PRIVACY POLICY

Foxo Development Corp. ("Foxo," "we," "us," or "our") provides financial and payment services. We serve business customers: corporations, companies, and other legal entities (each, a "Business Customer"), and individual customers who use our Services for personal purposes (each, an "Individual Customer"). Business Customers and Individual Customers are together our "Customers."

This Privacy Policy explains how we collect, use, disclose, and protect personal information, including information about:

• Individual Customers who use our Services directly;
• individuals connected to a Business Customer, such as directors, officers, beneficial owners, authorized signatories, personal guarantors, and employees; and
• visitors to our website at www.wolfo.io (the "Website").

As used in this Privacy Policy, "you" and "your" refer to the individual whose personal information we process, whether you are an Individual Customer, Business Customer`s authorized users (“Authorized User”), or someone connected to a Business Customer.

Your relationship with us is also governed by the Wolfo Terms and Conditions of Use, or the separate agreements with us (the "Agreement"). If this Privacy Policy conflicts with the Agreement on how we handle personal information we process, the Agreement governs.

Our Services are intended for adults, and we do not knowingly open a Services account ("Account") for anyone under the age of majority. If you are a minor, please do not give us personal information.

If you have questions about this Privacy Policy or our privacy practices, see Section 9 for how to contact us.

This Privacy Policy applies to personal information we collect and process (defined below) about you in two situations:

• You use or interact with the services available on the Website, including the technology we provide to access and use those services (the "Services").
• You interact with us through our social media, emails, newsletters, advertisements, or any other online or offline channel.

We are responsible for the personal information covered by this Privacy Policy, including personal information relating to Individual Customers and individuals connected to Business Customers that we collect and use to verify identity, ownership and control, prevent fraud, and comply with our obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and other applicable laws.

In limited cases, where a Business Customer instructs us to process personal information solely on its behalf and for its own purposes, we act as a Processor for that processing. That processing is governed by the Agreement and the Business Customer's instructions, not this Privacy Policy. This does not apply to Individual Customers, who deal with us directly and whose information we process

This Privacy Policy does not cover third-party applications or services used together with our Services, or other services and accounts offered by third-party providers through the Website (collectively, "Third-Party Services"). For example, you may connect Third-Party Services to an Account. Third-Party Services help us offer an integrated solution, but they are not part of our Services. Independent third parties provide them under their own policies and terms.

We process personal information to deliver Services to you and to run our business.

A. Personal Information You Give Us Directly

If you apply for or use an Account we collect the following categories of personal information directly from you:

• Contact Information: your name, email address, phone number, and mailing/residential address.
• Identity Verification & Risk Information: what we need to confirm who you are and assess risk before providing Services, including your name, login credentials, date of birth, residential address, country of citizenship, photograph, and identification documents (driver's licence, passport, or other government-issued ID), where the PCMLTFA requires it.
• Financial Information: income, assets, and liabilities, and other information gathered through our identity-verification and risk-assessment process, where relevant to your use of the Services.
• Social Insurance Number (SIN): collected only where the law requires or allows it, for example, tax reporting under the Income Tax Act. We do not use your SIN as a general identifier and do not require it unless the law does.
• Communications: what you tell us when you contact sales or support, give us feedback, or otherwise correspond with us.
• Content: documents, files, or other information you give us, which may include personal information about you.
• Transaction Data: information about currency exchanges, payments, and transactions made through an Account, online or in person, which may include personal information.

If you, or someone at a Business Customer, start applying for an Account, we collect the same categories listed above for each individual connected with the account (for example, directors, signing officers, or beneficial owners) with Contact Information additionally including employer and job title, as well as the following, specific to the Business Customer relationship:

• Business Ownership and Risk Information: ownership and control information (shareholding percentage, control chain, and politically exposed person (PEP) status).
• Third-Party Information: personal information you give us about co-workers, contractors, or vendors, such as their name, email, phone number, employer, or job title.

B. Personal Information We Collect Automatically

When you use or interact with the Website, the Services, or other services we provide, we automatically collect:

• Use Data: information and metadata about your logins and about Third-Party Services you choose to connect ("Connected Data").
• Device Data: your device or browser type, operating system and settings, internet service provider, and device identifiers such as your IP address.
• Cookies and Similar Technologies: We use the following categories of cookies and similar technologies, including browser local storage, to run and improve the Website and Services:
  • Strictly Necessary. These support core function keeping you signed in, remembering your account and interface preferences, and remembering items you have dismissed. We store them in your browser's local storage. They are necessary for the Website and Services to run securely, so we do not ask for separate consent to use them. You can clear this data by clearing your browser storage, though this may sign you out or reset your preferences.
  • Analytics. We use Google Analytics 4, a web analytics service provided by Google LLC ("Google"), to understand how visitors use the Website. Google Analytics sets cookies (_ga, _ga_*) and Use Data and Device Data to Google, which may process it outside Canada. These cookies are not necessary for the Website to function. We only set them once you give consent through our cookie preferences panel (open the panel), and you can withdraw that consent, or turn these cookies off, at any time through the same panel.
  • Third-Party Content Delivery. We serve some scripts and fonts from third-party content delivery networks (jsDelivr, cdnjs, unpkg, Google Fonts). Requesting these resources may reveal your IP address to the relevant provider, as a technical side effect of your browser loading the resource. These providers do not receive any Foxo Account data.

We do not collect GPS location or mobile-wallet data.

You can also limit what we collect by changing your device or browser settings. This may limit some features.

C. Personal Information We Collect from Other Sources

We also collect personal information about you from:

• Financial Institution Partners: banks, card networks, payment processors, money transmitters, and other entities that provide or support financial services.
• Identity Verification, Fraud, Compliance, and Business Information Providers: to help us verify identity, prevent fraud, and meet legal obligations. This may include your name, address, phone number, photograph, government ID, or device information.
• Service Providers: who support our operations and may collect personal information depending on the service they provide and your interactions with the Services and Website.
• Social Networks and Public Databases: to help us understand prospective customers and measure advertising. This may include your name, email, phone number, address, gender, age, and other demographic data, plus data about how you interact with our social media pages (for example, likes, comments, shares, and impressions).
• Joint Marketing and Business Partners: who may share information about customers we have in common, such as contact information and the services they use.
• Publicly Available Sources: such as company websites, news articles, and press releases, to help us identify potential customers or conduct due diligence.

The categories of personal information we collect from these sources may include any of the categories listed above under "Personal Information You Give Us Directly" and "Personal Information We Collect Automatically." We handle information from these sources under any laws or contracts that apply to us.

(a) Consent as our general rule

For Individual Customers, and for anyone whose personal information we process outside the exceptions below, we rely on your consent. Consent can be express (you clearly say yes) or implied (reasonable in the circumstances, given what you are asking us for). We ask for express consent for sensitive information, as explained in paragraph (e).

(b) Business contact information exception

For business contact information: your name, business title, business address, business email, and business phone number, used only to contact you about your job, business, or profession, we rely on the business contact information exception in PIPEDA section 4.01. We do not need your consent to collect, use, or disclose business contact information used for that purpose. This exception does not apply to information you give us as an Individual Customer for your own personal Account.

(c) Statutory obligations (KYC, KYB, UBO, AML)

To verify identity, ownership, and control, including information about you as an Individual Customer, or about a Business Customer's directors and beneficial owners, we rely on the exceptions to consent in PIPEDA section 7, and on our obligations under the PCMLTFA, its Regulations, and FINTRAC guidance. This processing is required by law. We cannot provide the Services without it.

(d) Reliance on a Business Customer's authority

When a Business Customer gives us personal information about individuals connected to it, the Business Customer confirms three things:

• It has the authority to give us that information.
• It told the individuals about the disclosure, and gave them a copy of, or a link to, this Privacy Policy.
• It obtained any consent the law requires for the disclosure.

We rely on those confirmations. If you have not received this notice from a Business Customer, contact our Privacy Officer for a copy of this Privacy Policy and to exercise the rights described in Section 8.

(e) Express consent for sensitive information

For biometric information, your Social Insurance Number, and any use of personal information beyond what the Services need, we ask for your express consent directly. Before you consent, we will tell you, in plain language:

• What personal information we collect.
• Which third parties we will share it with, and why.
• The likely results of giving or refusing consent.
• Any remaining risk of harm.

(f) Withdrawing consent

Where we rely on consent, you can withdraw it at any time, subject to legal or contractual limits and reasonable notice. Before your withdrawal takes effect, we will tell you what is likely to happen, for example, that we may no longer be able to provide Services to you or a Business Customer, that a role such as authorized signatory or guarantor may need to be reassigned, or that a transaction may not complete. Withdrawal does not undo processing we already carried out, and it does not affect processing under a statutory exception (paragraph (c)), which continues for as long as the law requires.

Some identity checks need a biometric step, usually a real-time photo or short video of your face, together with a photo of your government-issued ID. When that happens:

(a) Separate express consent

Because biometric information is sensitive, we ask for your express consent to collect and use it at the point of collection. This is separate from any other consent you gave as part of onboarding.

(b) We only use it to verify you

We use biometric information only to verify your identity and prevent fraud. We do not use it for marketing, analytics, or any other purpose, and we do not sell or license it.

(c) We delete it after verification

We delete the raw biometric image or video once verification succeeds. We keep the verification result (verified or not verified), and any non-reversible template used for ongoing fraud prevention, only as long as necessary and to meet our record-keeping duties, and never more than 5 years after your Account closes.

(d) Our service providers follow the same rules

Where an identity-verification provider collects biometric information for us, our contract requires them to protect it the way we do, delete raw biometric data on the same schedule, and never use it for their own purposes.

We use personal information for the following purposes:

• Open and manage your Account. We verify your identity (as an Individual Customer) or the identity, ownership, and control of a Business Customer and its people (KYC/KYB).
• Meet regulatory requirements. We comply with the PCMLTFA, FINTRAC, sanctions, and tax-reporting rules, and respond to lawful requests from regulators and law enforcement.
• Deliver and run the Services. We open and service Accounts, verify access to portals, process transactions, and respond to support requests.
• Detect and prevent fraud. We monitor transactions and access patterns for unauthorized activity.
• Communicate with you about products and offers, where the law allows. For Individual Customers, this follows Canada's Anti-Spam Legislation (CASL) and your consent choices. For prospective Business Customers, we use information we collect from other sources (Section 2C).
• Manage risk. We assess and manage our operational and enterprise risk.
• Send you service communications. We tell you about the Services you use and material changes to them.
• Establish and defend legal claims. We also use personal information to enforce our agreements.

We do not use personal information for personalized advertising, behavioural targeting, or loyalty-program purposes.

We do not make decisions about you, such as approving, declining, or pricing an Account, application, or transaction, based exclusively on automated processing. A person is always involved before a decision affecting you is made.

We do not sell or rent personal information. We disclose personal information as described in this Privacy Policy. We may also disclose information that does not identify you (including aggregated or de-identified data) for any purpose, unless a law or contract stops us.

• Business Customers. If you are connected to a Business Customer, we may share information about you with that Business Customer where needed to run the Services, for example, to confirm a signatory's identity has been verified, or to update onboarding status. We do not share your underlying identity documents or biometric material with the Business Customer.
• Service Providers. We share personal information with service providers who perform functions for us, cloud hosting, IT and security, communications and support tools, and professional advisors. They may access personal information only as needed for their work, and our contracts require them to protect it the way this Privacy Policy does.
• Providers of Third-Party Services. If you or a Business Customer choose to connect a Third-Party Service (for example, crypto access services), we share personal information with that provider.
• Financial Institution Partners. We share personal information with banks, card networks, and payment processors involved in opening Accounts or processing transactions, to support their own identification, risk, and compliance checks, and so they can help us provide the Services and deliver payments and transfers. For example, to meet Know-Your-Customer requirements, we may share the information described in Section 2A and transaction information.
• Mergers and Acquisitions. If we are involved in a merger, acquisition, reorganization, financing, or sale of all or part of our business, we may use and disclose personal information, without consent, to the other parties and their advisors, under PIPEDA section 7.2.
• Identity Verification and Risk Providers. We use service providers for identity and biometric verification, sanctions and PEP screening, fraud monitoring, card issuance, collections, and legal representation. They receive only what they need to do their job, and our contracts require them to protect it as we do.
• Public Authorities. We may disclose personal information to public authorities, such as FINTRAC, the Canada Revenue Agency, and other regulators, where the law, payment network rules, or a legal process requires it, including to investigate suspicious activity or respond to lawful requests from regulators, courts, or law enforcement.

We may process and store personal information in Canada or other countries, either ourselves or through service providers. Where personal information is transferred, processed or stored outside Canada, we comply with all applicable privacy, data protection and other legal requirements governing such transfers and take appropriate measures to protect the personal information in accordance with applicable law.

This section applies where a Business Customer gives us personal information about its Authorized Users or other connected individuals. It does not apply to Individual Customers, who give us their own information and consent directly.

By giving us personal information about an Authorized User or other individual connected to it, a Business Customer agrees to the following:

• It will follow applicable privacy laws when collecting that information and giving it to us.
• It will tell each individual, before disclosure, that it is giving us their information, and give them a copy of, or a working link to, this Privacy Policy.
• It will get any express consent the law requires, including for sensitive information such as biometric data and Social Insurance Numbers, unless we get that consent directly.
• It will tell us promptly when an individual no longer holds a role that justifies our continued processing, for example, when a director or authorized signatory resigns or is removed.
• It will help us respond to access, correction, and other rights requests from individuals connected to it.

The Business Customer will cover our losses if it breaches these obligations, as set out further in the Agreement.

A. Access, Correction

If you are an Individual Customer, you deal with us directly. Contact our Privacy Officer (Section 9) to exercise the rights below.

If you are connected to a Business Customer, the Agreement between us and the Business Customer governs the information in its Account. Direct questions about personal information we process on a Business Customer's behalf to that Business Customer and its administrators, we will support them in responding to you. If you are an Authorized User, you may be able to access, update, or delete some personal information within the Business Customer's Account through the Services, but the Business Customer and its administrators generally decide how that information is processed.

Subject to legal limits, you have three main rights:

• You can know what personal information we process about you, and get a copy of it, in a structured, commonly used technical format, where technically feasible.
• You can correct inaccurate personal information about you.
• You can withdraw your consent at any time for future processing, where we process your information based on consent.

We may limit these rights, for example, if answering your request would reveal someone else's personal information, reveal a Business Customer's confidential commercial information (an exception under PIPEDA), or if you ask us to delete information the law requires us to keep, or that we have a compelling reason to keep.

To exercise these rights, contact our Privacy Officer (Section 9). We may ask you to verify your identity first. We will respond within 30 days, at little or no cost to you; if a cost applies, we will tell you the approximate amount in advance and only proceed if you do not withdraw your request. If we extend the response period, as PIPEDA allows, we will tell you, within the original 30 days, the new deadline, why we extended it, and your right to complain to the Office of the Privacy Commissioner of Canada about the extension.

If we cannot resolve a disagreement about whether your information is accurate or complete, we will record the disagreement and, where appropriate, tell any third party who has access to the information about it. Where we correct information, we will pass the correction to third parties who have access to it, where appropriate.

We may withhold some personal information if disclosing it would reveal a Business Customer's confidential commercial information, reveal someone else's personal information, is protected by legal privilege, or falls under another PIPEDA exception.

B. Communication Preferences

1. Emails. You can opt out of our emails anytime using the unsubscribe link in the email. You cannot opt out of transactional and relationship emails, for example, about your Account, transactions, servicing, or our ongoing relationship. For Individual Customers, the legal basis for commercial electronic messages is your consent under Canada's Anti-Spam Legislation (CASL); for messages connected to a Business Customer relationship, it is set out in the Wolfo Terms and Conditions of Use.

2. Text or SMS Messages. If you opted in to text or SMS messages about the Services, text "STOP" to the short code to opt out anytime. We will confirm by SMS once you are unsubscribed; after that, you will not receive SMS messages from us. We will not share, sell, rent, or otherwise disclose your text-messaging opt-in data or consent for marketing purposes. See the Agreement for more information. You may need to opt out separately on other platforms, such as WhatsApp.

If you have a question, concern, or complaint about how we handle personal information, contact our Privacy Officer:

Privacy Officer

By email: [email protected]

By mail: 7030 Woodbine Avenue, Suite 500, Markham, Ontario, L3R 6G2, Canada

We will acknowledge your complaint within 10 business days and give you a substantive response within 30 days of receiving it.

If you are not satisfied with our response, or you want to raise a privacy concern independently at any time, you may contact:

Office of the Privacy Commissioner of Canada

30 Victoria Street, Gatineau, Quebec K1A 1H3

Toll-free: 1-800-282-1376 · https://www.priv.gc.ca

If you live in Quebec, you may also contact the Commission d'accès à l'information du Québec (CAI) about how we handle your personal information: https://www.cai.gouv.qc.ca.

We use technical, organizational, administrative, and physical measures to protect your personal information from loss, theft, misuse, unauthorized access, disclosure, alteration, or destruction. These measures include:

• We encrypt personal information in transit, keep key material in a hardware-backed key management service, and encrypt sensitive credentials at rest.
• We use role-based access controls, multi-factor authentication for Account access, and need-to-know access to personal information.
• We run continuous security monitoring, vulnerability management, and regular internal reviews of our security controls.
• We choose service providers based on their security and privacy practices, including, where available, recognized certifications such as SOC 2 or ISO 27001, and we engage them under data processing agreements.

No security program or internet transfer is completely secure, so we cannot guarantee your personal information's security. We recommend using strong, unique passwords, turning on multi-factor authentication for your Account, and following good information-security practices generally. If you suspect unauthorized activity on your Account, or a security incident, contact us immediately at [email protected]

We keep personal information only as long as reasonably necessary for the purposes we collected it, or as long as the law requires. Indicative retention periods are below. Where more than one rule applies, the longest period governs.

Category of information	Retention period
Identity information of Individual Customers, directors, officers, and beneficial owners (name, address, date of birth, ID documents)	Duration of the customer relationship + 5 years
Business contact information (name, business title, business email/phone)	Duration of the Business Customer relationship + 3 years
Social Insurance Number (where lawfully collected)	Only while required for tax reporting or verification; deleted promptly after
Transaction and account records	5 years from the transaction date or account closure (PCMLTFA)
Biometric raw images or video	Deleted after successful verification
Biometric verification outcome and non-reversible template	Duration of the customer relationship + 5 years (see Section 4(c))
Website and portal usage data	26 months, then aggregated or deleted
Consent and marketing-preference records, including CASL consent records	Duration of the customer relationship + 3 years, or 3 years from when consent was given or withdrawn
Records of breaches of security safeguards	Minimum 24 months (PIPEDA s. 10.1)
Client-support communications	3 years from resolution
Prospect and marketing contact information (public sources, social networks, partners)	24 months from last meaningful interaction or opt-out, whichever is earlier; if the prospect becomes a customer, the relevant customer category applies
Website visitor logs (non-customers)	12 months, then deleted or aggregated
Website, portal, and security logs	5 years from creation, then deleted or aggregated

After the retention period ends, we securely destroy, erase, or anonymize personal information so that re-identification is not reasonably possible.

If personal information in our custody or control is affected by a breach of security safeguards that creates a real risk of significant harm to you, we will take the following steps:

• We will report the breach to the Office of the Privacy Commissioner of Canada as soon as feasible after we determine it happened.
• We will notify affected individuals directly, without unreasonable delay, with enough information for you to understand the breach and take steps to reduce or avoid harm.
• We will notify any other organization or government body that could help reduce or avoid harm.
• We will notify the affected Business Customer promptly, where the breach involves its personal information, or information we process on its behalf, so we can coordinate our response.
• We will keep a record of every breach of security safeguards involving personal information for at least 24 months, and give the Commissioner access to those records on request.
• Where the breach involves personal information of individuals in Quebec, we will also notify the Commission d'accès à l'information du Québec, as required under Quebec's private-sector privacy law.

We assess whether a breach creates a real risk of significant harm by looking at the sensitivity of the information, the likelihood of misuse, and any other factor PIPEDA and the Breach of Security Safeguards Regulations require.

We may update this Privacy Policy from time to time.

Changes that do not materially affect how we collect, use, or disclose personal information take effect once we publish the updated policy on the Website.

If we make a material change to how we collect, use, or disclose your personal information, we will give you reasonable advance notice before it takes effect for you:

• If you are an Individual Customer, we will notify you directly, using the contact information you gave us, or through a notice on the Website or in your Account.
• If you are connected to an existing Business Customer, we will notify the Business Customer so it can inform you, or we will notify you directly using your contact information.
• If we do not have an existing relationship with you (for example, you only visit the Website), we will post any notice on the Website.

Where a material change relies on your consent, we will only apply it to information we already collected once we have that consent, through the channels above. Otherwise, if you keep using the Services after a change takes effect, the updated Privacy Policy governs our processing of your personal information.

We encourage you to check this Privacy Policy regularly, so you know what personal information we collect, how we use and otherwise process it, when we disclose it to third parties, and what privacy rights you have.

We maintain a privacy management program that includes the following:

• Documented policies and procedures for collecting, using, disclosing, keeping, and destroying personal information.
• Privacy-by-default settings in our products and Services, so that you get the highest level of privacy protection consistent with providing the Services, without having to do anything yourself. This does not apply to cookies and similar tracking technologies, which follow the settings described in Section 2B.
• A designated Privacy Officer who oversees our compliance and advises us on our privacy obligations.
• Privacy impact assessments for new products, features, and material changes to how we process personal information.
• A framework for managing service-provider risk, covering due diligence before we engage them, contract protections, and ongoing monitoring.
• A breach-response plan with clear roles, escalation paths, and notification steps.
• A framework for retaining and destroying records.