Privacy Notice

Verifiction Technologies Inc. ("Verifiction," "we," "us," or "our"), a company incorporated in British Columbia, Canada, operates the Verifiction application, platform, website, hosted application programming interfaces ("APIs"), URL-based retrieval features and related media-authenticity and detection services (collectively, the "Services"). Please read this Privacy Notice carefully. It explains what Personal Information and customer-submitted content we collect and process, what the Services do with that information, how information may be disclosed or retained, and the choices and rights that may be available to you. By accessing or using the Services, creating an account, enabling an integration, or submitting content for analysis, you acknowledge that you have read and understood this Privacy Notice. Where consent is required by applicable law, we will request consent in an appropriate manner. If you have questions about our privacy practices, please see Section 16, "Contact Information."

For purposes of this Privacy Notice, "process," "processed," or "processing" means any operation performed on Personal Information or customer-submitted content, whether by automated means or otherwise, including collection, recording, organization, structuring, storage, transmission, retrieval, consultation, analysis, comparison, use, disclosure, restriction, deletion or destruction. This Privacy Notice applies to information we process: through the Verifiction application, account portal, dashboard or other authenticated Services; through APIs, URLs, webhooks or other customer-enabled integrations; when a customer or user uploads, submits, transmits or directs us to retrieve images, video, audio, documents or other content for analysis; through communications with Verifiction by email, forms, support channels or otherwise; and on behalf of our customers in connection with the Services, as described separately in Section 13. Verifiction generally acts as a controller or equivalent responsible organization for account, billing, security, support, website and business-relationship information that Verifiction determines how and why to process. When Verifiction processes customer-submitted Personal Information solely to provide the Services requested by a customer, Verifiction generally acts as a processor, service provider, contractor or equivalent acting on that customer's instructions. Verifiction's public marketing website may use analytics, advertising or marketing technologies described in Verifiction's separate Cookie Policy. This Privacy Notice describes Verifiction's standard practices. Where an enterprise customer has entered into an Order Form or Data Processing Agreement that varies a specific practice described here, that agreement governs for content submitted under it, and the customer is responsible for providing any notice required to the individuals concerned.

"Personal Data" or "Personal Information" means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with an identifiable individual. It does not include information that has been lawfully anonymized or aggregated so that it can no longer reasonably identify an individual. Depending on how the Services are used, we may process the following categories:

We collect or receive Personal Information through: Direct interactions with you, including information you provide during registration, billing, support, account administration or when you submit your own content. Our customers, customer administrators, authorized users, end users or customer-controlled systems, including information a customer submits about another individual or directs us to process on the customer's instructions. The Services, including direct uploads, URLs, APIs, webhooks and other integrations. Contracted providers used for authentication, hosting, storage, computing, email delivery, payments, security and customer support. Third-party sign-on or linked services, if enabled and selected by the user. When a customer directs Verifiction to retrieve content from a URL or connected system, we may receive the content and associated information from the location identified by the customer. The customer is responsible for having the lawful authority to direct that retrieval and processing.

We process Personal Information for the following purposes:

Canada Where Canadian privacy law applies, we collect, use and disclose Personal Information with meaningful consent, except where processing without consent is authorized or required by law. We identify the purposes for which information is processed and limit collection, use, disclosure and retention to purposes that a reasonable person would consider appropriate in the circumstances. You may withdraw consent to processing that is based on consent, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent will not affect processing that lawfully occurred before withdrawal and may prevent us from providing some or all of the Services. European Economic Area, United Kingdom and Switzerland Where applicable, we may rely on one or more of the following legal bases: Consent, including explicit consent where required for sensitive information. Performance of a contract, including providing the Services requested by you or a customer. Compliance with legal obligations, including obligations connected with civil, criminal, corporate, taxation, regulatory or litigation matters. Our legitimate interests or those of a third party, where those interests are not overridden by applicable rights and interests, including security, fraud prevention, service administration and protection of legal rights. When Verifiction processes Personal Information on behalf of a customer, the customer is responsible for establishing the lawful basis and providing required notices or obtaining required consent.

We do not sell, rent or loan customer-submitted media or Results to data brokers or independent third parties. We may disclose Personal Information only as described below and as permitted or required by law:

• Within Our Corporate Group We may disclose Personal Information to Verifiction affiliates or related entities where reasonably necessary to operate, secure, support, finance or administer Verifiction and the Services. Contractors and Service Providers We may use contracted providers for hosting, cloud storage, computing, authentication, transactional email, payment processing, customer support, security, communications and other functions necessary to provide the Services. Providers may access only the information reasonably necessary to perform their contracted functions and are subject to confidentiality, security and data-processing obligations where required. Customer-Directed Integrations and Webhooks If a customer configures a webhook or another integration, we may transmit limited status or account-activity information, Results or other information selected or authorized by the customer to the system controlled by that customer. Information sent to a customer-controlled system is then governed by the customer's practices and agreements. Other Organizations at Your or the Customer's Instruction You or the customer may direct us to share Results or other information with another organization. Once information is disclosed at that direction, the recipient's privacy practices apply. We are not responsible for an independent recipient's use or security of information. Third-Party Sign-On and Linked Services If you elect to use a third-party sign-on or linked service, that provider may receive information about your use of the connection. Its own terms and privacy practices govern its processing. Legal, Safety and Regulatory Disclosures We may access, preserve or disclose information where we reasonably believe it is necessary to comply with law, legal process, national-security or law-enforcement requests
• protect rights, property or safety
• enforce contracts or policies
• collect amounts owed
• or investigate suspected unlawful activity. Corporate Transactions Information may be disclosed or transferred in connection with a merger, acquisition, financing, reorganization, sale of assets, insolvency or similar transaction, subject to applicable law and continuing privacy obligations.

The authenticated Verifiction application may use essential and functional cookies or similar technologies for authentication, account security, session management, fraud prevention, preferences, load balancing and core functionality. Verifiction's public marketing website may use essential, functional, analytics, advertising or marketing cookies, pixels, web beacons and similar technologies. These technologies, the categories used, available consent choices and instructions for changing preferences are described in Verifiction's separate Cookie Policy and Cookie Settings tool. Cookie choices on the public website may not control technologies used in the authenticated application, and vice versa. You can usually configure your browser to block or delete cookies, although some essential features may not function properly if essential cookies are disabled.

You may choose not to provide or submit information. However, Verifiction cannot perform an analysis without receiving the content and information required for the selected Service. Do not upload, submit, connect or direct us to retrieve content if you do not agree to the processing described in this Privacy Notice. You may manage available cookie categories through Verifiction's Cookie Settings tool and may use browser or device controls to manage cookies and similar technologies. You may unsubscribe from promotional emails using the unsubscribe link in the message. We may continue to send service, security, billing, account and legal communications that are necessary to administer the Services. Customers may disable or change their own webhooks and integrations through available settings or by contacting support. Customers remain responsible for information already sent to systems they control.

Personal Information and customer-submitted content may be processed outside your province, territory or country through related entities or contracted providers. Information processed in another jurisdiction may be subject to the laws of that jurisdiction and may be accessible to courts, law-enforcement agencies or governmental authorities there. Where Canadian privacy law applies, Verifiction remains accountable for Personal Information transferred to a service provider for processing and uses contractual, technical and organizational measures designed to provide an appropriate or comparable level of protection. Where European transfer restrictions apply, we will use an appropriate transfer mechanism required by applicable law.

We retain Personal Information only for as long as reasonably necessary to fulfil the purposes for which it was processed, including providing the Services and satisfying legal, accounting, reporting, security, fraud-prevention, audit, dispute-resolution and enforcement requirements. To determine an appropriate retention period, we consider the nature and sensitivity of the information, the purposes for processing it, the risk of harm from unauthorized use or disclosure, whether the purpose can be achieved through another means, customer instructions, contractual requirements and applicable law. Account, billing, support, security, audit and legal records may be retained for different periods based on those purposes. Retention of customer-submitted media and associated Results is described in Section 13. When Personal Information is no longer required, we will delete, destroy or de-identify it in accordance with applicable law and our retention and disposal procedures. Limited information may remain where reasonably required by law, security, fraud prevention, billing reconciliation, dispute resolution or backup processes.

Subject to applicable law, you may have rights regarding Personal Information, including:

• the right to request confirmation of whether we process Personal Information about you
• the right to request access to Personal Information under our control and information about how it is used or disclosed
• the right to request correction of inaccurate or incomplete Personal Information
• the right to withdraw consent where processing is based on consent, subject to legal and contractual limitations
• where applicable, the right to request deletion, restriction, objection or data portability
• and the right to challenge our compliance or file a complaint with an applicable privacy regulator. the right to appeal a decision we make about a request, and to challenge our compliance or file a complaint with an applicable privacy regulator. To exercise a right, contact support@verifiction.com. We may request information necessary to verify your identity and authority. Canadian access requests will ordinarily be answered within 30 calendar days. Other jurisdictions may prescribe different response periods. Where applicable law permits an extension of the response period, we will inform you of the extension and the reason for it within the original period. If we decline a request in whole or in part, we will explain the basis for that decision and how you may appeal it or complain to the applicable privacy regulator. If Personal Information was submitted by a Verifiction customer, please contact that customer first. Verifiction generally acts on the customer's instructions and will provide reasonable assistance where required.

Verifiction customers may electronically provide or transmit information to the Services for media-authenticity detection, synthetic-media detection, manipulation analysis, source or workflow analysis, or related purposes. Customer processing is also governed by the applicable Terms of Use and Services Agreement, service agreement, customer Order Form and, where applicable, Data Processing Agreement, including the customer's representations, warranties, indemnification obligations and the applicable disclaimers and limitations of liability.

We keep this Privacy Notice under regular review and may update it to reflect legal requirements, technical developments, new Services or changes in our information-handling practices. We will post the updated Privacy Notice and revise the Last Modified date. We will provide additional notice or obtain consent where required for a material change. Continued use after an update may constitute acceptance where permitted by law.

Law-enforcement officials seeking disclosure of records must serve valid legal process issued by a court or other authority with jurisdiction over Verifiction Technologies Inc. Requests should identify the requesting authority, the legal basis, the records sought, the relevant account or transaction and contact information for the responsible official. Legal process should be sent to support@verifiction.com and, where formal service is required, to Verifiction Technologies Inc. at its registered address in British Columbia, Canada. We reserve all rights and objections available under applicable law and may require formal service where appropriate.

If you have questions, concerns or requests concerning this Privacy Notice or our information-handling practices, contact: Organization: Verifiction Technologies Inc. Location: British Columbia, Canada Attention: Privacy Officer Privacy Email: support@verifiction.com Support Email: support@verifiction.com Canadian residents may also have the right to contact the Office of the Privacy Commissioner of Canada or an applicable provincial privacy regulator. Individuals in the EEA or United Kingdom may contact the competent supervisory authority.