Privacy Policy | ParkStow

2.5 Why We Use Your Personal Information
We identify the purposes for which we collect personal information at or before the time of collection. We use personal information for the following purposes:
• To operate the Platform — create and maintain your account, facilitate bookings, payments, payouts, refunds, and dispute resolution; enable communication; send Platform-related notifications, security alerts, and confirmations; personalize search results and recommendations.
• To verify identity and promote trust and safety — verify Users using Persona and other tools; detect, prevent, and investigate fraud, unauthorized access, money laundering, theft, prohibited-item storage, unauthorized vehicle use, and other violations; apply automated risk checks to bookings, listings, and accounts; enforce our Terms of Service; comply with AML, KYC, sanctions, and tax obligations.
• To process payments — process Renter payments and Host payouts through Stripe; verify payee eligibility for AML/KYC; prevent payment fraud and chargebacks; calculate and remit applicable taxes (including HST/GST); pursue collections for unpaid amounts.
• To improve and develop the Platform — analyze usage, debug, conduct research, develop new features, and improve customer support (including through call-recording quality assurance).
• To communicate marketing and promotions — send promotional emails, in-app messages, and (with your express consent) SMS messages; administer referrals, contests, surveys, and rewards; deliver and measure interest-based advertising.
• To comply with legal obligations and protect rights — comply with applicable laws, court orders, subpoenas, and lawful requests; establish, exercise, or defend legal claims (including insurance and property-damage claims); protect the rights, property, safety, and security of the Company, our Users, and the public; audit compliance and respond to regulatory inquiries.
3. Consent
Your knowledge and consent are required before we collect, use, or disclose your personal information, subject to limited exceptions permitted by law (such as where collection is clearly in your interest and consent cannot be obtained in a timely way, where it is necessary to investigate a breach of an agreement or contravention of law, or where disclosure is required by a subpoena, warrant, or court order).
The form of consent we seek depends on the sensitivity of the information and the reasonable expectations of the individual. Express consent is obtained for sensitive personal information (including biometric data, government ID information, and precise geolocation) and for marketing communications. Implied consent may be appropriate for less-sensitive information that is reasonably necessary to provide a service you have requested.
You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting our Privacy Officer or by adjusting your account settings. Withdrawing consent may affect our ability to continue providing certain services to you.
4. How We Disclose Personal Information
We do not sell your personal information. We disclose personal information only as described below or with your consent.
• Between Hosts and Renters. Upon a confirmed booking, we share contact details sufficient to coordinate access to and use of the Space; verified-identity status, profile photo, first name, ratings, and reviews; booking details, access schedules, and Space-specific rules; and information reasonably necessary to resolve disputes, damage claims, or safety issues.
• Publicly on the Platform. Certain information is visible to other Users or the public by default, including a Host's first name and last initial, profile photo, listing description and photos, approximate Space location, access policies, verified-host status, and ratings and reviews. You can manage public information in your account settings, subject to Platform-wide minimums needed to operate a trustworthy marketplace.
• Service providers and processors. We disclose personal information to third parties processing it on our behalf under written contracts requiring them to safeguard the information and use it only for authorized purposes. Categories include:
Category
Example Providers
Purpose
Payment processing
Stripe, Inc.
Process Renter payments, Host payouts, refunds, and chargebacks; AML/KYC; fraud prevention.
Identity verification
Persona Identity, Inc.
Verify identity from government ID and selfie images; biometric matching; fraud and risk scoring.
Hosting and infrastructure
Cloud hosting, database, and storage providers
Operate the Platform and store data.
Customer support and communications
Helpdesk, email, SMS, and chat providers
Respond to inquiries and deliver service messages.
Analytics and product improvement
Web and product analytics providers
Measure usage, debug, and improve the Platform.
Advertising and marketing
Advertising platforms and email-marketing providers
Deliver and measure marketing campaigns (with your consent where required).
Background and sanctions screening
Third-party screening providers
Trust-and-safety checks with your consent.
Professional advisors
Lawyers, accountants, auditors, insurers
Obtain professional services where personal information is incidentally accessed.

• Business transfers. In a merger, acquisition, financing, reorganization, sale, bankruptcy, or similar transaction, personal information may be transferred as part of due diligence or as an asset, subject to recipients honouring this Policy or providing notice and choice where required by law.

• With your direction or consent. When you direct us to share information with a third party (such as linking a third-party application or participating in a co-branded promotion), we will share what is needed for that purpose.
4.1 International Transfers of Personal Information
Some of our service providers process personal information outside of Canada, including in the United States and other jurisdictions. When personal information is processed outside of Canada, it is subject to the laws of those jurisdictions, including lawful requirements for foreign governments, courts, and law enforcement to access that information.
We use contractual and other reasonable measures to ensure that personal information transferred outside of Canada receives a comparable level of protection to what it would receive in Canada.

5. Your Rights and Choices
• Access, correction, and accuracy. You may request access to the personal information we hold about you and ask us to correct inaccurate or incomplete information. We will respond within 30 days. We may extend this by up to an additional 30 days where permitted by PIPEDA (e.g., where responding within the original period would unreasonably interfere with our activities, where consultations are needed, or where conversion to an alternate format is required); if we extend, we will notify you within the original 30 days and advise you of your right to complain to the Office of the Privacy Commissioner of Canada (OPC). We will use reasonable efforts to keep personal information as accurate, complete, and up to date as is necessary for the purposes for which it is used.
• Withdrawal of consent. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting our Privacy Officer.
• Deletion and account closure. You may request that we delete your account and associated personal information by contacting our Privacy Officer. We will honour such requests except where retention is required by law, necessary to complete an outstanding transaction, or needed to defend or pursue legal claims or prevent fraud.
• Marketing communications. Opt out of marketing emails through the "unsubscribe" link, your account preferences, or by contacting our Privacy Officer. Reply STOP to opt out of marketing SMS. We may continue to send transactional, account, and safety messages.
• Cookies, tracking, and device permissions. Manage cookies through our cookie banner, your browser settings, or industry opt-out tools. Disable our access to your device's precise geolocation, camera, microphone, and photos through your mobile device settings. Disabling certain technologies may affect Platform functionality.
• Automated decisions. We use automated systems to detect fraud, screen bookings, score risk, and enforce Platform policies. These may restrict, suspend, or terminate access where they detect risk. To challenge a decision made through automated means, contact our Privacy Officer and a member of our team will review it.
To exercise any of these rights, contact our Privacy Officer using the details in Section 8. We may need to verify your identity before responding. There is no charge for a reasonable request.
6. Safeguards, Retention, and Breaches
• Safeguards. We implement physical, organizational, and technological safeguards designed to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification, including: encryption in transit (TLS) and at rest where appropriate; access controls limited to personnel who need it, with role-based permissions and multi-factor authentication for administrative access; use of PCI-DSS-compliant payment processors (Stripe) so card data is handled in tokenized form and not stored on our systems; written data-processing agreements with Platform providers; logging, monitoring, and incident-response procedures; and employee privacy and security training. No security measure is perfect and we cannot guarantee absolute security.
• Retention. We retain personal information only as long as is reasonably necessary to fulfill the purposes for which it was collected and to comply with our legal, tax, accounting, dispute-resolution, and contractual obligations. In determining retention periods we consider whether you have an active account; the applicable limitation periods (generally two years in Ontario, or longer where the law requires); statutory retention obligations under tax, anti-money-laundering, and accounting laws; and whether retention is needed to detect, prevent, or investigate fraud or safety issues. You may request deletion of your account and associated personal information, which we will action subject to outstanding bookings, unresolved disputes, and legal or regulatory retention obligations. Once retention is no longer required, we destroy, erase, or anonymize personal information using methods appropriate to its sensitivity. Information you have made publicly available (such as reviews) may remain visible after your account is closed.
• Breaches of security safeguards. If a breach of security safeguards involving personal information under our control creates a real risk of significant harm to an affected individual, we will notify affected individuals and the Office of the Privacy Commissioner of Canada (and any other applicable regulator) as required by PIPEDA, and maintain records of all breaches of security safeguards as required.
7. Children, Third-Party Sites, and Changes
• Children. The Platform is intended for individuals 18 years of age or older (or the age of majority in your province or territory). We do not knowingly collect personal information from minors. If you believe we have collected personal information from a minor without appropriate consent, please contact our Privacy Officer.
• Third-party websites and platforms. The Platform may contain links to or be embedded with third-party sites and other platforms we do not control, including Stripe, Persona, social media, mapping platforms, and advertising networks. This Privacy Policy does not apply to them; we encourage you to review their privacy policies.
• Changes to this Privacy Policy. We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date and provide notice through the Platform or by email at least 30 days before changes take effect, where required by law. Continued use of the Platform after the effective date constitutes acceptance of the revised Policy.
8. Accountability, Privacy Officer, and Complaints
We are responsible for the personal information under our control. We have designated a Privacy Officer who is accountable for our compliance with this Privacy Policy and applicable privacy laws. Questions, concerns, complaints, or requests to exercise your privacy rights should be directed to:
ParkStow Inc.
Toronto, Ontario, Canada
Attention: Privacy Officer | Email: support@parkstow.com
Complaints process. We will acknowledge receipt of your complaint promptly, investigate it fairly and impartially, and respond to you in writing with the outcome and any steps we have taken or will take in response. If you are not satisfied with our response, you have the right to make a complaint to:
Office of the Privacy Commissioner of Canada 30 Victoria Street, Gatineau, Quebec K1A 1H3 Toll-free: 1-800-282-1376 Website: https://www.priv.gc.ca

PARKSTOW PRIVACY POLICY Last Updated: June 5, 2026 1. Introduction ParkStow (“we,” “us,” “our,” or the “Company”) operates an online marketplace (the “Platform”) that connects individuals and businesses who have unused space (“Hosts”) with users (“Renters”) who wish to rent that space to store personal property or to park vehicles. Hosts and Renters are collectively referred to as “Users” or “you.” A “Space” is a garage, driveway, basement, shed, storage unit, parking spot, lot, pad, or other physical area listed on the Platform for storage or parking use. In this Policy, “personal information” means information about an identifiable individual, as defined in PIPEDA, and does not include the name, title, or business address or telephone number of an employee of an organization. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you access or use the Platform, including our website, mobile applications, and related services, and the rights and choices you have in relation to that personal information. We are committed to protecting your privacy in accordance with the Personal Information Protection and Electronic Documents Act (“PIPEDA”). By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. 2. What We Collect and Why We limit our collection to what is reasonably necessary for the purposes set out below, and we collect personal information by fair and lawful means. The personal information we collect, and our purposes for collecting it, depend on how you interact with the Platform. 2.1. Information You Provide (a) Contact, Account, and Profile Information Such as your first and last name, email address, address, phone number, date of birth, postal code, profile photo, username and password, and any other information you choose to add to your account or profile. (b) Identity Verification Information Where permitted by law, we may ask you to provide government-issued identification (such as a driver’s licence, passport, or provincial ID), a selfie image, and other verification data. Identity verification is performed by our third-party provider, Persona Identity, Inc. (“Persona”), which extracts facial geometry and other biometric identifiers from the images you submit to verify your identity and prevent fraud. We do not directly collect or store your biometric data; Persona collects, uses, and retains this data in accordance with its privacy policy, available at https://withpersona.com/legal/privacy-policy. By submitting verification information, you consent to Persona’s collection and use of that information for these purposes. (c) Listing and Host Business Information If you list a Space as a Host, we collect information about the Space (location, dimensions, photos, access hours, pricing, prohibited items, rules), and, where applicable, information about your business such as registered business name, business address, tax identification number, and any licences, permits, or insurance required by applicable law. (d) Vehicle and stored-item information If you are renting a parking space, we may collect your licence plate, province of registration, vehicle make, model, year, and dimensions; for storage bookings, we may collect a general description of items stored. This information is used to facilitate the booking, verify permitted use, support safety, and resolve disputes. (e) Payment Information When you make or receive payments through the Platform, certain billing and payment information is required, including your name, billing address, payment card or bank account information, and transaction history. All payment card and bank account data is collected and processed directly by our third-party payment processor, Stripe, Inc. (“Stripe”). We do not store full payment card numbers on our systems. Stripe processes your payment information under its own privacy policy, available at https://stripe.com/privacy. Depending on your activity, Stripe may also collect identity verification data, beneficial ownership information (for business Hosts), and tax information. (f) Communications and Support Information Messages, calls, chats, SMS texts, emails, and other communications you exchange with us, with other Users through the Platform, or with our customer support team, including the content, metadata, and any attachments. Where permitted by law and disclosed to you at the time, we may record and review customer support calls and on-Platform messages for quality assurance, training, dispute resolution, fraud prevention, and safety purposes. (g) User-Generated Content Photos, videos, reviews, ratings, listing descriptions, comments, feedback, forum posts, and any other content you upload or post to areas of the Platform that are visible to other Users or the public. 2.2 Information We Collect Automatically When you use the Platform or interact with our communications, we and our service providers automatically collect: • Device data — device type, operating system, browser type and version, IP address, unique device and advertising identifiers, screen resolution, mobile carrier, network type, and language settings. • Usage data — pages and screens viewed, search terms, listings viewed and booked, time spent, navigation paths, click and scroll data, dates and times of access, referring URLs, and email open and click data. • Approximate location — derived from your IP address (typically city or region) for fraud prevention, security, and localization. • Precise geolocation — collected from your mobile device only with your express consent through your device settings, where required to provide a feature you have requested (such as showing nearby Spaces). • Crash, performance, and diagnostic data — to maintain and improve the Platform. 2.3 Information We Collect from Third Parties • Identity verification providers (Persona) — verification results and risk signals derived from documents and selfies you submit. • Payment processors (Stripe) — transaction status, payout status, dispute and chargeback data, and risk and fraud signals. • Background and sanctions screening providers — where you consent and where permitted by law, criminal record checks, sanctions screening, and similar reports for trust-and-safety purposes. • Linked third-party services — if you choose to log in or link an account via Google, Apple, Facebook, or another third-party service, information that the third-party service makes available to us in accordance with your settings on that third-party service. • Other Users — information about you provided by other Users, such as reviews, ratings, referrals, or complaints. • Data providers and public sources — demographic data, government registries, public records, social media, and similar sources, used for fraud prevention, compliance, and improving the Platform. 2.4 Cookies Cookies are small text files placed on your device when you visit a website or use an application. They help us recognize your device, remember preferences, and improve functionality. We also use similar technologies such as local storage, SDKs, and pixels. The categories we use are: • Essential cookies — necessary for the Platform to function; used to maintain secure login sessions, enable core functionality, and prevent fraud and abuse. • Analytics cookies — tools such as Google Analytics that help us measure traffic and usage patterns and improve performance. We use analytics only in aggregate and do not use it to identify individual users. • Advertising and marketing cookies — cookies or pixels from advertising partners such as Google Ads and Meta Platforms, used to measure campaign effectiveness, deliver relevant advertisements, and perform retargeting where permitted by law. • Functional cookies — remember preferences such as language settings, location preferences, and saved login sessions. We do not use session replay, screen recording, keystroke logging, or biometric tracking technologies. You can manage or disable cookies through your browser or device settings; for mobile applications, cookie-like technologies are managed through device permissions. Disabling essential cookies may affect Platform functionality, and disabling analytics or marketing cookies may limit certain features. Some cookies are set by third-party analytics and advertising partners who process information under their own privacy policies; we do not control third-party cookies once they are set. 2.5 Why We Use Your Personal Information We identify the purposes for which we collect personal information at or before the time of collection. We use personal information for the following purposes: • To operate the Platform — create and maintain your account, facilitate bookings, payments, payouts, refunds, and dispute resolution; enable communication; send Platform-related notifications, security alerts, and confirmations; personalize search results and recommendations. • To verify identity and promote trust and safety — verify Users using Persona and other tools; detect, prevent, and investigate fraud, unauthorized access, money laundering, theft, prohibited-item storage, unauthorized vehicle use, and other violations; apply automated risk checks to bookings, listings, and accounts; enforce our Terms of Service; comply with AML, KYC, sanctions, and tax obligations. • To process payments — process Renter payments and Host payouts through Stripe; verify payee eligibility for AML/KYC; prevent payment fraud and chargebacks; calculate and remit applicable taxes (including HST/GST); pursue collections for unpaid amounts. • To improve and develop the Platform — analyze usage, debug, conduct research, develop new features, and improve customer support (including through call-recording quality assurance). • To communicate marketing and promotions — send promotional emails, in-app messages, and (with your express consent) SMS messages; administer referrals, contests, surveys, and rewards; deliver and measure interest-based advertising. • To comply with legal obligations and protect rights — comply with applicable laws, court orders, subpoenas, and lawful requests; establish, exercise, or defend legal claims (including insurance and property-damage claims); protect the rights, property, safety, and security of the Company, our Users, and the public; audit compliance and respond to regulatory inquiries. 3. Consent Your knowledge and consent are required before we collect, use, or disclose your personal information, subject to limited exceptions permitted by law (such as where collection is clearly in your interest and consent cannot be obtained in a timely way, where it is necessary to investigate a breach of an agreement or contravention of law, or where disclosure is required by a subpoena, warrant, or court order). The form of consent we seek depends on the sensitivity of the information and the reasonable expectations of the individual. Express consent is obtained for sensitive personal information (including biometric data, government ID information, and precise geolocation) and for marketing communications. Implied consent may be appropriate for less-sensitive information that is reasonably necessary to provide a service you have requested. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting our Privacy Officer or by adjusting your account settings. Withdrawing consent may affect our ability to continue providing certain services to you. 4. How We Disclose Personal Information We do not sell your personal information. We disclose personal information only as described below or with your consent. • Between Hosts and Renters. Upon a confirmed booking, we share contact details sufficient to coordinate access to and use of the Space; verified-identity status, profile photo, first name, ratings, and reviews; booking details, access schedules, and Space-specific rules; and information reasonably necessary to resolve disputes, damage claims, or safety issues. • Publicly on the Platform. Certain information is visible to other Users or the public by default, including a Host's first name and last initial, profile photo, listing description and photos, approximate Space location, access policies, verified-host status, and ratings and reviews. You can manage public information in your account settings, subject to Platform-wide minimums needed to operate a trustworthy marketplace. • Service providers and processors. We disclose personal information to third parties processing it on our behalf under written contracts requiring them to safeguard the information and use it only for authorized purposes. Categories include: Category Example Providers Purpose Payment processing Stripe, Inc. Process Renter payments, Host payouts, refunds, and chargebacks; AML/KYC; fraud prevention. Identity verification Persona Identity, Inc. Verify identity from government ID and selfie images; biometric matching; fraud and risk scoring. Hosting and infrastructure Cloud hosting, database, and storage providers Operate the Platform and store data. Customer support and communications Helpdesk, email, SMS, and chat providers Respond to inquiries and deliver service messages. Analytics and product improvement Web and product analytics providers Measure usage, debug, and improve the Platform. Advertising and marketing Advertising platforms and email-marketing providers Deliver and measure marketing campaigns (with your consent where required). Background and sanctions screening Third-party screening providers Trust-and-safety checks with your consent. Professional advisors Lawyers, accountants, auditors, insurers Obtain professional services where personal information is incidentally accessed. • Business transfers. In a merger, acquisition, financing, reorganization, sale, bankruptcy, or similar transaction, personal information may be transferred as part of due diligence or as an asset, subject to recipients honouring this Policy or providing notice and choice where required by law. • With your direction or consent. When you direct us to share information with a third party (such as linking a third-party application or participating in a co-branded promotion), we will share what is needed for that purpose. 4.1 International Transfers of Personal Information Some of our service providers process personal information outside of Canada, including in the United States and other jurisdictions. When personal information is processed outside of Canada, it is subject to the laws of those jurisdictions, including lawful requirements for foreign governments, courts, and law enforcement to access that information. We use contractual and other reasonable measures to ensure that personal information transferred outside of Canada receives a comparable level of protection to what it would receive in Canada. 5. Your Rights and Choices • Access, correction, and accuracy. You may request access to the personal information we hold about you and ask us to correct inaccurate or incomplete information. We will respond within 30 days. We may extend this by up to an additional 30 days where permitted by PIPEDA (e.g., where responding within the original period would unreasonably interfere with our activities, where consultations are needed, or where conversion to an alternate format is required); if we extend, we will notify you within the original 30 days and advise you of your right to complain to the Office of the Privacy Commissioner of Canada (OPC). We will use reasonable efforts to keep personal information as accurate, complete, and up to date as is necessary for the purposes for which it is used. • Withdrawal of consent. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting our Privacy Officer. • Deletion and account closure. You may request that we delete your account and associated personal information by contacting our Privacy Officer. We will honour such requests except where retention is required by law, necessary to complete an outstanding transaction, or needed to defend or pursue legal claims or prevent fraud. • Marketing communications. Opt out of marketing emails through the "unsubscribe" link, your account preferences, or by contacting our Privacy Officer. Reply STOP to opt out of marketing SMS. We may continue to send transactional, account, and safety messages. • Cookies, tracking, and device permissions. Manage cookies through our cookie banner, your browser settings, or industry opt-out tools. Disable our access to your device's precise geolocation, camera, microphone, and photos through your mobile device settings. Disabling certain technologies may affect Platform functionality. • Automated decisions. We use automated systems to detect fraud, screen bookings, score risk, and enforce Platform policies. These may restrict, suspend, or terminate access where they detect risk. To challenge a decision made through automated means, contact our Privacy Officer and a member of our team will review it. To exercise any of these rights, contact our Privacy Officer using the details in Section 8. We may need to verify your identity before responding. There is no charge for a reasonable request. 6. Safeguards, Retention, and Breaches • Safeguards. We implement physical, organizational, and technological safeguards designed to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification, including: encryption in transit (TLS) and at rest where appropriate; access controls limited to personnel who need it, with role-based permissions and multi-factor authentication for administrative access; use of PCI-DSS-compliant payment processors (Stripe) so card data is handled in tokenized form and not stored on our systems; written data-processing agreements with Platform providers; logging, monitoring, and incident-response procedures; and employee privacy and security training. No security measure is perfect and we cannot guarantee absolute security. • Retention. We retain personal information only as long as is reasonably necessary to fulfill the purposes for which it was collected and to comply with our legal, tax, accounting, dispute-resolution, and contractual obligations. In determining retention periods we consider whether you have an active account; the applicable limitation periods (generally two years in Ontario, or longer where the law requires); statutory retention obligations under tax, anti-money-laundering, and accounting laws; and whether retention is needed to detect, prevent, or investigate fraud or safety issues. You may request deletion of your account and associated personal information, which we will action subject to outstanding bookings, unresolved disputes, and legal or regulatory retention obligations. Once retention is no longer required, we destroy, erase, or anonymize personal information using methods appropriate to its sensitivity. Information you have made publicly available (such as reviews) may remain visible after your account is closed. • Breaches of security safeguards. If a breach of security safeguards involving personal information under our control creates a real risk of significant harm to an affected individual, we will notify affected individuals and the Office of the Privacy Commissioner of Canada (and any other applicable regulator) as required by PIPEDA, and maintain records of all breaches of security safeguards as required. 7. Children, Third-Party Sites, and Changes • Children. The Platform is intended for individuals 18 years of age or older (or the age of majority in your province or territory). We do not knowingly collect personal information from minors. If you believe we have collected personal information from a minor without appropriate consent, please contact our Privacy Officer. • Third-party websites and platforms. The Platform may contain links to or be embedded with third-party sites and other platforms we do not control, including Stripe, Persona, social media, mapping platforms, and advertising networks. This Privacy Policy does not apply to them; we encourage you to review their privacy policies. • Changes to this Privacy Policy. We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date and provide notice through the Platform or by email at least 30 days before changes take effect, where required by law. Continued use of the Platform after the effective date constitutes acceptance of the revised Policy. 8. Accountability, Privacy Officer, and Complaints We are responsible for the personal information under our control. We have designated a Privacy Officer who is accountable for our compliance with this Privacy Policy and applicable privacy laws. Questions, concerns, complaints, or requests to exercise your privacy rights should be directed to: ParkStow Inc. Toronto, Ontario, Canada Attention: Privacy Officer | Email: support@parkstow.com Complaints process. We will acknowledge receipt of your complaint promptly, investigate it fairly and impartially, and respond to you in writing with the outcome and any steps we have taken or will take in response. If you are not satisfied with our response, you have the right to make a complaint to: Office of the Privacy Commissioner of Canada 30 Victoria Street, Gatineau, Quebec K1A 1H3 Toll-free: 1-800-282-1376 Website: https://www.priv.gc.ca