Privacy Policy

The purpose of this Privacy Policy is to inform mortgage brokers, lenders, mortgage applicants, and other users (collectively the "Users"), how personal information is collected, used and disclosed in connection with the MBA Document Collection service (the "MBA Service"). Please read this Privacy Policy carefully.

This Privacy Policy applies only to information which MBA Technologies Inc. ("MBA") collects through and processes using the MBA Service, and other electronic communications sent through or in connection with the MBA Service, and DOES NOT apply to any information that is provided to it or is collected by any third party.

What is the MBA Service?

The MBA Service is a technology solution operated by MBA that provides integrated and automated mortgage document collection, management, and processing, and data reporting, services to mortgage brokers and lenders ("Mortgage Professionals"). The goal of the MBA Service is to provide higher efficiency and standardization to the collection of documentation required for mortgage qualification/approval and underwriting purposes, and confidence to applicant screening, and deal review.

What Information is Collected in Connection With the MBA Service?

MBA collects the following information as necessary in order to fulfil the purposes described below. This information may be collected by MBA from mortgage brokers or advisors currently or previously employed by Mortgage Professionals, mortgage applicants directly, or from other sources. For all information that MBA collects, MBA shall use the most current information it receives from any of the sources listed below. MBA shall collect and process any personal data deemed to be "sensitive" personal data under the Personal Information Protection and Electronic Documents Act in accordance with all applicable Canadian privacy laws.

Personal Information Collected from Mortgage Professionals

In order to participate in the MBA Service, a Mortgage Professional must create an MBA Account. In order to create an MBA Account, certain information will be requested from the relevant individual. This information, pertaining to the Mortgage Professional, may include:

• Name, and business contact information, including business phone and fax number, address and email address.
• Business Number (BN) for incorporated Mortgage Professionals.
• The Mortgage Professional's business affiliations, including with Mortgage Brokers, lenders or financial institutions, and other businesses (if and as applicable).
• Details of the Mortgage Professional's real estate licence (if applicable).

Following creation of an MBA Account, Mortgage Professionals may place individual orders on the MBA Service. When placing an order, certain information will be requested from and provided by the Mortgage Professional regarding the order and the subject of that order. This information, pertaining to the mortgage applicant, may include:

• Name, address, and email address.
• Known owned properties and associated addresses.
• Known financial institutions and date range requirements for bank statements.
• Consent form authorizing MBA to interact with the mortgage applicant to gather documents and personal information on behalf of the Mortgage Professional.

Personal Information Collected About Mortgage Applicant from the Mortgage Applicant and Third Party Sources

In response to an order placed by a Mortgage Professional, and subject to provision of an appropriate consent form, MBA will collect documents and personal information regarding the relevant mortgage applicant required by the Mortgage Professional. This information may be collected from either the mortgage applicant (through upload to an integrated portal via secure link sent by MBA to the mortgage applicant) or relevant third party sources, and may include:

• A copy of valid Canadian photo ID.
• Pay stubs.
• T4 documents.
• Notice of Assessment documents.
• Mortgage statements.
• Property tax bills.
• Confirmation of condominium or strata fees.
• Lease agreements.
• Bank statements.
• Name and contact information of solicitor or lawyer.
• Void cheque.
• Any other information where permitted or required by applicable law or regulation.

Technical Data

Technical data is collected automatically when registering, using and accessing the MBA Service, including:

• The type of device the User uses.
• Time zone settings.
• The IP address and operating system of the User's computer.
• The type of Internet browser the User uses.
• Information the User's browser sends to MBA when it accesses or uses the MBA Service.
• Usage details.
• Unique device identifiers to support essential use cases such as analytics and fraud prevention, and other diagnostic data.

In some cases, technical data may also be personal information.

What is Personal Information Used for and Who has Access to it?

Use of Personal Information

MBA uses information that it collects or that is provided to MBA, including personal information:

• To manage and administer the MBA Service and to carry out administrative tasks relating to the MBA Service, including: (i) gathering and completing document collection necessary to support the processing of mortgage applications, (ii) verification of information provided by mortgage applicants, (iii) completion of key underwriting data reporting services in relation to mortgage applications.
• To satisfy any legal, dispute resolution, accounting, or reporting requirement.
• To notify Users of changes to any products or services MBA offers or provides in connection with the MBA Services.
• To fulfill the purposes for which the information was provided, or which were described when such information was collected.
• To attend and manage User requests to MBA.
• To conduct data analysis, identify usage trends, determine the effectiveness of promotional campaigns, and to evaluate and improve MBA's products, services, and marketing.
• For marketing or promoting MBA's products and services, unless the User has opted not to receive such information.
• For any other purpose with the relevant User's consent.

Transfer of Personal Information

In some cases, MBA uses third parties to help provide its services. This means that MBA must transfer personal information to them. MBA transfers personal information that it collects or that is provided to it in connection with the MBA Services as described in this Privacy Policy:

• With contractors, service providers, and other third parties that MBA uses to support its business, including but not limited to for customer support, data hosting, on-going compliance monitoring, electronic contracting and data processing services. MBA contractually requires these third parties to keep personal information confidential, use it only for the purposes for which MBA discloses it to them, and to process personal information following the same standards set out in this Privacy Policy.
• As necessary or required by applicable law or regulation.
• For business transfers. According to applicable law, MBA (and/or its successor and assigns) may share or transfer personal information in connection with, or during negotiations of, any proposed or actual financing, securitization, insuring, sale, restructuring, dissolution, assignment or other disposal, or other sale or transfer of some or all of MBA's business or assets.
• With MBA affiliates, in which case MBA will require those affiliates to follow the same standards set out in this Privacy Policy.

Disclosure of Personal Information

MBA may disclose personal information that it collects or that is provided to MBA as described in this Privacy Policy:

• To comply with any court order, law, regulation or legal process, including to respond to any government or regulatory request, according to applicable law or regulation.
• If MBA believes disclosure is necessary or appropriate to protect the rights, property, or safety of its business, customers, or others.
• To enforce MBA's rights arising from any contracts between it and its Users, and for billing and collection, if applicable.
• In limited circumstances, MBA (or its successors and assigns) may also provide personal information to potential acquirers of its business or assets.
• For any other purpose MBA discloses when such information is provided, including as otherwise required or permitted by law.
• To fulfill the purpose for which it is provided.
• With the individual User's consent.

MBA may disclose aggregated information about Users, provided that such information does not identify any individual, without restriction.

How and When Does MBA Retain Personal Information?

Except as otherwise permitted or required by applicable law or regulation, MBA will retain Users' personal information only for as long as is necessary to fulfill the purposes that MBA collected it for as set out in this Privacy Policy, subject to legal, accounting, or reporting business requirements.

MBA will also retain technical data, including without limitation, login information, device type, time zone setting, and usage details, for internal analysis purposes. Technical data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of the MBA Service, or MBA is legally obligated to retain this data for longer time periods.

Under some circumstances, MBA may anonymize or aggregate personal information so that it can no longer be associated with an individual. MBA reserves the right to use such anonymous and de-identified data for any legitimate business purpose without further notice to or consent from Users.

In the event that the relevant subscription or other agreement relevant to the MBA Service between a Mortgage Professional and MBA terminates or expires, the Mortgage Professional will not have access to information about any User that is added to the MBA Service after the date or termination or expiry, however, information (including personal information) about the Mortgage Professional that was in the MBA Service prior to contract termination or expiry will still be accessible and will be retained in accordance with the terms contained herein.

Is Personal Information Transferred?

MBA may transfer information to outside agents or service providers (including affiliates acting in this capacity), located in Canada and the US, and such information will be subject to the laws, including public authority access laws, of such countries.

Whenever MBA engages a service provider, it requires that such service provider's privacy and security standards comply with this Privacy Policy and applicable privacy laws.

How Can Personal Information be Accessed and Corrected?

It is important that the personal information MBA holds about Users is accurate and current. Users must keep MBA informed if their personal information changes. By law, individuals have the right to request access to and to correct the personal information that MBA holds about them.

MBA may request specific information from individual Users to help it confirm their identity and right to access, and to provide such individuals with the personal information that MBA holds about them or make their requested changes. Applicable law or regulation may allow or require MBA to refuse to provide individual Users with access to some or all of the personal information that MBA holds about them, or MBA may have destroyed, erased, or made such personal information anonymous in accordance with its record retention obligations and practices. If MBA cannot provide the individual User with access to their personal information, such individual User will be informed of the reasons why, subject to any legal or regulatory restrictions.

How is Security of Personal Information Protected?

The security of personal information is very important to MBA. MBA uses physical, electronic, and administrative measures designed to secure personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. This information is maintained in a file on MBA's servers and will be accessible by authorized MBA employees, representatives and agents who require access to perform their job functions. MBA stores all information provided to it behind firewalls on its secure servers. Any payment transactions related to the MBA Service are processed by a third party service provider that is subject to industry standard payment data security standards. Unfortunately no method of transmission over the Internet, or method of electronic storage is completely secure. Although MBA does its best to protect personal information, MBA cannot guarantee the security of personal information transmitted through the MBA Service. Any transmission of personal information is at the individual User's own risk. MBA is not responsible for circumvention of any MBA Service privacy settings or security measures.

How Can Consent be Withdrawn?

Where an individual User has provided MBA with consent to the collection, use, and transfer of their personal information, such User may have the legal right to withdraw its consent under certain circumstances. To withdraw consent, if applicable, contact MBA at adam@mbatech.net

Please note that if consent is withdrawn, MBA may be unable to provide the relevant individual User with a particular product or service, and/or its ability to access and use the MBA Service may be significantly restricted. MBA will explain the impact to such individual User at the time to help such individual User make their decision.

Links to Other Websites

The MBA Service may contain links to other websites that are not operated by MBA. If a third party link is clicked on, the User will be directed to that third party's site. MBA strongly advises its Users to review the Privacy Policy of every site it visits.

MBA has no control over and assumes no responsibility for the content, privacy policies or practices of any third party sites or services.

Questions, Concerns and Access to Personal Information

Any questions or concerns about how information is handled by MBA in connection with the MBA Service should be directed to the Privacy Officer at legal@mbatech.net.

Users may also request access to or correction of their information by contacting the Privacy Officer, as described above. MBA shall make reasonable efforts to respond to such requests within thirty (30) days. However, if such information is comingled with the information of others, responses may be delayed and access may be denied if such information cannot be segmented from the information of others.