Personal information means any information that can be used to identify an individual including your name, address, telephone number, email address, scanned copies of your government photo ID and information on the legal matter with which you are seeking assistance with and any other information that you choose to provide. Personal information does not include information that is publicly available such as business contact information. Any personal information that is collected is limited to that information that is necessary in order for us to conduct business in order to provide legal services. We will obtain your direct consent before we collect such information and you can opt out at any time. The personal information is collected only used for the original purpose for which it was collected (unless you provide consent otherwise). All your personal information is protected and safeguarded and not shared with any third party unless you provide your consent to do so. The entcounsel.com website and client portal provide general information to any visitor or user in Ontario who are seeking legal information or services.

By providing us with your personal information, you consent to the collection, use and disclosure of that information as described in this Policy. Your consent can be provided orally, electronically or in writing. However, we only collect personal information in a form that identifies you when you proactively provide it such as filling out our client intake form, creating a portal account, or engaging us for legal services. It includes express oral or written consent, implied consent and opt-out consent. You do not have to provide your personal information and even if you do, you can opt out at any time to having your personal information retained and collected at any time. If your withdrawal of consent has any legal consequences or prevent us from providing legal or other services, we will let you know so you can make an informed decision. Any personal information you provide to us of another individual can only be provided provided that you have obtained the consent of the other person for us to collect, use and/or disclose their personal information. We take reasonable steps to handle such information in accordance with this privacy policy and applicable Canadian laws. We may share your personal information with other lawyers that we work with that may not be part of our firm. When you use our website or portal, we may automatically collect technical information about you (but which does not identify you), such as information about your internet connection, device and usage of the website, through cookies, similar technologies and data analytics software.

We collect personal information that you provide to us through our client intake form, portal registration, and during the course of our legal engagement. This may include your name, email address, phone number, mailing address, and information related to your legal matter.

Your information is used for the purpose of providing legal services, maintaining client records, managing our practice, and ensuring compliance with legal and regulatory obligations. We may also use your contact information to send appointment reminders and case updates if you have provided consent.

We use personal information only as described in this Policy or as otherwise permitted or required by law unless you provide consent. We only collect personal information and limit it to that which is relevant and necessary to provide legal services. We will retain information, including personal information, for as long as it is needed for the purposes for which it was collected. We collect and use personal information for the following:

Legal Services

• To identify conflicts of interest to determine whether we can represent you
• To provide legal services to you
• To carry out a client's instructions
• To verify your identity as required by law (via our identity verification service)
• To manage your client portal account and appointments
• To invoice for our services
• To fulfill legal and professional obligations
• As permitted or required by law
• For other purposes for which you have provided consent

Communications

• Communicating with you including subscribing to our newsletter or as otherwise to be kept informed of legal information
• To provide you with information that you request from us
• To provide articles, blog posts and tools if you have opted in to receive that information
• To send you newsletters about our services, legal developments, articles, legal tools, events and courses if you have opted in to receive such information
• To send SMS notifications regarding your legal matter, appointment reminders, and program updates. You may opt out of SMS communications at any time through the portal or by contacting us

Operations

• To administer surveys or request feedback
• To protect against fraud, illegal activities or error
• To understand how you use the website, for data analytics, or statistical analysis

You may change your preferences or unsubscribe from our mailing lists at any time. We may collect such personal information from you directly or through credit bureaus, government agencies or institutions or through other third parties such as employment and other references, employers and service providers.

When you use the Entcounsel client portal, we additionally collect:

• Account information: Login credentials, profile details
• Identity verification: Government-issued photo ID and selfie, processed by our identity verification service provider
• Legal matter information: Documents, descriptions, correspondence related to your legal matters uploaded through the portal
• Payment information: Billing details processed through our payment service provider (we do not store credit card numbers on our servers)
• Communications: Messages sent through the portal messaging system
• Booking information: Appointment dates, times, and meeting preferences

Once you are a client of the firm, information you share with Entcounsel about your legal matter is kept confidential under the Rules of Professional Conduct of the Law Society of Ontario, and communications made to seek or give legal advice are generally protected by solicitor-client privilege, subject to the limited exceptions recognized by law. Not all information is privileged. Information you send before a solicitor-client relationship is established, including through website forms, general email or an initial inquiry, is not protected by solicitor-client privilege. You become a client of the firm only when you have signed an Engagement Letter, the engagement has been accepted in writing, and any required identity verification has been completed. Nothing on this website is legal advice.

• Legal files: Generally 10 years after matter completion. A file may be retained longer, up to 15 years or more, at Entcounsel’s discretion, including where the client was a minor or an incapable person, where the matter concerned a will or estate, intellectual property or an ongoing agreement, where the matter was complex or contentious, or where retention is prudent for the defence of a claim. Entcounsel does not undertake to retain a file beyond 10 years
• Financial records: 7 years, as required by the Canada Revenue Agency
• Account information: Retained while your account is active, plus the applicable retention period above
• Identity verification: Your identification document is processed by our verification service provider and is not permanently retained by them. Entcounsel separately retains a record of the verification (the type of document presented and the date of verification) for the longer of the duration of the professional relationship and six years after the work is completed, as the Law Society of Ontario requires
• Conflict check records: A minimal record of the names involved and the date, retained so that conflicts of interest can be identified in future matters, for you and for others. This record contains no description of your matter
• Matter documents and work product: Documents and information you provide in connection with a legal matter, together with the advice, correspondence, drafts and other work product created for it, form the matter file and are retained for the period set out above
• Records required to respond to a claim: Anything Entcounsel reasonably requires in order to respond to a claim, complaint or regulatory proceeding, or to comply with a court order or other legal obligation

Deletion is subject to these obligations. Where a record must be kept for one of the reasons above, Entcounsel cannot delete it on request, and will say so and explain why. Information retained under this section is used only for the obligation that requires it to be kept.

Intake where no engagement follows. If you complete an intake and no engagement results, whether because you decide not to proceed or because Entcounsel is unable to act, the information you provided is kept confidential and is not used for any purpose other than those set out above. On request, Entcounsel will delete any part of that information which is not subject to a retention obligation, and will tell you what has been retained and why.

After the applicable retention period, data may be securely destroyed without further notice. Unless you tell us otherwise, your consent remains valid after termination of our relationship with you. We may store your personal information in databases located in the United States, Canada, or other countries. Additionally, some of our service providers may store personal information in the United States or other countries and will be subject to local laws. As a result, in certain circumstances, the United States and other foreign governments, courts, law enforcement agencies or regulatory agencies may be entitled to access personal information under our control. In addition, if you are visiting our website from a country other than Canada, your communication through our website or any of our services may result in the transfer of information across international boundaries. By using our website, portal, or otherwise communicating with us, you consent to the collection, storage, and processing of your information in Canada, United States and in any country to which we may transfer your information in the course of our operations.

Internet Protocol ("IP") addresses are automatically assigned to web users. Such IP addresses may be used to identify an individual using the website in certain circumstances.

Server logs record statistical information, such as a visitor's IP address and type of operating system, the time and duration of visit, categories of visitors, domains, browser types and Web pages requested. Such information does not identify any individual visitor unless it was required to do so due to security or other reasons. Google Analytics tracks visitors to the websites but such personally identifiable information is not shared with Google Analytics. Such information is used to understand website performance. You can opt out of Google Analytics data collection through the Google Analytics Opt-out Browser Add-on.

Google Analytics is a web analytics tool from Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google Analytics uses information obtained by the cookies to evaluate your use of the website for us, to create reports on website activities and to provide further services related to the website and the internet usage for us. This information may be transmitted to a server in the USA and stored there. Please note that Google Analytics information may be disclosed to marketing agency partners that use the data to optimize marketing campaigns. Google will not associate your IP address with any other data held by Google.

You can deactivate the Google Analytics function with a browser add-on, which you can download at tools.google.com/dlpage/gaoptout. To do this you must install that browser add-on. This will prevent the analysis information from being sent to Google.

De-identified Data

We may de-identify, aggregate or anonymize information to identify trends, manage our website, develop statistical information, understand how the website is performing, or develop relevant services. Such information may be shared with third parties for analytical purposes but will not personally identify any individual and therefore is not subject to this privacy policy. For example, we may publicly report how many people have used the website but will not identify any individual user.

When a member of our team connects their Google Calendar, Entcounsel requests permission (via Google OAuth) to view and manage calendar events. We use this access solely to create, update, and cancel meeting events for bookings made through the portal, and to check availability for scheduling.

We store only the OAuth tokens required to maintain the connection and the identifiers of events we create. We do not read, store, sell, or share the contents of unrelated calendar events, and we never use Google user data for advertising. You may revoke Entcounsel's access at any time at myaccount.google.com/permissions or by disconnecting Google Calendar in your portal settings, at which point we delete the stored tokens.

Our website collects cookies. Cookies are automatically deposited on a visitor's computer and track information about your visit to our website such as font size, Google and other analytic tools. They are stored temporarily on your computer. This information is not used to try to identify any personal information about our website visitors. The purpose of cookies are to help track performance of the website. They are used anonymously and do not store personally identifiable information. You can opt out of cookies any time by referring to your browser's documentation on how to do so. We may use cookies and similar technologies on certain web pages to help us analyze our website usage, flow, and to help improve future visits. You can manage website cookies in your browser settings, and you always have the choice to change these settings by accepting, rejecting, or deleting cookies. If you choose to change your settings, you may find that certain functions and features will not work as intended on the website. The website is not designed to override "do not track", "disable cookies" or other browser settings and signals regarding online tracking or preferences. For more information on cookies, visit youradchoices.ca (Canada), networkadvertising.org (USA) or allaboutcookies.org.

Portal Cookies

• Session cookies: Required for authentication and maintaining your login state
• Security cookies: Required for CSRF protection and rate limiting

The portal does not use advertising, analytics, or tracking cookies.

We disclose personal information only as described in this Policy, with your consent, or as otherwise permitted or required by law. We may disclose personal information:

• To third parties in the course of providing legal services (e.g. experts, agents, other lawyers and consultants etc.)
• To service providers for the purpose of hosting, technical support, payment processing, identity verification, document signing, appointment scheduling, communication services, credit worthiness, collection of debts, and mailing lists, which is limited only for the third parties services it is providing us. We require the service providers to maintain the confidentiality of the personal information and to take steps to protect the security of the personal information we give it
• Where you have instructed us to disclose your personal information to a third party for a designated purpose
• To insurers and to regulatory agencies
• To CARFAC Ontario, if you are a member participating in the CARFAC Member Legal Services Program, limited to the information described in the CARFAC Member Legal Services Agreement (name, contact info, service type, fee charged, date, and membership number — never the substance of your legal matter)
• In connection with a business transaction
• To a third party or parties provided that you gave consent or where such disclosure is required or permitted by law

We do not sell or rent personal information, nor do we provide or offer commercial services of any kind. However, as described above, some third parties may receive, use or analyze personal information as part of the services they provide to our website and portal. All service providers are contractually obligated to protect your information and are prohibited from using it for their own purposes.

We use trusted third-party service providers for payment processing (Stripe), identity verification, electronic document signing, email communications, and appointment scheduling. Payment information (credit card numbers) is processed directly by our payment provider and is not stored on our servers. A list of current service provider categories is available upon request.

We use industry-standard security measures to protect your information, including encrypted communications, secure cloud storage, and access controls. Our portal uses Supabase for secure authentication and data storage.

We take reasonable steps to protect personal information, including through appropriate physical, organizational and technological safeguards appropriate to the sensitivity of the information. These include:

• Encrypted data transmission (TLS/SSL)
• Encrypted data storage
• Role-based access controls
• Multi-factor authentication on administrative accounts
• Regular security reviews
• Solicitor-client privilege protections on all engagement communications

However, there are inherent risks associated with the use of electronic means of communication so you should not provide us with sensitive personal or business information through unsecured channels. The possibility exists that information could be unlawfully observed by a third party while the data is being transmitted over the internet or while stored on cloud-based servers, or subject to access and review by law enforcement or other authorities. Ultimately, any transmission of personal information is at your own risk.

Data breach notification. In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as required by PIPEDA. Notification will include a description of the breach, the information involved, and steps we are taking to reduce the risk of harm.

The website and portal are not intended for use by children, especially those under the age of 13, and we do not knowingly collect personal information from children under the age of 13. If we become aware that a child has submitted personal information to us, we will delete it.

We take reasonable steps to ensure that your personal information is accurate, up-to-date, complete, relevant and updated as necessary to fulfil the purposes for which it is used. You may email us to request access to your personal information to review its accuracy or to update your personal information. You may also email us to request that we delete your personal information or remove it from our website and portal. Deletion is subject to the retention obligations set out in Data Retention above. Where a record must be kept, we will tell you what has been retained and why, and will delete anything not subject to an obligation.

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access your personal information held by Entcounsel
• Correct inaccurate or incomplete information
• Request deletion of your information, subject to legal retention obligations
• Withdraw consent to the collection, use, or disclosure of your information (this may affect our ability to provide services)
• File a complaint with the Office of the Privacy Commissioner of Canada

You have the right to access, correct, or request deletion of your personal information, subject to legal retention obligations. To exercise these rights, submit a request through the Privacy section of your client portal, email privacy@entcounsel.com, or call 416-865-0800. Requests will be responded to within 30 days. Please note that we may need to confirm your identity or request additional details in order to process your request.

For complaints about our handling of your personal information, you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

This Privacy Policy, as well as our Terms and Conditions and CARFAC Member Legal Services Agreement, may be updated from time to time to reflect changes to our personal information practices, services, or legal requirements. The revised policy will be posted on this website. By continuing to use the website or portal after changes are posted, you consent to the updated terms. We encourage you to review this policy periodically. Material changes will also be communicated through the client portal.

If you have questions about this privacy policy, please contact:

Vandana Taxali, Entcounsel
Email: privacy@entcounsel.com
Phone: 416-865-0800
Portal: portal.entcounsel.com

Please note that we may need to confirm your identity or request additional details in order to process your request.