Privacy Policy

Risk Alive Analytics Inc. ("Risk Alive", "RAA", "we", "us" or "our") respects your privacy and is committed to protecting the personal information entrusted to us.

This Privacy Policy explains how we collect, use, disclose, retain and protect personal information in connection with our websites, software platforms, professional services, training activities and other interactions with customers, prospective customers, suppliers, business partners and other individuals.

Our handling of personal information is governed by applicable privacy legislation, including Alberta's Personal Information Protection Act ("PIPA") and, where applicable, Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and other privacy laws applicable to our activities.

1. Scope of this Privacy Policy

This Privacy Policy applies to personal information that Risk Alive collects, uses or discloses in the course of its commercial activities, including through:

• our websites and online services;
• Risk Alive software, applications and cloud-based platforms;
• professional consulting and process safety services;
• training programs and events;
• customer support;
• sales and business development activities;
• communications with customers, prospective customers, suppliers and business partners; and
• other business interactions with Risk Alive.

In some circumstances, Risk Alive processes information on behalf of a customer as part of the services we provide. Where we process personal information under the direction of a customer, the customer's agreement with Risk Alive and its own privacy practices may also apply. Individuals should contact the applicable customer directly regarding requests relating to personal information controlled by that customer.

This Privacy Policy is intended primarily to address Risk Alive's Canadian operations. Additional requirements may apply where individuals or our activities are subject to privacy laws in other jurisdictions.

2. What Is Personal Information?

"Personal information" generally means information about an identifiable individual.

Depending on applicable law, certain business contact information used solely to communicate with an individual in relation to their employment, business or professional responsibilities may not be treated as personal information.

Personal information does not generally include information that has been aggregated or de-identified so that it can no longer reasonably be associated with an identifiable individual.

3. Personal Information We May Collect

The type of personal information we collect depends on how you interact with Risk Alive.

Contact and Business Information

We may collect:

• name;
• employer or organization;
• job title or business role;
• business address;
• email address;
• telephone number; and
• other information you provide when communicating with us.

Account and Service Information

Where you use Risk Alive products, platforms or services, we may collect information such as:

• account and user profile information;
• username or account identifiers;
• authentication and access information;
• organization or customer affiliation;
• service preferences and configurations;
• records of service usage;
• customer support communications; and
• information submitted through our platforms or services.

Professional Services and Training Information

When providing consulting, process safety, risk assessment, training, webinar or related services, we may collect information concerning participants, customer representatives or other individuals involved in the engagement.

This may include names, business roles, contact information, registration and attendance information, training records and other information reasonably necessary to perform the applicable services.

Payment and Transaction Information

When you purchase training or other offerings through our websites, payment is completed through a third-party payment processor. We do not collect or store complete payment card numbers. We receive transaction records that may include your name, email address, country, purchase details, and limited payment information such as the payment method type, the last four digits of the card and the issuing bank.

Communications

If you contact us, we may maintain records of correspondence, inquiries, support requests, feedback, meeting information and other communications.

Website and Technical Information

When you visit our websites or use our digital services, we may automatically receive certain technical information, such as:

• Internet Protocol ("IP") address;
• browser type and version;
• device and operating-system information;
• referring website;
• pages viewed;
• date and time of access;
• approximate geographic location derived from an IP address;
• session and interaction information;
• cookie and similar identifiers assigned to your browser or device;
• the campaign, source or link parameters used to reach our website;
• content, links and files you interact with on our pages;
• forms you submit and the information you enter in them; and
• similar technical and usage information.

We use this information to operate, secure, understand and improve our websites and services.

Where you have provided your contact information to us, information about your visits to our websites may be associated with your contact record.

4. How We Collect Personal Information

We may collect personal information:

• directly from you;
• from the organization you represent;
• when you create or use an account;
• when you communicate with us;
• when you participate in our services, training or events;
• when you purchase products or services through our websites;
• automatically through our websites and digital services;
• from customers when they provide information necessary for us to perform services;
• from service providers acting on our behalf; and
• from other lawful sources where permitted by applicable law.

Where another organization provides personal information to us, we expect that organization to have the authority to provide the information for the applicable purpose.

5. Why We Collect and Use Personal Information

Risk Alive may collect and use personal information for purposes including:

• establishing, managing and administering customer and business relationships;
• providing our products, software and professional services;
• administering user accounts and controlling access to our systems;
• providing technical support and responding to inquiries;
• delivering training programs and maintaining appropriate training records;
• communicating with customers, users, suppliers and business partners;
• understanding customer requirements and improving our products and services;
• administering contracts, invoices, payments and business records;
• operating and improving our websites and digital platforms;
• monitoring performance, reliability and security;
• detecting, investigating and preventing fraud, cybersecurity threats, misuse or other unauthorized activity;
• maintaining business continuity and protecting Risk Alive's systems, personnel, customers and property;
• conducting internal reporting, analysis and business planning;
• developing and improving our services and analytical capabilities;
• complying with contractual, legal, regulatory, insurance and audit requirements;
• establishing, exercising or defending legal rights; and
• other purposes that are identified when information is collected or for which consent is otherwise obtained.

We limit our collection of personal information to information that is reasonably necessary for the purposes for which it is collected.

6. Analytics, Automation and Artificial Intelligence

We may use analytical, automated or artificial-intelligence-assisted technologies to support activities such as:

• searching, summarizing and organizing process-safety information
• identifying patterns, trends and relationships within risk and hazard data
• ranking, prioritizing and assessing risk information
• generating draft analytical content for review by qualified personnel
• responding to user questions within our platforms
• service delivery, product development and quality improvement
• customer support
• internal business processes

Risk Alive does not use personal information or customer content to train, fine-tune or otherwise develop generally available artificial-intelligence or machine-learning models.

Our third-party artificial-intelligence providers are contractually prohibited from using content submitted by or on behalf of Risk Alive to train or improve their models, and from disclosing that content to other customers.

Where Risk Alive develops, tunes or evaluates its own analytical models, we use aggregated, anonymized or de-identified information, information we have licensed or that is publicly available, or customer information where the applicable customer agreement authorizes that use.

Where personal information is involved, we will handle that information in accordance with applicable privacy laws, applicable customer agreements and this Privacy Policy.

Where reasonably possible, we seek to use aggregated, anonymized or de-identified information for analytical and product-improvement purposes.

We will not use personal information for a materially different purpose requiring consent without obtaining that consent or otherwise having lawful authority to do so.

7. De-Identified and Aggregated Information

Risk Alive may create aggregated, anonymized or de-identified information from information available to us, subject to applicable law and our contractual obligations.

We may use such information for purposes including:

• statistical analysis;
• benchmarking;
• research;
• improving our products and services;
• developing analytical methodologies;
• understanding industry trends; and
• developing new products, services or capabilities.

Where information is treated as de-identified or anonymous, we take reasonable measures appropriate to the circumstances to reduce the risk that an individual could be identified from that information.

8. Cookies and Similar Technologies

Our websites and digital services may use cookies and similar technologies.

Cookies are small files or identifiers used by websites and online services to support functions such as:

• maintaining sessions;
• remembering preferences;
• improving website functionality;
• measuring website usage and performance;
• understanding how visitors interact with our services; and
• maintaining security.

Some cookies may be necessary for our websites or services to function. Others support analytics that help us measure and improve website performance.

By continuing to use our websites, you consent to the use of cookies and similar technologies as described in this Privacy Policy.

You may also be able to control cookies through your browser settings. Disabling certain cookies may affect the availability or functionality of portions of our websites or services.

9. Marketing Communications

Risk Alive may use business contact information to communicate about our products, services, events, industry developments or other matters that may be relevant to our customers and business contacts.

We will send commercial electronic communications in accordance with applicable law, including Canada's Anti-Spam Legislation (CASL).

Our marketing emails include analytics technologies that tell us how recipients engage with our messages. We use this information to measure the performance of our communications.

Where required, we will obtain consent and provide a means to unsubscribe from marketing communications. You may unsubscribe using the mechanism contained in the applicable communication or by contacting us.

Unsubscribing from marketing communications will not prevent Risk Alive from sending service, contractual, administrative, security or other non-marketing communications where appropriate.

10. Consent

Where consent is required, Risk Alive seeks consent that is appropriate having regard to the circumstances and sensitivity of the personal information.

Consent may be express or implied where permitted by applicable law.

For example, when you request services from Risk Alive or enter into an agreement with us, certain collections, uses and disclosures of personal information may be reasonably necessary to provide those services or administer that relationship.

We will seek additional consent where required if we intend to use personal information for a materially new purpose that was not previously identified.

You may withdraw consent to our use of personal information where the processing is based on consent, subject to reasonable notice and any legal, contractual or other restrictions.

Withdrawal of consent may affect our ability to provide certain services.

11. When We Disclose Personal Information

Risk Alive does not sell personal information.

We may disclose personal information in the circumstances described below.

Employees and Representatives

We may provide information to employees, contractors, consultants and affiliates who reasonably require access to perform their responsibilities.

Service Providers

We may engage third parties to provide services on our behalf, such as:

• information technology;
• cloud hosting and data storage;
• cybersecurity;
• communications;
• customer relationship management;
• website hosting;
• analytics;
• professional advisory services; and
• other operational services.

We seek to limit service-provider access to information reasonably required to perform their services and use contractual or other appropriate measures to protect information entrusted to them.

Customers

Where our services are provided to an organization, information associated with users or participants may be accessible to authorized representatives of that organization where reasonably necessary to provide or administer the services.

Corporate Transactions

Personal information may be disclosed in connection with a proposed or completed financing, merger, acquisition, reorganization, sale of assets, investment, secured transaction or other business transaction, subject to applicable legal requirements and appropriate confidentiality protections.

Legal and Regulatory Purposes

We may disclose personal information where reasonably necessary or permitted by law, including:

• in response to a court order, subpoena, warrant or other lawful process;
• to comply with legal or regulatory obligations;
• to investigate fraud or illegal activity;
• to enforce our agreements or protect our legal rights;
• to protect the safety or security of individuals, systems or property;
• in connection with an emergency; or
• where otherwise permitted or required by applicable law.

We may also disclose personal information with your consent or at your direction.

12. Processing and Storage Outside Canada

Risk Alive may use service providers located outside Canada, including in the United States, to support certain aspects of our operations.

As a result, personal information may be transferred to, processed or stored in another jurisdiction and may be subject to the laws of that jurisdiction. Government authorities, courts or law-enforcement agencies in that jurisdiction may be entitled to access information as permitted by applicable law.

Risk Alive remains responsible for personal information under its control and uses contractual, technical and organizational measures appropriate to the circumstances when engaging service providers.

For additional information regarding our use of service providers outside Canada, including the countries in which information may be processed and the purposes for which such providers are authorized to process information, please contact our Privacy Officer.

13. Information Security

Risk Alive maintains physical, administrative and technical safeguards designed to protect personal information against risks such as:

• unauthorized access;
• unauthorized collection, use or disclosure;
• loss or theft;
• copying or modification;
• accidental destruction; and
• unauthorized disposal.

The safeguards used depend on factors including the sensitivity, volume and format of the information and the risks associated with its processing.

Measures may include, where appropriate:

• access controls;
• authentication measures;
• role-based access;
• encryption;
• network and system security;
• monitoring and logging;
• secure backup processes;
• confidentiality obligations;
• employee awareness and training;
• vendor security requirements; and
• incident-response procedures.

No information system or method of electronic transmission can be guaranteed to be completely secure. We therefore continually assess and improve safeguards as technology and risks evolve.

14. Privacy and Security Incidents

Risk Alive maintains processes for identifying, investigating and responding to actual or suspected privacy and security incidents.

Where a breach of security safeguards occurs, we will assess the circumstances and take appropriate action in accordance with applicable law. This may include notifying affected individuals, privacy regulators or other parties where notification is legally required.

If you become aware of a suspected unauthorized access to or disclosure of personal information involving Risk Alive, please contact our Privacy Officer promptly.

15. Retention and Destruction

Risk Alive retains personal information only for as long as reasonably necessary to:

• fulfill the purposes for which it was collected;
• provide our products and services;
• satisfy contractual obligations;
• maintain appropriate business and audit records;
• comply with legal and regulatory requirements;
• resolve disputes; and
• establish, exercise or defend legal rights.

Retention periods vary depending on the nature and sensitivity of the information and the applicable legal, contractual and operational requirements.

When personal information is no longer reasonably required, we take appropriate steps to securely destroy, delete or de-identify it, subject to applicable legal and contractual requirements.

16. Accuracy

Risk Alive takes reasonable steps to ensure that personal information used to make decisions affecting an individual is accurate, complete and up to date as reasonably necessary for the purposes for which it is used.

We encourage individuals to advise us if information they have provided changes or is inaccurate.

17. Access and Correction

Subject to applicable law, you may request:

• confirmation of whether Risk Alive holds personal information about you;
• access to personal information we hold about you;
• information regarding how that information has been used or disclosed; and
• correction of inaccurate or incomplete personal information.

We may need to verify your identity before responding to a request.

Certain information may be withheld where permitted or required by law, including information that would reveal personal information about another individual, confidential commercial information or information subject to legal privilege.

Where we are unable to provide requested information, we will provide an explanation where required and permitted by law.

Requests should be directed in writing to our Privacy Officer.

18. Your Privacy Choices

Depending on the circumstances and applicable law, you may be able to:

• withdraw consent to certain uses of your information;
• update or correct personal information;
• request access to personal information;
• unsubscribe from marketing communications;
• manage or delete cookies through your browser settings; or
• raise a concern regarding our privacy practices.

Certain information and processing may be necessary for us to provide services, maintain a contractual relationship, comply with legal obligations or protect our systems and business.

19. Third-Party Websites and Services

Our websites or services may contain links to websites or services operated by third parties.

Risk Alive does not control the privacy or security practices of those third parties. This Privacy Policy does not apply to information you provide directly to an unrelated third party.

We encourage you to review the applicable third party's privacy practices before providing personal information.

20. Children's Privacy

Risk Alive's commercial services are designed for organizations and professionals and are not directed to children.

We do not knowingly collect personal information directly from children through our business services except where reasonably necessary and permitted by law, such as where information is provided by an organization that has appropriate authority to provide it.

If you believe personal information relating to a child has been provided to us inappropriately, please contact our Privacy Officer.

21. Accountability

Risk Alive is responsible for personal information under its control.

We have designated a Privacy Officer who is responsible for overseeing Risk Alive's privacy-management practices and responding to privacy inquiries, access requests and complaints.

Employees and service providers who handle personal information are expected to comply with applicable confidentiality, privacy and security requirements.

22. Questions, Complaints and Privacy Requests

If you have a question, concern, complaint or request relating to this Privacy Policy or Risk Alive's handling of personal information, please contact:

Privacy Officer
Risk Alive Analytics Inc.
#900, 926 - 5th Avenue S.W.
Calgary, Alberta T2P 0N7
Canada

Email: privacy@riskalive.com
Telephone: 403-264-9637

We will review privacy concerns and respond as appropriate in accordance with applicable law.

23. Changes to This Privacy Policy

Our business, technology and legal obligations may change over time.

We may revise this Privacy Policy periodically to reflect changes to:

• our products or services;
• our information-handling practices;
• technology;
• service providers; or
• applicable legal or regulatory requirements.

The current version will be posted on our website together with its effective date.

Where a change materially affects how we collect, use or disclose personal information and additional notice or consent is required by law, we will provide that notice or obtain that consent as appropriate.

24. Interpretation

This Privacy Policy provides a general description of Risk Alive's privacy practices and is not intended to limit any rights or obligations established by applicable law.

If there is an inconsistency between this Privacy Policy and applicable privacy legislation, the applicable legislation will govern to the extent of the inconsistency.