1. What personal information do we collect?

Personal information means any information about an identifiable individual. We do not consider anonymous data (data not associated with or linked to an individual) as personal information.

The personal information we collect depends on how you interact with us and our Services, the choices you make, and the products and features you use. We do not collect sensitive personal information, such as information regarding your racial or ethnic origin, sexual orientation, or religious beliefs.

With limited exceptions outlined below, we will obtain your consent before collecting, using, or disclosing your personal information. This consent may be written, verbal, or implied (including when you voluntarily submit an application or request).

By submitting a loan or investor application (including financial or corporate information), you consent to Atrium MIC using the information to assess and process your application, verify details, and fulfill legal and regulatory obligations.

We may collect the following categories of information:

• Contact details: full name, email address, mailing address, and phone number.

• Financial, investment, or loan application data.

• Demographic and preference information (e.g., investor type, communications preferences).

We may rely on implied consent when:

• An existing relationship is in place.

• Consent was previously given for a similar use.

• The purpose of use is reasonably apparent at the time of collection.

Exceptions where consent is not required:

• When using third-party suppliers or service providers.

• When required by a court or regulator.

• To protect our legal interests, such as enforcing security or collecting debts.

• To update credit information with bureaus (during and after loan term).

• In the event of a corporate transaction (e.g., sale or syndication of loans).

Apart from that, we collect personal information that you provide voluntarily when expressing interest in our Services (for example: filling in contact forms, newsletter subscriptions), participating in activities related to our Services, or contacting us.

When you visit the Atrium website, we do not collect personally identifiable information unless it is provided voluntarily. However, our website may automatically collect information such as:

• IP address data.

• Device Characteristics (device type, OS, browser type, IP, location, etc.).

• Date and time of access.

• Log and usage data.

• Referring website.

This information helps us analyze usage patterns and improve website performance. It does not personally identify you.

2. What is the purpose of collecting your personal information, and how is it processed?

We collect and use your information for the following purposes:

• To provide, maintain, and improve our Services and website, including responding to your requests, delivering requested information or products, and personalizing your experience.

• To verify your identity, maintain secure access, and establish professional relationships.

• To fulfill the purposes for which your information was collected or as otherwise authorized by you.

• To comply with legal and regulatory obligations.

We will only use personal information for the purposes for which it was collected, unless otherwise permitted or required by law.

3. What consent and legal bases do we rely on to process your information?

We process your personal information only when we have valid legal basis to do so. These bases include:

• Your Consent: We obtain your consent before collecting, using, or disclosing your personal information, except where otherwise permitted or required by law.

• Contractual Necessity: When processing is required to fulfill a contract with you.

• Legal Obligations: When processing is necessary to comply with applicable laws and regulations.

• Legitimate Interests: When processing is necessary to protect our rights or interests, or those of others, provided such interests are not overridden by your privacy rights.

In some exceptional cases, we may process your personal information without consent for:

• Fraud prevention

• Business transactions

• Legal investigations and compliance

• Publicly available information

• Journalistic/artistic/literary purposes

4. How do we limit the collection of your personal information?

Atrium MIC limits the collection of personal information to only what is necessary for the purposes identified in this Privacy Policy. We collect personal information by fair and lawful means, ensuring that the scope of information gathered is appropriate and relevant to the Services we provide.

By limiting our collection practices, Atrium MIC ensures that your privacy is respected and that information is gathered only as needed to fulfill the purposes described in this Privacy Policy.

5. How do we limit the use, disclosure, and retention of your personal information?

Atrium MIC uses your personal information only for the purposes for which it was collected, unless you provide additional consent or as required by law. We do not use or disclose your personal information for unrelated purposes without your explicit consent.

We do not collect any information from third parties. However, we may share your personal information with affiliated entities, credit bureaus, and service providers who assist us in delivering our Services. These third-party services may include communication and collaboration tools, sales and marketing platforms, data analytics providers, and website hosting companies. All third parties are required to handle your personal information in accordance with applicable privacy laws and only for the purposes specified by Atrium MIC.

If you wish to withdraw consent for certain uses of your personal information, you may do so at any time by notifying us in writing or by clicking “unsubscribe” at the bottom of our email marketing communications.

We retain personal information only as long as necessary for the purposes outlined or as required by law. When your information is no longer needed, it will be securely deleted, anonymized, or stored until deletion is possible.

6. How do we keep your personal information accurate?

All personal information must be as accurate, complete, and up-to-date as necessary to fulfill the purposes for which it is being used. We rely on you to provide true, complete, and current information when interacting with our Services, and we ask that you notify us promptly of any changes to your personal information.

If you believe that any of your personal information is inaccurate or incomplete, you may submit an amendment request via email or mail (see point 10).

We will respond to your request in accordance with applicable privacy laws and take reasonable steps to ensure your information is accurate, complete and up-to-date.

7. How do we keep your information safe?

We implement organizational, physical, and technical measures to protect personal information against unauthorized access, disclosure, alteration, or destruction. No system can guarantee absolute security.

8. How do we make information about our privacy practices and policy updates available to you?

We make detailed information about our privacy practices publicly and readily available through this Privacy Policy, which is accessible on our website and upon request.

We review and update our Privacy Policy as needed to reflect changes in our practices or legal requirements. When updates are made, we revise the “Last Updated” date and may provide notice of significant changes.

9. How can you access your personal information?

Upon request, Atrium MIC will inform you of the existence, use, and disclosure of your personal information. You have the right to access the personal information we hold about you and to know how it has been used and shared. You can request this information via email or by mail (see point 10).

Depending on your location, you may have rights to:

• Access, correct, or delete your personal information.

• Restrict or object to processing.

• Data portability.

• Withdraw consent.

10. How can you contact us about this Privacy Policy?

If you have any questions, comments, feedback, or suggestions on how Atrium MIC manages your personal information or complies with privacy principles, please reach out to us:

• Via email at info@atriummic.com.

• By mail at 1010 – 18 King Street East, Toronto, Ontario, M5C 1C4.

We will review your feedback and respond in accordance with applicable privacy laws.

11. Do we use cookies and other tracking technologies?

Yes, we do use cookies and similar technologies to help maintain security, prevent crashes, save preferences, and provide analytics.

You may opt-out using the following tools:

• https://tools.google.com/dlpage/gaoptout

• http://optout.networkadvertising.org/

• http://www.networkadvertising.org/mobile-choice

12. How could your personal information and data be transferred outside of Canada?

Atrium MIC does not operate outside of Canada; however, we may engage third-party service providers who may store, process, or transfer your personal information on servers located outside of Canada, such as in the United States. As a result, your information may be subject to the laws of those jurisdictions and could be accessed by government authorities, courts, or law enforcement in those countries.

We use reasonable efforts to ensure that our third-party providers maintain protections for your personal information that are equivalent to those required in Canada, subject to applicable laws in those jurisdictions.

13. How do third-party websites and analytics affect your personal information?

Our website may contain links to third-party websites. Once you leave the Atrium MIC website, this Privacy Policy no longer applies. We are not responsible for the privacy practices or content of any third-party sites.

We may also use third-party analytics services, such as Google Analytics, to help us understand how visitors use our website. You can opt out of Google Analytics by visiting https://tools.google.com/dlpage/gaoptout. We use features such as “Anonymize IP” to help protect your privacy.

14. Do we collect information from minors?

We do not knowingly collect data from or market to children under 18 or who are minors by law.

15. What are our controls for Do-Not-Track features?

We do not currently respond to Do-Not-Track signals due to lack of a uniform standard.