Privacy notice

1. Notice statement

The company is committed to respecting your privacy and protecting your personal data. We have implemented a privacy program and appointed a privacy officer.

The purpose of this Policy is to inform you about how the company collects, uses, discloses, retains, manages, shares, and protects your personal data, and how you can exercise your rights regarding your personal data or contact us if you have any questions about how we handle your personal data.

To provide you with a quality service, we need access to certain personal data about you. We make sure that our employees handle this information with all necessary discretion and diligence, in accordance with applicable legal and regulatory requirements.

By downloading or using the Application or the Service, by accessing the Website, or by sending us Personal Data, you accept the terms of this Notice and consent to our collection, use, disclosure, communication, retention, and management of your Personal Data as described in this Policy.

2. Interpretation and definitions

For the purposes of this Notice, words with an initial capital letter have the meanings defined in the following conditions. The following definitions have the same meaning whether they appear in the singular or the plural:

Account means a unique account created for you to access our Service or parts of our Service.

Affiliate means an entity that controls, is controlled by, or is under common control with a party, where “control” means ownership of 50% or more of the shares, equity interests, or other securities entitled to vote for the election of directors or other managing authority.

Application means the Solfium application provided by the Company.

The company (referred to as “the company,” “we,” “us,” or “our” in this notice) means Solfium Inc., a Canadian corporation with its registered office at 2200 – 1250 René-Lévesque Boulevard West, Montreal, QC, H3B 4W8.

Device means any device that can access the Application or the Website, such as a computer, a mobile phone, or a digital tablet.

Notice means this Privacy Notice, as amended from time to time in accordance with its terms.

Personal Data means any information about an identifiable person, or information that, on its own or combined with other data, makes it possible to identify a person.

Privacy Officer means the person appointed by the Company’s senior management to manage the Company’s privacy compliance program, as described in more detail in this Notice.

Service means solar energy, energy storage, and electric mobility solutions, as well as the related services that the Company makes available through the Application, the Website, or by other means, including the purchase of photovoltaic systems.

Service Provider means any natural or legal person that processes data on behalf of the Company. It refers to third-party companies or individuals engaged by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service, or to help the Company analyze how the Service is used.

Third-party social media service means any website or social network through which a User can log in or create an account to use the Service.

Usage Data means data collected automatically, whether generated by the use of the Service or from the Service’s own infrastructure (for example, the duration of a page visit).

Website means the Company’s website at https://solfium.com/ or any other website that the Company may maintain from time to time.

You means the person accessing or using the Service, or the company or other legal entity on whose behalf that person accesses or uses the Service, as applicable.

3. Compliance with the law

We respect the privacy of everyone who provides us with personal data. The company is subject to the privacy and personal-data protection laws of the jurisdictions in which it operates, including the Personal Information Protection and Electronic Documents Act (Canada), the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Mexico), and all other applicable federal, state, or provincial privacy laws. Where a requirement of any applicable law is inconsistent with this Notice, that legal requirement will apply.

4. Collection and use of your personal data

Types of data collected

Identifying information

When you download or install our application or use our service, we may ask you to provide certain personally identifying information that can be used to contact or identify you. Personally identifying information may include, among other data:

• Email address;
• First and last name;
• Phone number;
• Address, state, province, postal code, city.

Usage Data

Usage Data is collected automatically when you use the Service.

Usage Data may include information such as your device’s Internet Protocol address (for example, the IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

We may collect certain information automatically, including, among other things, the type of mobile device you use, your mobile device’s unique ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browser you use, unique device identifiers, and other diagnostic data.

We may also collect information that your browser sends whenever you visit our Service or when you access the Service through a mobile device.

Information from third-party social media services

To the extent the Company allows you to create an account and log in to use the Service through third-party social media services, including:

• Google
• Facebook
• Instagram
• Twitter
• LinkedIn

If you choose to register through a third-party social media service or to grant us access to it, we may collect personal data already associated with your account on that third-party social media service, such as your name, your email address, your activities, or your contact list associated with that account.

You may also have the option to share additional information with the company through your third-party social media service account. If you choose to provide that information and personal data, during registration or otherwise, you are giving the company permission to use, share, and store it in a manner consistent with this notice.

Information collected while using the Service

While you use the application or the service, in order to provide the features of our service, we may collect:

• Information about your location;
• Information about your home or the building for which you are considering solar energy;
• Information about your budget, photovoltaic systems or other equipment or services purchased, other considerations, parameters, and information communicated through the Service or related to past or current orders or requests;

We use this information to provide the features of our Service, and to improve and personalize our Service. The information may be uploaded to the Company’s servers and/or a Service Provider’s server, or simply stored on your device.

5. Use of your personal data

The Company may use Personal Data for the following purposes:

To provide and maintain our Service, including monitoring the use of our Service and registering you as the owner of a purchased photovoltaic system, as applicable.

To manage your account: to manage your registration as a user of the application or the service. The personal data you provide will allow you to access different features of the service that are available to you as a registered user.

For the performance of a contract: the development, compliance, and performance of the purchase contract for the products, items, or services you have purchased, or of any other contract with us through the Service, including the management of certain technical features of your purchased photovoltaic system, as applicable.

To contact you: to contact you by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as mobile application push notifications regarding updates or informational communications related to the functionalities, products, or contracted services, including security updates, when necessary or reasonable for their implementation.

To provide you with news, special offers, and general information about other products, services, and events that we offer and that are similar to those you have already purchased or requested, unless you have opted out of receiving such information.

To respond to your inquiries or complaints: to handle and manage your inquiries or complaints directed to us.

For business transfers: we may use your information to evaluate or carry out a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceedings, in which personal data we hold about users of our Service is among the assets transferred.

For other purposes: we may use your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns, and evaluating and improving our Service, products, services, marketing, and your experience, to collect information on environmental, social, and governance (ESG) standards, or for purposes necessary or incidental to the supply of goods and services to you.

We may share or disclose all or part of your Personal Data in the following situations and with the following persons:

• With service providers: we may share your personal data with service providers to provide the Service (including the delivery and installation of photovoltaic systems purchased through the Service), to monitor and analyze the use of our Service, to show you advertisements to help support and maintain our Service, to process payments, and to contact you.
• For business transfers: we may share or transfer your personal data in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or part of our business by another company.
• With affiliates: we may share your information with our affiliates (which currently include Solfium México, Sociedad Anónima de Capital Variable (S.A. de C.V.) and Solfium España Sociedad Limitada), in which case we will require those affiliates to comply fully with this Notice.
• With business partners: we may share your information with our business partners to offer you certain products, services, or promotions.
• With other users: when you share personal data or otherwise interact with other users through the Service, including the installers of a purchased photovoltaic system, that information may be seen by those other users and may be publicly distributed outside the Application or the Service.
• With your consent: we may disclose your personal data for any other purpose with your consent.

6. Limits on the collection, use, and disclosure of personal data

We strive to limit the collection of personal data to what is strictly necessary for the purposes for which it is collected. In certain circumstances, we may need to collect personal data and confidential information to comply with our legal obligations, such as foreign sanctions legislation. Please be assured that we will not disclose or use your personal data for any purpose other than those stated in this notice, unless you consent to that disclosure or the disclosure is required or permitted by law.

We may use your personal data if necessary to prevent or reduce a serious threat to public health or public safety, or if the use of the information is necessary for law enforcement or for proceedings before any court or tribunal.

7. Retention of your personal data

We will retain your personal data only for as long as necessary for the purposes set out in this Notice. We will retain and use your personal data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

We will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period, except when this data is used to strengthen the security or improve the functionality of our service, or when we are legally required to retain this data for longer periods.

After that time, any personal data we hold will be destroyed, deleted, or anonymized in accordance with applicable personal-data protection laws.

8. Transfer of your personal data

Your information, including personal data, is processed at the company’s operating offices or those of its subsidiaries in Canada, Mexico, or Spain, and in any other place where the parties involved in the processing are located. This means that this information may be transferred to and retained on computers located outside your state, province, country, or other governmental jurisdiction, where data protection laws may differ from those of your jurisdiction.

Your consent to this Notice, followed by your submission of such Personal Data, represents your acceptance of that transfer.

The Company will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Notice, and no transfer of your Personal Data will be made to an organization or a country unless adequate controls are in place, including the security of your Personal Data. Where required by personal-data protection laws, the Company will carry out an assessment before any international transfer of Personal Data outside the Jurisdiction.

9. Your rights regarding your personal data

Depending on applicable laws, you may have the right to access, rectify, or delete your personal data, to withdraw your consent (if any), and not to be discriminated against. You may have additional rights, namely the right to be informed of a decision based solely on automated processing (if any), the right to restrict and object to our use and processing of your personal data, and the right to data portability, by receiving a copy of all personal data we hold about you in a structured, commonly used, and machine-readable format.

To exercise any of these rights (to the extent they are available), send us your request in writing to the privacy officer, as indicated in this notice. Depending on the right exercised, we will inform you of the procedure to follow, the processing time (response delay), and the information required. We will endeavor to process your request within 30 days of the date we receive it. We will let you know if this period is not feasible and will extend it as permitted by applicable law.

We may charge a fee to cover the costs of handling your request if it is unfounded or excessive.

Unless the law requires or allows us to refuse, we will, upon request, provide you with details of the personal data we have collected about you, or update and rectify your personal data in accordance with your request. Where applicable law requires us to provide more information about the use or disclosure of your personal data, we will do so at your request.

If we do not agree to give you access to your personal data, to rectify or delete it as requested, or otherwise to fulfill your requests, we will notify you. Where appropriate, we will provide the reasons for our decision and the mechanisms available to challenge the refusal. If the refusal relates to a request to amend your personal data, you may make a statement about the requested amendment and we will attach it to your file.

In some circumstances, and provided there are no legal obligations preventing it, we may be unable to give you access to your personal data or to fulfill your requests regarding it, including when:

• your personal data cannot be retrieved;
• the request is frivolous or vexatious; or
• providing access or otherwise fulfilling your request could pose a serious threat to the safety of a person or the public; could unreasonably affect the privacy of other people; or would be unlawful for any other reason.

10. Security of your personal data

We have security measures designed to protect your personal data. We strive to apply the necessary and appropriate security measures to ensure the confidentiality of the personal data we hold or control. The standard security measures we use will depend on the type of information collected. To that end, we follow generally accepted industry standards.

Appropriate physical, technical, and/or administrative security measures and safeguards have been implemented and are maintained to prevent:

• Any accidental or unlawful destruction;
• Accidental loss;
• Unauthorized disclosure;
• Unauthorized modification;
• Unauthorized access; or
• Any unlawful processing.

In terms of system security, these are some of the measures we take to protect your personal data:

• We use firewalls, standard software protection programs, password access protections, and secure servers;
• We periodically review our security measures to make sure we are taking the reasonable and technically feasible measures available at the time to protect your personal data; and
• We take reasonable steps to permanently destroy, delete, or anonymize personal data as soon as possible if it is no longer needed, as described in this notice.

We also make our employees, contractors, and service providers aware of the importance of protecting personal data, and care is taken in the deletion or destruction of personal data so that unauthorized persons cannot access it.

However, it should be noted that no method of transmission over the Internet and no method of electronic storage is 100% secure or error-free. Although we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security. You provide information to us over the Internet at your own risk. We cannot accept any responsibility for the misuse, loss, or unauthorized access to your personal data when the security of the information is not under our control. We recommend that you be cautious when using the Internet.

11. Analytics

We may use third-party service providers to monitor and analyze the use of our Service.

Google Analytics

Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our website or Service. This data is shared with other Google services. Google may use the collected data to contextualize and personalize the ads of its own advertising network.

You can opt out of certain Google Analytics features through your mobile device settings, such as your device’s advertising settings, or by following the instructions provided by Google in its Privacy Policy: https://policies.google.com/privacy

For more information about Google’s privacy practices, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy

12. Advertising

We may use service providers to show you advertisements in order to help support and maintain our service.

Google AdSense and DoubleClick cookies

Google, as a third-party vendor, uses cookies to serve ads on our Service. Google’s use of the DoubleClick cookie enables Google and its partners to serve ads to our users based on their visit to our Service or other websites on the Internet.

You may opt out of the use of the DoubleClick cookie for interest-based advertising by visiting the Google Ads Settings web page: http://www.google.com/ads/preferences/

13. Email marketing

We may use your personal data to send you newsletters, marketing or promotional materials, and other information that may be of interest to you. You may opt out of receiving any or all of these communications from us by following the unsubscribe link or the instructions provided in any email we send you, or by contacting us.

We may use email marketing service providers to manage and send emails to you.

Mailchimp

Mailchimp is an email marketing delivery service provided by The Rocket Science Group LLC.

For more information about Mailchimp’s privacy practices, please see its privacy policy: https://mailchimp.com/legal/privacy/

14. Payments

We use third-party services for payment processing (for example, payment processors) in connection with purchases made through the Service.

We will not store or collect your payment card details. That information is provided directly to our third-party payment processors, whose use of your personal data is governed by their privacy policy. These payment processors adhere to the standards set by PCI-DSS, managed by the PCI Security Standards Council, which is a joint effort of brands such as Visa, Mastercard, American Express, and Discover. PCI-DSS requirements help ensure the secure handling of payment information.

dLocal

You can access its Privacy Center at https://dlocal.com/legal/privacy-hub/

Santander

Its privacy policy can be viewed at https://www.santanderbank.com/online-privacy-policy

Scotiabank

Its privacy policy can be viewed at https://www.scotiabank.com/ca/en/about/contact-us/privacy/privacy-agreement.html

15. Children’s privacy

Our Service is not directed at anyone under 14 years of age. We do not knowingly collect Personal Data from anyone under 14. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from anyone under 14 without verification of parental consent, we will take steps to remove that information from our servers.

16. Links to other websites

Our application, website, or service may contain links to other websites that are not operated by us. If you click a third-party link, you will be directed to that third party’s site. We strongly recommend that you review the privacy policy of every site you visit.

We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services.

17. Cookies and similar technologies

The website and the application use cookies and similar technologies (such as pixels and local storage) to improve your experience, understand how our service is used, and support certain features.

Cookies are small text files that are stored on your device when you visit a website or use an application. They allow us to recognize your browser or device and store certain information. We use the following types of cookies:

• Essential cookies: necessary for the operation of our website/application (for example, security, session management, and enabling basic features).
• Performance and analytics cookies: they help us understand how visitors use our Service so that we can improve functionality and the user experience.
• Functionality cookies: they remember your preferences and choices (such as language or region).
• Advertising/targeting cookies: they may be used to deliver relevant ads or measure the effectiveness of advertising campaigns (only where applicable).

You can control or disable cookies through your browser or device settings. Please note that some features of our services may not work properly if you disable essential cookies.

18. Changes to this notice

We reserve the right to amend this Notice at any time, so we recommend that you review it frequently. Changes to this Notice will be published by posting an updated Notice on this page and will take effect at the time of publication.

If we update this Notice in a material way, we will notify you by sending a notice in the Application and on the website or by email. In all other circumstances, however, posting a new version of the Notice in our Application and on our website, or your continued use of the Application, the website, or the Service, will be sufficient notice of and consent to the changes to the Notice.

19. Privacy officer and contact information

Our senior management has delegated management of our privacy compliance program to the privacy officer. The privacy officer is responsible for the internal management and oversight of our privacy compliance program.

The privacy officer is responsible for advising the company on personal-data protection, approving and implementing privacy policies and procedures, ensuring that they work properly, and reporting to our senior management on the effectiveness of the program.

The privacy officer also acts as the first point of contact for the people whose personal data we collect, use, or process, and for personal-data protection authorities on matters of personal-data protection. It is also the privacy officer’s responsibility to provide you with the necessary support if you have any question, complaint, or request related to personal-data protection.

If you have any questions about this Notice, you can contact the privacy officer as follows:

By email: privacy@solfium.com