Privacy Policy

Last Updated: August 6, 2025

TABLE OF CONTENTS

1. Collection and Use of Personal Information

2. Legal Bases for Processing

3. Disclosure of Personal Information

4. Collection of Information from Children

5. Security

6. Third Party Links

7. Cookies and Ads

8. Opting Out

9. Your Rights

10. Passwords

11. Changes to This Privacy Policy

12. How We Respond to Do-Not-Track Signals

13. Note About Public Posting Areas

14. International Data Transfers

15. Other Information Collection

16. Health Connect Data

17. Platform Morals and Use

18. Assignment

19. Your U.S. State Privacy Rights

20. Contacting Our Privacy Officer

21. Canadian Users: Your Privacy Rights Under PIPEDA

22. Quebec Privacy Rights

CrowdChange Inc. "we";"us", "our". or “CrowdChange”) is committed to protecting your privacy. We need to collect certain personal information in order to facilitate the services provided through our websites, partner White Label Sites, mobile applications and other media content (“Services”) that are owned or controlled by CrowdChange, and this privacy policy ("Privacy

Policy") is designed to inform you about our practices relating to the collection, use and disclosure of personal information by CrowdChange. Information collected by CrowdChange will

vary depending on the user’s interactions with CrowdChange. (The CrowdChange platform cannot be used for crowdfunding initiatives unless all funds collected flow directly into the bank

account of a registered charity, designated 501C3, 501C7 or like-registered organization.)

This Privacy Policy governs CrowdChange’s data practices as they relate to its Services and is intended to comply with applicable privacy laws. Please do not use the CrowdChange Services if you do not agree with the provisions of this Privacy Policy.

Your use of the Services is also governed by the CrowdChange Terms of Use.

1. COLLECTION AND USE OF PERSONAL INFORMATION

The term "personal information" means information that can be used to identify an individual, such as name, phone number, email address, or mailing address. We collect personal

information when you:

Use Our Services as a Partner or a Supporter Through a Partner’s White Label Site

When you use our Services, you may be asked to provide registration information that identifies you (“Registration Information”). We collect personal and activity-related information including your name, email address, date of birth, fundraiser name, name of the entity for which you are fundraising, fundraiser goal, fundraiser photo, an overview of your fundraiser in the “About”section, fundraising team names, mailing address, phone number, and any other information you provide in connection with your activity and/or fundraiser(s). We use this information to provide our Services and, with your consent where required, to send promotional messages about our Services.

CrowdChange supports peer-to-peer fundraising campaigns, where individual users may create personal fundraising pages or events on behalf of a partner nonprofit organization or cause

through a partner White Label Site. In such cases, we collect the same information as for other events and fundraising campaigns and may share it with the partner or benefiting organization, consistent with this Privacy Policy.

Make a Donation, Purchase, or Interact with a Partner White Label Site

When you make a donation, purchase, or otherwise interact with a partner White Label Site, we may collect your name, phone number, email address, mailing address, and billing information. If your donation or purchase is made through our partner White Label Program, the partner or third party hosting the fundraiser collects and maintains the information you provide. We use this information to provide our Services, to send promotional messages about our Services, and to generate reports for our partners about their events and fundraisers.

In addition, the partner or third party in charge of the fundraiser may ask additional questions. CrowdChange is not responsible for the nature, content, or outcome of these requests and does not monitor or control such communications. The decision to respond to any such inquiries is voluntary; however, by providing information, users acknowledge and agree that such

information may be collected, stored, and used by the partner or third party in accordance with their own privacy practices. CrowdChange does not assume responsibility for the partner or

third party’s handling or safeguarding of any information provided.

Send Pictures

When you upload a picture, it will be publicly available to all viewers of your profile and fundraising page. Also, when you send us a picture or message via email, text message,

Instagram, Snapchat or other, we may take a screenshot of your picture or message for the purposes of providing our Services, which may include sharing your picture online or on social

media.

Contact Customer Service

If you contact us with a question, comment or complaint, you may be asked for information that identifies you (such as your name or email address) along with additional information we need to help us confirm your identity (if necessary), and to promptly answer your question or respond to your comment or complaint. We may also retain this information to assist you in the future and to improve our customer service and service offerings.

2. LEGAL BASES FOR PROCESSING

We process personal information in accordance with applicable laws, and in a manner that is transparent and fair. We rely on the following legal bases under the General Data Protection

Regulation (GDPR):

• Consent (Article 6(1)(a) GDPR): We rely on your consent, where required, to send promotional messages about our Services.
• Contractual Necessity (Article 6(1)(b) GDPR): We process your personal information as necessary to establish and fulfill a contract with you, including providing our Services

and responding to your inquiries or requests.

3. DISCLOSURE OF PERSONAL INFORMATION

We disclose your personal information in the following instances and to the following parties:

Partners and Affiliates

We may share your personal information with organizations to which you donate or interact, as well as affiliated organizations and other entities working on their behalf. For example, if

CrowdChange is the host of a White Label website operated by a partner or third party, we will share your personal information with this partner or third party. With your consent where

required, these partners, third parties and affiliates may use your personal information for their direct marketing purposes. CrowdChange does not control how partners or third parties use or protect your personal information. To understand more about how partners or third parties protect your personal information, please visit their respective websites directly.

Please note that the partner organizations to which you donate or interact may download a copy of your personal information for their own databases. You will need to contact the organization directly if you wish to have your personal information removed from their database.

Service Providers

We may transfer (or otherwise make available) your personal information to our affiliates, partners and other third parties who provide services on our behalf. We use service providers to

host our servers, send communications on our behalf, and process transactions.

Our service providers are given the information they need to perform their designated functions, and we do not authorize them to use or disclose personal information for their own purposes.

All payment processing services for donations on the CrowdChange platform are provided by third-party providers, such as Stripe. CrowdChange does not store or control payment data and does not process or transfer funds. Compliance with applicable anti-money laundering (AML) or counter-terror financing laws, including those governed by FINTRAC, is managed by these third-party payment processors.

Sale of Business

We may transfer any information we have about you as an asset in connection with a merger or sale (including transfers made as part of insolvency or bankruptcy proceedings) involving all or part of our operations or as part of a corporate reorganization or stock sale or other change in corporate control.

Legal

CrowdChange, our affiliates and related companies and our Canadian, US and other service providers may provide your personal information in response to a search warrant or other legally

valid inquiry or order, or to an investigative body in the case of a breach of an agreement or contravention of law, or as otherwise required by applicable Canadian, U.S. or other law. We

may also disclose personal information where necessary for the establishment, exercise or defence of legal claims, or as otherwise permitted by law.

4. COLLECTION OF INFORMATION FROM CHILDREN

Our Services are not intended for use by, and we do not knowingly collect any personal information from children under the age of 13, or 16 in the European Union (“EU”). If we

discover that we have such information in our possession, we will destroy it.

5. SECURITY

We have implemented administrative, technical and physical safeguards designed to protect personal information in our custody and control against unauthorized access, use, modification

and disclosure.

That said, no data transmissions over the Internet can be guaranteed to be 100% secure. If we learn of a security systems breach we may attempt to notify you electronically so that you can

take appropriate protective steps. By using our Services, providing access to our Services or providing personal information to us, you agree that we can communicate with you electronically regarding security, privacy and administrative issues relating to your use of our Services. We may post a notice through our Services if a security breach occurs. We may also send an email to you at the email address you have provided to us in these circumstances. Depending on where you live, you may have a legal right to receive notice of a security breach in writing.

6. THIRD PARTY LINKS

Our Services may contain links to other sites that CrowdChange does not own or operate. We provide partners and event organizers with the ability to have links to third party websites as a

convenience to the user. These links are not intended as an endorsement of or referral to the linked websites. The linked websites have separate and independent privacy statements,

notices and terms of use, which we recommend you read carefully. We do not have any control over such websites, and therefore we have no responsibility or liability for the manner in which the organizations that operate such linked websites may collect, use or disclose, secure and otherwise treat your personal information.

7. COOKIES AND ADS

We, our partners and third parties we work with, use cookies and other similar technologies, such as web beacons to collect information about your interaction with our servers (such as IP

addresses, device type, operating system and average time spent using our platform). We collect and use this information for the purposes of helping us understand how users use our

Services and to optimize our platform and service offering. We may also collect cookies (including Adobe or flash cookies) and web beacons.

In particular, we use Google Analytics to measure how you interact with our Services and to improve your user experience. To learn more about Google Analytics privacy practices and opt-

out mechanisms, please visit the Google Analytics Security and Privacy Principles page here. Google also provides a complete privacy policy and instructions on opting-out of Google

Analytics here.

There are several ways to manage cookies. You can control the use of cookies at the browser level, by instructing your browser to accept cookies, disable cookies or notify you when

receiving a new cookie. Please note that if you reject certain cookies, you may still use our Services, but your ability to use some features or areas of our Services may be limited.

8. OPTING OUT

You may decline to receive promotional emails, text messages or mail from us at the time of registration or at the time you otherwise provide the information to us. You may also opt-out of

receiving promotional emails or text messages by following the instructions in those emails or text messages or by sending an email to support@crowdchange.co.

If you opt out, we may still send you transactional messages, such as emails about your account or our ongoing business relationship.

9. YOUR RIGHTS

You have the right to access, update, and correct inaccuracies in your personal information in our custody and control, subject to certain exceptions prescribed by law. To request access,

updating or correction of inaccuracies in your personal information that we have in our custody or control, you can email or write to us at the contact information set out below. We may request certain personal information for the purposes of verifying the identity of the individual seeking access to their personal information records. Additionally, those located in the EU have the right to:

• Obtain confirmation as to whether or not their personal information exists and to be informed of its content and source, verify its accuracy and request its completion, update or amendment;
• Request the deletion, anonymization or restriction of the processing of their personal information processed in breach of the applicable law;
• Object to the processing, in all cases, of their personal information for legitimate reasons;
• Receive an electronic copy of their personal information, if they would like such a copy for themselves or to port their personal information to a different provider;
• Lodge a complaint with the relevant data protection supervisory authority.

10. PASSWORDS

While many of our Services are publicly accessible, access to your account information and some of our Services are accessible only through the use of an individual user ID and

password. To protect the confidentiality of personal information, you must keep your password confidential and not disclose it to any other person. Please advise us immediately if you believe that the confidentiality of your password has been compromised or that your password has been misused. In addition, always log out and close your browser when you finish your session.

Please note that we will never ask you to disclose your password in an unsolicited phone call or email. CROWDCHANGE IS NOT RESPONSIBLE FOR ACTIONS TAKEN REGARDING YOUR

ACCOUNT WHILE A USER IS LOGGED IN USING YOUR USER ID AND PASSWORD.

11. CHANGES TO THIS PRIVACY POLICY

This Privacy Policy may be updated periodically to reflect changes to our privacy practices. When our Privacy Policy changes, we will update the “Last Updated” date at the top of this

Privacy Policy and post a notice via our Services. For material changes, we will notify you by email or message. We also strongly encourage you to refer to this Privacy Policy for the latest

information about our personal information practices.

12. HOW WE RESPOND TO DO-NOT-TRACK SIGNALS

We do not support Do Not Track browser settings and do not currently participate in any “Do Not Track” frameworks that would allow us to respond to signals or other mechanisms from you regarding the collection of your personal information. Although we do not currently respond to Do-Not-Track signals, we do honor opt-out preferences as outlined in Section 19.

13. NOTE ABOUT PUBLIC POSTING AREAS

Please note that any information you include in a message you post to any public posting area is available to anyone with Internet access. If you do not want people to know your email

address, for example, do not include it in any message you post publicly. PLEASE BE EXTREMELY CAREFUL WHEN DISCLOSING ANY INFORMATION IN PUBLIC POSTING AREAS. WE ARE NOT RESPONSIBLE FOR THE USE BY OTHERS OF THE INFORMATION THAT YOU DISCLOSE IN PUBLIC POSTING AREAS.

14. INTERNATIONAL DATA TRANSFERS

If you choose to provide us with information, we may transfer that information to our partners, affiliates and subsidiaries or to other third parties, across borders, and from your country or

jurisdiction to other countries or jurisdictions around the world. If you are visiting from the EU or other regions with laws governing data collection and use that may differ from US or Canadian law, please note that you are transferring your personal information to the United States or Canada and other jurisdictions which may not have the same data protection laws as the EU. We take reasonable steps to ensure that such transfers are undertaken in accordance with applicable data protection and privacy laws. You acknowledge you understand that by providing your personal information:

• Your personal information will be used for the uses identified above in accordance with this Privacy Policy; and
• Your personal information may be transferred to the United States, Canada and other jurisdictions as indicated above.

15. OTHER INFORMATION COLLECTION

In addition to the definition of Personal Information in Section 1, personal information can also include health and other information you submit when you use our interactive tools. We do not collect personally identifiable information from you unless you provide it to us voluntarily and knowingly. We do not require visitors to register or provide information to us to view the website.

CrowdChange only gathers personally identifiable information when it is voluntarily submitted by a user. As outlined in Section 4, our website is not intended for children, and we do not

knowingly collect data on children under 13. We comply with the federal Children’s Online Privacy Protection Act of 1998 (COPPA).

16. HEALTH CONNECT DATA

CrowdChange apps may access data from Apple Health, Android Health Connect, Garmin, Strava, and Fitbit to support fitness-related features. The data we receive is limited to fitness

activity only—specifically, workout types and durations, steps, and distance. This information is used solely to credit users with activity rewards related to their participation in partner nonprofit fundraising campaigns.

We do not collect or share users’ health record data of any kind. No personal health record information beyond the activity types stated above is accessed, stored, or transmitted by

CrowdChange.

Users retain full control over their connection to Android Health Connect and may choose to connect or disconnect at any time through the Activity Tracking screen in the app.

17. PLATFORM MORALS AND USE

CrowdChange is committed to maintaining a respectful, safe, and ethical environment for all users. While CrowdChange does not have an obligation to proactively review user-generated

content or fundraisers, we reserve the right to monitor, review, or remove any content at our discretion to ensure compliance with this section or protect the integrity of the platform. You

agree not to use our Services to create, promote, or support events or fundraisers or content that:

• Violates any applicable law or regulation.
• Promotes discrimination, hate speech, violence, or harassment against individuals or groups based on race, ethnicity, religion, gender, sexual orientation, disability, or other protected characteristics.
• Encourages illegal activities or the use of illegal substances, including fundraising for illegal or prohibited activities such as terrorism, hate groups, weapons, or illicit drugs.
• Involves fraudulent, deceptive, or misleading information, including misrepresenting identity, affiliation, or the purpose of a fundraiser.
• Is obscene, pornographic, or otherwise offensive.
• Violates the rights of others, including intellectual property rights, privacy rights, or unauthorized use of proprietary content.
• Is contrary to generally accepted moral standards or public policy.
• Engages in harassment, bullying, threats, or abusive behavior toward other users or third parties.
• Uses the platform to send spam, phishing, or malicious software.
• Fails to comply with all applicable local, national, and international laws.

CrowdChange reserves the right to investigate any suspected violations of this policy, request additional information from users, and remove or disable access to any content or fundraiser it

determines violates these principles or is otherwise harmful to the community or the integrity of the platform.

Users who engage in prohibited conduct may have their accounts suspended or terminated and may be subject to legal action.

18. ASSIGNMENT

As noted in Section 3, in the event that all or part of our assets or shares are sold or acquired by another party, or in the event of a merger, you grant us the right to assign the personal and non-personal information collected via the Services.

19. YOUR U.S. STATE PRIVACY RIGHTS

Residents of certain U.S. states, including but not limited to California, Colorado, Connecticut, Utah, and Virginia, may have additional rights under their respective state privacy laws. These

may include:

• The right to access personal information we hold about you;
• The right to delete certain personal information we have collected from you;
• The right to correct inaccuracies in your personal information;
• The right to opt-out of the sale or sharing of your personal information;
• The right to limit the use and disclosure of sensitive personal information;
• The right not to receive discriminatory treatment for exercising your privacy rights.

To exercise any of these rights, you may contact us at support@crowdchange.co. We will verify your request and respond within the timeframes provided by applicable state laws. You may

also authorize an agent to make a request on your behalf.

For California residents specifically, California Civil Code Section 1798.83 permits you to request certain information regarding our disclosure of personal information to third parties for

their direct marketing purposes. To make such a request, please contact our Privacy Officer as provided below.

20. CONTACTING OUR PRIVACY OFFICER

Please contact our Privacy Officer if you have any questions, comments or complaints about this Privacy Policy, or the manner in which we or our service providers treat your personal

information. You may contact our Privacy Officer at support@crowdchange.co (please include ATTENTION PRIVACY OFFICER in the subject line).

21. CANADIAN USERS: YOUR PRIVACY RIGHTS UNDER PIPEDA

If you are a resident of Canada, your personal information is collected, used and disclosed in accordance with the Personal Information Protection and Electronic Documents Act

(PIPEDA) and other applicable provincial privacy legislation.

We are responsible for the personal information under our control and have designated a Privacy Officer accountable for compliance with PIPEDA. Canadian users have the right to:

• Request access to and correction of personal information held by CrowdChange.
• Withdraw consent to the use and disclosure of personal information, subject to legal and contractual restrictions.
• File a complaint with the Office of the Privacy Commissioner of Canada if they believe their rights under PIPEDA have been violated.

Personal information may be stored or processed outside of Canada, including in the United States, and may be subject to disclosure to government authorities under lawful orders in those

jurisdictions.

If you are a Canadian resident and have any questions or concerns about how your personal information is handled, you may contact our Privacy Officer at the contact information below.

Privacy Officer: support@crowdchange.co

Mailing Address: CrowdChange Inc., 158 Sandringham Drive, North York, Ontario, Canada M3H1E3

For more information about your privacy rights under Canadian law, please visit: https://www.priv.gc.ca/

22. QUÉBEC PRIVACY RIGHTS

This section applies to residents of Québec and reflects compliance with the requirements set out in Québec’s privacy law, including Law 25.

Privacy Officer

You may contact our Privacy Officer at:

Email: support@crowdchange.co (please include ATTENTION: QUEBEC PRIVACY OFFICER (in the subject line).

Your Rights Under Québec Law

If you are a resident of Québec, you have the right to:

• Access the personal information we hold about you.
• Request corrections to inaccurate or incomplete personal information.
• Request deletion of your personal information, subject to legal retention requirements.
• Withdraw your consent to the collection or use of your personal information, where processing is based on consent.

To exercise these rights, please contact us using the contact details above. We will respond in accordance with applicable legal timelines.

Cross-Border Transfers

Your personal information may be transferred or stored outside of Québec, including in other provinces in Canada and internationally, in jurisdictions where privacy protections may differ.

Before transferring data, we assess the legal framework of the destination to ensure your information receives adequate protection, as required under Law 25.

Retention of Personal Information

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. When your information is no longer needed, we

securely delete or anonymize it in accordance with our data retention practices.

Automated Decision-Making

If we use technology to make automated decisions about you, including through profiling, and those decisions may impact you significantly, we will inform you and provide information about the logic involved and the consequences of such processing. You may request human intervention or challenge the outcome of the decision where applicable.