A quick note about scope. This public policy applies to our member relationships, prospective members, our website, online forms and electronic communications. Separate notices or agreements may provide additional details for a particular product, service, digital platform or transaction.

1. Who we are and the rules we follow

Equity is an Ontario credit union, not a bank, and is authorized to operate in Ontario. We handle personal information in accordance with applicable Canadian and Ontario requirements, including:

• the Personal Information Protection and Electronic Documents Act (PIPEDA) and its ten fair information principles;
• Canada's Anti-Spam Legislation (CASL), where we send commercial electronic messages;
• the Credit Unions and Caisses Populaires Act, 2020 (Ontario), its regulations, and applicable Financial Services Regulatory Authority of Ontario (FSRA) requirements and guidance; and
• other laws that apply to financial services, record keeping, fraud prevention, anti-money laundering, tax reporting and legal process.

We are accountable for personal information under our control, including information handled for us by service providers. Our Privacy Officer oversees our privacy program and responds to privacy questions and complaints.

2. What personal information we collect

The information we collect depends on your relationship with us and the products or services you use. It may include:

Identity and contact information

Your name, date of birth, address, telephone number, email address, occupation, identification documents, signatures and information needed to verify your identity.

Financial and transaction information

Account numbers, balances, deposits, withdrawals, payment instructions, transaction history, income, assets, liabilities, tax information, credit information, borrowing needs and information about the source or intended use of funds.

Membership, product and service information

Your membership details, applications, agreements, beneficiary information, product holdings, service preferences, communications with us and records of the advice, support or service we provide.

Compliance and security information

Information used to meet legal and regulatory obligations, prevent fraud and financial crime, manage risk, authenticate you, investigate concerns and protect our members, employees, systems and premises. This may include security questions, device or login information, call recordings where notice is provided, and video surveillance at our premises.

Website and digital information

When you visit our website or use an online service, we or our service providers may collect your IP address, browser and device type, operating system, referring page, pages viewed, links selected, date and time of access, approximate location derived from an IP address, cookie identifiers and similar technical information.

Information you submit online

We collect the information you enter in online forms, applications, surveys, newsletter sign-ups, service requests or messages. Please do not include passwords, PINs, access codes or other highly sensitive information in a general website form or unencrypted email.

3. How we collect personal information

We generally collect personal information:

• directly from you, including in person, by telephone, by mail, through our website, applications, online banking or electronic communications;
• from joint account holders, co-borrowers, guarantors, representatives or other people acting with your authority;
• from credit reporting agencies, financial institutions, payment networks, identity-verification providers, fraud-prevention services, public records and other lawful sources; and
• automatically through cookies, analytics and security technologies when you use our website or digital services.

If you provide personal information about another person, you must have the authority to provide it to us and, where required, obtain their consent.

4. Why we collect, use and disclose personal information

We collect, use and disclose only the personal information reasonably needed for identified purposes, including to:

• confirm identity, eligibility and membership and keep our records accurate;
• open, administer and service accounts, loans, mortgages, investments and other products or services;
• process transactions, payments, transfers, statements, tax slips and other instructions;
• assess creditworthiness, affordability, security and risk and make lending or service decisions;
• communicate with you, respond to questions, provide support and handle complaints;
• detect, prevent and investigate fraud, cyber threats, suspicious activity, errors, misuse and other risks;
• comply with legal, regulatory, tax, accounting, audit, anti-money laundering and court-order requirements;
• protect and enforce our legal rights and the rights, safety and property of members and others;
• operate, secure, measure and improve our website, systems, services and member experience; and
• provide information about products, services, events or updates, where permitted by law and consistent with your communication choices.

We will not use or disclose personal information for a materially new purpose without identifying that purpose and obtaining additional consent where required, unless the law permits or requires the use or disclosure.

5. Consent and your choices

We seek meaningful consent appropriate to the circumstances, the sensitivity of the information and your reasonable expectations. Consent may be express or implied. In limited situations, the law permits or requires us to collect, use or disclose personal information without consent.

Withdrawing consent

You may withdraw consent to a particular use or disclosure, subject to legal, regulatory and contractual restrictions and reasonable notice. Withdrawal will not affect actions already taken with valid consent. In some cases, withdrawing consent may mean we cannot provide or continue a product or service. Contact our Privacy Officer to discuss your request and any consequences.

Marketing and electronic messages

You can ask us not to use your information for optional marketing. Commercial electronic messages from us will include the identification and unsubscribe information required by CASL. You may unsubscribe using the method in the message or by contacting us. We may still send service, security, transactional or legally required messages that are not optional marketing.

Cookie choices

Where our website offers a cookie preference tool, you can accept or reject non-essential cookies and change your choices later through the Cookie Settings link. You can also adjust your browser settings to block or delete cookies. Blocking essential cookies may affect website features; rejecting analytics cookies should not prevent basic access to the website.

6. Cookies, analytics and similar technologies

Cookies are small files stored on your device. We use cookies and similar technologies for the following purposes:

• Essential cookies support core website functions, security, network management and your privacy choices. These cannot always be switched off through our website.
• Analytics cookies help us understand website traffic and how visitors use the site so we can improve performance and content.
• Preference cookies remember choices that improve your experience, where used.

We use Google Analytics or a similar analytics service. The provider may receive technical information such as your IP address, device and browser details, pages visited, interactions and timestamps. We configure analytics and our cookie controls to limit collection where reasonably possible and to prevent non-essential analytics from loading until the required choice has been made.

Do not enter personal or financial information into a website search box or another field unless that field is clearly intended to collect it. We do not sell personal information. U.S.-specific controls such as a 'Do Not Sell My Personal Information' link or Global Privacy Control may not apply to Equity; however, our cookie choices allow visitors to decline non-essential analytics where offered.

7. When we share personal information

We may share personal information, only as reasonably necessary, with:

• employees and representatives who need it to perform their duties;
• financial institutions, payment systems, clearing networks, card providers and other parties needed to carry out your transactions or provide a requested service;
• service providers that support areas such as core banking, digital banking, hosting, cloud services, communications, document management, analytics, identity verification, credit reporting, fraud prevention, professional advice, audit and records storage;
• joint account holders, authorized representatives, co-borrowers, guarantors or other parties where authorized or required for the product or transaction;
• regulators, government bodies, law enforcement, courts, tax authorities or other organizations where disclosure is required or permitted by law; and
• another organization in connection with a proposed or completed merger, transfer, financing or other business transaction, subject to appropriate confidentiality and legal requirements.

We do not sell or rent member or visitor personal information. We require service providers to use personal information only for authorized purposes and to protect it through contractual or other appropriate measures.

8. Processing outside Canada

Some service providers may store or process personal information outside Ontario or Canada. When information is processed in another jurisdiction, it may be subject to that jurisdiction's laws and may be accessible to courts, law enforcement or regulatory authorities there. Equity remains accountable for personal information transferred to a service provider for processing and uses contractual and other measures designed to provide a comparable level of protection.

You may contact our Privacy Officer for information about our use of service providers outside Canada in relation to your personal information.

9. How we protect personal information

We use administrative, technical and physical safeguards appropriate to the sensitivity, amount, format and location of the information. Depending on the circumstances, safeguards may include:

• privacy, security and confidentiality policies, employee training and need-to-know access;
• identity verification, authentication, role-based permissions and access monitoring;
• encryption and other protections for information in transit or at rest, where appropriate;
• secure facilities, systems, backups, logging, monitoring and incident-response processes; and
• service-provider due diligence, contractual requirements and oversight.

No method of transmission or storage is completely secure. You also play an important role: protect your cards, cheques, statements, passwords, PINs and access codes; use strong, unique passwords and available multi-factor authentication; and notify us promptly about suspected fraud, loss or unauthorized activity.

Ordinary email is not always encrypted. Do not send account numbers, government identification, passwords, PINs or other confidential information to us by unencrypted email. Contact us to arrange a more secure method.

10. Retention and disposal

We keep personal information only as long as reasonably needed for the purposes described in this policy and to meet legal, regulatory, tax, accounting, fraud-prevention, dispute-resolution and record-keeping requirements. Retention periods vary according to the type of information, product, relationship and applicable requirements.

When personal information is no longer required, we securely destroy, delete or anonymize it, subject to technical, legal and operational limitations. Information in backups may remain protected until it is overwritten or deleted through normal retention cycles.

11. Accuracy, access and correction

We take reasonable steps to keep personal information accurate, complete and up to date for the purposes for which it is used. Please tell us when your contact or other relevant information changes.

You may ask to:

• access the personal information we hold about you;
• learn how it has been used and to whom it has been disclosed, as required by law; and
• correct information that is inaccurate or incomplete.

Submit a written request to our Privacy Officer. We will verify your identity before providing access or making a correction. We will respond within the time required by applicable law and explain any lawful limit on access. Depending on the request, we may charge a reasonable fee where permitted, after advising you in advance.

PIPEDA does not provide an unrestricted right to deletion or portability. We will consider requests to delete information that is no longer required, subject to our legal, regulatory, contractual and legitimate record-keeping obligations.

12. Privacy concerns and complaints

If you have a privacy question, request or complaint, please contact our Privacy Officer first. We will review the matter fairly, transparently and as promptly as reasonably possible. Please describe your concern, the relevant dates and any supporting information. We may contact you for clarification and will provide a written response where appropriate.

Privacy Officer
Equity Credit Union Inc.
Whitetail Centre
299 Kingston Road East, Unit 1
Ajax, Ontario  L1Z 0K5
Email: privacy@equitycu.com
Telephone: 905-426-1389 or 1-800-263-9793

If you are not satisfied with our response to a privacy complaint, you may contact the Office of the Privacy Commissioner of Canada. For a broader complaint about an Ontario credit union product, service or market-conduct matter, follow Equity's Compliments and Concerns process before asking FSRA to review the matter.

13. Other websites and services

Our website may link to websites, applications or services operated by others, including online banking and third-party product providers. Their privacy practices and terms apply when you use their services. Review their privacy information before providing personal information. A link from our website does not make Equity responsible for another organization's privacy practices.

14. Children and minors

Our general website is not directed to children. Products or services for a minor are established with the consent or involvement required by law and our account-opening requirements. If you believe a child has submitted personal information through a general website form without appropriate authority, contact our Privacy Officer.

15. Changes to this policy

We may update this policy to reflect changes in our practices, services, technology or legal requirements. We will post the current version on our website and identify its effective date. If a change is material, we will provide additional notice where appropriate or required.

^{Effective date: August 30, 2026  |  Policy owner: Privacy Officer  |  Review: at least annually}