Privacy Policy

In this Policy, the following terms have the meaning indicated: Data subject: any natural person about whom Synergie TG collects, holds, discloses to a third party, destroys or anonymizes personal information. Personal information: any information that allows a natural person to be identified, directly or indirectly. Sensitive personal information: information that, by its nature (notably medical, biometric or otherwise intimate) or because of the context of its use or disclosure, gives rise to a high reasonable expectation of privacy. Platform or Service: the GoProsperia web platform, accessible at goprosperia.com and its subdomains, as well as any related application or interface operated by Synergie TG inc.

In accordance with Law 25, Synergie TG has designated a person in charge of the protection of personal information. Person in charge: Serge Tousignant, President Synergie TG inc. Email: privacy@goprosperia.com This person ensures compliance with the Act, handles complaints relating to personal information, oversees privacy impact assessments (PIAs) and maintains the register of confidentiality incidents.

We collect the following categories of personal information: Account information: • Full name • Email address • Phone number • Mailing address (billing) • Language and time zone preferences • Password (stored encrypted and not recoverable in clear text) Business information (entered by you in the Platform): • Information about your business contacts (names, contact details, investor profiles) • Data about the assets and opportunities you manage (real estate, vehicles, art, etc.) • Notes, documents and files you create or upload Technical information (collected automatically): • IP address • Device, browser and operating system type • Activity, access and audit logs • Connection timestamps • Session data Consent record: • Date and time of your acceptance of the Terms of Service and the Privacy Policy • Version of the documents accepted • IP address and browser identifier (user agent) at the time of that acceptance Payment information: Your payments are processed by a third-party provider compliant with the PCI DSS standard (see section 11). Synergie TG does not store any full credit card number or banking details on its systems; only a transaction identifier, the card type and the last 4 digits may be retained for reconciliation and support purposes.

Personal information is collected in one of the following ways: • Directly from you — when creating your account, using the Platform and in any communication with our team; • Automatically — as you browse the Platform (session cookies, server logs, technical data); • Through you — for information concerning third parties (business contacts you enter in the Platform). In this case, you are responsible for obtaining the appropriate consent from those individuals.

We use your personal information for the following purposes: • Providing and operating the Service — creating, managing and maintaining your account and the Platform's features; • Billing — processing your payments and managing your subscription; • Transactional communications — service notifications, alerts, technical support, invoices; • Security — protecting the Platform against unauthorized access, fraud and malicious activity; • Improvement — analyzing aggregated usage to improve the Platform; • Proof of consent — retaining a record of your acceptance of the legal documents so that we can demonstrate, if needed, that this consent was validly obtained and which version of the documents it relates to; • Legal compliance — meeting our legal, tax and regulatory obligations. We never sell your personal information to third parties and we do not use it for third-party marketing purposes.

We process your personal information on the following bases: • Performance of the contract — to provide the Platform you are subscribed to; • Consent — for marketing communications (where applicable) and optional analytics; • Legal obligation — to comply with tax, accounting and other applicable laws; • Legitimate interest — to secure, improve and evolve the Platform, insofar as this interest does not infringe your rights.

Your consent is required for certain processing of your personal information. In accordance with Law 25, when required, your consent must be clear, free, informed, given for specific purposes and presented separately from any other information. You may withdraw your consent at any time by: • Changing your preferences in your account settings; • Contacting us at privacy@goprosperia.com. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. However, it may limit your access to certain features of the Service. Recording of your consent: When your account is created, your acceptance of the Terms of Service and of this Policy is recorded in an append-only register. Each record contains the date and time of the acceptance, the version of the document accepted, and the IP address and browser identifier (user agent) sent by your device at that precise moment. These last two elements serve solely to establish proof of consent: they are not used for any other purpose, are not subject to any profiling and are not cross-referenced with any other data. Records are never modified: if you accept these documents again after a revision, a new record is added without erasing the previous ones.

You may refuse to provide certain personal information. However, refusing to provide the information necessary to deliver the Service (for example, your name, email address or payment information) may result in our inability to enter into the contract and grant you access to the Platform.

In the course of providing the Platform, Synergie TG does not collect sensitive personal information within the meaning of Law 25 (notably medical, biometric or otherwise intimate information). Should an exceptional situation require the collection of such information, your express consent would be obtained beforehand and limited to specific purposes.

In accordance with Law 25, the Platform's privacy settings are configured, by default, to the highest level of privacy, without any action on your part. You may adjust these settings in your account at any time. This provision does not apply to cookie preferences, which are governed by section 18.

We may disclose your personal information to the following recipients: Service providers (subprocessors): • DigitalOcean, LLC — Application and data hosting. • Backblaze, Inc. — Encrypted off-site backups. • Supabase Inc. — User authentication and storage of uploaded files. • Cloudflare, Inc. — Site delivery, protection against attacks and bots, and cookieless traffic measurement. • Stripe, Inc. / Stripe Payments Canada, Ltd. — Subscription management, billing and payment processing. • Anthropic, PBC — Artificial-intelligence processing: extracting information from documents and assistance features. • Amazon Web Services, Inc. — Sending transactional emails (service notifications, invoices, confirmations). • Functional Software, Inc. — Application error monitoring. • Google LLC — Address geocoding (Maps / Places) and optional calendar (Google Calendar) and contacts (Google Contacts) synchronization. • Microsoft Corporation — Optional Outlook calendar synchronization. • Sanity AS — Editorial content management (public blog and in-app announcement banner). Artificial-intelligence providers may process the content you enter or upload to produce the requested result; the data transmitted is not used to train their models. Within your organization: Information you enter may be visible to other authorized users within your organization, according to the access settings configured by your administrator. Professional advisors: We may disclose your information to our lawyers, accountants or other advisors, under a duty of confidentiality, when necessary to defend our rights or perform our obligations. Legal authorities: We may disclose your information if required by law or in response to a valid court order. We never sell your personal information to third parties.

Some of our providers process or store personal information outside Quebec: • Elsewhere in Canada: DigitalOcean, LLC; Backblaze, Inc.; Supabase Inc.; Amazon Web Services, Inc. • United States: Stripe, Inc. / Stripe Payments Canada, Ltd.; Anthropic, PBC; Google LLC; Microsoft Corporation • European Union: Functional Software, Inc.; Sanity AS • Distributed international network: Cloudflare, Inc. In accordance with section 17 of the Act respecting the protection of personal information in the private sector, before any disclosure of personal information outside Quebec, Synergie TG inc. conducts a privacy impact assessment to confirm that the information will receive adequate protection. Our providers are bound by written agreements requiring: • Appropriate security measures • Processing of data only according to our instructions • Notification in case of a security incident

We retain your personal information only as long as necessary for the purposes for which it was collected, and thereafter for as long as required by our legal, tax and regulatory obligations. When the information is no longer needed for these purposes, we destroy it or anonymize it. Retention periods vary according to the type of information and the applicable purpose or legal obligation — for example, billing and tax records are kept for the period required by law. Consent register: the records evidencing your acceptance of the legal documents (see section 7) are retained for the entire life of your account and are destroyed together with it upon deletion. Upon termination of your account: • You have 30 days to export your data (see Right to portability); • Your data is then deleted from our active systems within a reasonable delay, unless a legal retention obligation applies; • Encrypted backup copies are then gradually replaced over the course of our backup cycles.

In accordance with Law 25 and PIPEDA, you have the following rights regarding your personal information: • Right of access — to obtain confirmation that we hold your personal information and to receive a copy of it. • Right of rectification — to have inaccurate, incomplete or ambiguous information corrected. • Right to de-indexing and to cease dissemination (right to be forgotten) — to request that we cease disseminating personal information or de-index any hyperlink attached to your name giving access to information, if such dissemination causes you harm or contravenes the law. • Right to erasure — to request the deletion of your information when it is no longer necessary for the purposes for which it was collected. • Right to portability — to receive, in a structured, commonly used technological format, the computerized personal information you have provided to us, or to have it transmitted to an authorized third party. This right does not apply to information created or inferred from other data, nor to information concerning third parties. • Right to withdraw your consent — at any time, subject to the limits set out in section 7. • Right to be informed of an automated decision — see section 15. Exercising your rights: To exercise these rights, send your written request to the Person in charge of the protection of personal information, by email at privacy@goprosperia.com. Your request must: • Allow your identity to be verified; • Be specific enough to locate the information concerned. We will respond to your request within a maximum of 30 days.

The Platform may include features for analyzing, ranking and recommending investment opportunities based on automated rules or models, including artificial-intelligence models (see section 11). These processes are designed to assist you in your decision-making and not to produce individual decisions about you with legal effects. Should you ever be subject to a decision based exclusively on automated processing of your personal information, we will inform you no later than at the time of the decision and offer you the opportunity to submit your observations to a member of our staff able to review that decision.

We implement technical, organizational and physical security measures to protect your personal information. Technical measures: • Encryption of data in transit (TLS 1.2 / 1.3) and at rest; • Strict multi-tenant isolation between client organizations; • Role-based access control (RBAC); • Detailed logging of access and changes; • Rate limiting on APIs; • Protection against common attacks (CSRF, injection, etc.) at the application and network level; • Encrypted backups. Organizational measures: • Restricting access to personal information to strictly authorized staff; • Adoption of an internal governance policy for the protection of personal information (see section 20); • Staff training and awareness; • Privacy impact assessments (PIAs) for projects involving personal information. Physical measures: • Access to our hosting providers' infrastructure restricted by physical and logical controls; • Strict management of individual named credentials and access logging. No system is completely secure. In the event of an incident, we will apply the procedure described in section 17.

In the event of a confidentiality incident presenting a risk of serious harm, we will: • Assess the incident as quickly as possible; • Take reasonable measures to reduce the risk of harm and prevent recurrence; • Notify the Commission d'accès à l'information du Québec; • Notify the individuals concerned, providing them with: - a description of the incident; - the types of personal information concerned; - the measures taken to reduce the risks; - the measures you can take to protect yourself; - the contact details of a person who can answer your questions. We maintain a register of all confidentiality incidents, in accordance with the requirements of Law 25. This register may be provided to the Commission d'accès à l'information upon request.

The Platform and the goprosperia.com website use only cookies that are strictly necessary for their operation: Essential cookies (required): • Authentication and session management; • Security and fraud protection (CSRF tokens, anti-bot protection on public forms); • Payment processing (checkout session); • Remembering your consent preferences. No advertising, behavioral tracking, or profiling cookie is used. Traffic analytics: we use Cloudflare Web Analytics to measure site traffic. This tool does not set any cookie, does not use any persistent identifier, and cannot track you individually across visits — it only produces an aggregated pageview count. Its loading is nonetheless conditional on your consent: this tool is enabled only if you accept the analytics tier and remains disabled by default. When it is enabled, your browser transmits your IP address to Cloudflare when making the request, as with any online service (see section 3 and section 11). Although Law 25 requires your consent only for technologies that allow you to be identified, located, or profiled — which Cloudflare Web Analytics does not do — we still give you a genuine choice. On your first visit, a banner lets you accept essential cookies only, or also accept traffic analytics. Until you accept the analytics tier, Cloudflare Web Analytics is not loaded and produces no measurement. You can change your choice or review the cookies in use at any time via the "Cookie settings" link at the bottom of the site.

The Platform is intended for professionals and businesses. We do not knowingly collect personal information from persons under 18 years of age. In accordance with Law 25, personal information concerning a minor under 14 years of age may not be collected without the consent of the holder of parental authority or the tutor, unless the collection is clearly for the minor's benefit. If we learn that we have collected personal information from a minor without the required consent, we will take appropriate steps to delete it promptly.

Synergie TG inc. has adopted an internal governance policy for the protection of personal information, in accordance with section 3.2 of the Act respecting the protection of personal information in the private sector. This policy notably governs: • The roles and responsibilities of staff throughout the life cycle of personal information; • The rules for retaining and destroying information; • The complaint-handling process; • Staff training and awareness activities. A summary of the key elements of this governance policy can be obtained on request sent to privacy@goprosperia.com.

We may amend this Policy from time to time, notably to reflect changes in the Platform, our practices or legal requirements. In the event of material changes, we will: • Publish the updated Policy on the goprosperia.com website; • Update the last-updated date shown at the top of the Policy; • Inform you by email or by notice within the Platform; • Seek renewed consent where the changes require it. Your continued use of the Platform after the changes take effect constitutes your acceptance of the revised Policy.

If you are not satisfied with our handling of your personal information, you may: 1. Contact us first: Person in charge of the protection of personal information Synergie TG inc. Email: privacy@goprosperia.com We will review your complaint and respond within a maximum of 30 days. 2. File a complaint with the Commission d'accès à l'information du Québec: Commission d'accès à l'information du Québec 525, boul. René-Lévesque Est, bureau 2.36 Québec (Québec) G1R 5S9 Phone: 418-528-7741 Toll-free: 1-888-528-7741 Website: https://www.cai.gouv.qc.ca

For any question regarding this Policy or your personal information: Person in charge of the protection of personal information Synergie TG inc. Email: privacy@goprosperia.com General support: support@goprosperia.com