Client portal privacy policy

1. Scope of this policy

This policy applies to all personal information processed through the Portal, including data submitted by you, generated by our systems, or shared by your mortgage team on your behalf. By using the Portal, you consent to the practices described below.

2. Information we collect

• Identification and contact details: name, email address, phone number, mailing address, preferred language, and other profile information.
• Application data: documents, forms, property details, financial information, employment records, and supporting materials uploaded by you or your mortgage team.
• Communications: secure messages exchanged within the Portal and notification preferences.
• Usage and security data: login history, device and browser identifiers, IP addresses, activity logs, and audit trails to protect your account and meet compliance obligations.

3. How we use your information

• To verify your identity and manage access to the Portal.
• To process mortgage applications, assess eligibility, and track progress.
• To communicate with you regarding document requests, checklist items, property updates, and reminders.
• To comply with legal, regulatory, and audit requirements, including anti-fraud safeguards.
• To monitor, maintain, and improve the security and performance of the Portal.

4. Consent and withdrawal

We collect, use, and disclose your personal information with your consent, which may be express or implied depending on the circumstances. You may withdraw your consent at any time by contacting us; however, this may limit our ability to provide mortgage services. We will honour all legal or contractual restrictions relating to your account.

5. Disclosure of your information

We only share personal information as required to deliver the services you request or when we have a legal obligation. This may include sharing with mortgage lenders, insurers, legal representatives, service providers performing work on our behalf, or regulators and law enforcement when required by law. Every third party is vetted to ensure they provide comparable protections and only use your data for authorized purposes.

6. Safeguards and retention

• Documents are encrypted in transit and at rest using industry-standard protocols.
• Access is limited by role-based permissions, multi-factor authentication, and regular access reviews.
• We maintain detailed audit logs, automated monitoring, and intrusion detection to identify suspicious activity.
• Personal information is retained only as long as necessary to fulfill the purposes described above or to meet legal and regulatory obligations. When information is no longer required, it is securely deleted or anonymized.

7. International transfers

Our primary systems are hosted in Canada. If data is processed in other jurisdictions, it will be subject to the laws of those jurisdictions; however, we implement contractual and technical safeguards to ensure equivalent protection.

8. Your privacy rights

You have the right to access, correct, or update your personal information, withdraw consent (subject to legal or contractual restrictions), and request deletion of your data. To exercise these rights, contact us directly. We will respond to requests within the timelines required by PIPEDA.

9. Cookies and analytics

The Portal uses essential cookies and session storage to maintain secure login sessions and remember language or accessibility preferences. We do not use advertising cookies. You can adjust your browser settings to manage cookie preferences, but this may affect Portal functionality.

10. Updates to this policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. We will post a notice in the Portal when material changes are made, and the revised policy will take effect on the date indicated below.

11. Contacting us

If you have questions, concerns, or wish to exercise your privacy rights, contact our Privacy Office at support@cognitivecapital.ca.