Privacy Policy Statement

Last updated August 6, 2026

Effective Date of Updated Privacy Statement August 6, 2026.

This is New Leaf Debt Solutions, Inc.’s (“New Leaf”) privacy policy statement (this “Policy”). This Policy explains New Leaf’s policies for the collection, storage, use and disclosure of personal information collected through our website, social media pages, our designated Member Portal (as defined in our Terms and Conditions), and our mobile App (as defined in our Terms and Conditions). New Leaf abides by applicable privacy legislation, including, but not limited to the Personal Information Protection and Electronic Documents Act (“PIPEDA”), as amended from time to time. This Policy is governed by and designed to comply with the ten principles for the Protection of Personal Information set out in Schedule 1 of PIPEDA, being: Accountability, Identifying Purposes, Consent, Limiting Collection, Limiting Use, Disclosure and Retention, Accuracy, Safeguards, Openness, Individual Access, and Challenging Compliance. In addition, this Policy is subject to New Leaf’s Terms and Conditions, which too may govern certain aspects of our collection and use of your personal information.

1. THE INFORMATION WE COLLECT

   New Leaf offers consumer credit counselling services to Canadian residents only. In connection with a request for our credit counseling services, personal information (“PI”, as defined under PIPEDA), including personal information of a financial nature, such as income, debt, and creditor details (“Personal Financial Information” or “PFI”). The information is required in order for us to provide you with services, and in order to administer your program with your creditors. In addition, we may collect other information which is defined as any information other than PI and PFI that does not reveal your specific identity or does not directly relate to an individual, such as browser information, information collected through cookies, pixel tags and other technologies, demographic information, aggregated and de-identified data.

   New Leaf may, but is not required to, collect any of the following categories of PI and PFI:

   1. General Identifying Information: General Identifying Information may include, but not limited to, your full name, postal address, e-mail address, telephone number, social media account ID, profile photo, other data made publicly available, or data made available by linking your online accounts or other similar identifiers.
   2. Demographic Information and Important Dates: Demographic Information and Important Dates may include, but not limited to, your gender, language preferences, nationality, and/or date of birth.
   3. Financial Information: Financial Information may include, but not limited to, your credit, debit, or other payment data, bank account information, personal financial statements, or other financial personal information about you or your household.
   4. Credit Information: Credit Information may include, but not limited to, your credit score, credit accounts status, and other creditworthiness information about you or your household.
   5. Biometric Data: Fingerprint scan, Retina scan, or Face scan, or other methods of biometric scans that are collected in connection with your account access. Please note that use of FaceID or FingerID to login to the App does not involve capturing of Biometric Data. See Section IV, subparagraph titled “Biometric Authentication Signals.”
   6. Internet or Other Electronic Information: Internet or other Electronic Information may include, but not limited to, your web history, search history, interactions with a website, email, applications, or advertisements, IP address, IP Host location, enabled cookies, or any other information that may be automatically obtained from you while making use of the Sites.
   7. Geolocation information: Geolocation information may include, but not limited to, your real-time location or GPS coordinates data provided by your computer or mobile device or web browser, data derived from your IP address, general location based on nearby Wi-Fi networks or cell towers, location history records, geotags in content uploaded to the Site, or other user location information entered by you.
   8. Categories that may be considered Sensitive Personal information: Such information may include Government Identifiers, Financial Information, Credit Information, or other sensitive information as defined by applicable law.
   9. Inferences drawn from the above information about your predicted characteristics.

   In addition, New Leaf may collect sensitive personal information (“SPI”), which is information that is inherently sensitive in nature. This includes but is not limited to:

   • Government issued identification numbers.
   • Credit score and credit reports.
   • Investment information and accounts.
   • Canadian Tax Authorities documents.
   • Personal financial statements.
   • Biometric Data (if collected).
   • Any other information, beyond the categories above, which is used or associated with a financial account belonging to you or your financial well-being.

   For purposes herein, “personal information” means any such information about an identifiable individual, including any PI, PFI, or SPI.

   New Leaf may collect non-personal information (“NPI”), being information that does not directly or indirectly reveal your identity or relate to an identifiable individual. New Leaf is not required to treat NPI in accordance with PI or PFI protections set out in this Policy.

   Categories of non-personal information include, but are not limited to: demographic information; statistical or aggregated information; Uniform Resource Locators (URLs); clickstream data to, through, and from our Website (including date and time); products or services you viewed or searched for; page response times; download errors; length of visits to certain pages; page interaction information (such as scrolling, clicks, and mouse-overs); methods used to browse away from a page; and any phone number used to call our customer service number.

   New Leaf may derive NPI from personal information. Where derived NPI cannot be reasonably used, alone or in combination with other information, to identify an individual, it will be treated as NPI for the purposes of this Policy. However, if NPI is combined with personal information in a manner that directly or indirectly reveals an individual’s identity, New Leaf will treat the combined information as personal information in accordance with this Policy.

2. HOW WE COLLECT INFORMATION

   New Leaf may collect PI, PFI, and SPI (each as described in this Policy) from the following sources:

   • Information we receive from you on applications or other forms submitted by you, whether submitted through the Internet or manually, as well as through face-to-face conversations, telephone calls, our web-portal, and e-mail communications. This information may include PI, PFI, and SPI as defined in this Policy.
   • PI, PFI, and SPI that may be developed internally as part of your interaction and transactions with us.
   • PI, PFI, and SPI that we may receive from your creditors (e.g. statements, balances, requests, letters, etc.).
   • Certain PI is collected by the App, the Portal, and most browsers and/or through your device, such as your Media Access Control (MAC) address, device type, make and model, operating system and version, unique device identifiers (such as IDFV on iOS or Android ID), mobile carrier (if applicable), browser type and version, language and locale settings, time zone, screen resolution, and App version and build number. We use this information to ensure websites function properly, for fraud detection and prevention, and security purposes.
   • From marketing or analytics partners, such as Google, Meta, or other third-party partners.
   • From government agencies or public records.
   • Various third parties, such as public databases, joint marketing partners, financial service providers.
   • From all communications with you, whether by e-mail, mail, facsimile, or phone. Please note that all calls with you are recorded for purposes of accuracy and performance reviews, compliance with applicable laws and regulations, and dispute resolution.
   • Mobile SDKs. The App uses software development kits (“SDKs”) for analytics, crash reporting, and performance monitoring. These SDKs may generate identifiers and collect telemetry about App usage.

   New Leaf may use cookies, web beacons, pixel tags, and other automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

   • Details of your visits to the App, the Portal, and other browsers, including traffic data, logs, and other communication data, and the resources you access and use on the Website.
   • Information about your device and internet connection, including your IP address, operating system, browser type and version, and device identifiers.
   • Your browsing and interaction patterns on the App, the Portal, and other browsers, including pages visited, links clicked, time spent on pages, and navigation paths.

   This information may constitute personal information under PIPEDA where it can be used, alone or in combination with other information, to identify you as an individual. Where it does, New Leaf will handle it in accordance with this Policy and PIPEDA’s Schedule 1 principles.

   New Leaf may use automatic data collection technologies to collect information about your online activities over time and across third-party websites or online services for the purpose of delivering interest-based or tailored advertising (“online behavioural advertising” or “OBA”). The Office of the Privacy Commissioner of Canada considers OBA to involve the collection of personal information and requires meaningful consent. Where New Leaf engages in OBA, we will obtain your consent in accordance with PIPEDA prior to doing so.

   You may opt out of tailored advertising at any time by visiting the Digital Advertising Alliance of Canada Opt-Out Tool. Please note that opting out of OBA means that the advertisements you receive will not be tailored to your inferred interests based on your browsing behaviour.

   The information we collect automatically helps us to operate, maintain, and improve our Website and App, and to deliver a more personalized experience. Specifically, this information enables us to:

   • Estimate our audience size and usage patterns.
   • Store information about your preferences and customize experiences to your individual interests.
   • Recognize you when you return to the App, the Portal, and other browsers.
   • Improve the speed and relevance of search results.
   • Detect, investigate, and prevent fraudulent or unauthorized activity.

   For information about the specific technologies we use for automatic data collection, including cookies, see Section X of this Policy.

3. HOW WE USE YOUR INFORMATION

   The personal information, whether in the form of PI, PFI, or SPI, from the Categories provided in this policy, which New Leaf collects is used to provide our services to our clients. The client’s contact information may also be used for other internal purposes such as sending New Leaf’s newsletters, updates, announcements and other information or to better serve our clients. For more information on how to opt-out of this information usage, see Section IX of this Policy.

   New Leaf may use aggregated or anonymous information which will not be linked to identified individuals for various other uses for itself and third parties.

4. MOBILE APP AND CLIENT PORTAL SPECIFIC PRIVACY POLICY TERMS.
   1. When you register for or log into the client Portal or App, we may collect information necessary to establish, secure, and maintain your account, including any of the following:
      • Credentials. Username, password (stored in hashed or otherwise cryptographically protected form), security questions and answers, and password-reset tokens.
      • Identity and Contact Data. Full name, client or matter number, email address, telephone number, mailing address, and any other identifiers you provide during onboarding.
      • Multi-Factor Authentication (MFA) Data. One-time passcodes, authenticator-app tokens, backup codes, SMS or email verification codes, and records of successful and failed authentication attempts.
      • Biometric Authentication Signals. If you choose to enable fingerprint, face, or other biometric sign-in authentication feature to access the App on your device, your biometric data remains on your device. New Leaf does not receive, collect, store, or have access to any fingerprint, facial geometry, or other biometric identifier. Authentication is performed locally by your device’s operating system, which returns to us only a “success” or “failure” signal and, where applicable, a device-bound cryptographic token.
   2. The Portal or App allows you to upload, exchange, and store information in connection with our engagement. We collect and process:
      • Documents, files, forms, images, you upload, send, or receive through the Portal or App;
      • Messages, comments, notes, requests, and other communications you send to us or to other authorized users through in-product messaging;
      • Electronic signatures, signature metadata (such as timestamp and IP address), and records of documents you have reviewed, acknowledged, or signed;
      • Payment processed directly by us, or through a third party of our choosing (if applicable); and/or
      • Any additional information you choose to provide through intake forms, questionnaires, or profile fields.
   3. The App may request your permission to access certain features or data on your device. If the App requests such permissions, you may grant or deny each permission, and you may change your choices at any time in your device settings. Denying a permission may limit certain features. The permissions we may request include:
      • Camera. To capture photographs of documents, identification, or other materials you wish to upload.
      • Photo Library / Files and Media. To allow you to select and upload documents, images, or files already stored on your device.
      • Microphone. Only if you choose to record or send voice messages or participate in in-app audio communications (if such feature is available or becomes available).
      • Notifications. To deliver push notifications regarding your account, matters, messages, deadlines, and security alerts. If you enable push notifications, we may send you alerts concerning account activity, new messages, document requests, appointment reminders, payments, and security events. You may disable push notifications at any time through your device settings or within the App.
      • Biometrics / Secure Enclave (if available). To enable biometric unlock of the App, handled by the device operating system as described above. No biometric data is stored or maintained by New Leaf. You may disable the use of the biometric enclave at any time through the App and/or through your device settings.
      • Location. Only if expressly enabled by you and only to support specific features (for example, locating a nearby office or flagging anomalous sign-in locations for security). We do not collect precise, continuous background location.
      • Contacts and Calendar. Only if you choose to invite another authorized user or add appointments to your calendar; we do not upload your full contact list or calendar to our servers.
   4. When you download the App from a third-party store (such as the Apple App Store or Google Play), the store may collect information about your download and use of the App in accordance with its own privacy practices. We do not control, and are not responsible for, the data practices of those stores. Any in-App payments are processed by the applicable store or by our designated payment processor, each of which maintains its own privacy policy. New Leaf does not receive personal information from Apple or Google in connection with App downloads beyond what is described in this Policy.
   5. In addition to the uses described in the Policy, we use information collected through the Portal or App to:
      • Create, authenticate, and maintain your account and verify your identity.
      • Provide, operate, and support the Portal and App, including delivering documents, messages, and other content to you.
      • Facilitate communications and collaboration between you and our personnel regarding your account or customer service engagement.
      • Enable electronic signatures, document review, task tracking, and scheduling.
      • Process payments and related financial transactions.
      • Monitor, detect, investigate, and prevent fraudulent, unauthorized, or unlawful activity, and enforce our terms of use.
      • Troubleshoot, debug, and improve the performance, reliability, and user experience of the Portal and/or App.
      • Conduct internal analytics regarding usage and feature adoption, using aggregated or de-identified data, except where identified data is reasonably necessary for a specific operational purpose.
      • Comply with legal, regulatory, professional-conduct, and court-ordered obligations, including records-retention requirements applicable to our engagement.
   6. Additional Rights Specific to App and Portal Use. In addition to the rights described in the Policy, you may exercise the following choices with respect to the App or Portal:
      • Update or correct your account profile information from within the Portal or App.
      • Grant, deny, or revoke device permissions (camera, microphone, notifications, location, etc.) through your device settings.
      • Enable or disable biometric sign-in at any time through the App’s security settings.
      • Manage or turn off push notifications through your device or within the App.
      • Log out of active sessions and, where available, remotely revoke trusted devices.
      • Request access to, correction of, or deletion of your personal information, subject to applicable law and our retention obligations.
      • Uninstall the App from your device at any time, which will stop further collection of information through the App, although information previously collected will remain subject to this Policy.
   7. Portal and App Data Storage. Although our App and Portal data is stored on a cloud based service, none of your account information will be stored on the cloud. Rather, each time you attempt to log in to your account, the App or Portal will make an API call to the server in which the data is located and will retrieve the data; once the session is terminated, so is the access to the data. Your account data is not cached or persistently stored on your device. For information on how and where your account data is retained, including applicable retention periods, please see Section VI of this Policy.
5. WHO WE SHARE THIS INFORMATION WITH

   New Leaf does not share Personal Information with third parties except as required to provide or improve our services. The nature of our services requires New Leaf to disclose Personal Information to creditors. New Leaf may provide Personal Information to its consultants, subcontractors and professional advisers or other third parties (each of which shall be bound by privacy obligations) to assist New Leaf’s uses disclosed herein. If New Leaf refers a client to a third party for advice or services New Leaf does not provide, it will share that client’s Personal Information with the third party after the client agrees to use such services.

   New Leaf will disclose Personal Information without an individual’s knowledge or consent if we receive an order, subpoena, warrant or other legal requirement issued by a court, tribunal, regulator or other person with jurisdiction to compel disclosure of an individual’s Personal Information. If we receive a request from a police officer or other law enforcement agency for access to your Personal Information in the course of an actual or potential investigation, our policy is to require the police officer or law enforcement agency to obtain an order, subpoena or warrant, unless the information is urgently required to prevent serious bodily injury or serious damage to personal property. If we receive a written request from a police officer or other law enforcement agency with authority to request access to your Personal Information in the course of an actual or potential investigation into a breach of a law, our policy is to provide the requested information.

   New Leaf may disclose personal information, in accordance with applicable law, to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of New Leaf’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by New Leaf about our clients and users is among the assets transferred. Such disclosure may also occur prior to the completion of any such transaction, to the extent necessary for due diligence purposes. In either case, New Leaf will take reasonable steps to ensure that the receiving entity is bound by privacy obligations no less protective than those set out in this Policy or as otherwise required by applicable law, including PIPEDA.

   New Leaf may also disclose personal information where we believe disclosure is necessary or appropriate to protect the rights, property, or safety of New Leaf, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

6. SMS AND PHONE CALL OPT-IN AND OPT-OUT

   You acknowledge that by providing your phone number and/or joining our SMS Service, you authorize New Leaf to contact you (including using artificial intelligent autodialers, automated text and pre-recorded messages and calls, as well as AI generated calls and messages) via your telephone, cellphone, mobile device (including SMS and MMS) and email, even if your telephone number is currently listed on any state, federal or company’s Do Not Call list. Standard phone and data charges will apply. Your consent to the above terms is not required as a condition of purchasing or receiving our services. You also consent to the recording and monitoring of all calls to and from us. You may opt out of receiving such phone calls or text messages to your mobile device at any time by emailing us your instructions at privacyofficer@newleafdebt.ca. You may also opt-out and remove your authorization to receive SMS text messages by replying with “STOP”, “END”, “QUIT”, “UNSUBSCRIBE”, or “CANCEL” to any SMS you receive or by going to Members of New Leaf.

   No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

7. SECURITY

   Personal Information is stored in a combination of paper and electronic files. All paper files are stored on our facilities in Canada. Client electronic files are stored at our IT Vendor servers. We take commercially reasonable precautions to protect your personal information and only provide employees access to it on a need-to-know basis. In an effort to prevent the unauthorized access, disclosure, dissemination, misuse, loss, alteration or destruction of your personal information, we have employed commercially reasonable physical, electronic, and managerial measures to protect your data, and we periodically review these policies and procedures to prevent these types of acts. These files are protected by security measures appropriate to the nature of the information. Client data on New Leaf’s network is encrypted in transit, and all data is encrypted at rest. Backups are run at least once per day and all backups are encrypted, air gapped and zero trust.

   However, despite our best efforts, no security policy, procedures or practices are adequate to protect against all types of threats or data losses, and no type of data transmission method is impenetrable to interception.

   Furthermore, access to your account information through the member Portal or App requires unique credentials that are set by you. You agree to ensure to take all measures to protect those credentials (such as username and/or password), and to ensure you are not accessing the Portal or App from unsecured networks or locations. We recommend that you set a password that only you know and that is sufficiently secured and require you to meet specific character requirements. Do not share your password, and do not reuse passwords that you may have used in other online accounts.

   You will be promptly notified in writing in the event of theft, loss, unauthorized use or release of your non-public personal information.

8. ACCESSING INFORMATION

   Individuals may review their personal information contained in New Leaf’s files by contacting the New Leaf privacy officer at the email address provided at the end of this Policy. For your convenience, New Leaf created a data request form on our website to allow you to take the following actions:

   1. Request to Know. You may request to know whether we process your Personal information and to access such Personal information. You may request to receive the specific pieces or a copy of your Personal information, including, where applicable, a copy of the Personal information you provided to us in a portable format. Depending on where you reside, you may request that we disclose to you the following information:
      1. The categories of Personal information we collected about you and the categories of sources from which we collected such Personal information;
      2. The business or commercial purpose for collecting, selling, or sharing (if applicable) Personal information about you;
      3. The categories of Personal information about you that we sold or “shared” and the categories of third parties to whom we sold or “shared” such Personal information (if applicable); and
      4. The categories of Personal information about you that we otherwise disclosed and the categories of third parties with whom we disclosed such Personal information (if applicable).
   2. Request to Delete. You may request that we delete some of your Personal information. You understand that because New Leaf is required, in accordance with regulatory requirements, to maintain files for a certain period of time as provided in applicable regulations. Therefore, New Leaf cannot upon request delete PI, PFI, or SPI belonging to the client, which must be maintained by New Leaf to comply with the applicable regulatory requirements.
   3. Request to Appeal. If we refuse to act on your request, you may appeal our refusal within a reasonable period after you have received notice of the refusal.
   4. Request to Correct. You may request that we correct inaccuracies in your Personal Information.
   5. Request to Opt-Out of Sale, Targeted Advertising, Limit Disclosure of Sensitive Information and/or Sharing. You may request to opt-out of the “sale” of your Personal information and/or targeted advertising, including the “sharing” of your Personal information for cross-context behavioral advertising purposes. You may also limit the Disclosure and Sharing of your Sensitive Information.

   Submitting a Data Request. To submit a data rights request in accordance with the above, please visit our Data Rights Request page.

9. OPT-OUT POLICY, YOUR NEWSLETTER AND EMAIL SUBSCRIPTIONS

   You can opt-out or unsubscribe to a newsletter or other email list at any time by following the instructions at the end of the newsletters or emails you receive. Please allow up to ten business days for changes to take effect. Client service-related communications are an integral part of the services you receive from us and you may continue to receive such service-related emails unless you cancel your account, even if you opt out of the newsletters or email list. If you have provided more than one email address to us, you may continue to be contacted unless you request to unsubscribe each email address you have provided. You may also opt-out of receiving our newsletter or marketing emails by contacting us at the unsubscribe email or by replying to an existing email with your request to be removed from the mailing list or click here.

10. COOKIES

    This website, https://www.newleafdebt.ca/ (the “Website”), uses cookies to improve the Website’s performance and to enhance your user experience. Certain areas of the Website also use cookies to understand more about our uses in an effort to offer more personalized experiences.

    If you have any questions in relation to the cookies we use, please contact us at privacyofficer@newleafdebt.ca or 647-259-2547.

    1. What is a cookie?

       A cookie is a small text file placed on your device by the websites that you visit. Cookies are then sent back to the website on each subsequent visit, or to another webpage that recognizes that cookie. Cookies are used in order to make the website work, or to work more efficiently, as well as to provide information to the owners of the website. Such information may be used to provide a more personalized and responsive service. Cookies may be either first party cookies set directly by us to your device, or third-party cookies set by a third party provider on our behalf. Whenever you use this Website, information may be collected through the use of cookies and other similar technologies (e.g., web beacons, tags, scripts, local storage).

    2. Cookies we may use and why

       When we use cookies on our Website, we may classify them into any one of the following categories:

       • “Strictly Necessary” cookies are necessary for the Website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms.
       • “Analytics and Performance” cookies allow us to track analytics by counting visits and traffic sources so we can measure and improve the performance of our Website. They may be set by us or by third party providers Google Analytics, Matamo & Anura to help us know which pages or videos are the most and least popular and see how visitors move around the Website.
       • “Functional” cookies enable the Website to provide enhanced functionality and personalization based on your interaction with the Website. They may be set by us or by third party providers, such as Adobe, whose services we have added to our pages.
       • “Advertising and Targeting” cookies may be set through our Website by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant advertisements on other websites.
       • “Social Media” cookies are set by social media services (e.g., Twitter, LinkedIn, Facebook, YouTube, Pinterest, Instagram) that we have added to the Website to enable you to share our content with your friends and networks. These cookies are capable of tracking your browser across other websites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit.
    3. How long will cookies remain on my device?

       The length of time cookies will stay on your device will depend on whether it is a “persistent” or “session” cookie. A persistent cookie will be stored by a web browser and will remain valid until its set expiration date, unless deleted by you before the expiration date. A session cookie, on the other hand, will expire at the end of your web session, when the web browser is closed.

    4. Cookies that have been set in the past

       If you have disabled one or more cookies, we may still use information collected from cookies prior to your disabled preference being set; however, we will stop using the disabled cookie to collect any further information.

    5. How can I control cookies?

       Please keep in mind, removing or disabling cookies may impact your user experience and parts of this Website may no longer be fully functional.

       You may also be able to change your browser settings to manage and control cookies.

       For more information on cookies used by other websites or pages, please refer to the specific privacy or cookie notice on those websites.

    6. Email communications

       We may also use tracking technologies to determine whether you have read, clicked on, or forwarded certain email communications we send to you so that we can make our communications more helpful and interesting. If you do not wish us to confirm whether you have opened, clicked on or forwarded our communications, you will need to unsubscribe, as it is not possible for us to send these emails without tracking enabled. Registered subscribers can update their communication preferences at any time by contacting us, or you can unsubscribe following the instructions in the individual email communications you receive from us.

    7. Changes to this Cookie Notice

       We may modify or amend this Cookie Notice from time to time at our discretion. When we make changes to this notice, we will amend the revision date at the top of this page, and such modified or amended Cookie Notice shall be effective as to you and your information as of that revision date.

       We encourage you to periodically review this Cookie Notice to be informed about how we are using cookies.

11. THIRD-PARTY WEB BEACONS

    New Leaf may also use third-party web beacons from Yahoo! to help analyze where visitors go and what they do while visiting the Website. Yahoo! may also use anonymous information about your visits to this and other websites in order to improve its products and services and provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by Yahoo!, visit https://legal.yahoo.com/us/en/yahoo/privacy/dashboard/index.html to learn how to opt out of this service.

12. RETENTION OF PERSONAL INFORMATION

    New Leaf will retain your personal information for as long as it remains necessary to fulfil the identified purposes for which it was collected, as set out in this Policy, or as required by applicable law or our internal retention schedules. In accordance with PIPEDA’s Limiting Use, Disclosure and Retention principle (Schedule 1, Principle 5), New Leaf will not retain personal information for longer than is necessary to fulfil those purposes and will take reasonable steps to destroy or permanently de-identify personal information that is no longer required.

    New Leaf reserves the right to retain personal information records for both active and inactive or unsubscribed clients to the extent permitted by applicable law and consistent with our retention obligations, including any legal, regulatory, or professional obligations that may require retention beyond the termination of our relationship with you.

13. CHILDREN AND MINORS

    The Website, our Member Portal, our App, and our services offered on the Website are not directed to children. In fact, our Website, Member Portal, App, and services are not offered to minors under the age of 18 years. We will not knowingly collect personal information from individuals under the age of 18. We do not allow minors (persons who are under the age of majority in their place of residence) to create accounts, make purchases or enter contests or promotions, or otherwise make any use of the Website. If you believe your child entered information on our site, please let New Leaf know so we can remove the information from our site database.

14. STORAGE OUTSIDE OF CANADA

    Your Personal Information may be used or stored by us or our service providers and our technology vendors outside of Canada. While paper files are stored in our Canadian offices, electronic data may be stored outside of Canada on secured servers of our IT service provider. We require that our service providers and our corporate affiliates safeguard your personal information. However, if your personal information is used or stored outside of Canada, it will also be subject to the laws of the country in which it is used or stored. The privacy laws of these jurisdictions may differ from Canadian privacy law and may not provide the same level of protection.

    Although our App and Online Portal are hosted on Firebase, a cloud-based hosting service, your data is not stored on Firebase. Your account data is retrieved via API calls to our servers each time you log in and is not cached or persistently stored on your device. Upon termination of your session, access to your data through the App or Portal is ended until your next authenticated login. If you ever request to delete the App or Online Portal access, it will end the API access to your data, and the data will remain only on our data servers for the continued performance of our services with regards to your debt management plan. For further information on how your data is stored and retained, see Section XII of this Policy.

15. GENERAL

    New Leaf reserves the right to amend this Policy from time to time by posting an updated version on the Website. If such amendments affect how New Leaf uses or discloses personal information already held by New Leaf in a material way, New Leaf will send such updated privacy policy statement in advance of the effective date, and the continued use of the Website, Member Portal, and App, shall constitute consent to the updated Policy.

    Notwithstanding the general terms of this Policy, the collection, use, and disclosure of personal information may be made outside of the terms herein to the extent provided for in any applicable privacy or other legislation in effect from time to time, or pursuant to court orders.

16. CONTACT US

    For more information on New Leaf and privacy, or if you believe that New Leaf has not handled your personal information in accordance with this Policy or PIPEDA, please contact our Privacy Officer at: privacyofficer@newleafdebt.ca. If you are unhappy with the way New Leaf has processed your personal information, you have a right to complain to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or 1-800-282-1376.

YOU AGREE THAT YOU HAVE READ, UNDERSTAND AND AGREE TO BE BOUND BY THE TERMS AND CONDITIONS AND THIS PRIVACY POLICY. PLEASE KEEP THIS PRIVACY POLICY IN YOUR RECORDS.

We retain previous versions of this Policy for record-keeping and compliance purposes.