Castleton Financial Ltd. is committed to maintaining the protection and confidentiality of your personal information secure and confidential and this Privacy Code outlines the measures we take to ensure these goals. In this code, "we", "our" and "us" mean, collectively, the companies affiliated with Castleton Financial Ltd. ("Castleton"). Also, "you" and "your" mean an individual who has made an application to us, or provided a guarantee, for any product or service provided by us, or any other person for whom we receive, hold, use or disclose personal information for the purposes of our activities.

This Privacy Code applies to personal information collected by technological or other means. We are committed to providing you with relevant information about the collection, use and retention of your information in a clear and understandable manner. Transparency is our priority.

If you have concerns or questions that you feel are not addressed by this code, please contact the Castleton Financial Ltd. Privacy Officer at the address listed.

What Is Personal Information?

Personal information is information that is specific to you — any information that concerns you and allows you to be identified. We use it not only to identify you as our customer but also to understand your needs and how we can serve you better. This information includes, but is not limited to, your name, address, date of birth, identification numbers (such as your SIN), income, assets, liabilities, source of funds and references, as well as your financial and employment records. Personal information may also include whether or not credit was extended and to whom the information was disclosed.

Personal information is considered sensitive if it is medical, biometric or otherwise intimate, or if, because of its particular context, it gives rise to a high reasonable expectation of privacy.

Why Do We Collect Your Personal Information?

There are several reasons why we collect and use your personal information. They relate to the day-to-day operations of the Company and facilitate the delivery of services and products we provide to you. When you apply for, or provide a guarantee in respect of, any of our personal financial products or services, you agree that we may collect your information in order to:

• Identify you and understand your needs
• Determine the suitability and your eligibility for our products and services
• Validate the accuracy of the information in the file
• Inform you about other products and services that may meet your needs
• Provide ongoing service and improve our interactions with you
• Comply with legal requirements and regulations
• Protect both your interests and ours

If a new purpose for using your personal information should develop, we will ask for your consent before using it. We will not keep any of your personal information if it is no longer required to fulfill these purposes or to comply with legal or regulatory requirements.

How Do We Collect Your Personal Information?

In addition to the information you provide directly, we may collect, obtain and verify information about you from credit bureaus, mortgage insurers, creditor insurers, registries and other persons with whom you may have financial dealings, as well as any other person or entity as may be permitted or required by law. You authorize any person whom we contact in this regard to provide such information to us. You have the right to know the source of the personal information we collect upon request to our Chief Privacy Officer.

1. Accountability

Maintaining the security and confidentiality of your personal information is the responsibility of every employee at Castleton and every supplier that we work with. All employees are required to sign a confidentiality agreement, which prohibits them from disclosing or otherwise using your information without your consent — even after they no longer work for the Company.

2. Collection

We collect your personal information for the necessary purposes identified in this Privacy Code or for any purpose that may be communicated to you prior to collection. We do not collect personal information from children (14 years of age or younger) without the consent of their parent, legal guardian or tutor, except for purposes permitted by law.

When we become aware of a credit report or recommendation on your creditworthiness from a personal information agent, we will inform you of your right to access and rectify these records. If we ever refuse one of your credit applications on the basis of such a report or recommendation, we will inform you.

3. Consent

We will take all reasonable means to make sure you understand why you are providing us with personal information, how we collect it, and what we can or will do with that information. You can express your consent to us orally, in writing, or electronically.

You can have your name deleted from our marketing lists if you do not wish to receive our direct marketing communications. You can also refuse to provide us with personal information or withdraw your consent at any time by providing us with reasonable written notice. This withdrawal may affect our ability to provide you with certain products.

4. Disclosure of Your Information

Your personal information is accessible only to our employees, representatives, agents or service providers who need your information to perform their duties. We have entered into written agreements with all our agents and service providers to ensure that they preserve the security and confidentiality of your information and comply with our Privacy Code.

We may also disclose your information to credit bureaus, mortgage insurers, credit insurers, registries and other persons with whom you may have a financial relationship, as well as any other person as permitted or required by law. Your personal information may also be disclosed without your consent for legal, security, emergency, research, statistical, or privacy incident management purposes as permitted by law.

5. Use of Your Information

We will use or disclose your personal information only for the reasons it was collected. We may use your information without your consent for purposes consistent with those already disclosed, for purposes clearly for your benefit, for fraud prevention and detection, to improve our security measures, or for study, research or statistical purposes where you cannot be directly identified.

6. Retention of Your Information

We will retain personal information as long as necessary for the identified purposes, even if you cease to be a customer. We retain information used to make a decision about you for a minimum of one year after that decision is made. After the retention period, we destroy the information. Upon request, you have the right to be informed of the information we hold, the categories of people who have access to it, and how long we keep it.

7. Keeping Your Information Accurate

Castleton seeks to maintain the accuracy, completeness and relevance of your personal information. It is your responsibility to notify us if there is any change to your personal information. You may challenge the accuracy and completeness of your personal information and we will make any necessary amendments. We will respond to your request within 30 days and provide you with a copy of the corrected information, free of charge.

8. Keeping Your Information Secure

We ensure the physical, organizational and electronic security of your personal information. We use our best efforts to destroy, erase or make anonymous any personal information that is no longer required. In the event of a privacy incident involving your personal information, we will take all reasonable steps to minimize the risks and prevent further incidents. In the event of an incident presenting serious risk, we will notify you and the Commission d'accès à l'information. We maintain a register of privacy incidents for a period of five years.

9. Your Access to Your Information

When you request it, we will tell you what personal information we have, what it is being used for, from whom it was collected and to whom it has been disclosed (where permitted by law). Any request for access must be made in writing. We will respond within 30 days. We will not provide personal information if it contains references to other persons that could harm a third party, is subject to solicitor-client privilege, contains proprietary information, cannot be disclosed for legal reasons, would cause serious harm to your health, or would affect a legal investigation or proceeding.

10. Dealing with Your Concerns and Questions

Castleton has policies and procedures to receive, investigate and respond to customers' complaints and questions. All inquiries should be sent to the Company's Chief Privacy Officer. You also have the right to contest our decisions and submit a disagreement to the Commission d'accès à l'information within 30 days of any refusal on our part.