Privacy Policy

Arbutex Inc.

Last modified: July 3, 2026

Introduction

Arbutex Inc. and our affiliates and subsidiaries ("Company" or "We") respect your privacy and are committed to protecting it by complying with this policy.

This policy describes:

• How we collect, use, disclose, and protect the personal information of our customers and website users ("you").
• The types of information we may collect from you or that you may provide when you visit the website of Arbutex Inc. and use our software-as-a-service platform (collectively, our "Website"), and use our services.
• Our practices for collecting, using, maintaining, protecting, and disclosing that information.

We will only use your personal information in accordance with this policy unless otherwise required by applicable law, or agreed to by you. We take steps to ensure that the personal information that we collect about you is adequate, relevant, not excessive, and used for limited purposes.

Privacy laws in Canada generally define "personal information" as any information about an identifiable individual, which includes information that can be used on its own or with other information to identify, contact, or locate a single person. Personal information does not include business contact information, including your name, title, or business contact information.

This policy applies to information we collect, use, or disclose about you:

• On this Website.
• In email, text, and other electronic messages between you and this Website.
• Through mobile and desktop applications you download from this Website, which provide dedicated non-browser-based interaction between you and this Website.
• When you interact with our advertising and applications on third-party websites and services if those applications or advertising include links to this policy.

The Website may include links to third-party websites, plug-ins, services, social networks, or applications. Clicking on those links or enabling those connections may allow the third party to collect or share data about you. If you follow a link to a third-party website or engage a third-party plugin, please note that these third parties have their own privacy policies and we do not accept any responsibility or liability for these policies. We do not control these third-party websites, and we encourage you to read the privacy policy of every website you visit.

Please read this policy carefully to understand our policies and practices for collecting, processing, and storing your information. If you do not agree with our policies and practices, your choice is not to use our Website. By accessing or using this Website, you indicate that you understand, accept, and consent to the practices described in this policy. This policy may change from time to time. We will notify you in advance of any material changes to this policy and obtain your consent to any new ways that we collect, use, and disclose your personal information.

Information We Collect About You

We collect and use several types of information from and about you, including:

• Personal information, that we can reasonably use to directly or indirectly identify you, such as your name, mailing address, e-mail address, telephone number, internet protocol (IP) address used to connect your computer to the internet, user name or other similar identifier, billing and account information, banking and payment information, tax identification or corporate numbers, and any other identifier we may use to contact you ("personal information").
• Non-personal information, that does not directly or indirectly reveal your identity or directly relate to an identifiable individual, such as demographic information, or statistical or aggregated information. Statistical or aggregated data does not directly identify a specific person, but we may derive non-personal statistical or aggregated data from personal information. For example, we may aggregate personal information to calculate the percentage of users accessing a specific Website feature.
• Technical information, including your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, or information about your internet connection, the equipment you use to access our Website, and usage details.
• Non-personal details about your Website interactions, including the full Uniform Resource Locators (URLs), clickstream to, through and from our Website (including date and time), products you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page, or any phone number used to call our customer service number.
• Customer business and transaction data specific to use of the platform, including currency-related documents, workflow inputs, transaction records and confirmations uploaded by customers, counterparty information, account and exposure data, and identity and onboarding documentation collected for account administration, billing, security, and fraud prevention purposes. Customers using the platform in connection with foreign exchange or other financial services activities may be subject to their own regulatory, AML, recordkeeping, and compliance obligations; Arbutex does not assume those obligations on the customer's behalf.

How We Collect Information About You

We use different methods to collect your information, including through:

• Direct interactions with you when you provide it to us, for example, by filling in forms or corresponding with us by phone, email, or otherwise.
• Automated technologies or interactions, as you navigate through our Website. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies.
• Third parties or publicly available sources, for example, our business partners, or other users of the Website and services.
• Information You Provide to Us. The information we collect directly from you on or through our Website or the related apps may include:
  • Information that you provide by filling in forms on our Website. This includes information provided at the time of registering to use our services.
  • Records and copies of your correspondence (including email addresses), if you contact us.
  • Your responses to surveys that we might ask you to complete for research purposes.
  • You and your authorized users may upload or submit documents, transaction records, workflow inputs, account information, and other business materials to the platform ("Customer Data"). Customer Data is processed in accordance with this policy and any applicable agreement between your organization and Arbutex. You are responsible for ensuring that any Customer Data you upload complies with applicable law and that you have the necessary rights to share such data with Arbutex for processing in connection with the services. Arbutex does not post Customer Data to public areas of the platform or share it with other customers without your authorization.

Customer-Uploaded Documents and Platform Inputs

As you navigate through and interact with our Website and platform, we may use cookies and similar functional technologies to collect certain information about your equipment, browsing actions, and patterns, limited to the following purposes: authentication and session management; security and fraud prevention; user preferences and platform customization; diagnostics, troubleshooting, and performance monitoring; and platform functionality and service delivery.

As you navigate through and interact with our Website, we may use cookies or other automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

• Details of your visits to our Website, including traffic data, location data, logs, and other communication data and the resources that you access and use on the Website.
• Information about your computer and internet connection, including your IP address, operating system, and browser type.

The technologies described in this section are used for authentication, session management, security, user preferences, diagnostics, platform functionality, and performance monitoring. We do not use these technologies for behavioural advertising, cross-site tracking, or ad targeting. We do not participate in third-party advertising networks for the purpose of targeting users of this Website.

The information we collect automatically may be statistical in nature and may include personal information, and we may maintain it or associate it with personal information we collect in other ways, that you provide to us, or we receive from third parties. It helps us to improve our Website and to deliver a better and more personalized service, including by enabling us to:

• Estimate our audience size and usage patterns.
• Store information about your preferences, allowing us to customize our Website according to your individual interests.
• Speed up your searches.
• Recognize you when you return to our Website.

The technologies we use for this automatic data collection may include:

• Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of our Website. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Website.
• Flash Cookies. Certain features of our Website may use local stored objects (or Flash cookies) to collect and store information about your preferences and navigation to, from, and on our Website. Flash cookies are not managed by the same browser settings that are used for browser cookies.
• Web Beacons. Pages of our Website and our e-mails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).

Third Party Use of Cookies and Other Tracking Technologies

Some functionality on the Website may involve third-party service providers (such as analytics, security, and infrastructure providers) that use functional technologies to assist in delivering and improving the platform. These providers are contractually restricted to using any information collected solely for the purposes for which they have been engaged by Arbutex, and are not permitted to use such information for their own advertising, profiling, or tracking purposes.

We do not permit third parties to use cookies or similar tracking technologies on our Website for the purpose of serving targeted or behavioural advertising to our users. Third-party service providers we engage (such as analytics, security, or infrastructure providers) may set functional cookies solely for the purposes for which they have been retained. You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Website or platform.

If you have any questions about how third-party service providers process information in connection with our Website or platform, please contact us using the contact information set out at the end of this policy.

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal information:

• To use Customer Data and other information to provide, operate, secure, support, troubleshoot, maintain, and improve the services for the relevant customer, in accordance with our agreement with that customer and this policy.
• To present our Website and its contents to you.
• To provide you with information, products, or services that you request from us.
• To fulfill the purposes for which you provided the information or that were described when it was collected, or any other purpose for which you provide it.
• To provide you with notices about your account or subscription, including expiration and renewal notices.
• To carry out our obligations and enforce our rights arising from any contracts with you, including for billing and collection or to comply with legal requirements.
• To notify you about changes to our Website or any products or services we offer or provide though it.
• To improve our Website, products or services, marketing, or customer relationships and experiences.
• To maintain the security, availability, and integrity of our Website and SaaS platform, detect and prevent fraud or unauthorized activity, troubleshoot issues, and comply with our legal and contractual obligations.
• In any other way we may describe when you provide the information.

Use of Automated Tools and AI/LLM Processing

Arbutex may use automated tools, artificial intelligence, machine-learning models, and large language model (LLM)-enabled tools to extract, structure, analyze, classify, and process Customer Data and other information uploaded to or processed through the platform. These tools are used for service delivery purposes, including document extraction and digitization, workflow automation, analytics, data organization, audit support, and customer support. Arbutex does not use actual Customer Data or customer-specific documents to train, fine-tune, or otherwise develop AI or machine-learning models without the express prior authorization of the relevant customer. Where Arbutex engages third-party AI or LLM providers to process Customer Data, Arbutex requires those providers to be contractually prohibited from using Customer Data for their own model training, development, or any purpose independent of providing the services to Arbutex.

We may also use your information for any other purpose with your consent.

Disclosure of Your Information

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

Arbutex may use aggregated, anonymized, or de-identified data derived from use of the platform for product improvement, analytics, benchmarking, security monitoring, and service development. Such data will not identify any individual customer or user.

We may disclose personal information that we collect or you provide as described in this privacy policy:

• To our subsidiaries and affiliates.
• In accordance with applicable law, to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our customers and users is among the assets transferred.
• To contractors, service providers, and other third parties we use to support our business (such as analytics and search engine providers that assist us with Website improvement and optimization) and who are contractually obligated to keep personal information confidential, use it only for the purposes for which we disclose it to them, and to process the personal information with the same standards set out in this policy.
• To fulfill the purpose for which you provide it. (For example, if you give us an email address to use the "email a friend" feature of our Website, we will transmit the contents of that email and your email address to the recipients.)
• For any other purpose disclosed by us when you provide the information.
• With your consent.
• As necessary to prove the existence and content of any agreement entered into through the Website.

We may also disclose your personal information:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request, in accordance with applicable law.
• To enforce or apply our terms of use and other agreements, including for billing and collection purposes.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of any person.

Transferring Your Personal Information

We may process, store, and transfer your personal information in and to a foreign country, with different privacy laws that may or may not be as comprehensive as Canadian law. Such countries may include the United States and other jurisdictions in which our service providers, cloud and hosting infrastructure providers, AI and LLM processing providers, analytics and security vendors, and other subprocessors operate. In these circumstances, the governments, courts, law enforcement, or regulatory agencies of that country may be able to obtain access to your personal information through the laws of the foreign country. Whenever we engage a subprocessor or service provider, we require that its privacy and security standards adhere to this policy and applicable Canadian privacy legislation, and that Customer Data is used only for the purposes for which the subprocessor has been retained.

You are welcome to contact us to obtain further information about Company policies regarding service providers outside of Canada.

By submitting your personal information or engaging with the Website, you consent to this transfer, storage, or processing.

Choices About How We Use and Disclose Your Information

We strive to provide you with choices regarding the personal information you provide to us. We have created mechanisms to provide you with the following control over your information:

• Cookies and Functional Technologies. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. To learn how you can manage your Flash cookie settings, visit the Flash player settings page on Adobe's website. If you disable or refuse cookies, please note that some parts of this Website may not be accessible or may not function properly. For more information about the functional technologies we use, see the applicable section above.
• Promotional Offers from the Company. If you have opted in to receive certain emails from us but no longer wish to have your contact information used by the Company to promote our own products or services, you can opt-out at any time by sending us an email stating your request to support@arbutex.ca. If we have sent you a promotional email, you may unsubscribe by clicking the unsubscribe link we have included in the email. This opt-out does not apply to information provided to the Company as part of a product purchase, subscription, or other transaction.

Data Security

The security of your personal information is very important to us. We use physical, electronic, and administrative measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. We store all information you provide to us behind firewalls on our secure servers.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Website, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to our Website. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Website.

Data Retention

Except as otherwise permitted or required by applicable law or regulation, we will only retain your personal information for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Please note that all information associated with agreements you enter into through the Website is intended to be retained for a minimum period consistent with ordinary commercial and legal recordkeeping practices and, in many cases, may be retained permanently as part of the platform's document archive and audit-support functionality. Customers using the platform in connection with regulated financial services activities — including foreign exchange dealing, anti-money laundering compliance, or know-your-client obligations — may be subject to their own statutory or regulatory retention obligations. Arbutex retains Customer Data uploaded to the platform to support customer access, historical records, audit workflows, backup and recovery, dispute resolution, and service administration. Under some circumstances we may anonymize your personal information so that it can no longer be associated with you. We reserve the right to use such anonymous and de-identified data for any legitimate business purpose without further notice to you or your consent.

Customer Data uploaded to the platform, including transaction documents, confirmations, and other business records, may be retained as part of the platform's document archive and audit-support functionality. Customers may use the platform as a centralized record of transaction confirmations and related documents. Deletion requests will be processed in accordance with applicable contractual commitments; however, Arbutex may retain Customer Data for the periods necessary to fulfill backup and recovery obligations, comply with legal holds, support dispute resolution, and satisfy audit or compliance workflow requirements. We will notify you of any applicable retention period that prevents immediate deletion of requested data.

Financial Services Data

As operator of a foreign exchange workflow, analytics, and document-processing SaaS platform, Arbutex Inc. collects and processes categories of business and financial data on behalf of its customers. Customer Data processed through the platform — including trade documents and confirmations, transaction records, counterparty information, account and exposure data, and identity and onboarding documentation — is handled in accordance with the terms of this policy and any applicable customer agreement. Access to Customer Data is restricted to authorized personnel and is subject to security controls appropriate to the sensitivity of such information. Customers using the platform in connection with regulated financial services activities — including foreign exchange dealing, anti-money laundering compliance, securities regulation, and know-your-client obligations — are responsible for their own compliance with applicable financial services legislation and regulatory requirements. Where Arbutex is required by applicable law to retain, report, or disclose information to a regulatory or law enforcement authority, such disclosure may occur without prior notice to you.

Children Under the Age of 18

Our Website is not intended for children under 18 years of age. No one under age 18 may provide any information to the Website. We do not knowingly collect personal information from children under 13. If you are under 18, do not use or provide any information on this Website or on or through any of its features/register on the Website, make any purchases through the Website, use any of the interactive or public comment features of this Website, or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received personal information from a child under 13 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 13, please contact us at support@arbutex.ca.

Accessing and Correcting Your Personal Information

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes. By law you have the right to request access to and to correct the personal information that we hold about you. Please note that this does not apply to information relating to, or forming part of, executed agreements which by its nature must remain unmodified.

You can review and change your personal information by logging into the Website and visiting your account profile page.

If you want to review, verify, correct, or withdraw consent to the use of your personal information you may also send us an email at privacy@arbutex.ca to request access to, correct, or delete any personal information that you have provided to us. We cannot delete your personal information except by also deleting your user account, nor can we delete information that relates to, or forms part of, an executed agreement. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

We may request specific information from you to help us confirm your identity and your right to access, and to provide you with the personal information that we hold about you or make your requested changes. Applicable law may allow or require us to refuse to provide you with access to some or all of the personal information that we hold about you, or we may have destroyed, erased, or made your personal information anonymous in accordance with our record retention obligations and practices. If we cannot provide you with access to your personal information, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

We will provide access to your personal information, subject to exceptions set out in applicable privacy legislation. Examples of such exceptions include:

• Information protected by solicitor-client privilege.
• Information that is part of a formal dispute resolution process.
• Information that is about another individual that would reveal their personal information or confidential commercial information.
• Information that is prohibitively expensive to provide.

If you are concerned about our response or would like to correct the information provided, you may contact our Privacy Officer at mvandendorpel@arbutex.ca.

If you delete Customer Data from the platform, copies may remain in cached, archived, or backup systems for the retention periods described in this policy.

Withdrawing Your Consent

Where you have provided your consent to the collection, use, and transfer of your personal information, you may have the legal right to withdraw your consent under certain circumstances. To withdraw your consent, if applicable, contact us at support@arbutex.ca. Please note that if you withdraw your consent we may not be able to provide you with a particular product or service. We will explain the impact to you at the time to help you with your decision.

Changes to Our Privacy Policy

It is our policy to post any changes we make to our privacy policy on this page. If we make material changes to how we treat our users' personal information, we will notify you by email to the primary email address specified in your account and through the Website.

We include the date the privacy policy was last revised at the top of the page. You are responsible for ensuring we have an up-to-date, active, and deliverable email address for you, and for periodically visiting our Website and this privacy policy to check for any changes.

Contact Information and Challenging Compliance

We welcome your questions, comments, and requests regarding this privacy policy and our privacy practices. Please contact us at:

We have procedures in place to receive and respond to complaints or inquiries about our handling of personal information, our compliance with this policy, and with applicable privacy laws. To discuss our compliance with this policy please contact our Privacy Officer using the contact information listed above.