Privacy policy

Passage Inc. including all of its affiliates and subsidiaries (collectively “Passage”, “we” or “our”), is committed to maintaining the accuracy, security and privacy of Personal Information in accordance with applicable legislation. This Privacy Policy is a statement of principles and guidelines concerning the protection of Personal Information of our clients, service providers and other individuals ("you”).

This Privacy Policy applies to any Personal Information that we collect, use, and disclose (collectively “process”) about you or otherwise received from you, including through the websites and mobile applications that are owned and/or operated by Passage, through partners and through telephone, written, and in-person interactions.

1. Consent
2. What Personal Information Do We Process?
3. How Do We Collect Your Personal Information?
4. Why Do We Process Your Personal Information?
5. To Whom Do We Disclose Your Personal Information?
6. How Do We Transfer Information Collected Internationally?
7. Your Rights
8. How Do We Protect Your Personal Information?
9. How Long Will We Retain Your Personal Information?
10. Our Websites
11. E-mail Communications
12. When You Integrate Social Networking Services
13. Changes to the Privacy Policy
14. Contact Us
15. Controller
16. Automated Decision-Making and AI
17. Additional Information for California Residents.

1. Consent

By submitting Personal Information to Passage or its service providers and agents, you agree that we may collect, use and disclose such Personal Information in accordance with this privacy policy and as permitted or required by law. If you do not agree to this Privacy Policy, please do not access the website or mobile applications or otherwise use the products or services.

Subject to legal and contractual requirements, you may refuse or withdraw your consent to certain of the purposes identified in this Privacy Policy at any time by contacting Passage’s Privacy Officer. If you refuse or withdraw your consent, we may not be able to provide you or continue to provide you with certain products or services or information which may be of value to you.

If you provide Passage or our service providers and agents with Personal Information of another individual, you represent that you have all necessary authority and/or have obtained all necessary consents from such person to enable us to collect, use and disclose such Personal Information for the purposes set forth in this Privacy Policy.

Our products, services and websites are not targeted or directed at children under the age of 16. We do not knowingly collect Personal Information from children under the age of 16. If you believe we might have any information from or about a child under 16, please contact us using the contact details as provided in the “Contact Us” section below. Certain products, Services or features may have higher age requirements or require authorization from a parent or legal guardian. Any additional requirements will be presented when the relevant product, Service or feature is requested.

We may also collect additional consents and provide supplemental information about our data collection or privacy practices in disclosure about specific products, services or circumstances, or in some cases, at the time we collect Personal Information from you.

2. What Personal Information Do We Process?

Personal information means any information which relates to a natural person and allows that person to be identified directly, or indirectly in combination with other information (hereinafter, “Personal Information”). It does not include information from which all references to the identity of the relevant individual have been removed (i.e., anonymous Personal Information).

Without limitation, any of the following categories of information (which may constitute Personal Information) may be collected by us:

• Identity information: includes name, date of birth, gender, marital status, job title, profession, social insurance number, tax identification number, government-issued ID

documents and numbers (including driver’s license and passport), demographic information, username and password;

• Contact information: includes email, address (mailing and primary residence), postal code, telephone numbers and emergency contact, reference letter provider and guarantor details;

• Product information: includes information about products/services you have utilized in the past including the date of your usage, Rewards activity and status, fees paid and information about products/services that you prefer or that interest you;

• Financial information: includes credit/debit card or account information, financial information, bank statements, income, housing status, information about credit worthiness and other information necessary for a lender to make a credit decision based on your request (including information from credit bureaus, business partners, affiliates and other companies);

• Preference information: includes information regarding your personal interests, such as related products and services you use, skills, biographical information, both academic and employment aspirations, reviews of users, products or services, groups that you have joined and information from your social networking sites;

• Technical information: includes internet protocol (IP) address and geolocation information, web browser type and version, operating system and/or device, cookies and other technology on the devices you use to access this web site;

• Internet activity information: includes session information, such as page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page;

• Education information: includes application information, institution, programs, grades, resume, cover letter, statement of purpose, references, status, standardized test scores (including GMAT, TOEFL, IELTS, PTE, SAT and ACT) and other information and documents you choose to add to your profile or otherwise provided;

• Visa information: includes application information, legal status and other information and documents you choose to add to your application or otherwise provided; and

• Employment information: includes employment status, title, credentials, application information and history, skills, certifications, resume, information about the person that referred you for a position, the legal status that allows you to work in a designated country, remuneration, disciplinary matters and other information and documents you choose to add to your profile or otherwise provided.

3. How Do We Collect Your Personal Information?

We may use different methods to collect Personal Information from and about you including through:

• Direct interactions. You may give us Personal Information by corresponding with us or by using our products or services, including without limitation our web site’s and mobile application’s features, products and services. This includes Personal Information you may provide if you (or your personal representative):

  • sign-up for a user account on our web site or mobile application and update such user account;

  • contact us through telephone, mail, email, social networking services, messaging applications (e.g. WhatsApp, Telegram and Messenger) or a chat-box on our web site or mobile application;

  • input or upload any Personal Information through one of our web sites or mobile application, including in connection with you applying for, utilizing and purchasing any products or services;

  • utilize third party payment providers or otherwise make a payment;

  • choose to share or sync your contacts with Passage;

  • choose to grant us permission to access your device’s precise geolocation;

  • subscribe to our newsletter or marketing materials, respond to a survey, fill out a form, participate in a sweepstakes, or otherwise input or upload information or files through our website or mobile application, by telephone, or in person; and

  • posts, comments or direct messages on or through our website or mobile application.

• Automated technologies or interactions. As you interact with our web site or mobile application, we will automatically collect technical information and internet activity information about your equipment and browsing actions and patterns. We collect this information by using cookies, pixels, server logs and other similar technologies. We may also receive technical information about you if you visit other web sites or mobile applications employing our cookies.

• Third Party Services. If you use third party services like Facebook, Google or Apple to log in to Passage or if you connect a third party account to your Passage account at any time, then we will collect Personal Information from that third party service. The specific information shared with us will depend on the third party’s privacy practices, agreements we have with the third party and any choices that you may make in sharing your personal information. We may also receive information from data providers and public sources.

• Indirectly: Authorize us (including our service providers on our behalf) to collect personal information about you from our partners (which may include loyalty partners, referral partners, recruiters, academic institutions, financial institutions, testing and assessment providers, contractors, landlords, employers, registries, governmental agencies (including the Canada Revenue Agency, Canada Border Services Agency and Immigration, Refugees and Citizenship Canada), and debt collectors) and credit bureaus.

4. Why Do We Process Your Personal Information?

In general, Passage processes Personal Information in order to provide you with products and services, and for the purpose of evaluating applications and deciding whether to establish (and subsequently to manage or terminate) an employment, contractual relationship or partnership. More specifically, we process your Personal Information for the following purposes:

Passage’s processing of your Personal Information may be supported by the following lawful bases:

• Performance of a Contract: Passage needs to process your Personal Information to perform our contract with you or in order to take steps at your request prior to you entering into a contract.

• Legitimate Interest: Passage may process your Personal Information to further its legitimate interests, including operating, securing, personalizing and improving the Services; identifying relevant products and opportunities; preventing fraud; providing support; developing products; and managing our business. We rely on these interests only where they are not overridden by your interests or fundamental rights and freedoms.

• Consent: In some cases: Passage also relies on your Consent to process your Personal Information.

• Compliance with our Legal Obligations: Passage may process your Personal Information to comply with our legal obligations.

5. To Whom Do We Disclose Your Personal Information?

From time to time, Passage may disclose your Personal Information to:

• Passage’s subsidiaries and affiliates, as required to provide our products and services;

• service and payment providers, including an organization or individual retained by Passage to perform functions on its behalf or in connection with our products and services;

• an organization or individual retained by Passage to evaluate your creditworthiness or to collect debts outstanding on an account;

• a financial institution, investor, donor or lender, on a confidential basis and in connection with the assignment of a right to receive payment, the provision of security or other financing arrangements;

• a business partner (including loyalty partners, referral partners, recruiters, academic institutions, scholarships and financial-aid providers, testing and assessment providers, contractors, landlords, employers, registries, governmental agencies (including the Canada Revenue Agency and Immigration, Refugees and Citizenship Canada), and debt collectors), on a confidential basis and in connection with products, services and opportunities. Where a business partner receives Personal Information for its own purposes, it may process that information under its own privacy policy;

• a person who, in the reasonable judgment of Passage, is providing or seeking the information as your agent;

• to our insurers and to regulatory agencies such as insurers or others in connection with regulatory or other activities relating to the obligations of Passage;

• to personnel in Passage, government authorities, insurers, benefits providers, consultants or agents as reasonably required to establish, manage or terminate employment, contractual relationships and partnerships and to facilitate the products and services;

• to professional advisors, such as lawyers, auditors, bankers and insurers in the course of the professional services they render to Passage;

• to respond to court orders and legal investigations, or as required by applicable law;

• to an acquiring entity in connection with the consummation or proposal of a business transaction (including liquidation, realization, seizure or repossession), concession, merger, business combination or any other type of acquisition, liquidation, transfer, translative contract or financing of Passage, in whole or in part, or of any property, stock, asset, share or business of Passage; and

• any third party or parties (including Passage’s business partners), where you consent to such disclosure or where disclosure is required or permitted by law.

Based on your settings, content you post on Passage, such as posts, replies, recommendations, messages and certain of your profile information may be visible to other members, businesses,

governments, academic institutions, employers, agencies or the public. Additional information about profile visibility and sharing will be provided when you activate or change the applicable settings.

By providing us with Personal Information, you acknowledge and agree that such Personal Information may be transferred to other jurisdictions for processing and storage, including in servers located across Canada and in the United States, where laws regarding the protection of Personal Information may be less stringent than the laws in your jurisdiction. Further, such Personal Information may be accessible to law enforcement, national security authorities, and the courts of such jurisdictions. Where necessary to make such transfers, we will comply with our legal and regulatory obligations in relation to the Personal Information.

6. How Do We Transfer Information Collected Internationally?

When we transfer your Personal Information outside of Australia, the United Kingdom ("UK"), Switzerland, or the European Union ("EU"), we ensure it remains protected by implementing appropriate safeguards. These may include:

• Transferring to countries officially recognized as providing an adequate level of data protection; or

• Using Standard Contractual Clauses or other approved legal mechanisms that offer similar levels of protection to those required in Australia, the UK, Switzerland, or the EU.

You may contact our Data Protection Officer (DPO) for additional information about the safeguards applicable to transfers of your Personal Information, including how to obtain a copy where available.

7. Your Rights

Subject to certain exemptions, to the extent permitted by applicable law, you have the following rights in relation to the Personal Information we hold about you:

• Your right of access. If your request is made in writing, subject to applicable laws and the provisions of this Privacy Policy, we will provide you with access to your Personal Information that is in our possession. You will have to provide information or documentation to verify your identity. Your rights to access your Personal Information are not absolute. Access can be denied for several different reasons under applicable legislation. If we deny your request for access to your Personal Information, we shall explain why.

• Your right to rectification. If we hold Personal Information about you and you believe that it is not accurate, complete and up-to-date, you can request to have it rectified (or

rectify it yourself via your account information page, if available). If we discover that information is not accurate, complete and up-to-date, we will take reasonable steps to rectify it. We will also send any information that has been amended, where appropriate, to any third parties that have access to the information.

• Your right to withdraw consent. If we rely on your implicit or explicit consent as our legal basis for processing your Personal Information, you may have the right to withdraw that consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdrew your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. You may not be able to withdraw your consent during the term of certain products and services.

• Your right to erasure. You may have the right to ask us to delete or remove Personal Information where we are no longer required to hold it. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

• Your right to object to processing. You may have the right to object to processing of your Personal Information when it is based on our legitimate interest or those of a third party. You also may have the right to object where we are processing your Personal Information for direct marketing purposes.

• Your right to request restrictions on processing. You may have the right to ask us to suspend the processing of your Personal Information in certain circumstances such as establishing the accuracy of your Personal Information or where you require us to hold the Personal Information to establish, exercise or defend legal claims etc.

• Your right to request transfer. You may have the right to request transfer of your Personal Information to you or (if technically feasible) any third party in a commonly used machine-readable format. Note that these rights only apply to Personal Information which you initially provided us. Certain Personal Information will need to be retained for administrative, legal, security or other legitimate business purposes.

What we may need from you We will handle your requests and rights in accordance with applicable law. This means there may be legal reasons why we cannot fulfil all requests. We may also need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Information (or to exercise any of your other rights). This is a security measure to ensure that Personal Information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up

our response. If you would like to exercise any of these rights, please see contact us as set forth in “Contact Us” below.

No fee required You will not have to pay a fee to access your Personal Information (or to exercise any of the other rights hereunder). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

Time limit to respond We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Lodging Complaints You have the right to lodge complaints about our data processing activities by filing a complaint with our Privacy Officer using the contact information in the “Contact Us” section below. You may also have the right to complain to the privacy or data-protection authority in your jurisdiction.

8. How Do We Protect Your Personal Information?

To help protect the confidentiality of your Personal Information, Passage employs physical, administrative and technological safeguards appropriate to the sensitivity of your Personal Information. Where Personal Information is sent to a third party for processing, we take reasonable steps, through our contacts with them, that all Personal Information is kept secure. We operate secure data networks protected by industry standard firewall and password protection systems. However, no internet or email transmission is ever fully secure or error free.

9. How Long Will We Retain Your Personal Information?

We only keep Personal Information for as long as reasonably necessary and for the reasons it was collected, or for as long as required to comply with any applicable legal obligation and our document retention policies. The length of time Personal Information is kept varies according to the nature of the information, and it may extend beyond the end of the relationship between an individual and us.

When the Personal Information collected is no longer required by us, the necessary procedures for destroying, deleting, erasing, or converting it into an anonymous form are applied.

10. Our Websites

Cookies. When an individual visitor accesses the Passage website or mobile application, we may use a browser feature called a ‘cookie’ to collect information such as the type of Internet browser and operating system the visitor uses, the domain name of the Website from which the visitor came, date and duration of the visit, number of visits, average time spent on our website, pages viewed and number of cookies accumulated. A cookie is a small text file containing a unique identification number that identifies the visitor’s browser, but not necessarily the visitor; to our computers each time our website is visited. Unless a visitor specifically informs us (e.g. by registering for an event or sending us correspondence from the website), we will not know who the individual visitors are. In addition to the identified purposes described in our Privacy Policy, we may use this website information and share it with other organizations with whom we have a commercial relationship to measure the use of our website, to improve the functionality and content of the website and to facilitate usage by a visitor. Visitors can reset their browsers either to notify them when they have received a cookie or refuse to accept cookies. However, if a visitor refuses to accept cookies, he or she may not be able to use some of the features available on our website. Our systems are not currently configured to accept browsers’ “Do Not Track” signals, as no industry-wide standard for handling them has been adopted. You can manage your cookie preferences via our website’s cookie banner or privacy settings. In addition, our systems honor browser-enabled Global Privacy Control (GPC) signals as a mechanism for opting out of cookie-based data sharing for cross-context behavioral advertising, as required by CPRA.

Links. Our website may contain links to other websites which are provided as a convenience only. Visitors are advised that other third party websites may have different privacy policies and practices than Passage, and Passage has no responsibility for such third party websites.

Analytics. We and/or our third-party partners may employ various tracking technologies, such as analytics software, that help us better manage content by informing us what content is effective (e.g. Google Analytics, Amplitude and Segment).

Browser Extensions. You may be provided with the option to install browser extensions and if used, Personal Information will be collected and used in connection with extension as set out in the notice and consent presented when the extension is installed.

11. E-mail Communications

Occasionally, we may send marketing or promotional communications to you (including by email, SMS or other electronic channels) with information that may be useful, including information (both personalized and not personalized) about the products, services, offers and opportunities from Passage and other third parties with whom we have a relationship. In this process, we may collect certain information such as the date/time you first opened our e-mail

communications, the number of times you open our e-mail communications, the number of click-throughs per article, total click-through activity on the contents of our e-mail communications and compile generally the related statistics. We may combine and store any such information to manage and improve our e-mail communications to you. We will include instructions on how to unsubscribe and inform us of preferences if you decide you do not want to receive any future marketing or promotional e-mails from Passage.

12. When You Integrate Social Networking Services

One of the features of our products and services is the ability to connect your Passage account to various social networking services like LinkedIn, Facebook, Twitter, Academia, GitHub and ResearchGate. By directly integrating social networking services, we aim to make your online experiences richer and more personalized. To take advantage of this feature, we will ask you to log into or grant us permission to connect via the relevant social networking services. When you add a social networking service account to our products and services or log in to our products and services using your social networking services account (or Google and Apple), we will collect relevant information necessary to enable our products and services to access that social networking service and your data contained in such social networking services or sites, subject to an in accordance with your authorizations and consents. As part of this integration, the social networking services or sites will provide us with access to certain information that you have provided to the social networking services or sites, and we will use, store, and disclose such information in accordance with this Privacy Policy. However, please remember that the manner in which social networking services or sites use, store, and disclose your information is governed by the policies of such third parties, and we have no liability or responsibility for the privacy practices or other actions of any social networking services or sites that may be enabled within our products and services. You may also have the option of posting your account activities to social networking services when you access content through our products and services (for example, you may post to Facebook that you performed an activity using our products or services). You acknowledge that if you choose to use this feature, your friends, followers, and subscribers on any social networking services you have enabled will be able to view such activity.

13. Changes to the Privacy Policy

Passage reserves the right to modify or supplement this Privacy Policy at any time. If we make a change to this Privacy Policy, we will post such changes on our website and, to the extent required by applicable law, we will notify you of the change, for example by email to the address provided in your profile. Changes take effect immediately upon posting or notice to your email, as applicable. Your continued use of our products and services after any changes or revisions to this Policy shall indicate your agreement with the terms of such revised Privacy Policy.

When used in this Privacy Policy, the term “include”, “includes” and “including” will be deemed to be followed by the phrase, “without limitation”. Headings and sections are for convenience only and do not affect the interpretation of the rest of this Privacy Policy.

14. Contact Us

Passage has appointed a Privacy Officer who is responsible for Passage’s privacy program and also serves as Passage’s Data Protection Officer (“DPO”) for purposes of applicable data-protection law. For questions or concerns about this Privacy Policy, or to exercise your privacy rights, please contact:

Passage Inc. Attn: Privacy Officer / Data Protection Officer 151 Charles Street West, Suite 100 Kitchener, Ontario Canada, N2G 1H6 Email: [email protected]

Residents of the European Union and the United Kingdom We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

• United Kingdom (UK)

• European Union (EU)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/passage. Please add ‘GDPR-REP ID: 16597913686’ to all correspondence, which may be addressed to:

European Union: Prighter EU Rep GmbH Attorneys at Law c/o Passage Inc. Schellinggasse 3/10, 1010 Vienna Austria as representative in the EU according to Art 27 GDPR

United Kingdom:

Prighter Ltd c/o Passage Inc. 20 Mortlake Mortlake High Street, London, SW14 8JN United Kingdom as representative in the UK according to Art 27 UK GDPR

15. Controller

Passage Inc. is the controller and responsible for your Personal Information and its registered address is 151 Charles Street West, Suite 100 Kitchener, Ontario, Canada, N2G 1H6.

16. Automated Decision-Making and AI

We may use automated decision-making technologies, including artificial intelligence and machine learning models, to process Personal Information for purposes such as personalizing Services, generating matching recommendations, assessing eligibility or risk, detecting fraud and supporting decisions relating to products or services.

Where decisions are made solely by automated means and have significant effects on you, you have the right to:

• Ask for an explanation of how the decision was made in plain language

• Request that someone from our team reviews the decision

• Share your perspective or provide additional information

• Disagree with the outcome and request reconsideration

To exercise these rights, please contact our Privacy Officer using the information in the “Contact Us” section.

We may also use de-identified data to improve our models and services, including for training purposes. This data is never used in a way that identifies you personally.

17. Additional Information for California Residents (CPRA Compliance)

During the preceding 12 months, Passage has collected the categories of Personal Information described in Section 2 from the sources described in Section 3 for the purposes described in Section 4.

During the preceding 12 months, Passage disclosed the following categories of Personal Information for business purposes:

• Identity, Contact, Product, Financial, Preference, Education, Visa and Employment Information to our affiliates, service providers, payment and identity-verification providers, educational institutions, employers, financial institutions, lenders, testing and assessment providers, professional advisers, government authorities and other business partners, as applicable to the products or Services requested by the individual.

• Technical and Internet Activity Information to our affiliates and providers of hosting, security, analytics, communications, advertising and other technology services.

Passage retains each category of Personal Information only for as long as reasonably necessary for the purposes for which it was collected or processed. In determining the applicable retention period, Passage considers the nature and sensitivity of the information, the duration of its relationship with the individual, the applicable product or Service, and its legal, regulatory, accounting, fraud-prevention, security and dispute-resolution obligations.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CPRA):

• Right to Know: What personal information we collect, use, disclose, and share.

• Right to Delete: Request deletion of your personal information.

• Right to Correct: Correct inaccurate personal information we maintain about you.

• Right to Opt-Out of Sale or Sharing: Opt out of the sale or sharing of your personal information for cross-context behavioral advertising.

• Right to Limit Use and Disclosure of Sensitive Personal Information: Restrict certain uses and disclosures of sensitive Personal Information, where applicable.

• Right to Non-Discrimination: Exercise your rights under the CPRA without receiving discriminatory treatment.

You may exercise these rights by:

• Visiting our "Do Not Sell or Share My Personal Information/Limit the Use of My Sensitive Personal Information" link

• Emailing: [email protected]

• Calling: +1 888 983 5232

We will respond within the timeframes required by law (typically 45 days). We may verify your request by matching the information you provide with information in our records or by requesting additional information. An authorized agent may submit a request on your behalf, but we may require proof of the agent’s authority and may ask you to verify your identity or confirm the authorization.

We do not sell personal information as defined under CPRA. However, we may "share" personal data with third parties (such as analytics providers and marketing platforms) for targeted advertising purposes. You may opt out of such sharing via our website's privacy controls.