Privacy and Personal Information Notice

1. Introduction and scope

1.1 Because Crown Intelligence compiles sanctions, politically exposed persons ("PEP"), debarment, corporate registry and beneficial ownership data, some of the Content includes personal information about identifiable individuals (for example, a PEP's name, position, and family or associate relationships, or a beneficial owner's name and ownership percentage) (the "Individual Data"). This notice explains how Crown Stack Systems Inc., operating as Crown Intelligence, of 1230 Oakhill Avenue, Oshawa, Ontario L1K 2R4, Canada ("Crown", "we") collects, uses, discloses and safeguards Individual Data, and the rights available to the individuals it describes.

1.2 This notice does not apply to information you provide to Crown about yourself as a user of the Site (account information, billing information); that is addressed in a separate site/account privacy policy covering website and billing data, kept distinct from the notice covering personal information appearing within the compiled data itself.

2. Legal basis: publicly available information

2.1 Crown's collection, use and disclosure of Individual Data is undertaken in reliance on the "publicly available information" provisions of applicable Canadian privacy law, including:

(a) the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and its Regulations Specifying Publicly Available Information;

(b) Quebec's Act respecting the protection of personal information in the private sector, as amended by Quebec's Act to modernize legislative provisions as regards the protection of personal information ("Law 25"); and

(c) Alberta's Personal Information Protection Act and British Columbia's Personal Information Protection Act (each, a "Provincial PIPA"),

in each case to the extent the Individual Data was published by a Source Publisher under a legal or regulatory mandate, or otherwise appears in a record made available to the public (for example, a government gazette, a court or regulatory filing, a corporate registry, or a sanctions list).

2.2 Where Individual Data does not fall within a "publicly available information" exception under applicable law — for example, where Crown's own research supplements a public record with additional detail — Crown relies instead on the applicable law's other available bases (such as reasonable purpose, or consent where consent is practically obtainable), and labels such supplemented fields as described in the Attribution notice.

2.3 Consistent with the position taken by comparable Canadian providers, Crown treats PEP relative/associate data and beneficial-ownership percentages as falling within the "publicly available information" basis under Law 25 where that data was itself published by the Source Publisher under a legal or regulatory mandate (for example, a beneficial-ownership registry filing or an official PEP disclosure), rather than compiled by Crown from private or non-mandated sources. Because Crown's processing of this category of data is, on that basis, a continuation of an existing public disclosure rather than a new collection activity, Crown's internal assessment is that a stand-alone Law 25 privacy impact assessment is not required prior to Quebec-facing launch.

3. Purposes of collection, use and disclosure

3.1 Crown collects, uses and discloses Individual Data only for the following purposes:

(a) regulatory compliance — enabling Users, under their own legal obligations (for example, anti-money-laundering, anti-terrorist-financing, sanctions compliance, and know-your-customer obligations), to screen individuals and entities against Public Records;

(b) due diligence — supporting commercial, investment, legal and journalistic due diligence on individuals and entities named in Public Records;

(c) legal and investigative uses, including by law enforcement, regulators, and investigative journalists, consistent with the public-interest basis on which the underlying Public Records were themselves published; and

(d) operating, securing and improving the Site and the Compilation.

3.2 Crown does not use Individual Data for behavioural advertising, and does not sell Individual Data to data brokers for marketing purposes.

4. Accuracy and correction requests

4.1 Crown takes reasonable steps to ensure Individual Data is as accurate, complete and current as is necessary for the purposes in section 3, consistent with the limitations described in the Attribution notice.

4.2 An individual who believes Individual Data about them is inaccurate or out of date may request correction or annotation by contacting the Privacy Officer under section 7. Crown will:

(a) direct correction requests concerning the substance of a designation (for example, a sanctions listing or debarment) to the relevant Source Publisher, since Crown does not have authority to alter another authority's determination, and will annotate the Crown record to reflect a pending or resolved correction where the Source Publisher confirms one; and

(b) correct, without reference to the Source Publisher, any error introduced by Crown's own compilation process (for example, a matching or transcription error), within 30 days of receiving the request, consistent with the response commitment published by comparable Canadian providers and with PIPEDA's default response timeline.

5. Retention

5.1 Crown retains Individual Data compiled from a Source Publisher's current, active record for as long as that record remains part of the Compilation, and retains historical versions indefinitely, with a "last seen" or delisting date attached to each, to preserve an audit trail of changes. This mirrors the retention approach published by comparable providers, on the basis that a historical designation remains a fact of public record even after a Source Publisher removes the current listing.

5.2 Where a Source Publisher removes a listing, Crown updates the Compilation on its normal refresh cycle and retains the dated historical record rather than deleting it, consistent with section 5.1 and with the audit-trail practices common among screening providers. An individual whose listing has been removed by the Source Publisher may request that Crown's record be annotated to reflect the delisting date under section 4; Law 25 and Provincial PIPA do not require deletion of a historical fact that remains part of the public record from which it was drawn.

6. Disclosure to third parties

6.1 Crown discloses Individual Data to Users through the Free Services and under Commercial Use licences described in the Commercial licence summary, subject to the purpose limitations in section 3 and the no-sole-basis-for-adverse-decision requirement in the Terms of use, section 6.1(c).

6.2 Crown may disclose Individual Data to service providers (for example, hosting and infrastructure providers) who process it solely on Crown's behalf and under contractual confidentiality and security obligations, which may be located, or process data, outside Canada, including in the United States. Consistent with the practice of comparable Canadian providers, Crown will, before publication: (a) publish a current list of subprocessors and their locations, updated as it changes; and (b) rely on Canada's PIPEDA adequacy recognition and, for transfers not covered by an applicable adequacy finding, standard contractual clauses or an equivalent contractual safeguard, to disclose and govern any cross-border transfer, in each case disclosed on the Trust/Subprocessors page referenced from this notice once infrastructure is finalized.

7. Privacy Officer and inquiries

7.1 Crown's Privacy Officer, accountable for compliance with this notice and applicable privacy law, may be reached at [email protected] or in writing at Crown Stack Systems Inc., Attn: Privacy Officer, 1230 Oakhill Avenue, Oshawa, Ontario L1K 2R4, Canada. Consistent with the practice of comparable Canadian providers, Crown designates this role by title and role-based mailbox rather than by naming an individual, so that the designated-accountable-individual requirement under PIPEDA and Law 25 is met independently of personnel changes.

7.2 Individuals with questions, correction requests, or complaints about the handling of Individual Data may contact the Privacy Officer at the address in section 7.1. An individual who is not satisfied with Crown's response may complain to the Office of the Privacy Commissioner of Canada and, for Quebec residents, the Commission d'accès à l'information du Québec, or the applicable provincial commissioner in Alberta or British Columbia.

8. Security

8.1 Crown maintains administrative, technical and physical safeguards appropriate to the sensitivity of Individual Data, including encryption of data in transit and at rest, access limited to personnel on a need-to-know basis, and security training for staff and contractors. Consistent with the practice of comparable providers, Crown intends to publish a Trust Center / security documentation page summarizing its safeguards and pursued certifications before or shortly after launch.

9. United States note: not a consumer report

9.1 This service, including the Content and any screening results derived from it, is not a "consumer report" as that term is defined in the US Fair Credit Reporting Act ("FCRA"), and Crown is not a "consumer reporting agency" for purposes of the FCRA.

9.2 You must not use the Content, or any results obtained through the Site or under any licence, as a factor in determining eligibility for: (a) employment (including hiring, promotion, reassignment or termination); (b) credit or insurance to be used primarily for personal, family or household purposes; (c) government licences or benefits where FCRA-type eligibility criteria apply; or (d) tenancy or housing decisions — in each case where a consumer report would be required under the FCRA or analogous state law.

9.3 A User who requires data for any FCRA-permissible purpose listed in section 9.2 must obtain it from a consumer reporting agency that complies with the FCRA's accuracy, dispute, and disclosure obligations; Crown's Compilation does not meet, and is not designed to meet, those obligations.

9.4 Sections 9.1 through 9.3 are drafted, consistent with the market practice of non-consumer-reporting compilers, to extend by their own terms to any state, provincial or other analogue to the FCRA, and are not limited to the federal statute; a User remains responsible for determining whether any state-level regime applies to its intended use.