Client Portal Privacy Policy

Countable Inc. (“Countable”, “we”, “us”, or “our”) is committed to protecting the privacy and security of your Personal Information. This Privacy Policy explains how we collect, use, disclose, and protect Personal Information when you access the Countable Client Portal (the “Portal”), whether through a web browser or the Countable mobile application.

This Privacy Policy applies to Client Admins and Client Users: individuals who access the Portal as clients of an accounting firm (your “Firm”) that uses Countable's platform. It does not govern the separate data processing relationship between Countable and Firms; that is addressed in Countable's Firm Data Processing Agreement.

By downloading the Countable mobile application, accessing the web-based Client Portal, or otherwise using the Portal, you agree to the practices described in this Privacy Policy. If you do not agree, you must not use the Portal.

Countable Inc. is responsible for the Personal Information you submit directly through the Portal. Our Privacy Officer handles all privacy-related inquiries.

We collect Personal Information that is necessary to provide you with access to the Portal and to facilitate your collaboration with your Firm. The table below summarizes what we collect, why, and the legal basis under applicable Canadian privacy law.

We do not collect sensitive Personal Information (such as health information, financial account numbers, or government ID numbers) directly unless it is contained within documents you choose to upload through the Portal. Responsibility for the content of uploaded documents lies with the submitter.

We use your Personal Information only for the purposes for which it was collected, or for compatible purposes permitted by law. Specifically, we use your information to:

• create and manage your Portal account and authenticate your identity;
• provide the Portal's collaboration, document exchange, and messaging features;
• notify you about your account, security events, or changes to our terms or policies;
• maintain and improve the security and reliability of the Portal;
• comply with applicable legal and regulatory obligations; and
• generate audit logs accessible to your Firm for professional compliance purposes.

We do not use your Personal Information for advertising, marketing to third parties, or to build profiles for sale. We do not sell your Personal Information.

All Personal Information you submit through the Portal is stored on servers located within Canada. Countable does not transfer your Personal Information to servers outside of Canada.

Some of our third-party service providers may have staff located outside Canada who access data for technical support purposes only. In such cases, we require contractual protections equivalent to Canadian privacy law standards before permitting any such access.

If you are accessing the Portal from the United States or another jurisdiction, please be aware that you are voluntarily submitting information to a service operated under Canadian law. Your continued use of the Portal constitutes your acknowledgement of this.

We retain your Personal Information for as long as your Portal account is active, and for a period thereafter as required by applicable legal, regulatory, or professional obligations. The table below summarizes key retention periods.

When retention periods expire, we securely delete or anonymize your Personal Information. Deletion requests are subject to applicable legal retention requirements; we will advise you if we are unable to immediately fulfill a deletion request for that reason.

Depending on your province of residence, you have various rights with respect to your Personal Information. We are committed to honouring these rights.

To exercise any of these rights, please contact our Privacy Officer at info@countable.co. We will respond within 30 days. If you are dissatisfied with our response, you may contact the applicable regulator:

• Federal (PIPEDA): Office of the Privacy Commissioner of Canada — www.priv.gc.ca
• Quebec (Quebec Privacy Act): Commission d'accès à l'information du Québec — www.cai.gouv.qc.ca
• Alberta (PIPA): Office of the Information and Privacy Commissioner of Alberta — www.oipc.ab.ca
• BC (PIPA): Office of the Information and Privacy Commissioner for BC — www.oipc.bc.ca

Countable implements commercially reasonable technical and organizational security measures designed to protect your Personal Information against unauthorized access, disclosure, alteration, or destruction. These include:

• encryption of data in transit (TLS) and at rest;
• access controls limiting who can access Personal Information to authorized personnel on a need-to-know basis;
• regular security assessments and monitoring;
• session management and automatic timeout for inactive sessions; and
• incident response procedures to detect and respond to security events.

In the event of a security breach that creates a real risk of significant harm to you, we will notify you and the applicable privacy regulator as required by law (within 72 hours for Quebec residents, as required by the Quebec Privacy Act).

You also have a role in keeping your account secure. Please use a strong, unique password, do not share your credentials, and contact info@countable.co immediately if you suspect unauthorized access to your account.

The web-based Client Portal uses session cookies and similar technologies to maintain your authenticated session and ensure the Portal functions correctly. The mobile application uses equivalent local session tokens.

We use the following technologies:

• Session cookies: required for authentication and Portal functionality. These are deleted when you close your browser or log out.
• Security tokens: used to verify your identity and protect against session hijacking.
• Analytics: we may collect aggregated, anonymized usage data to improve the Portal. This data does not identify you personally.

We do not use advertising cookies, third-party tracking pixels, or behavioural profiling technologies on the Client Portal.

The Portal is not directed to individuals under the age of 18 (or the age of majority in your province, whichever is greater). We do not knowingly collect Personal Information from minors. If you believe a minor has provided Personal Information through the Portal, please contact us at info@countable.co and we will take steps to delete that information.

If you are a resident of Quebec, the following additional provisions apply in addition to the general provisions of this Policy, in accordance with the Act Respecting the Protection of Personal Information in the Private Sector (Quebec Privacy Act, as amended by Law 25 / Bill 64, S.Q. 2021, c. 25):

The Portal is currently operated for Canadian accounting firms and their clients. While Countable does not actively market services to US residents, this section provides relevant information if you are accessing the Portal from the United States.

Countable may update this Privacy Policy from time to time to reflect changes in our practices, the law, or the Portal's features. We will notify you of material changes by:

• sending an in-app notification or email to the address associated with your account; or
• posting an updated Policy on our website at www.countable.co/privacy.

The updated Policy will indicate the revised effective date. Your continued use of the Portal after the effective date constitutes your acceptance of the updated Policy. If you do not agree to the updated Policy, you must stop using the Portal and request account deletion.

This Privacy Policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein. Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the courts of Ontario, except where applicable consumer protection or privacy laws in your province provide otherwise.

The following table summarizes the key Canadian and US privacy laws that inform this Policy.

By downloading the Countable mobile application or accessing the Countable Client Portal via web browser, you acknowledge that you have read, understood, and agreed to this Privacy Policy and the Client Portal Terms of Use. If you have questions or concerns about this Policy, please contact our Privacy Officer at info@countable.co before using the Portal.