not want us to erase it; (c) where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your information but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal information to you or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal information. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact using the details set out below.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Amendment of this Policy: We reserve the right to change this Privacy Policy at any time. If we decide to change this Privacy Policy in the future, we will post an appropriate notice on the home page at www.mindbridge.ai. Any non-material change (such as clarifications) to this Privacy Policy will become effective on the date the change is posted and any material changes will become effective 30 days from their posting on the Website. Unless stated otherwise, our current Privacy Policy applies to all Personal Information that we have about you. The date on which the latest update was made is indicated at the bottom of this document. We recommend that you print a copy of this Privacy Policy for your reference and revisit this policy from time to time to ensure you are aware of any changes. Your continued use of the Website signifies your acceptance of any changes.

Access and Accuracy: You have the right to access the Personal Information we hold about you in order to verify the Personal Information we have collected in respect to you and to have a general account of our uses of that information. Upon receipt of your written request, we will provide you with a copy of your Personal Information although in certain limited circumstances, we may not be able to make all relevant information available to you such as where that information also pertains to another user. In such circumstances we will provide reasons for the denial to you upon request. We will endeavor to deal with all requests for access and modifications in a timely manner.

We will make every reasonable effort to keep your Personal Information accurate and up-to-date, and we will provide you with mechanisms to update, correct, delete or add to your Personal Information as appropriate. As appropriate, this amended Personal Information will be transmitted to those parties to which we are permitted to disclose your information. Having accurate Personal Information about you enables us to give you the best possible service.

Contact Us: You can help by keeping us informed of any changes such as a change of address or telephone number. If you would like to access your information, if you have any questions, comments or suggestions of if you find any errors in our information about you, please contact us at: legal@mindbridge.ai or at:

MindBridge Ai
730 St Laurent Blvd.
Suite 540, Ottawa, Ontario K1G 5L1
Canada

Last Updated: May 2018