1. WHO WE ARE

SeedFi ("SeedFi," "we," "us," or "our") is a federally incorporated Canadian company providing payday loans i.e providing short-term, high-cost loans to eligible borrowers in Canada, subject to applicable provincial licensing and regulation.

Our payday lending operations are conducted pursuant to provincial licenses and in compliance with applicable provincial payday lending legislation, including but not limited to the Ontario Payday Loans Act, 2008 (as amended) and Alberta Payday Loans regulations.

SeedFi's registered address is:

General contact: help@SeedFi.com

2. SCOPE AND APPLICATION OF THIS POLICY

2.1. This Privacy Policy is designed to comply with:

1. Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, and its 10 Fair Information Principles;
2. The Breach of Security Safeguards Regulations, SOR/2018-64 (mandatory breach notification under PIPEDA, in force since November 1, 2018);
3. Nigeria's Data Protection Act, 2023 (NDPA), signed into law on June 12, 2023, and the Nigeria Data Protection Commission's General Application and Implementation Directive (GAID), effective September 19, 2025;
4. The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and associated FINTRAC regulations;
5. Applicable provincial payday lending legislation, including the Ontario Payday Loans Act, 2008; British Columbia's Business Practices and Consumer Protection Act; and the equivalent legislation in other provinces where we are licensed;
6. Canada's Criminal Code provisions governing interest rates, including the amended criminal rate of interest of 35% APR that came into effect January 1, 2025; and
7. The Financial Consumer Agency of Canada Act (FCAC Act) and applicable FCAC guidelines on consumer protection in financial services.

Where provincial privacy legislation has been deemed "substantially similar" to PIPEDA (Alberta, British Columbia, and Quebec), we comply with the applicable provincial law with respect to activities occurring entirely within that province. For all interprovincial and international activities, PIPEDA applies.

2.2. Who This Policy Applies To

This Policy applies to:

1. Canadian residents who apply for or receive a payday loan from SeedFi;
2. Visitors to our website (www.SeedFi.com) and mobile application; and
3. Any individual whose personal information we handle in the course of our commercial activities.

2.3. What Is Not Covered

This Policy does not apply to:

1. Third-party websites, apps, or services linked from our platform. We encourage you to review their privacy policies independently;
2. Anonymized or aggregated information that cannot be used to identify you; or
3. Business contact information used solely for communicating with you in your professional capacity.

3. PERSONAL INFORMATION WE COLLECT

We collect only the personal information that is necessary to provide our services, meet our legal obligations, and manage our business. "Personal information" means any information about an identifiable individual, as defined under PIPEDA.

3.1. Identity and Account Information

• Full legal name
• Date of birth
• Government-issued photo identification (e.g., passport, provincial driver's licence, permanent resident card, or national identity card)
• Nationality and country of residence
• Social Insurance Number (SIN), where required by law for tax reporting purposes
• Photograph or selfie, where required for identity verification

3.2. Contact Information

• Email address
• Mobile phone number
• Residential address (street, city, province, postal code)

3.3. Financial and Income Information

• Employment status and employer name and contact information
• Proof of regular income (e.g., recent pay stubs, bank statements provided by you directly in a format you control; we do not collect your online banking login credentials, username, or password)
• Bank account details for disbursement and pre-authorized repayment
• Loan application history with SeedFi
• Repayment history and default records
• Pre-authorized debit agreement details

Note on banking credentials: Consistent with the guidance of the Office of the Privacy Commissioner of Canada (OPC Finding #2021-006), SeedFi does not collect, request, or store online banking passwords, usernames, or security questions. Income and account verification is conducted through direct document submission only.

3.4. Credit and Creditworthiness Information (Payday Loans)

• Credit bureau reports (where a credit check is conducted and consented to)
• Information about existing debts or financial obligations, as disclosed by you
• Default or collections history relevant to the loan decision

Note: Many payday loan applications do not involve a formal credit check. Where no credit check is conducted, we will inform you of this at the time of application.

3.5. Compliance and Regulatory Information

• Politically Exposed Person (PEP) and Head of International Organization (HIO) status assessments
• Sanctions screening data (against Canadian, UN, and other applicable sanctions lists)
• Records required under PCMLTFA
• Beneficial ownership information

3.6. Loan Agreement and Repayment Records (Payday Loans)

• Signed loan agreements (electronic or otherwise)
• Disbursement records
• Repayment records, including dates, amounts, and any returned or dishonoured payments
• Records of any cancellation notices exercised within the two-business-day cancellation period
• Default records and collections activity

3.7. Technical and Usage Information

• IP address and approximate geographic location
• Device type, operating system, and browser information
• Login and session activity logs
• Cookies and similar tracking technologies (see Section 12)

3.8. Customer Communications

• Records of customer support interactions (phone, email, in-app chat)
• Complaints and dispute records
• Feedback, survey responses, and reviews
• Records of consent provided or withdrawn

4. HOW WE COLLECT YOUR PERSONAL INFORMATION

We collect personal information through the following means:

4.1. Directly from You

• When you register an account or complete an onboarding process
• When you submit a money transfer or loan application
• When you upload identity documents or proof of income
• When you sign a loan agreement
• When you contact our customer support team
• When you respond to surveys or provide feedback
• When you grant or withdraw consent for specific uses

4.2. Automatically Through Our Platform

• Through our website and mobile application using cookies, web beacons, and similar technologies (see Section 12)
• Through server logs and analytics tools that record usage activity

4.3. From Third Parties

• Identity verification and know-your-customer (KYC) providers who help us confirm your identity and assess document authenticity
• Credit bureaus (with your consent, for payday loan applications where a credit check is conducted)
• Sanctions screening and fraud detection service providers
• FINTRAC and other regulatory bodies, where we are required to receive or act on information by law
• Debt collection agencies, where applicable in loan recovery scenarios

5. PURPOSES FOR WHICH WE USE YOUR PERSONAL INFORMATION

We use your personal information only for the purposes for which it was collected or for purposes consistent with those purposes, or as required or permitted by law.

5.1. Payday Loan Service Purposes

1. Assessing your eligibility for a payday loan, including verifying your income, identity, and residency;
2. Determining an appropriate loan amount consistent with your income and applicable provincial rules;
3. Preparing and delivering your loan agreement, including mandatory cost of borrowing disclosures as required by provincial payday lending legislation;
4. Disbursing loan funds to your designated bank account;
5. Collecting repayments via pre-authorized debit;
6. Managing dishonoured payments, defaults, and, where necessary, collections activity;
7. Complying with provincial payday lending licensing requirements, including record-keeping and reporting obligations;
8. Processing cancellation requests within the two-business-day cancellation period; and
9. Assessing and managing credit risk across our loan portfolio.

5.3 General Business Purposes

1. Maintaining and improving our platform, products, and services;
2. Conducting internal audits, risk management, and fraud analysis;
3. Complying with all applicable Canadian federal and provincial laws and regulations, and applicable Nigerian law;
4. Fulfilling tax reporting obligations to the Canada Revenue Agency (CRA);
5. Communicating administrative and service-related notices to you;
6. Sending marketing communications, but only with your express opt-in consent, and subject to Canada's Anti-Spam Legislation (CASL); and
7. Defending or asserting legal claims.

5.4 Legal Bases Under PIPEDA

Under PIPEDA, we process your personal information on the basis of:

• Your express or implied consent (for most data collection and use);
• Our legal obligations under PCMLTFA, provincial payday lending legislation, the Criminal Code, and other applicable law; and
• Our legitimate business interests, where they do not override your privacy rights.

5.5 Legal Bases Under Nigeria's NDPA 2023 (For Nigerian Data Subjects)

For personal information relating to recipients of remittances in Nigeria, we process personal data on the basis of:

• Performance of a contract (completing the remittance transaction);
• Legal obligations under Nigerian law, including CBN regulations; and
• Your consent, where required under the NDPA 2023.

6. DISCLOSURE OF YOUR PERSONAL INFORMATION

SeedFi does not sell, rent, or trade your personal information to third parties for their own marketing purposes. We disclose your personal information only in the following circumstances.

6.1 Service Providers and Processors

We engage trusted third-party service providers who process personal information on our behalf under written contracts that require them to maintain confidentiality and data protection standards equivalent to our own. These include:

• Identity verification and KYC providers
• Credit bureaus (where a credit check is performed for loan applications)
• Payment processors and banking partners
• Cloud infrastructure and data hosting providers
• Customer support and communications platforms
• Fraud detection, cybersecurity, and sanctions screening services
• Debt collection agencies (for defaulted payday loans, where applicable)
• Legal, accounting, and audit professionals

6.2 Regulatory and Law Enforcement Authorities

We are required to disclose certain personal information to:

• FINTRAC, in accordance with mandatory reporting obligations under PCMLTFA (including large cash transaction reports, suspicious transaction reports, and terrorist property reports);
• The Canada Revenue Agency (CRA), for applicable tax reporting obligations;
• Provincial consumer protection and payday lending regulators, where required by our licensing obligations (e.g., the Financial Services Regulatory Authority of Ontario, or equivalent in other provinces);
• The Financial Consumer Agency of Canada (FCAC), where applicable;
• Law enforcement agencies, courts, or other governmental authorities, when required by a valid court order, subpoena, or applicable law; and
• The Nigeria Data Protection Commission (NDPC) and other Nigerian regulatory authorities, where required in connection with remittance transactions.

6.4 Credit Bureaus (Payday Loans)

Where a payday loan goes into default and remains unpaid, we may report that default to one or more Canadian credit bureaus. We will inform you in advance if we intend to make such a report. Similarly, where we conduct a credit check at the time of your application (and you have consented), the credit bureau will record this as an inquiry on your credit file.

6.5 Business Transfers

In the event of a proposed or completed merger, acquisition, sale of assets, or restructuring involving SeedFi, your personal information may be reviewed by and transferred to the acquiring or successor entity as part of that transaction. Where practicable, we will notify you of such a change prior to its completion, and your personal information will remain subject to this Privacy Policy or a policy offering equivalent protections.

6.6 With Your Consent

We may disclose your personal information to third parties not described above, but only with your express prior consent, which you may withdraw at any time.

6.7 Intra-Group Transfers

Where SeedFi establishes subsidiaries or affiliated entities, personal information may be shared within the SeedFi corporate group for the purposes described in this Policy, subject to equivalent data protection standards.

7. INTERNATIONAL DATA TRANSFERS (CANADA TO NIGERIA)

SeedFi's remittance service necessarily involves the transfer of personal data from Canada to Nigeria. We approach these transfers with care and transparency.

7.1 Transfers from Canada Under PIPEDA

PIPEDA does not prohibit cross-border transfers of personal information, but requires that organizations use contractual or other means to provide a comparable level of protection to personal information transferred internationally. When personal information is transferred from Canada to our service providers or partners outside Canada (including in Nigeria), we:

• Enter into written data processing agreements that impose privacy and security obligations at least equivalent to PIPEDA requirements;
• Limit transfers to the minimum personal information necessary to complete the relevant transaction or service; and
• Conduct due diligence on the data protection practices of our international partners before engaging them.

You acknowledge that personal information disclosed to us may be transferred to and processed in Nigeria and potentially other countries, and that applicable laws in those countries may differ from Canadian law.

7.2 Transfers to Nigeria Under the NDPA 2023

Under Section 41 of the NDPA 2023, transfers of personal data outside Nigeria are prohibited by default, subject to certain exceptions. Conversely, as a data controller that transfers personal data into Nigeria (as a destination for remittance recipients' data), we ensure that our Nigerian partners who receive this data comply with the NDPA 2023.

Where data originates in Nigeria (for example, recipient data initially provided by Nigerian residents or financial institutions), any further transfer outside Nigeria is handled through:

• Contractual clauses that provide an adequate level of protection equivalent to the NDPA 2023, consistent with Section 41(1) of the Act; and
• Ensuring recipients are bound by binding corporate rules, codes of conduct, or certification mechanisms approved by the Nigeria Data Protection Commission (NDPC), where applicable.

Canada has a recognized data protection framework. We assess the adequacy of protection using criteria consistent with Section 42 of the NDPA 2023.

8. DATA RETENTION

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, or as required by applicable law. The following minimum retention periods apply:

Where personal information is no longer required and is not subject to a legal retention obligation, we will destroy, delete, or anonymize it in a secure manner.

9. YOUR PRIVACY RIGHTS

9.1 Rights Under PIPEDA

Note on payday loan records: Your right to request deletion of loan records may be limited by our legal obligation to retain those records under PCMLTFA, provincial payday lending legislation, and CRA requirements.

9.2 How to Exercise Your Rights

To exercise any of the rights described in this Section, please contact our Privacy Officer at:

Email: help@SeedFi.com

We will respond to all rights requests within 30 calendar days. Where a request is complex or numerous, we may extend this period by up to an additional 30 days and will notify you accordingly. We will not charge a fee for access requests unless the request is manifestly unfounded or excessive.

We may require you to verify your identity before responding to a rights request, to protect your personal information from unauthorized access.

10. CONSENT

10.1 Obtaining Consent

Under PIPEDA, we obtain your consent before or at the time we collect personal information, except where the law permits or requires us to collect it without consent. Consent may be:

• Express: provided explicitly in writing or verbally (required for sensitive information such as credit bureau checks, marketing communications, and certain disclosures to third parties); or
• Implied: reasonably inferred from your conduct (for example, providing your bank account details for the purpose of receiving a loan disbursement constitutes implied consent to use those details for that purpose).

10.2 Consent for Payday Loans

When you apply for a payday loan, we will obtain your express written consent to:

• Collect and use your income and banking information to assess your application;
• Conduct a credit bureau inquiry (if applicable);
• Set up a pre-authorized debit arrangement for repayment; and
• Share your default information with credit bureaus in the event of non-payment (we will notify you before any such report is made).

10.3 Consent for Marketing

We will only send you promotional or marketing communications with your prior express opt-in consent, in compliance with Canada's Anti-Spam Legislation (CASL), S.C. 2010, c. 23. Every marketing communication we send will include a clear and easy mechanism for you to unsubscribe. Unsubscribing from marketing communications will not affect your receipt of transactional or service-related communications.

10.4 Withdrawing Consent

You may withdraw your consent to non-essential uses of your personal information at any time by contacting us at help@SeedFi.com or by using in-app preference settings. Please note that withdrawing consent may limit or prevent us from continuing to provide certain services to you.

11. DATA SECURITY

SeedFi implements appropriate technical and organizational safeguards to protect your personal information against unauthorized access, loss, alteration, disclosure, or destruction. Our measures include:

• AES-256 encryption for personal data at rest;
• TLS 1.2 or higher encryption for all data transmitted over public networks;
• Multi-factor authentication (MFA) for all user accounts and internal systems;
• Role-based access controls, limiting access to personal information to personnel with a legitimate business need;
• Regular security audits, penetration testing, and vulnerability assessments;
• Employee training on privacy and data security obligations;
• Formal information security policies and incident response procedures;
• Contractual security obligations imposed on all third-party service providers; and
• Physical access controls for any premises where personal information is processed.

Despite these measures, no system is completely secure. If you believe your SeedFi account has been compromised, or if you become aware of any unauthorized use of your information, please contact us immediately at: hello@theseedfi.com

12. DATA BREACH NOTIFICATION

In the event of a breach of our security safeguards involving your personal information, we will act in accordance with our legal obligations under PIPEDA.

12.1 Under PIPEDA (Canadian Users)

Where a breach creates a "real risk of significant harm" to individuals (which includes financial loss, identity theft, damage to reputation, humiliation, physical harm, or loss of employment), we will:

1. Report the breach to the Office of the Privacy Commissioner of Canada (OPC) as soon as feasible after determining that the breach has occurred;
2. Notify affected individuals directly and as soon as feasible, with sufficient information to allow them to take steps to protect themselves; and
3. Notify any other organizations that may be able to reduce the risk of harm to affected individuals.

We maintain records of all security breaches for a minimum of 24 months, regardless of whether the breach triggers mandatory notification, in compliance with the Breach of Security Safeguards Regulations.

12.3 What We Will Tell You

In a breach notification, we will include:

• A description of what happened and the type of personal information involved;
• The steps we have taken or are taking to address the breach;
• Steps you can take to protect yourself; and
• Contact information for further inquiry or to make a complaint.

13. COOKIES AND TRACKING TECHNOLOGIES

Our website and mobile application use cookies and similar technologies to support core functionality, enhance your experience, and analyze usage patterns.

13.1 Types of Cookies We Use

13.2 Managing Your Cookie Preferences

You may manage your cookie preferences through our Cookie Preference Centre, accessible on our website. You may also adjust your browser settings to block or delete cookies. Note that disabling strictly necessary cookies may impair your ability to use our services.

Opting out of analytics or marketing cookies will not affect your ability to use SeedFi's core remittance or payday loan services.

14. SPECIFIC PRIVACY DISCLOSURES

Given the sensitive nature of payday loan information, we provide the following additional disclosures specific to our payday loan service.

14.1 Sensitive Financial Information

Information collected in connection with your payday loan application and account (including income details, bank statements, loan repayment history, and default records) is treated as sensitive personal information. Access to this information is restricted to personnel directly involved in loan processing, risk management, compliance, and, where applicable, collections.

14.2 Credit Bureau Reporting

• Application Inquiries: Where a credit check is conducted with your consent, this will appear as a credit inquiry on your credit report.
• Repayment History: We do not routinely report on-time repayment to credit bureaus, but we reserve the right to do so in the future with appropriate notice.
• Default Reporting: If your loan goes into default and remains unpaid, we may report this to one or more Canadian credit bureaus. We will notify you in writing before making any default report.

14.3 Collections Activity

If you default on a payday loan, we may engage a third-party collections agency. Any such agency will have access to the personal information necessary to recover the outstanding debt and will be contractually bound to handle it in compliance with PIPEDA and applicable provincial collections legislation. We will not authorize our collections partners to contact you in a manner prohibited by applicable law, including the restrictions on contact frequency and contact with third parties set out in provincial payday lending legislation.

14.4 Regulatory Record-Keeping

Our payday lending operations are subject to mandatory record-keeping requirements under provincial payday lending legislation. Records of your loan agreements, disclosures provided to you, repayment records, and cancellation rights information must be retained for the periods specified in Section 8 of this Policy.

14.5 Pre-Authorized Debit (PAD) Information

Where you provide pre-authorized debit authorization for repayment of your loan, your bank account information is processed through the Canadian payments system and handled in accordance with the Payments Canada Rules and applicable agreements. Your PAD information is encrypted and accessed only by authorized personnel involved in payment processing.

14.6 Cancellation Rights

Under applicable provincial legislation, you have a right to cancel your payday loan agreement within two business days of signing, without penalty and without giving any reason. If you cancel, we will delete or securely destroy any personal information collected solely for the purpose of the cancelled loan, except to the extent we are required to retain records by law.

15. ANTI-MONEY LAUNDERING AND COUNTER-TERRORIST FINANCING (AML/CTF)

SeedFi is a Money Services Business regulated by FINTRAC under the PCMLTFA. Our AML/CTF obligations require us to:

• Verify the identity of clients before providing certain services;
• Keep records of transactions and identification documents for a minimum of five years;
• Report certain transactions to FINTRAC, including Large Cash Transactions, Electronic Funds Transfer Reports, Suspicious Transaction Reports, and Terrorist Property Reports, where required by law;
• Screen clients and transactions against applicable sanctions lists; and
• Assess and manage the risk of money laundering and terrorist financing associated with our business activities.

These activities are conducted pursuant to our legal obligations and are not subject to your consent. Where we are required by law to make a report to FINTRAC or another authority, we may not be able to disclose to you that such a report has been made, as tipping off a subject of a suspicious transaction report may itself be an offence under Canadian law.

16. CHILDREN'S PRIVACY

SeedFi's services are not directed to or intended for individuals under the age of 18. We do not knowingly collect personal information from minors. You must be at least 18 years of age, and meet applicable provincial minimum age requirements for payday lending, to use our services.

If you believe that we have inadvertently collected personal information from a person under 18, please notify us immediately at help@theseedfi.com and we will take prompt steps to delete that information, except to the extent we are required to retain it by law.

17. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, regulatory developments, or privacy best practices. When we make material changes, we will:

• Post the updated Policy on our website at www.SeedFi.ca with a revised Effective Date prominently displayed;
• Notify registered users via email or in-app notification; and
• Where required by applicable law (including PIPEDA or the NDPA 2023), seek your renewed consent before applying material changes to our processing of your personal information.

Your continued use of SeedFi's services after the effective date of any update constitutes your acknowledgment of the revised Policy. If you do not agree with the changes, you should discontinue use of our services and contact us to close your account.

We encourage you to review this Policy periodically. Prior versions of this Policy are available on request.

18. GOVERNING LAW AND JURISDICTION

This Privacy Policy is governed by and construed in accordance with the laws of Canada, including PIPEDA and applicable provincial privacy legislation.

To the extent that Nigerian law applies to the processing of personal data of Nigerian residents or the transfer of personal data to Nigeria, the Nigeria Data Protection Act 2023 and applicable NDPC directives shall govern those processing activities.

Nothing in this Policy limits SeedFi's obligations under applicable federal or provincial law, including PCMLTFA and provincial payday lending legislation.

19. HOW TO CONTACT US

For all privacy-related inquiries, rights requests, complaints, or consent withdrawals, please contact:

We will acknowledge all privacy inquiries within five (5) business days and aim to resolve them fully within thirty (30) calendar days.

External Regulators:

This policy was last reviewed on April 1, 2026.