Last Updated: January 28, 2021

OVERVIEW

Chroma exists to help build connections between people and make the built world more accessible, transparent and enjoyable. In short—to build a world where property owners, managers and renters come together to create better living experiences. We are a community built on trust and transparency. A fundamental part of earning that trust means being clear about how we use your information and protect your human right to privacy.

PERSONAL INFORMATION WE COLLECT

This Privacy Policy describes how Chroma Property Technologies Inc. and its affiliates ("we," "us," or "Chroma"), process personal information that we collect through the Chroma platform/website (www.chroma.ca). Collection and Use of Personal Information

In order to deliver our services we may collect the following personal information from our renter users:

• Contact Information, Account and Profile Information such as name, email address, address, postal code phone number, date of birth, and profile photo

• Banking and Financial Information such as bank account and/or credit card information, and other payment information

• Identification Information such as government issued photo ID, Social Insurance Number, etc.

• Demographic Information such as age, education, gender, interests, etc.

In order to deliver our services we may collect the following personal information from our property owner and manager users:

• Contact Information, Account and Profile Information such as name, email address, address, postal code phone number, date of birth, and profile photo.

• Company Information such as company name, company size, business type, business address, business age, head office address, etc.

• Banking and Financial Information such as bank account and/or credit card information, and other payment information

• Identification Information such as government issued photo ID, Social Insurance Number, etc. - Demographic Information such as age, education, gender, interests, etc.

As is true of most websites, we automatically gather certain information about your computer such as the precise or approximate location determined from your IP address or mobile device’s GPS depending on your device settings. We may also gather usage information such as the pages or content you view and other actions on the Chroma Platform. We may also collect log data and device information such as details about how you’ve used the Chroma Platform (including if you clicked on links to third party applications), IP address, access dates and times, hardware and software information, device information, device event information, unique identifiers, crash data, cookie data, and the pages you’ve viewed or engaged with before or after using the Chroma Platform. We may collect this information even if you haven’t created a Chroma account or logged in. We may also collect payment information such as payment instrument used, date and time, payment amount, payment instrument expiration date and billing postcode, and other related transaction details.

HOW CHROMA USES THE INFORMATION WE COLLECT

We use this information to deliver our services to you. More specifically we use this information to:

• enable you to access the Chroma Platform and make and receive payments

• enable you to communicate with other users

• perform analytics, debug and conduct research

• provide customer service

• send you messages, updates, security alerts, and account notifications

• personalize and customize your experience based on your interactions with the Chroma Platform, your profile information and preferences, and other content you submit

Create and Maintain a Trusted and Safer Environment.

We use personal information to:

• detect and prevent fraud, spam, abuse, security and safety incidents, and other harmful activity

• study and combat discrimination

• conduct security investigations and risk assessments

• verify or authenticate information provided by you

• comply with our legal obligations, protect the health and well-being of our users, employees and members of the public

• resolve disputes with our users

• enforce our agreements with third parties

• comply with law, respond to legal requests, prevent harm and protect our rights, and

• enforce our Terms of Service and other policies

Provide, Personalize, Measure, and Improve our Advertising and Marketing.

We may use personal information to:

• send you promotional messages, marketing, advertising, and other information based on your preferences and social media advertising through social media platforms

• personalize, measure, and improve our advertising

• administer referral programs, surveys, contests, or other promotional activities or events sponsored or managed by Chroma or its third-party partners

• analyze characteristics and preferences to send you promotional messages, marketing, advertising and other information that we think might be of interest to you, and

• invite you to events and relevant opportunities

Provide payment services.

Personal information is used to enable or authorize third parties to use payment services:

• Detect and prevent money laundering, fraud, abuse, security incidents.

• Conduct security investigations and risk assessments

• Comply with legal obligations (such as anti-money laundering regulations)

• Enforce the payment terms and other payment policies

• With your consent, send you promotional messages, marketing, advertising, and other information that may be of interest to you based on your preferences

• Provide and improve the payment services

Sharing With Your Consent or at Your Direction

Where you provide consent, we share your information as described at the time of consent, such as when authorizing a third-party application or website to access your Chroma account or information.

Profiles and other Public Information

You may make certain information publicly visible to others users on the Chroma Platform, such as:

• Your public profile page, which may include a profile photo, your first name, and location

• Reviews, ratings and other public feedback

• Content in a community or discussion forum, blog or social media post

We may display parts of your public profile and other content you make available to the public on third-party sites, platforms and apps. Information you share publicly on the Chroma Platform may be indexed through third-party search engines.

Third-Party Services and Providers

For residents, the owner or property manager may use third-party service providers to help manage their property such as cleaning services or lock providers. Owners and managers may use features on the Chroma Platform to share information about the residents (like name, phone number, etc.) with such third-party service providers.

Complying with Law, Responding to Legal Requests, Preventing Harm and Protecting our Rights

We may disclose your information to courts, law enforcement, governmental or public authorities, tax authorities, or authorized third parties, if and to the extent we are required or permitted to do so by law or where disclosure is reasonably necessary: (i) to comply with our legal obligations, (ii) to comply with a valid legal request or to respond to claims asserted against Chroma, (iii) to respond to a valid legal request relating to a criminal investigation to address alleged or suspected illegal activity, or to respond to or address any other activity that may expose us, you, or any other of our users to legal or regulatory liability, (iv) to enforce and administer our agreements with our users, or (v) to protect the rights, property or personal safety of Chroma, its employees, its users, or members of the public.

Where appropriate, we may notify users about legal requests unless: (i) providing notice is prohibited by the legal process itself, by court order we receive, or by applicable law, or (ii) we believe that providing notice would be futile, ineffective, create a risk of injury or bodily harm to an individual or group, or create or increase a risk of fraud upon or harm to Chroma, our users, or expose Chroma to a claim of obstruction of justice.

Programs with Managers and Owners

We may share users’ personal information, such as contact information, and information related to payments and preferences with property owners and/or management companies in order to facilitate programs with property management. For example, users personal information, including contact information, may be shared with the property management of the building, complex, or community where a user lives and/or the property is located, to facilitate services, compliance with applicable laws, security, payments, and other services.

Service Providers

We may share personal information with affiliated and unaffiliated service providers to help us run our business, including service providers that help us: (i) verify your identity or authenticate your identification documents, (ii) check information against public databases, (iii) conduct background or police checks, fraud prevention, and risk assessment, (iv) perform product development, maintenance and debugging, (v) allow the provision of the Chroma services through third-party platforms and software tools (e.g. through the integration with our APIs), (vi) provide customer service, advertising, or payments services, (vii) process, handle or assess insurance claims or similar claims, or (viii) facilitate non-profit and charitable activities consistent with our mission. These providers are contractually bound to protect your personal information and only have access to your personal information to perform these tasks.

Business Transfers

If Chroma undertakes or is involved in any merger, acquisition, reorganization, sale of assets, bankruptcy, or insolvency event, then we may sell, transfer or share some or all of our assets, including your information in connection with such transaction or in contemplation of such transaction (e.g., due diligence). In this event, we will notify you before your personal information is transferred and/or becomes subject to a different privacy policy.

OTHER IMPORTANT INFORMATION

Analyzing Your Communications

We may review, scan, or analyze your communications on the Chroma platform for reasons outlined in the "HOW CHROMA USES THE INFORMATION WE COLLECT" section of this policy, including fraud prevention, risk assessment, regulatory compliance, investigation, product development, research, analytics, enforcing our Terms of Service, and customer support purposes. In some cases, we may also scan, review, or analyze messages to debug, improve, and/or expand our product offerings. Occasionally we may need to manually review communications, such as for fraud investigations and customer support, or to assess and improve the functionality of our tools. We will not review, scan, or analyze your messaging communications to send third-party marketing messages to you and we will not sell reviews or analyses of these communications.

Linking Third-Party Accounts

You may now or in the future link your Chroma account with certain third-party services like banks, middleware or social networks. When you direct the data sharing by creating this link:

• some of the information provided to us from linking accounts may be published on your public profile

• a link to your public profile on that third-party service may be included in your Chroma public profile

• information you provide to us from the linking of your accounts may be stored, processed and transmitted for fraud prevention and risk assessment purposes; and

• publication and display of information that you provide to the Chroma platform through this linkage is subject to your settings and authorizations on the Chroma platform and the third-party service

Third-Party Partners & Integrations

Parts of Chroma may link to other third-party services, not owned or controlled by Chroma, such as Google Maps. Use of these services is subject to the privacy policies of those providers. Chroma does not own or control these third parties and when you interact with them you are providing your information to them.

YOUR RIGHTS

You can exercise any of the rights described in this section consistent with applicable law. Please note that we may ask you to verify your identity and request before taking further action on your request.

Managing Your Information

You can access and update your personal information in the Chroma user portal. If you connected your Chroma account to a third-party service, like certain banks, middleware providers or social networks, you can change your settings and unlink from that service in your Chroma user portal. You are responsible for keeping your personal information up to date.

Data Access and Portability

In some jurisdictions, applicable law may entitle you to: (a) request certain copies of your personal information or, (b) information about how we handle your personal information, or (c) request copies of personal information that you have provided to us in a structured, commonly used, and machine-readable format, and/or request that we transmit this information to another service provider (where technically and commercially feasible).

Data Anonymization

In certain jurisdictions, you can request that your personal information be removed. Please note that if you request the anonymization of your personal information:

• We may retain your personal information as necessary for our legitimate business interests, such as prevention of money laundering, fraud detection and prevention, and enhancing safety. For example, if we suspend a Chroma account for fraud or safety reasons, we may retain information from that account to prevent that user from opening a new Chroma account in the future

• We may retain and use your personal information to the extent necessary to comply with our legal obligations. For example, Chroma may keep information for tax, legal reporting and auditing obligations up to 7 years after use

• Information you have shared with others (e.g., Reviews, forum postings) will continue to be publicly visible on Chroma if we offer that functionality, even after your account is cancelled. However, attribution of such information to you will be made anonymous. Some copies of your information (e.g., log records) will remain in our database, but are disassociated from personal identifiers

• Because we take measures to protect data from accidental or malicious loss and destruction, residual copies of your personal information may not be removed from our backup systems for a limited period of time

SECURITY

While no organization can guarantee perfect security, we are continuously implementing and updating administrative, technical, and physical security measures to help protect your information against unauthorized access, loss, destruction, or alteration.

CHANGES TO THIS PRIVACY POLICY

We reserve the right to modify this Privacy Policy at any time in accordance with applicable law. If we do so, we will post the revised Privacy Policy and update the "Last Updated" date at the top. In case of material changes, we will also provide you with notice of the modification by email. If you disagree with the revised Privacy Policy, you can cancel your account. If you do not cancel your account before the date the revised Privacy Policy becomes effective, your continued access to or use of the Chroma platform will be subject to the revised Privacy Policy.

CONTACT INFORMATION AND RESPONSIBLE CHROMA ENTITIES

For questions or complaints about this Privacy Policy or Chroma’s handling of personal information please contact privacy@chroma.ca.