In this Policy, we describe:

• The information that we collect and process about you (that you provide directly to us or is provided to us by third parties);
• The purposes for which we collect and process information about you; and
• The basis on which we collect and process information about you, when you use this website located at https://trainhub.com (our “Website”) and the services available through this Website, provided to our registered users (collectively, our “Services”).

In this Policy, the term “personal data” or “personal information” means personal data or data that relates to an identified or identifiable person.

We recommend that you read this Policy carefully in order to understand what TrainHub, an affiliate of ApplyBoard Inc. does with your personal data. Your use of our Website and Services and any dispute over privacy, is subject to this Policy and any of our applicable Terms and Conditions for use of our Services, including their applicable limitations on damages and the resolution of disputes. Our Terms and Conditions for our Services are incorporated by reference into this Policy. By visiting our Website, you are consenting to the practices described in this Policy.

Important Notes:

• SPECIFIC TERMS FOR EUROPEAN UNION (“EU”), UNITED KINGDOM (“UK”) AND EUROPEAN ECONOMIC AREA (“EEA”) CUSTOMERS ONLY: Please note that the whole of this Policy applies to you, together with additional provisions which are specific to EEA and UK customers, and can be found at Appendix 1.

SPECIFIC TERMS FOR CUSTOMERS FROM THE STATE OF CALIFORNIA ONLY: Please note that the whole of this Policy applies to you together with additional provisions which are specific to residents of California, and can be found at Appendix 2.

How does TrainHub collect my personal data?

We collect personal data directly from you, about you from third parties such as our marketing affiliates and service providers used to verify your identity and prevent fraudulent activity, and through the use of cookies and metadata collected on our Website and the Services. At this time, use of our Services is only available to users who register for our Services.

We, and our third party service providers, automatically collect the following information about your use of our Website and our online Services through cookies, web beacons, log files and other technologies (subject to your consent where required by applicable law): your domain name, your browser type and operating system, web pages you view, links you click, your IP address, the length of time you visit our Website or use our Services, your activities on our Website, and the referring URL or the webpage that led you to our Website. Please see the section “Our Use of Cookies and other Tracking Mechanisms” below for more information.

What personal data does TrainHub collect?

The types of personal data we collect about you depends on your particular interaction with our Website and our Services. In the event that it is necessary to collect any sensitive data about you, where required by data protection laws we will gather your explicit consent to do so. The personal data collected is only shared with TrainHub and our third-party service providers acting as data processors for the purpose of providing the Services you request and will not be shared or used by us for any other purposes.

We have set out in the table below the categories of personal data we generally collect about you, where permitted by applicable law:

Categories of Personal Data Collected	Specific Personal Data	Sensitive Personal Data	Source of Personal Data
Identifiers	Name, email address, phone number, billing or mailing address, IP address		Directly from you, third parties on your behalf and as instructed by you, our service providers and affiliates.
Financial Information		Bank and credit account information.	Directly from you
Internet or Other Similar Network Activity	Other information collected through Cookies and other tracking technologies as listed above and as described in the section below entitled “Our Use of Cookies and other Tracking Mechanisms”.		From you directly and our third party analytic tools and cookies usage (See the section below entitled “Our Use of Cookies and other Tracking Mechanisms”).
Commercial Information	Information about your business.		Directly from you, third parties on your behalf
Other categories	Any other information that you choose to provide to us (e.g., when you send us an email/otherwise contact us).		Directly from you, third parties on your behalf and as instructed or permitted by you.

TrainHub collects your personal data for the following uses:

Create an Account: To access certain features on the Website, you are required to create an account and provide your email address and password or sign in with Facebook or Google. Your login information is used to create your account, and otherwise provide and administer the service you requested.

Register to Take Any Courses: You will have the ability to access our course content and provide voluntary personal data so we can register you as an individual taking the course. As a certificate of completion may be issued, we will keep a record of you having registered and/or completed the course offering.

Communicate with Us: When you contact us with a comment, question or complaint, you may be asked for information that identifies you (such as your name, address and a phone number) along with additional information we need to help us promptly answer your question or respond to your comment or complaint. We may also retain this information to assist you in the future and to improve our customer service, products, service offerings, events and promotions.

Payment Processing and Transaction Tracking: TrainHub uses, with your consent, third party PCI certified payment service providers including but not limited to Western Union, Flywire or Stripe. When you directly make a payment using these payment service providers, you are subject to their privacy policies. They are independent of TrainHub and TrainHub is not responsible for their privacy practices.

Our applications are designed to directly connect our users securely, transparently and cryptographically to the PCI certified payment processor. This helps ensure we maintain the privacy of your financial transactions. The payment processor provides ApplyBoard with a transaction number and status. TrainHub maintains a list of payment processors and other third party service providers that we may use to process payments to independent service providers and/or third party contractors that we retain in connection with delivery of the Services.

Sign Up for Marketing Email and Other Communications: We may offer you the ability to sign up to receive TrainHub marketing and promotional communications through the Website, on third party websites (including through social media sites), or educational events and information sessions. In these circumstances, we collect certain personal data (such as first and last name, email address or mobile phone number) which we use to send you email and other communications containing ApplyBoard updates, tips, and other content that may be of interest to you. You can opt out of receiving promotional email from us by following the “opt-out” or “unsubscribe” instructions provided in your email or text message, or by contacting us as set out below. Please note that you may continue to receive messages from us regarding your application or other transactional and account-related electronic messages from us.

Participate in Our Surveys and Customer Research: From time to time, we may offer you the opportunity to participate in one of our surveys or other customer research. The information obtained through our surveys and customer research is used in an aggregated, non-personally identifiable format. We use this information to help us understand our customers and to enhance our product and service offerings, promotions, and events.

You are responsible for providing accurate and up-to-date information.

We share your personal data with third parties, including service providers, regulated institutions (e.g., financial institutions), affiliated entities, and business partners as set out in the table below.

In the section below, we also list the reasons why we share information.

How and Why We Share Your Information

With whom we share your personal data	Reason
Service Providers	We may transfer (or otherwise make available) your personal data to third parties who provide services on our behalf. For example, we may use service providers such as cloud providers to send our emails, host the Website and data (including cloud providers) and operate certain of its features. Other service providers may assist us with the provision of the services, help us verify your identity, prevent, detect and protect against fraudulent activity or abuse of our services, conduct internal research and analytical assessments, process your transactions, maintain your account(s) and provide you with customer care services. These service providers include internet service providers, data and cyber security services, banks, financial institutions, payment processors, financial services providers, remote access services, service providers that help us verify your identity and help us comply with our legal and regulatory obligations; and our business, legal, tax, financial and other advisors, on a confidential basis. Your personal data may be maintained and processed by third party service providers in the US or other jurisdictions. Our service providers are given the information they need to perform their designated functions, and we do not authorize them to use or disclose personal data for their own marketing or other purposes.
Researchers	With your consent TrainHub uses your data internally for research and development to improve our existing products and services and/or create new features to serve you better. TrainHub also uses non-personal data (“Metadata”) for this same purpose. With your consent, we may share your personal data with third parties involved in research and development to improve our existing products and services and/or create new features to serve you better. Such third parties may include educational institutions, academics, and others in similar fields.
Lawyers, courts and law enforcement	ApplyBoard and our Canadian, US and other service providers may provide your personal data in response to a search warrant or other legally valid inquiry or order, or to an organization in the case of a breach of an agreement or contravention of law, or as otherwise required or permitted by applicable Canadian, US or other law. We may also disclose personal data where necessary for the establishment, exercise, or defense of legal claims, to detect, suppress or prevent fraud, and to investigate or prevent actual or suspected loss or harm to persons or property.

If you do not want us to use your personal data for us to market to you, and/or to pass on to third parties for marketing purposes, please contact us through the various communication channels available, as listed under the Section titled “Contact Us, Questions, Updating Your Info, Opting Out” below. You will also be able to unsubscribe from any marketing emails sent to you by ApplyBoard using a link provided in such emails. We do not sell your personal data.

All information you provide to us is stored in the servers of our cloud service providers. We take reasonable steps to ensure our service providers adhere to the security standards we apply to your information. Any payment transactions will be encrypted using SSL technology. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Our service providers’ servers are predominantly located in the USA. Many of our service providers are also located outside of Canada. While we use appropriate safeguards to keep your information secure, the laws in other places may differ from those in Canada and authorities in those jurisdictions may access your information in accordance with their local laws.

TrainHub takes the safeguarding of your information very seriously. We have implemented reasonable administrative, technical and physical safeguards in an effort to protect against unauthorized access, use, modification and disclosure of personal data in our custody and control, including limiting access to our database to legitimate users and employing device encryption and version tracking.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our Website; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access.

TrainHub promptly evaluates and responds to incidents that create suspicion of or indicate unauthorized access to or handling of personal data. If we become aware and determine that an incident involving personal data qualifies as a security breach leading to the unauthorized access, use, modification, or disclosure of personal data in our custody and control, we will notify you of such breach without undue delay. We will provide timely information relating to the breach as it becomes known or reasonably available to us and to the extent permitted by law.

You have certain rights relating to your personal data, subject to local data protection laws. Appendix 1 describes some of these rights in detail and explains how you can exercise them. Depending on the applicable laws, these rights may include the right to:

• Be informed
• Access your personal data
• Correct or rectify inaccuracies
• Erase your personal data (‘be forgotten’)
• Restrict our processing of your personal data
• Obtain and reuse your personal data
• Object to the processing of your personal data
• Not to be subject to a decision based solely on automated-processing, including profiling
• Withdraw your consent
• Right to report or complain

You may access, update and correct inaccuracies in your personal data in our custody or control at any time, subject to limited exceptions prescribed by law. Simply log into your account, go to your account profile, and make the necessary changes.

You can also request access, corrections or updates other personal data in our records by contacting us as set out below. We may request certain personal data for the purposes of verifying the identity of the individual seeking access to their personal data records.

You may request your data be withdrawn (forgotten); this type of request can be performed assuming TrainHub is in a legal position to fulfill such a request. You must not have an active study application where financial or billing records are or may be in process should an application to a third-party service be engaged. Should ApplyBoard be able to comply with your request, only the personal data you provided will be forgotten. Non-personal data (“Metadata”) will be maintained regardless.

Should you wish to lodge a concern or complaint to TrainHub, please contact us as set out below. We will respond to your concerns in a reasonable time, typically within 10 business days.

Please note that these rights are not absolute. In some cases, we may refuse a request to exercise particular rights if complying with it means that we are not able to meet our contractual obligations and provide our Services to you. We will keep you informed as to the actions that we can take when you make your request.

We are not responsible for the privacy practices of our third-party service providers and recommend that you review their privacy policies carefully. We may communicate with our third-party service providers, to the extent permitted by law, when you make a request based on your personal data rights that involves the data collected by our third-party service providers. We will keep you informed on the status of your request in such cases.

We and our third-party service providers use cookies and other tracking mechanisms (including tracking technologies designed for mobile applications) to track information about your use of our Website and Services. We may combine this information with other personal data we collect from you (and our third-party service providers may do so on our behalf).

Cookies. Cookies are alphanumeric identifiers that we transfer to your computer’s hard drive through your web browser for record-keeping purposes. Some cookies allow us to make it easier for you to navigate our Website and Services, while others are used to enable a faster log-in process or to allow us to track your activities at our Website and Service.

Cookies may involve the transmission of information from us to you and from you directly to us, to another party on our behalf, or to another party in accordance with its privacy policy. We may use cookies to bring together information we collect about you. You can choose to have your device warn you each time a cookie is being sent, or you can choose to turn off all cookies. You do this through your browser settings. If you turn cookies off, you won’t have access to many features that make your guest experience more efficient and some of our services will not function properly. Please see the last section of this Policy for more information about how to manage or disable browser cookies.

We use several categories of cookies and each performs different functions. You can learn more about cookies and their functions generally by visiting an information website like allaboutcookies.org.

There are four types of cookies:

Strictly necessary cookies.	These are cookies that are required for the operation of our Website. They include, for example, cookies that enable users to log into secure areas of our Website.
Analytical/performance cookies.	These types of cookies allow us to recognize, count the number of visitors, and see how visitors move around our Website when they are using it. This assists us to improve the way in which our Website works, for example, by ensuring that you can find what you are looking for easily.
Functionality cookies.	These cookies are used to recognize you when you return to our Website. They enable the personalization of content, recognition of users, and also remember your user preferences (for example, your choice of language or region).
Targeting cookies.	These cookies record your visit to our Website, the individual pages visited, and the links followed. If the cookie is set by a third party (for example, an advertising network) which also monitors traffic on other websites, this type of cookie may also be used to track your movements across different websites and to create profiles of your general online behavior. Information collected by tracking cookies is commonly used to target online advertising.

The four types of cookies above will be either session cookies or persistent cookies.

• Session Cookies. Session cookies exist only during an online session. They disappear from your computer when you close your browser or turn off your computer. We use session cookies to allow our systems to uniquely identify you during a session or while you are logged into the Website or Services. This allows us to process your online transactions and requests and verify your identity, after you have logged in, as you move through our Website or Services.
• Persistent Cookies. Persistent cookies remain on your computer after you have closed your browser or turned off your computer. We use persistent cookies to remember your user information, preferences and activity, to enable us to provide our services to you when you next return to our Website or Services. We also use persistent cookies to track aggregate and statistical information about user activity, which may be combined with other user information.

HTML5 Storage. We may also store your user information and Website preferences locally within your web browser via HTML5.

Clear GIFs, pixel tags and other technologies. Clear GIFs are tiny graphics with a unique identifier, similar in function to cookies. In contrast to cookies, which are stored on your computer’s hard drive, clear GIFs are embedded invisibly on web pages. We may use clear GIFs (a.k.a. web beacons, web bugs or pixel tags), in connection with our Website or Services to, among other things, track the activities of Website visitors, help us manage content, and compile statistics about Website and Services usage. We and our third-party service providers also use clear GIFs in HTML emails to our customers, to help us track email response rates, identify when our emails are viewed, and track whether our emails are forwarded.

Changing or Disabling your Cookie Settings. Most web browsers automatically accept cookies, but if you prefer you can edit your browser options to block them in the future. The Help portion of the toolbar on most browsers will tell you how to prevent your computer from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable cookies altogether. Visitors to our Website who disable their web browsers’ ability to accept cookies will be able to browse the Website; however, most site features will not function if you disable cookies and you will not be able to login to use our services.

There are a number of ways for you to manage cookies and other tracking technologies. Through your browser settings, you can accept or decline cookies or set your browser to prompt you before accepting a cookie from the websites you visit. You should be aware that you may not be able to use all our interactive features if you set your browser to disable cookies entirely.

If you use different computers in different locations, you will need to ensure that each browser is adjusted to suit your preferences.

You can delete or disable any cookies that have been installed in the cookie folder of your browser. The various browsers provide different procedures to manage your settings. Click on any of the browser links below for instructions.

• Microsoft Windows Explorer
• Google Chrome
• Mozilla Firefox
• Apple Safari

If you are not using any of the above-listed browsers, then you should select “cookies” in the “Help” function for information on where to find your cookie folder.

You should also be aware that disabling cookies does not disable other types of analytics products which we may use to collect generic information about how you and other visitors use our website.

Click the button below to remove cookies for Hubspot.

TYPE AND PURPOSE	VENDOR	OPT-OUT
Strictly Necessary Cookies: ApplyBoard: These session cookies are used to provide the basic functionality of the site, including login, page and content authorization. OneTrust: Used for cookie compliance purposes to maintain the cookie preference settings of visitors.	TRAINHUB TrainHub Privacy Policy TrainHub Terms of Use OneTrust: OneTrust Privacy Policy OneTrust Terms of Use	OPT-OUT NO: The site will not function without these cookies. They cannot be OPT-OUT.
Analytics: Used to identify and count the number of site visitors and analyze their movements around the Site (including number of page views, number of visitors, and time spent on each page). This helps us to improve the way our sites work, for example by making sure you can easily find what you need, and monitor the performance of our application in order to improve it. Functionality / Cookie Management: Used to control the Cookie OPT-OUT functionality on the site	Google Analytics: Google Analytics Privacy Policy Information on their expiration is available in their policy. Google Analytics Terms of service	OPT-OUT YES: Adjustments to your browser settings as explained in section above under the “DISABLING/ENABLING COOKIES VIA YOUR BROWSER” section. Providers often offer direct opt- out tools. Google Analytics Opt-Out Add-On’s for your browser
Functionality / Cookie Management: Used to control the Cookie OPT-OUT functionality on the site	Google Tag Manager: Google Tag Manager Privacy Policy Google Tag Manager Terms of service	OPT-OUT NO: This functionality is required to manage other cookies on the system. Without it there can not be an OPT-OUT option on the site.
Functionality: HelloBar: Used to maintain the users session – Show promotion and information related to new features and website issues to relevant visitors as a website pop-up. HubSpot: Used to maintain the user’s session – Targeted Marketing Automation and enabling user support. Shopify: Used to maintain the user’s session on our online shop - Improve website usage and store information about the user’s activity (e.g., login and checkout).	HelloBar: HelloBar Privacy Policy HelloBar Terms of Service HubSpot: Hubspot Privacy Policy Hubspot Terms of Service Shopify: Shopify Privacy Policy Shopify Terms of Service	OPT-OUT YES: HelloBar: Adjustments to your browser settings as explained in section above under the “DISABLING/ENABLING COOKIES VIA YOUR BROWSER” section. Providers often offer direct opt- out tools. HubSpot: Click to opt out. Shopify: Read more about how to opt out here.
Advertising/Targeting: These cookies are specifically designed to gather information from the browser on your device to display advertisements to you based on relevant topics that interest you.	Facebook: Facebook Privacy Policy Facebook Term of Service	OPT-OUT: YES Adjustments to your browser settings as explained in section above under the “DISABLING/ENABLING COOKIES VIA YOUR BROWSER” section. Providers often offer direct opt- out tools.
Training and Development: WalkMe: Used to develop training content for Institutional, Recruiter Partners and Counsellors.	WalkMe: WalkMe Privacy Policy WalkMe Terms of Service	OPT-OUT: YES Adjustments to your browser settings as explained in section above under the “DISABLING/ENABLING COOKIES VIA YOUR BROWSER” section. Providers often offer direct opt- out tools.

Do Not Track. Currently, our systems do not honor browser “do-not-track” requests. You may, however, disable certain tracking as discussed above (e.g., by disabling Cookies); you also may opt-out of Third Party Analytics or targeted advertising by following the instructions in the Third Party Ad Networks section below.

Social Media: We may offer you the opportunity to engage with our content on or through third-party social networking websites, plug-ins, and applications. When you engage with our content on or through third-party social networking websites, plug-ins and applications, you may allow us to have access to certain information associated with your social media account (e.g., name, username, email address, profile picture) to deliver the content or as part of the operation of the website, plug-in or application. When you provide information from your social media account, we may use this information to personalize your experience on the Website and on the third-party social networking websites, plug-ins and applications, and to provide you with other products or services you may request.

Links to Other Websites: Our Website may contain links to other websites that TrainHub does not own or operate, including the websites of third-party partners. Also, links to our Website may be featured on third party websites on which we advertise. Except as provided herein, we will not provide any of your personal information to these third parties without your consent.

We provide links to third party websites as a convenience to the user. These links are not intended as an endorsement of or referral to the linked websites. The linked websites have separate and independent privacy statements, notices and terms of use, which we recommend you read carefully. We do not have any control over such websites, and therefore we have no responsibility or liability for the manner in which the organizations that operate such linked websites may collect, use or disclose, secure and otherwise treat your personal information.

ApplyBoard uses the web analytics services from Google Analytics, Hubspot, Walkme, Hellobar, and OneTrust to collect standard internet log information. Tools such as these may use cookies to help us analyze how visitors use the Website. For example, with Google Analytics, the information generated by the cookie about your use of the Website (including your IP address) will be transmitted to and stored by a Google server. Google uses this information for the purpose of evaluating your use of the Website, compiling reports on Website activity for Website operators, and providing Website operators with other services relating to Website activity and internet usage. You can prevent the storage of data relating to your use of the Website and created via the cookie (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

TrainHub will only retain your personal data while it is needed to fulfill the intended purpose for which it was collected or as otherwise permitted or required by law or contract (which may extend beyond the termination of our relationship with you).

Typically, personal data is maintained during the time you are engaged in the Services offered on Our Website. We may retain certain data as necessary for:

• Legitimate business purposes, such as auditing, account recovery;
• If required by applicable federal, state, provincial or other laws;
• To prevent fraud or future abuse, or
• By contract with a partner and/or institution.

All retained personal data is treated in accordance with this Policy.

If you request that your personal data be removed from our databases and/or systems, it may not be possible to completely delete all your personal data due to technological and legal constraints. However, we will take such steps as are reasonable to securely destroy the information or to ensure that the information is de‑identified and/or anonymized as necessary.

Should you request additional services from TrainHub which are subject to this Policy, you will be authorizing the extension of the data collection and/or processing purpose as a result.

This Policy may change from time to time. Any changes in the future will be posted on our Website and, where appropriate, we will notify you by email, or via your “My Account” on our Website.

We strongly encourage you to check back frequently to see any updates or changes to our Policy. We will not materially reduce your rights under this Policy without taking steps to bring such changes to your attention

If you are a TrainHub customer and would like to update your personal data, please log into your “My Account” in order to update certain information or contact us through the contact information below. If you are not a TrainHub customer, but have provided us with personal data or if your personal data was provided to us by third parties, and you would like to update your personal data, you may contact us through the phone number or email address listed below. From time to time, we may email you or send you with special offers; you may opt-out of those offers by using a link provided in the email, or by contacting us as noted below.

Please contact our Data Privacy Officer if:

You may contact our Data Privacy Officer by email at dpo@applyboard.com or by mail at the following address:

ApplyBoard Inc. RE: TrainHub

101 Frederick Street, Suite 600

Kitchener, ON N2H 6R3

Canada

Toll-Free Phone: 1-844-972-7759

The information below is required pursuant to EEA law regarding privacy and data protection. The terms below apply to our EEA and UK customers and Website visitors, in addition to the terms in the rest of the Policy.

For the purposes of the General Data Protection Regulation (“GDPR”), the data controller is ApplyBoard of 101 Frederick Street, Suite 600, Kitchener, ON N2H 6R3, Canada. If you have any questions about this Policy, please contact our Data Protection Officer (DPO) at DPO@ApplyBoard.com.

If you are unhappy about how we are processing your data or how we have responded to a request or complaint, you have the right to make a complaint to your local supervisory authority.

WHEN DO WE SHARE YOUR PERSONAL DATA?

The table headed “How and Why We Share Your Information” in the main part of the Policy under the heading “WHEN DO WE SHARE YOUR INFORMATION” lists who we may share your information with, which include transfers for reasons of legal compliance and necessity in order to provide you with our Services.

You should be aware that when sharing your information, it may be transferred to, and stored at, a destination outside the EEA or the UK, as applicable.

Please note that where data is transferred outside of the EEA, non-EEA countries may not offer the same level of protection for personal data as is available in the EEA. ApplyBoard will take various measures to ensure that your data is treated securely, which may include, but not be limited to:

• Assessing the security measures taken at any place your personal data is transferred to;
• Having suitable contract terms in place that oblige a data processor to only process in accordance with our instructions;
• Having monitoring, reporting and resolution procedures in place with regard to ongoing security; and
• Only transferring your data via an appropriate safeguard as described in Article 46 of GDPR, including Standard Contractual Clauses adopted by the European Commission (Article 46.2)

Please contact us at DPO@ApplyBoard.com. if you require more detailed information about international transfers of your personal data, and the particular safeguards used.

LEGAL BASES FOR PROCESSING YOUR PERSONAL DATA

We process your personal data based on the following legal bases, as recognised by and in compliance with the applicable data protection laws:

• The processing is necessary to perform our contract with you (i.e. the Terms and Conditions that apply as applicable with respect to TrainHub Services, for the provision of our Services), or to take steps requested by you before entering into said contract;
• You are obliged to provide us with personal data as it is necessary to enter into and perform our contractual agreements. In the event that you do not wish to provide us with your personal data for the purposes outlined above in the “How and why we use your information” section, we will not be able to perform our contractual agreement with you;
• The processing is in ApplyBoard’s or someone else’s legitimate interests, and these interests are not overridden by your interests or rights in the protection of your personal data. This may include processing your data for prevention of fraudulent activity, internal research and analytics assessments, for purposes of communication with you, and informing you about new products and services we are offering or to promote new products and services of other parties which we think may be of interest to you, etc.;
• Before we process your personal data to pursue our legitimate interests for the purposes outlined above in the “How and why we use your information” section, we determine if such processing is necessary and we carefully consider the impact of our processing activities on your fundamental rights and freedoms. On balance, we have determined that such processing is necessary for our legitimate interests and that the processing which we conduct does not adversely impact on these rights and freedoms.
• You have given your consent to the processing of your data;
• The processing is necessary to meet a legal obligation which applies to ApplyBoard

If you would like more information about the legal grounds used to process your information, or about the legitimate interests referred to above, please contact us.

In cases where we have asked for, and you have given, your consent to our processing of your personal data, you have the right to withdraw such consent at any time. You can do this by contacting our DPO at DPO@ApplyBoard.com.

DO YOU HAVE TO GIVE US YOUR PERSONAL INFORMATION?

In most cases, providing your personal data to us is optional, however, if you do not provide it, you will not be able to use our Services. For example, we need details such as your name, address and bank account details so that we can make payments to you and receive payments from you. In other cases, you have a choice over whether we collect your personal data, for example, you can turn off cookies on your browser and we will not place any cookies on your device or computer (although in this case you may not be able to use all parts of our Website).

PROFILING AND AUTOMATED DECISION MAKING

We use automated decision making as part of the TrainHub Services. We use these tools as a measure of fraud prevention and for purposes of security and risk assessment relating to the performance of the TrainHub Services:

1. Automated tools incorporated in our process of approval of your application: based on the information you provided, the tool may advise if additional information is required for the purpose of approval of your application.
2. Automated tools incorporated in our process of approval of certain schools or programs of: such tools may advise if additional information is required for the purpose of eligibility or determine eligibility.

HOW LONG DO WE KEEP YOUR PERSONAL DATA?

ApplyBoard will only retain your personal data while it is needed to fulfill the intended purpose for which it was collected or as otherwise permitted or required by law or contract (which may extend beyond the termination of our relationship with you).

Typically, personal data is maintained during the time you are engaged in the institutional program you applied to, or for up to a year following our last contact with you. We may retain certain data as necessary for:

• Legitimate business purposes, such as auditing, account recovery;
• If required by applicable federal, state, provincial or other laws;
• To prevent fraud or future abuse, or
• By contract with a partner and/or institution.

All retained personal data is treated in accordance with this Policy.

If you request that your personal data be removed from our databases and/or systems, it may not be possible to completely delete all your personal data due to technological and legal constraints. However, we will take such steps as are reasonable to securely destroy the information or to ensure that the information is de‑identified and/or anonymized as necessary.

Should you request additional services from ApplyBoard which are subject to this Policy, you will be authorizing the extension of the data collection and/or processing purpose as a result.

YOUR RIGHTS UNDER GDPR

You have several rights in relation to your personal data which are described in more detail below. You can exercise your rights at any time by contacting us at DPO@ApplyBoard.com.

Accessing your data

You can ask us to:

• Confirm whether we are processing your personal data.
• Give you a copy of that personal data.
• Provide you with other information about your personal data such as what data we have, what we use it for, who we disclose it to, whether we transfer it outside of the EEA and how we protect it, how long we keep it for, what rights you have, how you can make a complaint, where we got your data from and whether we carry out any automated decision making or profiling. We aim to give you all this information in this Policy, although if anything is unclear, please contact our Data Protection Officer at DPO@ApplyBoard.com.

You do not have to pay a fee for a copy of your personal data unless your request is unfounded, repetitive or excessive, in which case we will charge a reasonable amount in the circumstances. We will let you know of any charges before completing your request.

Correcting your personal data

You can ask us to correct any personal data which is inaccurate or incomplete (in most cases you will be able to make these changes yourself by logging into your account). This is free of charge.

If we have shared the personal data with anyone else, we will tell them about the correction wherever possible.

If we cannot action a request to correct your personal data, we will let you know and explain why this is.

Erasing your personal data

This right is sometimes referred to as “the right to be forgotten”. This is not an absolute right but you have the right to have your data erased, free of charge, in certain circumstances.

You can ask for your personal data to be erased where:

• It is no longer necessary for the purpose for which it was originally collected or processed;
• We are processing your personal data based on your consent, and you withdraw that consent;
• You object to the processing of your personal data and we do not have an overriding legitimate interest for continuing;
• It has been unlawfully processed;
• It must be erased to comply with a legal obligation;
• It was processed to offer information society services to a child.

There are some exceptions to this right. If one of these applies, we do not have to delete the personal data.

If we have shared your personal data with third parties, we will tell them about the erasure of your data unless this is impossible or would involve disproportionate effort.

Please note, in connection with such requests, that personal data may be either deleted or retained in an aggregated manner without being linked to any identifiers or personal data, depending on technical commercial capability.

Restricting the processing of your personal data

You can ask us to restrict the processing of your personal data in some circumstances, free of charge. This is not an absolute right. If processing is restricted we can store the personal data and retain enough information to make sure the restriction is respected unless you consent or the processing is necessary in relation to a legal claim or to protect the rights of another person or for reasons of important public interest, but we cannot further process your personal data.

You can restrict the processing of your personal data in the following cases:

• If you contest the accuracy of your personal data, we will restrict processing until we have made sure the personal data is accurate;
• If you object to our processing pending the verification of whether or not our legitimate interests override your interests, rights and freedoms or in connection with legal proceedings;
• If the processing is unlawful but you do not want us to erase your personal data;
• If we no longer need the personal data but you require the data to establish, exercise or defend a legal claim.

If we have disclosed the data to a third party, we will inform them about the restriction unless it is impossible or would require a disproportionate effort. We will tell you if we decide to lift a restriction on processing your personal data.

Objecting to the processing of your personal data

You have a right to object to the processing of your personal data at any time. This request will be free of charge. It is not an absolute right, but you can object to our processing of your personal data where it is:

• Based on the legitimate interest ground; or
• For the purposes of scientific/historical research and statistics.

We will stop processing your personal data unless we have compelling legitimate grounds for the processing which override your interests and rights, or unless we are processing the personal data for the establishment, exercise or defence of legal claims.

You can require us to stop using your personal data for direct marketing purposes. We will stop as soon as we receive your request, however we may not be able to implement this for any direct marketing campaigns which are already in progress. There are no exemptions or reasons for us to refuse.

Data Portability

This allows you to obtain and reuse your personal data for your own purposes across different services. It applies where the following conditions are met:

• You provided the personal data to us yourself;
• We are processing the personal data either based on your consent or because it is necessary for the performance of a contract; and
• The processing is carried out by automated means.

We will provide your personal data free of charge in a structured, commonly used and machine-readable form.

Automated decision making and profiling

You have the right not to be subject to a decision which is based solely on automated processing and which produces a legal (or similarly significant) effect on you.

We will tell you about any automated decision making that affects you. You have the right to:

• Request human intervention;
• Express your point of view;
• Ask for the decision to be explained; and
• Challenge the decision.

These rights are not absolute. We may not be able to comply with this request if the processing of personal data is:

• Necessary for us to enter into or perform a contract with you;
• Authorized by law (i.e. for fraud prevention) and which also lays down suitable measures to safeguard your right, freedoms and legitimate interests; or
• Based on your explicit consent.

Dealing with requests to exercise your rights

We will respond to your request without undue delay at the latest within one (1) month of receiving your request unless it is particularly complicated or you have made several requests, in which case we may extend this by two (2) months. We will let you know if we are going to take longer than one (1) month in dealing with your request. If we have a lot of information about you we might ask you if you can tell us what exactly you want to receive. This will help us action your request more quickly.

For the purpose of complying with your requests to exercise the rights listed above, we shall perform the necessary internal processes to identify you.

Appendix 2: Additional Terms for State of California Customers

The information below is required pursuant to the California Consumer Privacy Act of 2018 (the “CCPA”). The terms below apply to residents in the State of California in addition to the terms in the rest of the Policy.

CCPA REQUESTS

Under the CCPA residents in the State of California are provided with specific rights regarding the collection and storage of their personal data.

You or your authorized agent may apply to us with requests as detailed below by contacting us by phone: 1-844-972-7759 or through the online form on our Website at https://ApplyBoard.custhelp.com/app/ask/l_id/1. We do not discriminate against any individual based on the exercise of his/her privacy rights.

CCPA Information Request Rights

You have the right to request that we provide to you the following information about our collection and use of your personal data over the preceding twelve (12) months. Once your verifiable consumer request has been confirmed through our review of the information you provide in your request, we will disclose to you:

1. The categories of personal data we have collected about you.
2. The categories of sources for the personal data we have collected about you (e.g., use of cookies, third party, etc.).
3. Our business or commercial purpose for collecting that personal data.
4. The categories of third parties with whom we share or have shared that personal data.
5. The specific pieces of personal data we collected about you (also called a data portability request).
6. We do not sell your personal data. In addition, if we have not disclosed your personal data for a business purpose, we will disclose this fact to you. If we have disclosed your personal data for a business purpose, including direct marketing, we will provide you with a listing that identifies the personal data categories that each category of recipient obtained.

CCPA Deletion Request Rights

You have the right to request that we delete any of the personal data collected from you and retained, subject to certain exceptions and your verification. Your request to delete the personal data collected may be denied if it is necessary for us to retain your information under one or more exceptions listed in the CCPA.

WE DO NOT SELL YOUR DATA We do not sell personal data collected about you to third parties. We may share your information with our service providers or as instructed by you from time to time for the purpose of providing you the Services and as detailed above under the section titled “WHEN DO WE SHARE YOUR INFORMATION”.

You may contact our Data Privacy Officer by email at dpo@applyboard.com or by mail at the following address:

ApplyBoard Inc.

101 Frederick Street, Suite 600

Kitchener, ON N2H 6R3

Canada

Toll-Free Phone: 1-844-972-7759