Privacy Statement

Our Commitment to Privacy

Haventree Bank is committed to maintaining the accuracy, confidentiality, and security of your personal information. We value the trust you have placed in us and wish to provide assurance that nothing is more important to us than the security and appropriate use of your personal information.

This Privacy Statement (the “Statement”) is designed to inform you of the policies and practices we have put in place to manage your personal information as well as the rights you have with regard to your personal information. We encourage you to read this Statement so that you can better understand how we collect, use, share, and protect your personal information and how you can exercise your rights.

Accountability What is Personal Information?Consent How we Collect your Personal Information The Personal Information We Collect How We Use Your Personal Information How We Transfer and Disclose Your Personal Information

How we Protect Your Personal Information Retention of Sensitive Personal Information Automated Decision-Making Individual Rights Information about our Website Legal Disclaimer

Accountability

We have appointed a Chief Privacy Officer to oversee compliance with our privacy obligations and commitments. You may contact our Chief Privacy Officer, using any of the methods below, with any questions about our policies and practices with respect your personal information:

Haventree Bank – Chief Privacy Officer
Email	privacyofficer@haventreebank.com
Mailing Address	Haventree bank Attn. Chief Privacy Officer PO Box 1160, STN TD, Toronto, ON M5K 1P2

You can issue a complaint to us if you have any concerns about the handling of your personal information.

You may also contact the relevant regulatory authority, e.g., the Office of the Privacy Commissioner of Canada if you have concerns about our adherence to applicable privacy legislation or the principles set out in this Statement.

What is Personal Information?

Personal information is any factual or subjective information relating to a natural person, including prospective, existing and former clients, business partners, and employees, which allows that person to be identified, either directly or indirectly.

Personal information does not include business contact information, such as name, title or business address or business telephone number of an employee, broker, other contracted distributor or an organization used for communicating with the individual in relation to their employment or business.

Examples of personal information include:

Individual name, date of birth/age, mailing or residential address, phone number, email address, occupation, and marital status;
Education and employment information, tax forms, health & safety records;
Credit bureau information, Social Insurance Number, bank statements, void cheques and balances, assets and liabilities, income/compensation;
Biometric information (e.g., voice recording, fingerprints, facial images, signature, etc.);
Health information including disability;
Behavioural information (e.g., click activity, apps used, etc.), dietary preferences religious beliefs, race or ethnicity, political affiliations, sexual orientation;
Partial IP address, device location, browser activity (for details, please see the section on Cookies, below).

How we Collect your Personal Information

Haventree Bank will not collect personal information unless it is necessary to fulfill the purposes set out in this Statement. See the sections below entitled “How We Use Your Personal Information” and “How We Transfer and Disclose Your Personal Information” for a full list of purposes of use and categories of third parties to whom we disclose personal information.

Personal information is collected primarily when you perform one of the following actions:

Applying for a Haventree Bank product or service;
Applying for a job with Haventree Bank;
Responding to electronic surveys sent by or on behalf of Haventree Bank;
Speaking with our representatives; and/or
Visiting our website.

In some circumstances, we collect your personal information from third parties, namely when:

Communicating with a broker or third party acting on your behalf;
Obtaining credit history information from credit bureau reports; and
Validating your income and/or employment history by contacting previous and/or current employers.

Personal information about you is also generated by Haventree Bank in setting up and servicing your account(s). For Haventree Bank employees, personal information is also generated in the form of performance reviews and cybersecurity risk assessments.

The Personal Information We Collect

The personal information we collect about you is summarized below, separated by relevant personas.

Site Visitors without Log-in	We collect only aggregated information (above a visitor threshold) that does not allow us to identify individual visitors, namely: Session statistics Approximate geolocation Client ID to identify recurring users Interests Age range Gender IP Address No information is gathered about other third-party sites the visitor has accessed.
Site Visitors with Log-in	Log-in credential (passwords are hashed) Haventree Bank sites visited and time spent No information is gathered about other third-party sites the visitor has accessed.
Email Recipients	IP Address Location data Links clicked Time email was opened
Potential Borrowers	Name Contact information Government identification, including SIN Date of birth Signature Credit and financial information Banking information Employment history, including income and contact information Marital status Assets and liabilities Voice recordings Whether heightened political status or connection exists, and source of funds, as applicable Business name, business address, business telephone number, business email address, name(s) of owner(s), officer(s) and director(s); industry type and financial status (for business clients)
Borrowers	Same as ‘Potential Borrowers’, and Information related to the mortgage over time Credit score development
Donors – Down Payment	Name Contact information Date of birth Signature Occupation Evidence of sufficient funds Identification information from credit report, if applicable Whether heightened political status or connection exists, and source of funds, as applicable
GIC Client Name Depositors	Name Contact information Government identification, including SIN Date of birth Signature Banking information Employment information Identification information from credit report, if applicable Business name, business address, business telephone number, business email address Whether citizen for tax purposes of another country In case of early redemption requests, where applicable, medical information, death certificates, and last wills Whether heightened political status or connection exists, and source of funds, as applicable
Officers/Directors, Trustees, and Beneficial Owners of Incorporated or Trust Depositors	Name Contact information Government identification Employment information Credit and financial information Signature Date of birth Tax information (for trust beneficiaries) Banking information, as needed Identification information from credit report, if applicable Whether heightened political status or connection exists, and source of funds, as applicable
Third Parties to Client Accounts (including Power of Attorneys)	Name Contact information Date of birth Employment information Banking information, as needed Identification information from credit report, if applicable Whether citizen for tax purposes of another country Whether heightened political status or connection exists, and source of funds, as applicable Signature
Mortgage Brokers	Same as ‘Email Recipients’, and Deals performed and commission earned Signature Voice recordings
Deposit Brokers, Signors of Proof of Employment Letters, and Representatives of Third-Party Vendors	Name Contact Information Signature
Job Applicants	Name Contact information Employment history Education Information Work permission Cognitive and behavioral assessment Signature.
Employees	Same as ‘Job Applicants’, and Work performance information Salary and tax information Inclusion and Equity information (optional) Medical notes Banking information Results of background checks Voice recordings
Independent Contractors	Name Contact information Signature Banking information GST/HST Number Work permission Results of background checks.

How We Use Your Personal Information

Based on your relationship with Haventree Bank, your personal information may be used for the purposes outlined below. Before using your personal information for any optional purposes, we will seek your express and informed consent. For more information about how consent is obtained, see the section above entitled “Obtaining Your Consent”.

Personas	Necessary purposes	Optional Purposes
Site Visitors without Log-in	N/A	Determine which content is interesting to our audience and whether navigating our website is intuitive and easy.
Site Visitors with Log-in	Provide access to our broker/borrower portals.	Determine which content is interesting to our brokers/borrowers and whether navigating our website and portals is intuitive and easy.
Email Recipients	N/A	Personalized marketing.
Potential Borrowers	Assess eligibility for our products and services.	N/A
Borrowers	Verify your identity and validate the information collected on you; Communicate with you to provide you with information related to the products and services you hold with us, or to collect on a debt owed to us; Perform data analysis to help us determine your interest rate, eligibility for a mortgage renewal, a refinancing, or for other products and services, and to improve our products; Prevent and detect fraud against you and assess and manage other risks; Comply with legal requirements, such as “know-your-client” obligations and anti-money-laundering requirements; Fulfil tax and financial reporting obligations; and Exercise our rights under this Mortgage Commitment, for example, the right to transfer, sell, and assign the Mortgage.	Personalized marketing; Disclosure to original broker for renewal purposes; and Enrollment in optional products/services.
Donors – Down Payment	Confirm that the donated funds are a genuine gift; and Comply with legal requirements, such as “know-your-client” obligations and anti-money-laundering requirements.	N/A
GIC Client Name Depositors	Verify your identity and validate the information collected on you; Assess eligibility for early redemption, where applicable; Prevent and detect fraud against you and assess and manage other risks; Comply with legal requirements, such as “know-your-client” obligations; and Fulfil tax and financial reporting obligations.	N/A
Officers/Directors, Trustees, and Beneficial Owners of Incorporated or Trust Depositors	Verify your identity and validate the information collected on you; Comply with legal requirements, such as “know-your-client” obligations; and Fulfil tax and financial reporting obligations.	N/A
Third Parties to Client Accounts (Including Power of Attorneys)	Verify your identity and validate the information collected on you; Comply with legal requirements, such as “know-your-client” obligations; and Fulfil tax and financial reporting obligations; Issue payments, if so instructed.	N/A
Mortgage Brokers	Administer the broker relationship.	Personalized marketing; and Enrollment into our Loyalty Program.
Deposit Brokers	Administer the broker relationship.	Personalized marketing.
Job Applicants	Assess suitability for employment; and Verify the information provided to us during the application process.	N/A
Employees	Administer the employment relationship; Administration of business travel, where applicable; and Meet reporting and tax obligations.	Enrollment in health, dental, and other group benefits programs.
Independent Contractors	Administer the contract relationship; Administration of business travel, where applicable; and Meet reporting and tax obligations.	N/A
Signors of Proof of Employment Letters	Verify a potential borrower’s employment.	N/A
Representatives of Third-Party Vendors	Administer the third-party vendor relationship.	N/A

How We Transfer and Disclose Your Personal Information

In order to fulfil some of the necessary purposes outlined in the section above, we disclose your personal information to select third-party vendors. These vendors are thoroughly vetted through privacy impact assessments and are committed to holding your personal information to the same standards that we do.

Several of our third-party vendor arrangements require that your personal information is communicated and stored outside of your province of residence. Where this is the case, an assessment of the relevant jurisdiction has been conducted and appropriate measures have been taken to ensure that your personal information will be held to the same standards applicable in the province you reside in.

You can select from the menu below to learn more about the categories of third parties to which we may disclose your personal information, and for what purposes.

Site Visitors

Categories of Third Parties	Description of Service/Purpose of Disclosure
Data analysis services	Assists us in extracting, validating, and analyzing data to improve our website content and experience.

Borrowers and Potential Borrowers

Categories of Third Parties	Description of Service/Purpose of Disclosure
Application system or API service providers	Enables us to retrieve a client’s bank statements directly from their bank.
E-signature services	Cloud-based e-signature services that allow us to replace paper and ink signature processes with fully automated electronic signature.
Name screening services	Allows us to comply with “know-your-client” regulatory requirements.
End-to-end loan administration platforms	Assists us in end-to-end loan administration.
Gateways to underwriting system	Assists us in ingesting mortgage deals into our underwriting system.
Loan originations and title insurance services	Enables us to obtain property and title information, including property valuation appraisals, for collateral pledging on our behalf as well as provide life/hazard/title insurance for loan underwriting purposes.
Infrastructure as a Service	Provides data storage and transmission services to Haventree Bank.
Credit bureaus	Provides credit reports on our clients for the purpose of assessing their financial suitability for a loan. Haventree Bank also provides mortgage loan information pertaining to the client to the credit reporting agency.
Software as a Service	Assists us in income verification and total debt service ratio calculation. Facilitates the exchange of documents and communications with brokers during the underwriting process. Provides customer relationship management, customer onboarding, account opening, loan origination, deposit accounts, workflow, credit analysis, enterprise content management, and instant reporting capabilities.
Location Intelligence providers	Assists us with our analytics based on property location data and loan type.
Employers and landlords in relation to this application	To obtain information to support the mortgage application.
Data analysis and verification services	Assists us in extracting, validating, and analyzing data from business income statements to make the data more digestible for underwriting.
Payment services	Transmits loan funding to the lawyer of the seller of real estate properties and handles mortgage enforcement proceedings.
Postal and shipping services	Enables us to mail documents related to our products and services to clients.
Haventree Bank's third-party advisors and/or agents, such as lawyers, accountants, and consultants	Represents Haventree Bank in relation to our loan contracts; handles mortgage enforcement proceedings.
Funding service providers	Allows us to instruct solicitors, review documents, and release funds.
Property identification number (PIN) monitoring and verification services	Provides monitoring and verification of PINs and daily reports.
Property tax servicing	Manages property tax servicing functions, and assumes full responsibility for timely payment of municipal property taxes on behalf of Haventree Bank and the borrower.
Other financial institutions	Remittance processing or to verify information such as your identity and income.
Audio and phone services	Provides customer service voice recordings, sentiment analysis, and phone call management.
Title custodians	Provides loan securitization services.
Customer service skills training	Assists in training Haventree Bank staff to improve phone and email customer service skills.
Broker Loyalty Program	Administers the loyalty program for mortgage brokers based on their deals with Haventree Bank.
Property Management services	Manages properties that we have possession of and completes occupancy checks.
Legal actions platform	Allows for communication and document sharing with law firms across Canada, hosted by a third-party vendor.
Foreclosure and sale assistance services	Assists with the sale of properties Haventree Bank has taken possession of as the result of a default.
Risk assessment services	Performs data analytics and data mining.
Originating brokerage, where applicable	Represents the borrower(s) post-funding of the mortgage.
Insurers (mortgage and others)	Provides insurance services.
Auditors and Rating and collection agencies	To satisfy our financial and regulatory requirements.
Regulators and their agents, Governmental authorities having jurisdiction over any sale or securitization of, or trade of interest in, the Mortgage or loan pool in which the Mortgage forms a part, and the Canadian Revenue Agency	To comply with regulatory obligations.
Haventree Bank's third-party advisors and/or agents, such as lawyers, accountants, consultants, and appraisers	To satisfy our legal and regulatory requirements.
Any subsequent or proposed purchaser of the mortgage and/or their third-party advisors	For securitization and whole loan sales.
Anyone to whom Haventree Bank transfers, sells, or assigns its rights	To exercise our rights under the Commitment Letter.
Other mortgage providers that have a financial relationship with the Bank involving this mortgage financing	To obtain alternative funding for the mortgage.

Donors – Down Payment

Client Name Depositors

Categories of Third Parties	Description of Service/Purpose of Disclosure
Name screening services	To comply with “know-your-client” regulatory requirements.
Tax slip printing and shipping service	Prints and mails T5 tax slips.
End-to-end GIC administration platforms	Provides end-to-end GIC administration.
Infrastructure as a Service	Provides data storage and transmission services to Haventree Bank.
Auditors	To comply with regulatory obligations.
Regulators and their agents	To satisfy our legal and regulatory obligations.
Canadian Revenue Agency	To comply with tax obligations.
Haventree Bank's third-party advisors and/or agents, such as lawyers, accountants, and consultants	To comply with regulatory, legal, and financial obligations.

Officers/Directors, Trustees, and Beneficial Owners of Incorporated or Trust Depositors

Third Parties to Client Accounts (including Power of Attorneys)

Mortgage Brokers

Categories of Third Parties	Description of Service/Purpose of Disclosure
Loyalty Program	Provides additional incentives to brokers to bring deals to Haventree Bank

Employees and Job Applicants

Categories of Third Parties	Description of Service/Purpose of Disclosure
Accountants	Prepares the Bank’s tax returns.
Canada Revenue Agency	To comply with tax obligations.
Payroll and Human Resources Information System	Assists with salary payment, management of time-off requests, and other employment-related administrative matters.
Health & Wellness Spending Account	Provides health and wellness benefits.
Benefits and Group RSP	Provides benefits, including RSP contributions.
Virtual Doctor and mental health support	Provides medical services to employees.
Salary survey services	Provides salary information as part of the onboarding process.
Background checks and behavioral and cognitive assessment service provider	Conducts background checks on applicants and assesses suitability for the role as part of the onboarding process.
Travel agency	Facilitates the planning and booking of business travel as well as payment of travel expenses.
Cybersecurity risk assessment services	Gathers behavioral information relating to cybersecurity threats and compose a risk score.
Document management and storage systems	Manages and stores employment-related documents.

Independent Contractors

Categories of Third Parties	Description of Service/Purpose of Disclosure
Auditors Government agencies Regulators and their agents Name screening services	To satisfy our legal and regulatory obligations.
Background checks and behavioral and cognitive assessment service provider	Conducts background checks on applicants and assesses suitability for the role as part of the onboarding process.

How we Protect Your Personal Information

We endeavor to maintain physical, technical, and procedural safeguards that are appropriate to the sensitivity of your personal information. These safeguards are designed to prevent your personal information from loss and unauthorized access, copying, use, modification, or disclosure.

We will take every necessary step to ensure the protection of your personal information, including:

Shredding of documents containing personal information;
Providing regular training to our staff on the importance of protecting the confidentiality of your information;
Physical security measures – restricted access to facilities and locked filing cabinets;
Electronic security measures for computerized personal information – password protection, database encryption, personal identification numbers;
Organizational processes and procedures including limiting access to your personal information to individuals on a need-to-know basis;
Destroying, anonymizing, erasing, or masking your information in accordance with our records retention policy and applicable privacy laws; and
Ensuring that third parties who are given access to your personal information protect and secure your personal information in a similar manner.

Despite our efforts to protect your personal information, there may be inherent consequences of its collection, use, or disclosure. Such consequences may include greater exposure to possible threat actors, increased likelihood of being involved in a privacy breach incident, and decreased confidentiality. For more information on how we protect your personal information, please contact our Chief Privacy Officer using the contact details found in the “Accountability” section above.

Retention of Sensitive Personal Information

We consider sensitive personal information to be any personal information (see definition provided in the “What is Personal Information” section above) that, either inherently, or depending on context, pose a higher risk of harm to the individual concerned when collected, used, or disclosed. Examples of sensitive personal information include financial information, medical records, government ID, information pertaining to minors, and equity and inclusion information (racial origins, political opinions, genetic and biometric data, an individual’s sex life or sexual orientation, and religious/philosophical beliefs).

The chart below indicates the period for which the Bank will retain your sensitive personal information after your relationship with us has ended. An exception are voice recordings which are retained for one year after the recording. If the recording is part of a customer complaint, we retain the recording for 7 years after the complaint has been resolved.

Your Relationship to the Bank	Retention Period for Sensitive Personal Information
All clients	Seven Years
Potential clients (where your application has been denied, cancelled, or voided	Three Months
Donors – Down Payment	Seven Years
Officers/Directors, Trustees, and Beneficial Owners of Incorporated or Trust Depositors	Seven Years
Third Parties to Client Name Deposits (including Power of Attorney)	Seven Years
Brokers and Representatives of Third-Party Vendors	Three Years
Signors of Proof of Employment Letters	Seven Years
Employees and Independent Contractors	Seven Years (Payroll information) Three years (Other records)
Job Applicants	Six Months

Automated Decision-Making

When we make an automated decision, prediction, or recommendation on the basis of your personal information, we will inform you about this fact no later than the time that we communicate this decision to you. Upon your request, we will inform you of the personal information that informed the decision, of the reasons, principal factors, and parameters that led to the decision, and of your right to have the personal information that was used to render the decision corrected. You will also have the opportunity to submit observations to an employee at Haventree Bank who can review the decision.

Individual Rights

Depending on where you reside, you may have one or more of the following rights relating to your personal information. Some of these rights will be subject to specific requirements or limitations under applicable law, such as the requirement to submit your request in writing. To exercise any of your rights, please contact our Chief Privacy Officer using the contact details found in the “Accountability” section above.

Right to Withdraw Consent

You may withdraw or amend your consent at any time to the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions and reasonable notice. Depending on the circumstances, however, a withdrawal or amendment to your consent may prevent us from providing you, or continuing to provide you, with our services, business, or employment.

Consulting the table above under the “How We Use Your Personal Information” section, you can see which purposes for which we collect your personal information are optional. If you withdraw your consent to the collection of your personal information for those purposes, this will not have an adverse effect on the core services we provide you with, e.g., your mortgage, deposit, or employment. However, your consent withdrawal may still affect your enjoyment of the optional service we provide.

Right of Access, Rectification, or Deletion

You may request access to any personal information we hold pertaining to you. You may also request the rectification of any inaccurate or incomplete information related to you and/or the deletion of personal information that is obsolete or not justified by the purposes provided. For employees and job applicants, please direct your request to the Chief Human Resources Officer at TLC@haventreebank.com.

For all other individuals, please direct your request to the Chief Privacy Officer at privacyofficer@haventreebank.com.

We consult credit reports indicating the solvency of prospective and current borrowers which are prepared by either Equifax or TransUnion. You have the right of access and rectification in relation to the personal information held by Equifax and TransUnion about you. You can access and, where necessary, cause rectification of the personal information contained in the credit reports.

You can access your credit report by visiting the Equifax Canada or the TransUnion Canada website.

If your report contains inaccurate information, you can submit a dispute to Equifax and TransUnion. Click on these links for more information.

Information about our Website

In certain sections of www.haventreebank.com, Haventree Bank may invite you to contact us, request information, or complete a registration form. In these cases, we request contact and other related information. If you choose to provide this information, we will use it only to contact you as requested, or to register you to access certain sections of our website or for specified events.

Cookies: Our website uses a technology called “cookies”. These cookies are generally a mix of first and third-party, session, and persistent cookies. A cookie is a tiny element of data that our website can send to your browser, which may then be stored on your hard drive so we can recognize you and your session history when you return as well as provide you with a consistent and efficient experience. You may set your web browser to notify you when you receive a cookie. However, if you decide not to accept cookies from our website, you may not be able to take advantage of all of the features of our website. Cookies cannot view or retrieve data from other cookies, or capture files or information stored on your computer. Only the website that sends you cookies is able to read them.

There are, however, cookies that we place without an opt-out being possible, namely essential cookies. Essential cookies are all the cookies without which our website could not perform basic functions. They may be set automatically when pages load, or as a result of a user request that cannot be fulfilled without the use of the cookie. On the other hand, for functionality and analytics cookies to be placed on your device, your active opt-in is required. Your choice not to accept these cookies will not prohibit your use of the Bank’s website.

Functionality cookies support site functionality that is visible or advantageous to the user or their experience of the site. This includes elements of persistent personalization (remembered on subsequent visits), and enhanced functionality like web chat services, surveys, commenting and rating systems, and user preferences. They are generally a mix of first and third party, session and persistent cookies.

Analytics cookies are used to better understand your interactions, improve our services, tailor our content, and personalize your experience. These cookies do not collect information that identifies you as a visitor. They collect information about how visitors use our website, for instance which pages visitors go to most often, and if they get error messages from web pages. All information these cookies collect is aggregated. We even partially mask your IP address, so no identification is possible.

All our cookies expire by default after 6 months, after which time we will ask you to confirm your choices again.

Tracer Tags & Web Beacons: Some areas of the www.haventreebank.com website may also use “web beacon” technologies. Web beacons work in conjunction with cookies and let us know what portions of our site are of interest to our visitors to help us provide you with tailored information from our website. If you turn off cookies, web beacon technologies will still detect anonymous visits, but the notices they generate cannot be associated with other information that is collected and are disregarded.

Third-party links: Our website may contain links to other sites that Haventree Bank does not own or operate. Also, links to our website may be featured on third-party websites on which we advertise. Except as described in this Privacy Statement, we will not provide any of your personal information to these third parties without your consent. We provide links to third-party websites as a convenience to the user. These links are not intended as an endorsement of or referral to the linked websites. The linked websites have separate and independent privacy statements, notices, and terms of use, which we recommend you read carefully. We do not have any control over such websites and therefore we have no responsibility.

Customer Testimonials/Case Studies/Reviews: We post customer testimonials/comments/reviews on our website, which may contain information about the customer. We obtain each customer’s consent via email prior to posting the customer's name and testimonial.

Legal Disclaimers

From time to time, Haventree Bank may make changes to our Privacy Statement to reflect changes in our legal or regulatory obligations, or in the manner in which we deal with your personal information. Any changes that affect your rights will be communicated to you via this Statement and posted on our website. We encourage you to refer to it on a regular basis.

This Privacy Statement does not create or confer upon any individual any rights, or impose upon Haventree Bank any obligations outside of, or in addition to, any obligations imposed by Canada’s federal and provincial privacy laws, as applicable. Should there be, in a specific case, any inconsistency between this disclosure and Canada’s privacy laws, this Statement shall be interpreted, in respect of that case, to give effect to, and comply with, such laws.