Personal information means any information that can be used to identify an individual including your name, address, telephone number, email address, scanned copies of your government photo ID and information on the legal matter with which you are seeking assistance with and any other information that you choose to provide. Personal information does not include information that is publicly available such as business contact information. Any personal information that is collected is limited to that information that is necessary in order for us to conduct business in order to provide legal services. We will obtain your direct consent before we collect such information and you can opt out at any time. The personal information is collected only used for the original purpose for which it was collected (unless you provide consent otherwise). All your personal information is protected and safeguarded and not shared with any third party unless you provide your consent to do so. The entcounsel.com website and client portal provide general information to any visitor or user in Ontario who are seeking legal information or services.

By providing us with your personal information, you consent to the collection, use and disclosure of that information as described in this Policy. Your consent can be provided orally, electronically or in writing. However, we only collect personal information in a form that identifies you when you proactively provide it such as filling out our client intake form, creating a portal account, or engaging us for legal services. It includes express oral or written consent, implied consent and opt-out consent. You do not have to provide your personal information and even if you do, you can opt out at any time to having your personal information retained and collected at any time. If your withdrawal of consent has any legal consequences or prevent us from providing legal or other services, we will let you know so you can make an informed decision. Any personal information you provide to us of another individual can only be provided provided that you have obtained the consent of the other person for us to collect, use and/or disclose their personal information. We take reasonable steps to handle such information in accordance with this privacy policy and applicable Canadian laws. We may share your personal information with other lawyers that we work with that may not be part of our firm. When you use our website or portal, we may automatically collect technical information about you (but which does not identify you), such as information about your internet connection, device and usage of the website, through cookies, similar technologies and data analytics software.

We use personal information only as described in this Policy or as otherwise permitted or required by law unless you provide consent. We only collect personal information and limit it to that which is relevant and necessary to provide legal services. We will retain information, including personal information, for as long as it is needed for the purposes for which it was collected. We collect and use personal information for the following:

Legal Services

• To identify conflicts of interest to determine whether we can represent you
• To provide legal services to you
• To carry out a client's instructions
• To verify your identity as required by law (via our identity verification service)
• To manage your client portal account and appointments
• To invoice for our services
• To fulfill legal and professional obligations
• As permitted or required by law
• For other purposes for which you have provided consent

Communications

• Communicating with you including subscribing to our newsletter or as otherwise to be kept informed of legal information
• To provide you with information that you request from us
• To provide articles, blog posts and tools if you have opted in to receive that information
• To send you newsletters about our services, legal developments, articles, legal tools, events and courses if you have opted in to receive such information

Operations

• To administer surveys or request feedback
• To protect against fraud, illegal activities or error
• To understand how you use the website, for data analytics, or statistical analysis

You may change your preferences or unsubscribe from our mailing lists at any time. We may collect such personal information from you directly or through credit bureaus, government agencies or institutions or through other third parties such as employment and other references, employers and service providers.

When you use the Entcounsel client portal, we additionally collect:

• Account information: Login credentials, profile details
• Identity verification: Government-issued photo ID and selfie, processed by our identity verification service provider
• Legal matter information: Documents, descriptions, correspondence related to your legal matters uploaded through the portal
• Payment information: Billing details processed through our payment service provider (we do not store credit card numbers on our servers)
• Communications: Messages sent through the portal messaging system
• Booking information: Appointment dates, times, and meeting preferences

• Legal files: Minimum 10 years after matter completion, as required by the Law Society of Ontario
• Financial records: 7 years, as required by the Canada Revenue Agency
• Account information: Retained while your account is active, plus the applicable retention period above
• Identity verification data: Processed by our verification service provider and retained per their privacy policy

After the applicable retention period, data may be securely destroyed without further notice. Unless you tell us otherwise, your consent remains valid after termination of our relationship with you. We may store your personal information in databases located in the United States, Canada, or other countries. Additionally, some of our service providers may store personal information in the United States or other countries and will be subject to local laws. As a result, in certain circumstances, the United States and other foreign governments, courts, law enforcement agencies or regulatory agencies may be entitled to access personal information under our control. In addition, if you are visiting our website from a country other than Canada, your communication through our website or any of our services may result in the transfer of information across international boundaries. By using our website, portal, or otherwise communicating with us, you consent to the collection, storage, and processing of your information in Canada, United States and in any country to which we may transfer your information in the course of our operations.

Internet Protocol ("IP") addresses are automatically assigned to web users. Such IP addresses may be used to identify an individual using the website in certain circumstances.

Server logs record statistical information, such as a visitor's IP address and type of operating system, the time and duration of visit, categories of visitors, domains, browser types and Web pages requested. Such information does not identify any individual visitor unless it was required to do so due to security or other reasons. Google Analytics tracks visitors to the websites but such personally identifiable information is not shared with Google Analytics. Such information is used to understand website performance. You can opt out of Google Analytics data collection through the Google Analytics Opt-out Browser Add-on.

Google Analytics is a web analytics tool from Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google Analytics uses information obtained by the cookies to evaluate your use of the website for us, to create reports on website activities and to provide further services related to the website and the internet usage for us. This information may be transmitted to a server in the USA and stored there. Please note that Google Analytics information may be disclosed to marketing agency partners that use the data to optimize marketing campaigns. Google will not associate your IP address with any other data held by Google.

You can deactivate the Google Analytics function with a browser add-on, which you can download at tools.google.com/dlpage/gaoptout. To do this you must install that browser add-on. This will prevent the analysis information from being sent to Google.

De-identified Data

We may de-identify, aggregate or anonymize information to identify trends, manage our website, develop statistical information, understand how the website is performing, or develop relevant services. Such information may be shared with third parties for analytical purposes but will not personally identify any individual and therefore is not subject to this privacy policy. For example, we may publicly report how many people have used the website but will not identify any individual user.

Our website collects cookies. Cookies are automatically deposited on a visitor's computer and track information about your visit to our website such as font size, Google and other analytic tools. They are stored temporarily on your computer. This information is not used to try to identify any personal information about our website visitors. The purpose of cookies are to help track performance of the website. They are used anonymously and do not store personally identifiable information. You can opt out of cookies any time by referring to your browser's documentation on how to do so. We may use cookies and similar technologies on certain web pages to help us analyze our website usage, flow, and to help improve future visits. You can manage website cookies in your browser settings, and you always have the choice to change these settings by accepting, rejecting, or deleting cookies. If you choose to change your settings, you may find that certain functions and features will not work as intended on the website. The website is not designed to override "do not track", "disable cookies" or other browser settings and signals regarding online tracking or preferences. For more information on cookies, visit youradchoices.ca (Canada), networkadvertising.org (USA) or allaboutcookies.org.

Portal Cookies

• Session cookies: Required for authentication and maintaining your login state
• Security cookies: Required for CSRF protection and rate limiting

The portal does not use advertising, analytics, or tracking cookies.

We disclose personal information only as described in this Policy, with your consent, or as otherwise permitted or required by law. We may disclose personal information:

• To third parties in the course of providing legal services (e.g. experts, agents, other lawyers and consultants etc.)
• To service providers for the purpose of hosting, technical support, payment processing, identity verification, document signing, appointment scheduling, communication services, credit worthiness, collection of debts, and mailing lists, which is limited only for the third parties services it is providing us. We require the service providers to maintain the confidentiality of the personal information and to take steps to protect the security of the personal information we give it
• Where you have instructed us to disclose your personal information to a third party for a designated purpose
• To insurers and to regulatory agencies
• In connection with a business transaction
• To a third party or parties provided that you gave consent or where such disclosure is required or permitted by law

We do not sell or rent personal information, nor do we provide or offer commercial services of any kind. However, as described above, some third parties may receive, use or analyze personal information as part of the services they provide to our website and portal. All service providers are contractually obligated to protect your information and are prohibited from using it for their own purposes. A list of current service provider categories is available upon request.

We take reasonable steps to protect personal information, including through appropriate physical, organizational and technological safeguards appropriate to the sensitivity of the information. These include:

• Encrypted data transmission (TLS/SSL)
• Encrypted data storage
• Role-based access controls
• Multi-factor authentication on administrative accounts
• Regular security reviews
• Solicitor-client privilege protections on all engagement communications

However, there are inherent risks associated with the use of electronic means of communication so you should not provide us with sensitive personal or business information through unsecured channels. The possibility exists that information could be unlawfully observed by a third party while the data is being transmitted over the internet or while stored on cloud-based servers, or subject to access and review by law enforcement or other authorities. Ultimately, any transmission of personal information is at your own risk.

The website and portal are not intended for use by children, especially those under the age of 13, and we do not knowingly collect personal information from children under the age of 13. If we become aware that a child has submitted personal information to us, we will delete it.

We take reasonable steps to ensure that your personal information is accurate, up-to-date, complete, relevant and updated as necessary to fulfil the purposes for which it is used. You may email us to request access to your personal information to review its accuracy or to update your personal information. You may also email us to request that we delete your personal information or remove it from our website and portal.

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access your personal information held by Entcounsel
• Correct inaccurate or incomplete information
• Request deletion of your information, subject to legal retention obligations
• Withdraw consent to the collection, use, or disclosure of your information (this may affect our ability to provide services)
• File a complaint with the Office of the Privacy Commissioner of Canada

To exercise these rights, submit a request through the Privacy section of your client portal or email privacy@entcounsel.com. Requests will be responded to within 30 days. Please note that we may need to confirm your identity or request additional details in order to process your request.

For complaints about our handling of your personal information, you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

We reserve the right to modify this privacy policy at any time, without notice, in our sole discretion, so please review it frequently. This privacy policy may be updated periodically to reflect changes to our personal information practices and services. The revised privacy policy will be posted on this website. Material changes will also be communicated through the client portal.

For privacy-related inquiries, you can ask to view your personal information by writing to us at any time:

Vandana Taxali
Entcounsel
Email: privacy@entcounsel.com
Portal: portal.entcounsel.com

Please note that we may need to confirm your identity or request additional details in order to process your request.