Evolve Stakeholder Relations and its subsidiaries and affiliates (collectively, “Evolve Stakeholder Relations,” “EvolveSR,” “we” or “us”) understand the importance of privacy. This privacy policy (the “Policy”) explains how we collect, store, use and share personal information through our Virtual Communication Platform. The Platform includes our webcast platform EvolveSR Live (live.evolvesr.com), and services related to our Webcasts, Virtual Environments, Channels, Portals and event emails (collectively, the “Platform”).

In this Policy, “personal information” is information about an identifiable individual.

The Platform is used by businesses, including direct customers of Evolve Stakeholder Relations and customers who access the Platform through an Evolve Stakeholder Relations reseller (the “Business Customers”). Business Customers use the Platform to run events such as earnings calls, annual general meetings and investor days. We collect information, which may include personal information, from Business Customers and from their employees, agents and end users, including people who register for or attend their events (the “End Users”). Together, End Users and Business Customers are “Platform Users”.

We may update this Policy from time to time. The effective date above shows when it last changed. If we make material changes to how we treat personal information, we will post the updated Policy here and notify affected Business Customers by email.

1. Scope

This Policy applies to personal information that Business Customers submit to us through the Platform, and to personal information we collect, access, store, use or otherwise handle (collectively, “process”) through the Platform on behalf of Business Customers, including information about End Users.

For End User information, we act as a service provider (a “processor”) to the Business Customer whose event you registered for or attended. That Business Customer controls the information and decides how it is used. This Policy does not cover a Business Customer’s own use of the information, which is governed by their privacy policy.

This Policy also covers the limited information we process for our own purposes, such as account administration, security and keeping records of unsubscribe requests.

2. Information we collect

Information you give us

Event registration. To register for an event, you provide the information the Business Customer’s registration form asks for. This is usually your first and last name and email address, and may include your company, job title, telephone number, country or other questions the Business Customer adds.

Consent record. When you register, we record the date and time, your IP address and the wording of the notice shown on the form. We keep this to show what you agreed to and when, as required by Canada’s Anti-Spam Legislation (CASL).

Account information. Business Customer staff who manage events have an account with their name, email address, role and password.

Event participation. If you take part in an event, we collect what you submit: questions, chat messages, poll answers and reactions. Business Customers may also add surveys or other questions and are responsible for what they choose to collect.

Speakers and presenters. Business Customers may give us speaker names, titles, photos and biographies to display on event pages. Events may be recorded, captioned and made available for replay, so a speaker’s voice, image and words may be processed and stored.

Communications. When you email us or reply to an event email, we may keep that message to answer your request and improve our services.

Affiliated sites. We may provide services together with other websites or suppliers. Personal information you give those sites may be sent to us to deliver those services, and we process it under this Policy.

Information collected automatically

Attendance information. When you join an event, we record when you joined and left, how long you watched, how you watched (for example, webcast or slides and interaction only), and your IP address. Business Customers use this for attendance reports and, where offered, continuing education credit.

Log information. Our servers record information your browser sends when you visit, such as the page requested, IP address, browser type and language, and the date and time of the request.

Email delivery information. For event emails, we record whether each message was sent, delivered, bounced or reported as spam.

Aggregate and de-identified information

We may use aggregate or de-identified information for research, analytics and service improvement, provided it does not identify, and could not reasonably be used to identify, a Business Customer or End User.

3. Legal basis and consent

In Canada, we process personal information with your knowledge and consent, as required by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. Registering for an event means you consent to the uses described in this Policy for that event, including the event emails described in section 5. You can withdraw consent at any time, subject to legal or contractual limits.

Where other laws apply, such as the EU or UK General Data Protection Regulation, we rely on one or more of these bases, depending on the purpose and our relationship with you:

• Performance of a contract: to provide the products and services set out in our contract with the Business Customer, or to provide the event you registered for.
• Legitimate interests: to operate, secure and improve the Platform. We weigh these interests against your rights, and you may have the right to object (see section 9).
• Legal obligation: to comply with the laws that apply to our business, such as keeping consent and unsubscribe records.
• Consent: where you have given it.

4. How we use information

We use personal information collected through the Platform to provide our services to Business Customers, including to:

• register you for events and give you your personal join link;
• run live events, including Q&A, chat, polls, captions and replays;
• send event emails (section 5);
• produce attendance and engagement reports for the Business Customer that ran the event, and continuing education records where offered;
• set up and manage Business Customer accounts;
• secure the Platform, prevent fraud and abuse, and troubleshoot problems;
• respond to requests from Platform Users; and
• operate and improve the Platform.

We do not sell personal information, and we do not use End User information to market our own services.

Business Customers may use the information they collect through the Platform for their own purposes, such as following up with attendees or investor relations activities. Please review their privacy policies for how they use it.

5. Event emails and unsubscribing

When you register for an event, we send emails about that event on behalf of the Business Customer that runs it. These are:

• a confirmation with your personal join link;
• reminders before the event (up to three, as set by the Business Customer); and
• a thank-you after the event, which may include a link to the recording.

We do not send newsletters, promotions or marketing to End Users, and we never buy, rent or import mailing lists. Each email identifies the Business Customer as the sender, with their mailing address, as CASL requires.

Unsubscribing. Every event email has an unsubscribe link in the footer. You can choose to stop emails about that one event, or all event emails from that Business Customer. Many email apps also show an Unsubscribe button, which stops all event emails from that Business Customer. Unsubscribes take effect immediately. If you later register for a new event, you will still receive the confirmation for that registration, because you asked for it.

Unsubscribing from one Business Customer’s events does not affect emails about other organizations’ events. To stop those, use the link in their emails or contact us.

Bounces and spam reports. If an address permanently bounces, we stop sending event emails to it. If you mark an event email as spam, we stop sending you event emails from that Business Customer.

We keep a record of unsubscribes, bounces and spam reports so we can continue to honour them.

6. Sharing and service providers

We share End User information with the Business Customer that ran the event, as described above. We are not responsible for how a Business Customer uses that information.

Otherwise, we share personal information only to provide the services you or the Business Customer requested, with your consent, or as follows:

• Service providers. We use service providers for hosting, databases and file storage, email delivery, live interaction messaging and captioning (section 7 lists them). They may use the information only to provide services to us, must protect it under contract, and have no right to use or share it for their own purposes. We remain responsible for information we transfer to them.
• Affiliates. We may share information with Evolve Stakeholder Relations affiliates and subsidiaries, whose use is subject to this Policy.
• Legal requirements. We may disclose information in response to lawful requests by public authorities, including for national security or law enforcement, or where needed to comply with law, regulation or legal process, to enforce our agreements, to prevent or address fraud, security or technical issues, or to protect the rights and property of Evolve Stakeholder Relations or others.
• Business transfers. If we are acquired by or merged with another company, or substantially all of our assets are transferred (including during due diligence before closing), or as part of a bankruptcy proceeding, we may transfer the information we hold to the acquiring company, which must protect it under terms consistent with this Policy.

7. Where information is stored and processed

EvolveSR Live stores personal information in Canada. We use service providers for hosting, storage, email delivery, live interaction messaging and captioning. While an event is running, some live features (chat, Q&A, polls and captions) may pass through service providers’ servers in the United States or the European Union; we do not store information there. Information processed outside Canada may be accessible to authorities in those countries under their laws.

8. Retention

We keep personal information only for as long as we need it for the purposes in this Policy, or as long as the law requires. We then delete it or de-identify it.

• Event records (registration, attendance, questions, chat and poll responses): 24 months after the event, unless the Business Customer’s contract sets a different period.
• Recordings and replays: for the period agreed with the Business Customer. If no period is agreed, we keep them for 12 months after the event.
• Consent records (date, time, IP address and notice shown at registration): 3 years after the last email we send you, so we can show that you agreed to receive it.
• Unsubscribe, bounce and spam records: for as long as needed to keep honouring them.
• Server logs: 90 days, for security and troubleshooting.

A Business Customer may ask us to delete information about its events sooner. Aggregate or de-identified information that cannot identify you may be kept longer.

9. Access and correction

You have the right to access the personal information held about you, to ask for it to be corrected, and in some cases to limit its use or have it deleted. Business Customer staff can view and update their own account details after signing in.

Because Business Customers control End User information, the fastest route is usually to contact the organization that ran the event. You can also contact us at contact@evolvesr.com with your name, email address and the organization or event. We will pass your request to that Business Customer and help them respond, or respond directly where the information is ours.

10. Cookies and browser storage

EvolveSR Live uses a small number of cookies and browser storage items that it needs to work:

• a sign-in cookie for Business Customer staff;
• your event access, so you can return to an event without registering again;
• display preferences, such as light or dark mode, caption language and how you chose to watch.

EvolveSR Live does not use advertising cookies or third-party tracking. Other Platform services may use cookies and similar technologies to operate and measure use of those services. You can block or delete cookies in your browser settings, but parts of the Platform may not work without them.

11. Security

We protect personal information with safeguards suited to its sensitivity. These include encryption in transit (HTTPS) and at rest, password-protected accounts with role-based access, personal join links that cannot be guessed, and limiting staff and service provider access to what each needs.

Keep your password and personal join link confidential. No method of transmission over the internet is completely secure. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals, Business Customers and the Office of the Privacy Commissioner of Canada as the law requires.

respond within 30 days.

12. Questions and complaints

Our Privacy Officer is responsible for this Policy and our compliance with it.

Privacy Officer: Bryan Squire, President, Evolve Stakeholder Relations, 2800 Skymark Ave #501, Mississauga, ON L4W 5A6, Email: contact@evolvesr.com

Contact us with any question, request or complaint about this Policy or how we handle personal information. We will investigate and respond within 30 days.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or the privacy regulator where you live.