Themis Lending Inc. Privacy Policy

1. Our Commitment to Privacy

Themis Lending Inc. (“Themis”, “we”, “us”) is committed to protecting the privacy and security of personal information in our custody or control. We maintain a privacy management program designed to comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial private‑sector privacy laws, including Québec's Act Respecting the Protection of Personal Information in the Private Sector, as amended by Law 25.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit our website or use our products and services (collectively, the “Services”).

2. What Themis Does

Themis provides an income calculation and mortgage‑qualification workspace intended to help borrowers — including self‑employed borrowers — organize financial information and generate lender‑aligned summaries. Borrowers may choose to share certain information with mortgage professionals such as mortgage brokers or agents, real estate professionals, lawyers or notaries, and lender representatives.

Important: Themis is not a lender and does not approve, underwrite, or fund mortgages. All lending and underwriting decisions are made independently by licensed professionals and/or financial institutions.

3. Scope and Roles

This Privacy Policy applies when you:

• visit our website;
• create or use a workspace or account;
• upload documents or use calculators;
• receive affordability or eligibility outputs;
• contact us for support, privacy, or security inquiries; or
• use an invitation issued by a mortgage professional.

Borrower‑controlled sharing: Professionals may only access personal information when you explicitly authorize sharing through platform controls, except where disclosure is required by law.

Third‑party services: This Policy does not apply to third‑party websites or services linked from our website, or to how mortgage professionals or lenders use personal information outside the Themis platform under their own privacy policies.

4. Personal Information We Collect

4.1 Information You Provide

We may collect identity and contact information (such as name, email address, phone number, province, and language preference); mortgage and financial information (including income details, expenses, assets, liabilities, and property details); documents you upload (such as pay stubs, tax records, bank statements, and financial statements); and professional user details (such as role, brokerage, and license number, where applicable).

4.2 Information Generated by the Platform

We may generate and store affordability and eligibility outputs, calculation metadata, audit logs, access records, and consent or sharing history.

4.3 Information Collected Automatically

We may automatically collect device identifiers, browser type, IP address, timestamps, usage data, and information collected through cookies or similar technologies.

5. How We Use Personal Information

We use personal information to:

• provide, operate, and support the Services;
• perform affordability and income calculations;
• process document uploads and generate summaries;
• enable borrower‑directed sharing with professionals;
• improve functionality, performance, and user experience;
• detect, prevent, and investigate fraud or misuse;
• communicate service‑related and support messages; and
• comply with legal and regulatory requirements.

6. Consent and Your Choices

We rely primarily on meaningful consent, including express consent for sensitive financial or tax‑related information. You may choose what information to provide, control whether and with whom it is shared, and revoke access previously granted to a professional, subject to legal retention requirements.

7. How We Share Personal Information

We do not sell personal information. We may share personal information:

• with professionals you explicitly authorize;
• with service providers who process information on our behalf subject to contractual safeguards;
• where required by law or to protect our rights, users, or platform; or
• in connection with a corporate transaction, such as a merger or acquisition, subject to appropriate safeguards.

Professionals who receive information may retain it in accordance with their own legal and regulatory obligations.

8. AI‑Assisted Features and Automated Processing

Themis may use AI‑assisted tools to support information intake, document data extraction, and the generation of summaries or explanations. Affordability and qualifying‑income calculations rely on deterministic, versioned rule sets. Themis provides decision‑support tools only and does not make automated lending decisions.

Where required by Québec Law 25 or other laws, we will provide notice of automated processing and meaningful explanations.

9. Cross‑Border Processing

Some service providers supporting our Services may process personal information outside Canada. When this occurs, we use contractual and technical safeguards to protect personal information in accordance with Canadian privacy laws.

10. Data Retention

We retain personal information only as long as necessary to fulfill the purposes described in this Policy, or as required or permitted by law. You may request deletion, subject to legal, security, and audit retention requirements.

11. Security Safeguards

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information we handle. Our safeguards are designed with reference to recognized frameworks such as SOC 2 and ISO/IEC 27001. No method of transmission or storage is completely secure.

12. Cookies and Marketing Communications

Cookies and similar technologies are used to maintain sessions, remember preferences, and understand website usage. You may manage cookies through your browser settings. Marketing communications are sent only where permitted by law, and you may opt out at any time using the unsubscribe mechanism provided.

13. Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

• access, correct, or request portability of your personal information;
• withdraw consent;
• request deletion or de‑identification (subject to legal requirements);
• obtain explanations of automated processing; and
• file a complaint with the appropriate privacy regulator, including the Office of the Privacy Commissioner of Canada.

14. Contact Us

Questions about this Policy or our data practices may be directed to:

15. Updates to This Policy

We may update this Privacy Policy from time to time. The most current version will be posted on our website with the revised effective date.