FinCard Pay Privacy Policy

FINCARD PAY

Privacy Policy

How we collect, use, disclose, retain and protect your personal information

Effective September 10, 2026

1. Introduction

FinCard Financial Services Inc. (“FinCard”), operating for purposes of this Privacy Policy as FinCard Pay, its subsidiaries, affiliates, or any of their respective employees, agents, officers, directors or third-party service providers (collectively “FinCard Pay”, “we”, “us” and “our”) provides commission and reward payout services through its website (the “Website”), its mobile application (the “App”) and its program administration portal (the “Portal”), which may also be accessed through the App.

FinCard Pay is committed to protecting the personal information that recipients of payments (“Recipient”, “you” and “your”) and the individuals who administer payout programs on behalf of a participating organization provide, including the collection, use, and disclosure of personal information. FinCard Pay recognizes and respects the importance of protecting the security and confidentiality of the personal information we collect and maintain and takes steps to ensure we meet privacy principles and requirements with respect to personal information under applicable Canadian privacy legislation, which can include the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”), the Alberta Personal Information Protection Act (“PIPA”) and any comparable provincial legislation, as well as related regulations.

Prepaid cards issued under a FinCard Pay program (each a “Program Card”) are issued by Digital Commerce Bank, a Schedule 1 Canadian chartered bank (the “Issuer”) pursuant to a licence from Visa Inc. The Issuer collects, uses and discloses personal information in accordance with its own privacy policy, available at https://www.dcbank.ca/legal/privacy-policy. The Issuer is the reporting entity in respect of the prepaid payment product accounts associated with Program Cards under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. Customer due diligence and cardholder identification are carried out in accordance with the allocation established under the Issuer’s program requirements.

The payment service provider for a FinCard Pay program is Everyday People Financial Corp. (“EPFC”). EPFC holds program funds in trust in a segregated account at the Issuer, receives and acts on payment instructions, and is responsible for the safeguarding, record-keeping and reporting obligations that apply to it under the Retail Payment Activities Act. FinCard owns and manages the program and provides the Website, App and Portal, and does not hold program funds.

The purpose of this Privacy Policy is to inform Recipients, program administrators and other individuals how we deal with your personal information and acts as a guideline of how we collect, use, disclose, retain and protect your personal information.

If you have questions, comments, concerns or require further information about our Privacy Policy or our terms of use (“Terms of Use”), please contact our Privacy Officer at:

Privacy Officer, FinCard Financial Services Inc. Suite 450, 11150 Jasper Avenue, Edmonton, AB T5K 0C7 [email protected]

2. Our Roles

FinCard Pay handles personal information in two distinct capacities, and it is important that you understand the difference.

2.1 Where we act for a Company

An organization that establishes a payout program (“Company”) decides who is eligible to receive a payment, calculates what is owed, completes any payroll, withholding or tax reporting obligations that apply to it, and approves each payment. When we receive a list of Recipients and approved payment amounts from a Company, we handle that information on the Company’s behalf and under the Company’s instructions, for the purposes set out in our agreement with that Company. The Company remains accountable for the personal information it provides to us and for having obtained any consent required to provide it. If you have questions about why your Company gave us your information, or you wish to correct information the Company supplied, please contact the Company directly.

2.2 Where we act for ourselves

We are independently accountable for the personal information we collect and use to establish and administer your Program Card, verify your identity, monitor for fraud and financial crime, operate the Website, App and Portal, and meet our own legal and regulatory obligations. This Privacy Policy governs that information, and you may exercise the rights described in it directly with us.

2.3 Where EPFC and the Issuer act

EPFC and the Issuer are each independently accountable for the personal information they collect, use and disclose in performing their own functions, and each is subject to its own privacy policy. EPFC holds the program funds and keeps the records the Retail Payment Activities Act requires of it; the Issuer maintains the Program Card accounts and the associated transaction records. This Privacy Policy does not govern the information they hold in their own right. If you wish to exercise a right against either of them, contact our Privacy Officer and we will help you direct your request.

3. Types of Personal Information

Personal information means information about an identifiable individual. For a FinCard Pay program, this may include identification information (name, date of birth, government-issued identification details used to verify your identity), contact information (address, telephone number, email address), payment information (Program Card number, card balance, load history, transaction history, merchant and transaction details), Company-provided information (your role, the payment amounts a Company has approved for you and the reason the Company has recorded for each payment), device and technical information (device identifiers, IP address, App version, authentication and login records) and general information relating to your interactions with us (support enquiries and information about how you use the Website, App and Portal collected through “cookies”).

We do not require your Social Insurance Number in order to issue or administer a Program Card, and you should not provide one to us. Where a Company is required to report amounts paid to you for tax purposes, the Company collects and reports that information itself.

Personal information does not include anonymous information or information that relates to a group of people rather than individuals where the information does not otherwise contain identifying information.

4. Your Consent

4.1 Acknowledgement, Acceptance and Consent

We collect, use and disclose personal information with your knowledge and consent (unless otherwise required or permitted by law). By activating or using a Program Card, or by using or accessing our Website, App or Portal, you acknowledge and confirm that you have read, understand and agree to be bound by this Privacy Policy and our Terms of Use, as may be amended from time to time in accordance with the “Changes to this Privacy Policy” section below. If you do not agree to be bound by this Privacy Policy or the Terms of Use, you must cease using the Website, App, Portal and Program Card.

4.2 Identified Purposes

We limit the collection, use and disclosure of your personal information to the purposes we have identified in this Privacy Policy. If we identify a new purpose for your personal information, we will update this Privacy Policy and, where the new purpose is material and not required or permitted by law, we will contact you to obtain your consent before using your personal information for that purpose.

4.3 Withdrawal of Consent

You can withdraw your consent to our collection, use or disclosure of your personal information at any time by contacting our Privacy Officer. Upon reasonable, advance notice FinCard Pay will ensure that your personal information collected is no longer used or disclosed by FinCard Pay (unless otherwise required or permitted by law, including where we are required to retain information under the Retail Payment Activities Act, the Proceeds of Crime (Money Laundering) and Terrorist Financing Act or applicable card network rules). We will advise you of any consequences of the withdrawal of your consent before we act on it. Withdrawing your consent to the information we require to administer a Program Card will mean that we can no longer provide you with that card, and any remaining balance will be dealt with as set out in the Terms of Use.

4.4 Marketing Consent Is Separate

Consent to receive commercial electronic messages from us is separate from, and not a condition of, receiving a payment or holding a Program Card. You may withdraw marketing consent at any time using the unsubscribe mechanism in any message we send you or by contacting our Privacy Officer, without affecting your Program Card.

4.5 Consent Not Required or Permitted by Law

FinCard Pay may be required or permitted under statute or regulation to collect, use or disclose personal information without the individual’s knowledge and consent in certain circumstances. For example:

1. When the collection, use, and disclosure is permitted or required by law or to comply with a court order.

2. To comply with local, provincial, or federal laws or regulations or a legally permitted inquiry by a government agency, including a request from the Financial Transactions and Reports Analysis Centre of Canada (“FINTRAC”) or the Bank of Canada. 3. To detect, investigate, prevent or suppress fraud, money laundering, terrorist financing or other unlawful activity. 4. When the collection, use and disclosure is clearly in the interests of the individual and consent cannot be obtained in a timely manner. 5. When seeking the consent of the individual may defeat the purpose of collecting the information. 6. When needed to collect a debt owed to us, to comply with a subpoena, warrant or other court order or as otherwise required or authorized by law. 7. When information is publicly available.

5. Our Principles of Privacy

1. Establishing Accountability: FinCard Pay is responsible for maintaining and protecting the personal information under its control. Our Privacy Officer is accountable for our compliance with this Privacy Policy. 2. Obtaining Consent: FinCard Pay will require the knowledge and consent of the individual for the collection, use or disclosure of personal information (unless required or permitted by law). 3. Identifying the Purpose and Limiting the Collection of Information: FinCard Pay will identify the purposes for which personal information is collected before or at the time the information is collected, by fair and lawful means. Personal information collected must be limited to those details necessary for the purposes identified by FinCard Pay. 4. Limiting Use, Disclosure and Retention of Personal Information: FinCard Pay may only use or disclose personal information for the purpose for which it was collected unless the individual has otherwise consented, or when it is required or permitted by law. We retain personal information only as long as necessary for those purposes and for the periods set out in the “Retention of Personal Information” section below. 5. Keeping Information Accurate: FinCard Pay will maintain personal information in as accurate, complete, and up-to-date form as is necessary to fulfill the purposes for which it is to be used. If your personal information has changed, please provide the updated information to us or, where the information was supplied by a Company, to that Company. 6. Protecting Personal Information: Personal information will be protected by security safeguards that are appropriate to the sensitivity level of the information. 7. Maintaining Openness of Policies and Practices: FinCard Pay will make information available concerning the policies and practices that apply to the management of personal information. 8. Providing Access to Personal Information: Upon request, an individual shall be informed of the existence, use and disclosure of their personal information, and shall be given access to it, except when legally restricted. Individuals may verify the accuracy and completeness of their personal information and may request that it be amended, if appropriate. 9. Handling Complaints and Questions: Individuals may direct any questions or inquiries with respect to the privacy principles or our privacy practices by contacting our Privacy Officer, who will respond in accordance with the “Access to Personal Information” section below.

6. Personal Information We Collect

We will identify the purposes for which personal information will be collected before or at the time of collection (unless new purposes are later identified as set out above).

6.1 Program Administration

We collect personal information from a Company in order to establish and operate its payout program, including the names and contact information of the individuals the Company has authorized to administer the program, and the names, contact information and approved payment amounts of the Recipients the Company has designated.

6.2 Program Cards and Payments

We collect personal information to issue and administer your Program Card and to load approved payment amounts onto it, including the information we require to verify your identity, to authorize and settle transactions, to provide you with your balance and transaction history, to replace a lost or stolen card and to respond to your enquiries.

6.3 Identity Verification, Fraud and Financial Crime

We collect and use personal information to verify your identity, to screen against sanctions and politically exposed person lists, to monitor for and investigate fraudulent, unauthorized or unlawful activity, and to meet our obligations under applicable anti-money-laundering, retail payments and card network requirements.

6.4 Research and Program Improvement

We may also put personal information to other uses, such as responding to your enquiries and conducting research to better understand, analyze and respond to needs and preferences, and to subsequently develop, enhance, and/or provide products and services to meet those needs. Your personal information may be combined with other personal information collected by us to provide aggregate statistical information about service usage and preferences. Where we use information for these purposes, we do so in a de-identified or aggregate form wherever it is practicable to do so.

6.5 Some Examples of Collection

FinCard Pay may collect your personal information in the following ways (this list includes only some examples and is not exhaustive):

1. Directly from you, when you activate a Program Card, register for the App, contact our support team, or update your contact information. 2. From a Company that has approved a payment to you, including through an individual payment instruction or a bulk payment file uploaded to the Portal. 3. From the Issuer, EPFC, the card network and payment processors, in the form of ledger, load, authorization, clearing and settlement records relating to your Program Card. 4. From identity verification, sanctions screening and fraud prevention service providers engaged by us. 5. Automatically, when you visit our Website or use the App or Portal, through cookies and similar technologies as described below.

7. Use of Your Personal Information

We use your personal information for the purposes identified in this Privacy Policy, and for the following purposes in particular.

7.1 Some Examples of Uses

1. To establish, administer and support a Company’s payout program. 2. To arrange for the issue, activation, replacement, loading, suspension and closure of Program Cards. 3. To authorize, process, record and settle transactions made with a Program Card. 4. To verify your identity and to comply with our obligations under applicable anti-money-laundering, retail payments, sanctions and card network requirements. 5. To detect, investigate, prevent and report fraud, unauthorized transactions and other unlawful activity. 6. To provide you with your balance, payment history and transaction history through the App. 7. To respond to your enquiries and provide customer support. 8. To provide reporting to the Company about its own program, including payment history and card activity for the Recipients in that program. 9. To communicate with you about your Program Card, including service messages, security notices and changes to the Terms of Use or this Privacy Policy. 10. To conduct research and analysis to maintain, improve and develop our products and services. 11. To comply with legal, regulatory, audit and security requirements, and to establish, exercise or defend legal claims.

8. Disclosure of Your Personal Information

FinCard Pay discloses personal information as reasonably required to provide and administer a payout program and a Program Card. Personal information that is shared with a third party for the purposes identified in this Privacy Policy is protected through contractual agreements which contain requirements for confidentiality and comparable privacy safeguards. These contractual agreements are entered into prior to the disclosure of your personal information (unless otherwise permitted or required by law).

8.1 We Do Not Sell Personal Information to Third Parties

FinCard Pay does not sell your personal information, and does not disclose your personal information to third parties for those parties’ own marketing purposes. We do not disclose your transaction-level data to a Company beyond the information described in the “Disclosure to a Company” section below.

8.2 Disclosure to a Company

A Company can see the payments it has approved and loaded to your Program Card, the status of those payments, your card status and balance, and the information it provided to us about you. A Company cannot see where you spend the money on your Program Card. Merchant-level and transaction-level detail from your own spending is not made available to a Company, except in an aggregated and de-identified form that does not identify you or your individual purchases, or where disclosure is required or permitted by law.

8.3 Corporate Transactions

We may use and disclose your personal information to parties connected with a contemplated or actual financing, insuring, sale, assignment, merger, reorganization or other disposal of all or part of our business or assets, including for the purpose of permitting such parties to determine whether to proceed or continue with such transaction, or to fulfill reporting, inspection, audit or other obligations to such parties. Where personal information is disclosed for this purpose before a transaction closes, it will be disclosed under an agreement that restricts its use to evaluating the transaction and requires its return or destruction if the transaction does not proceed. If all or part of our business or assets to which your personal information relates is sold, assigned, or otherwise disposed of, your personal information will be used and disclosed by such parties for substantially the same purposes as described in this Privacy Policy.

8.4 Examples of Disclosure

FinCard Pay may disclose your personal information to and for the following (this list includes only some examples and is not exhaustive):

1. To the Issuer of your Program Card, to EPFC as the payment service provider for the program, to Visa Inc. and to payment processors, as required to issue the card, to hold and move program funds, and to authorize, clear and settle transactions. 2. To third parties that perform services on our behalf, and which may also collect personal information on our behalf for the purposes identified in this Privacy Policy. Such third parties may include identity verification and sanctions screening providers, fraud prevention providers, card production and fulfilment providers, cloud hosting and data storage providers, customer support providers and communications providers. 3. To the Company that approved a payment to you, as described in the “Disclosure to a Company” section above.

4. To FINTRAC, the Bank of Canada, the Issuer’s regulators, the card network and other regulatory or law enforcement bodies, as necessary to meet legal, regulatory, insurance, audit and security requirements, or as permitted or required by law. 5. To our professional advisors, including legal counsel and auditors, where reasonably required and subject to obligations of confidentiality. 6. To a collection agent, where you owe an amount to us and that amount remains unpaid after we have given you notice, and only to the extent permitted by law. 7. To another person, where you have directed or consented to the disclosure.

9. Retention of Personal Information

We retain your personal information only for as long as it is required for the purposes for which it was collected, and for the periods we are required to retain it by law. In general:

1. Identity verification records, transaction records and other records we are required to keep under anti- money-laundering and retail payments legislation are retained for at least five (5) years after the later of the day your Program Card is closed and the day the record was created, and thereafter until we are no longer required to retain them. 2. Program and payment records are retained for the term of our agreement with the applicable Company plus seven (7) years, consistent with applicable tax, audit and limitation-period requirements. 3. Customer support records are retained for twenty-four (24) months following resolution. 4. Website analytics and cookie data are retained for the periods described in the “Cookies and Other Features” section below. 5. Information we hold on behalf of a Company is retained and disposed of in accordance with our agreement with that Company and applicable law. When personal information is no longer required for these purposes, it is securely destroyed, erased or de- identified.

10. Protecting Personal Information

10.1 Internet Security

While we take reasonable steps to protect information transmitted to us, no method of transmission over the internet is completely secure. You should take care to protect your Access Information, to use the App only on a device you control, and to notify us immediately if you believe your Program Card or App credentials have been compromised.

10.2 Storage

We store your personal information in databases operated by us or by service providers engaged by us. Access to your personal information is provided to our employees, service providers and third parties only on a need-to-know basis, and only to the extent required to fulfill the purposes described in this Privacy Policy.

Your information may be stored or processed on servers located outside of Canada, including in the United States. Where personal information is located outside of Canada, it is subject to the laws of that jurisdiction, and foreign governments, courts, law enforcement or regulatory agencies may be able to obtain disclosure of that information under those laws. Wherever your personal information is processed, it remains protected by contractual safeguards comparable to those required by this Privacy Policy.

If you would like more information about our policies and practices for the use of service providers outside Canada, including the countries in which your personal information may be stored or processed, please contact our Privacy Officer at [email protected] or at the address set out above. The Privacy Officer is able to answer questions about the collection, use, disclosure or storage of personal information by service providers outside Canada.

10.3 Safeguards

FinCard Pay is committed to ensuring that your personal information is protected by reasonable security safeguards. In addition to the safeguards set out above for data transmission and storage, FinCard Pay follows generally accepted industry standards to protect your personal information using physical, electronic and procedural security measures appropriate to the sensitivity of the information in our custody or control. Such safeguards may include, but are not limited to, encryption in transit and at rest, access controls and authentication, logging and monitoring, personnel training and confidentiality obligations, and protection against loss or theft, as well as unauthorized access, disclosure, copying, use or modification. FinCard Pay will update and review the reasonableness of the security safeguards as needed on an ongoing basis.

10.4 If There Is a Breach

If personal information in our control is lost or subject to unauthorized access, use or disclosure, and it is reasonable in the circumstances to believe that the incident creates a real risk of significant harm to you, we will report the incident to the Office of the Privacy Commissioner of Canada and, where applicable, to the Information and Privacy Commissioner of Alberta, and we will notify you as soon as feasible, in accordance with applicable law. Where the affected information was provided to us by a Company, we will also notify that Company.

11. Our Website and the Internet

11.1 Visiting our Website

You can visit our Website without telling us who you are or revealing any personal information about yourself. Our web servers collect aggregate, non-personal information such as the pages visited, the time spent on the site, the browser and device used, and the IP address from which the site was accessed. We use this information to understand how our Website is used and to improve it.

11.2 Cookies and Other Features

A cookie is a small data file that a website places on your device. We use strictly necessary cookies to operate the Website, App and Portal and to keep your session secure; these cannot be disabled. We use analytics and preference cookies only where you have consented to them. Where analytics or preference cookies are used, we obtain your consent through a cookie banner presented on your first visit, and you may change or withdraw that choice at any time through the cookie preferences link on the Website. Most browsers can also be configured not to accept cookies; however, disabling strictly necessary cookies may prevent you from accessing parts of the Website, App or Portal. Analytics and preference cookie data is retained for no longer than twenty-four (24) months. Details of the specific cookies in use, their providers and their retention periods are set out in the cookie notice available on the Website.

12. Communications

12.1 Text Message or Email Communications

Where you have provided your mobile telephone number or email address, we may send you service messages relating to your Program Card, including load notifications, security alerts and notices required by law. These are not marketing messages and are necessary to provide the service. We will only send you commercial electronic messages where you have consented to receive them, and every such message will include a means of unsubscribing. Standard message and data rates from your carrier may apply.

12.2 Telephone Communications

We may contact you by telephone in relation to your Program Card, a payment, a support enquiry or a suspected fraudulent or unauthorized transaction. Calls may be recorded for quality assurance, training and security purposes, and where a call is recorded you will be advised at the beginning of the call.

13. Governing Law

This Privacy Policy is governed by and interpreted in accordance with the laws of the Province of Alberta and the federal laws of Canada applicable in Alberta. Nothing in this Privacy Policy limits any right you may have under the privacy legislation applicable to you, or your right to make a complaint to the Office of the Privacy Commissioner of Canada or to the privacy commissioner of your province.

14. Access to Personal Information

You have the right to access the personal information we hold about you. You can access your personal information by making a written request to our Privacy Officer. You may be required to provide satisfactory proof of identification before we can process your request, so that we can protect the security of the personal information.

We will respond to your request within thirty (30) days, or will notify you within that period if we require an extension permitted by law and the reason for it. There is no charge for making a request. If responding to your request would require us to incur costs, we will provide you with an estimate before proceeding and you may withdraw or narrow your request at that time. If we are not able to provide you with access to some of your information, we will advise you in writing of the reasons and of your right to complain. Where possible we will advise you of the source of the personal information, its use and any parties to whom it may have been disclosed.

You may also request that we correct personal information you believe is inaccurate or incomplete. Where we agree, we will correct the information and, where appropriate, notify any third party to whom the incorrect information was disclosed. Where we do not agree, we will annotate the record with your requested correction.

We reserve the right to decline to provide access to personal information where the information requested would disclose:

1. personal information of another individual or a deceased individual; 2. information that is not readily retrievable and where the burden or cost of providing it would be disproportionate to the nature or value of the information; 3. information that does not exist, is not held or cannot be found by us; 4. information that could reasonably result in serious emotional harm to the individual or another individual, or serious bodily harm to another individual; 5. information subject to solicitor-client privilege; or 6. information that may harm or interfere with law enforcement activities, the detection or prevention of fraud or money laundering, or other investigative or regulatory functions of a body authorized by statute to perform such functions. Where we decline access to part of a record, we will provide access to the remainder.

If you are dissatisfied with our response, you may escalate your concern to our Privacy Officer for review and, if you remain dissatisfied, you may complain to the Office of the Privacy Commissioner of Canada or to the privacy commissioner of your province.

15. Changes to this Privacy Policy

We may update or modify this Privacy Policy from time to time. The current version will always be posted at https://fincard.ca/privacy-policy and will show its effective date.

Where a change is material, we will provide you with at least thirty (30) days’ notice before it takes effect, by email to the address we have on file for you, by a notice in the App, or by another method permitted by law. Where a change would involve using or disclosing your personal information for a new purpose that is not required or permitted by law, we will obtain your consent before doing so. Continued use of the Website, App, Portal or Program Card after a change takes effect indicates your acceptance of the updated Privacy Policy, but does not waive any right you have under applicable privacy legislation.

16. Contacting Us and Access to Your Personal Information

If you wish to make further inquiries, access the information that we have about you, request a correction, withdraw consent, or obtain further information about our privacy practices, please contact us at:

FinCard Financial Services Inc. o/a FinCard Pay Attention: Privacy Officer Suite 450, 11150 Jasper Avenue Edmonton, AB T5K 0C7 [email protected]