Privacy Policy

Introduction

Ribbon Business Solutions Inc. ("Ribbon," "we," "us," or "our") respects your privacy and is committed to protecting the personal information entrusted to us. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information across all of our services — our website, the Ribbon platform, and our business formation, corporate filing, bookkeeping, tax, payroll, and registered office and virtual mail services (together, the "Services").

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

Accountability

Ribbon's Privacy Officer, Nicholas Wesley-James, is accountable for our compliance with this Privacy Policy and applicable privacy law. You can reach our Privacy Officer at [email protected], or by mail at 1300B-350 Bay St, Toronto, ON M5H 2S6.

Information We Collect

We collect the personal information needed to deliver the Services you use. Depending on the Services, this may include:

• Contact and account information — your name, email address, phone number, and account credentials;
• Business information — details about your business needed to form, register, and maintain it, including director, officer, and shareholder information and information about individuals with significant control (beneficial ownership);
• Identity verification information — for services that require it (such as the registered office and virtual mail service), government-issued identification, date of birth, and address, and the results of compliance screening such as sanctions and politically exposed person checks;
• Financial information — bookkeeping records, tax filings, payroll information, and related financial documents you provide for bookkeeping, tax, and payroll Services. Payment card details are collected and processed by our payment processor; Ribbon does not store card numbers;
• Mail — the contents of business mail we receive, scan, and store for registered office and virtual mail clients;
• Support and communications — messages you exchange with our team, including through our support chat; and
• Usage information — information about your use of our website and platform, such as IP address, browser type, and pages visited.

How We Use Your Information

We use personal information to:

• Provide the Services, including preparing and submitting government filings you authorize;
• Verify identity and perform compliance screening where required for a Service;
• Process payments and manage subscriptions;
• Respond to inquiries and provide support;
• Operate, secure, and improve our website and platform; and
• Send marketing communications, where you have consented to receive them.

Consent

We collect, use, and disclose personal information with your consent, or as permitted or required by law. Your consent may be express (for example, when you provide identification for verification) or implied by the context (for example, providing your email address so we can respond to an inquiry). You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice; withdrawing consent may limit our ability to provide certain Services.

Service Providers and Data Location

Our platform and its databases — the primary systems of record for your data — are hosted in Google Cloud Platform's Canadian regions. We use a small number of service providers to help deliver the Services. Some of them may process or store data outside Canada, primarily in the United States, where it may be accessible to authorities under local law. Our service providers include:

• Google Cloud Platform — platform hosting, databases, and file storage (Canada);
• Stripe — payment processing (United States);
• Intuit (QuickBooks Online) — bookkeeping and payroll records (may process data outside Canada, including the United States);
• DocuSeal — electronic document signing (may process data outside Canada, including the United States);
• Intercom — customer support chat (United States);
• Google Workspace — email and business operations (may process data outside Canada, including the United States);
• Google Analytics and Google Ads — website analytics and advertising measurement and personalization; Google processes this data as an independent controller under its own terms (United States and global);
• Google Maps Platform — address autocomplete in our platform. When you enter an address, the characters you type are sent to Google's Places API to return address suggestions; Google may process this information outside Canada;
• Anthropic — AI tools used in our internal workflows (United States); and
• Cloudflare — network security and content delivery (global network).

We limit the information shared with each provider to what is needed for its role, and we use contractual and other safeguards appropriate to the sensitivity of the information. For more information about our service providers and their privacy practices, contact our Privacy Officer.

Cookies, Analytics and Advertising

Our website and platform use cookies and similar technologies (such as pixels, tags, local storage, and advertising identifiers) to operate the site, remember your preferences, measure performance, and support our marketing.

We use the following third-party services:

• Google Analytics — to understand how visitors find and use our website. We have enabled Google Analytics Advertising Features, including Google signals. This means that, for visitors signed in to a Google account who have consented to it, Google may associate the visit with their account and use information Google already holds to give us cross-device measurement and demographics and interest reporting. Google Analytics collects information such as your device and browser type, approximate location, pages visited, and how you interact with our site;
• Google Ads — to measure advertising performance (conversion tracking) and, where enabled, to show you our ads on Google and partner sites and apps after you have visited our website (remarketing) and to build audiences for personalized advertising. To do this, Google uses its own cookies and advertising identifiers; and
• Intercom — to provide support chat.

When we use Google's advertising features, Google processes some of this data as an independent controller under its own terms, and may store or process it outside Canada. See “Service Providers and Data Location” for more.

Your choices. You can:

• control or block cookies through your browser settings;
• opt out of Google Analytics using Google's opt-out browser add-on;
• manage or turn off ad personalization in your Google Ads Settings; and
• opt out of interest-based advertising at youradchoices.ca (Canada) or optout.aboutads.info.

Blocking cookies may affect how parts of our website and platform work.

Referrals and Partners

Where we make partner offers available (for example, from financial institutions), we do not share your personal information with the partner unless you choose to take up the offer and direct or consent to the sharing. Any information you provide directly to a partner is governed by the partner's own privacy policy.

Mail Handling

For registered office and virtual mail clients, we receive, scan, store, forward, and securely destroy business mail as described in our Virtual Address Policy and on the instructions of authorized users. Scanned mail is treated as confidential, is used only to provide the service, and may contain personal information about third parties, which we handle with the same care.

Disclosure Required by Law

We may disclose personal information where required or permitted by law — for example, in response to a court order, a lawful request by a government or regulatory authority, a legally mandated inspection or disclosure of corporate records, where necessary to protect Ribbon's legal rights, or where we have reasonable grounds to believe information relates to unlawful activity and make a proactive disclosure in good faith to law enforcement, regulatory, or government authorities.

How We Protect Your Information

We protect personal information with physical, technical, and administrative safeguards appropriate to its sensitivity, including encryption in transit and at rest, multi-factor authentication and role-based access controls for our personnel, and regular access reviews. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to protect your information against unauthorized access, use, and disclosure.

How Long We Keep Information

We keep personal information only as long as needed for the purposes described in this policy and to meet legal, regulatory, and professional requirements. In general:

• Client corporate records are retained while you have an account, and for a period afterwards as needed for legal, audit, and dispute-resolution purposes;
• Financial, tax, and payroll records relating to work Ribbon performed are generally retained for seven years, reflecting the record-keeping periods that apply to tax records;
• Physical mail is stored for 60 days as described in the Virtual Address Policy, and digital copies are retained as part of the client's records;
• Platform access logs are generally kept for one year for security purposes; and
• Data collected through Google Analytics is retained for up to 2 months (event data) and 14 months (user data), per our Google Analytics configuration.

When information is no longer required, we securely delete or destroy it. Retention for these purposes does not mean records remain accessible to you: your access to records on the platform is governed by the Terms of Service, and you should export your records before your subscription ends.

Breach Notification

We maintain an incident response process for security incidents. If a breach of our security safeguards creates a real risk of significant harm to individuals, we will report it to the Office of the Privacy Commissioner of Canada and any applicable provincial privacy commissioner, and notify affected individuals, as soon as feasible. We keep records of breaches of security safeguards as required by law.

Your Rights

You have the right to access the personal information we hold about you, to request corrections if it is inaccurate or incomplete, and to withdraw your consent subject to legal and contractual restrictions. You may also request the deletion of your personal information; we will honour deletion requests except where we are required or permitted by law to retain the information, such as records retention requirements under corporate and tax law.

To exercise any of these rights, contact our Privacy Officer. We respond to written access requests within the timelines required by law. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time by posting the updated version on our website with a revised “last updated” date. Material changes will be highlighted on our website or communicated to affected clients.

Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our handling of your personal information, contact our Privacy Officer, Nicholas Wesley-James, at [email protected] or by mail at Ribbon Business Solutions Inc., 1300B-350 Bay St, Toronto, ON M5H 2S6.