Privacy Notice

Privacy Notice for Personal Account Customers

Effective Date: 22/11/2025
Last Updated: 22/11/2025

Welcome

This Privacy Notice ("Notice") explains the types of personal data we collect, how we use and share it, and your rights and choices regarding your personal information.

Our Services: First Class Payments Inc., operating as 1Klas ("1Klas," "we," "us," or "our"), offers money transfer services, multi-currency account services, foreign exchange services, and payment processing solutions (our "Services").

Scope: This Notice applies to all Services provided by 1Klas to our personal account customers globally. If anything in this Notice applies to only one of our Services or to customers in a particular country, we'll clearly highlight it. You can also find country-specific provisions in the appendices below.

Table of Contents

1. Data Controller

2. Personal Data We Collect About You

3. Ways We Use Your Information

4. How We Share Your Personal Data

5. International Data Transfers

6. Profiling and Automated Decision Making

7. Cookies

8. Data Retention

9. How We Protect Your Personal Information

10. Your Rights

11. Changes to Our Privacy Notice

12. Contact

Country-Specific Provisions

1. Canada - Provincial Privacy Laws

2. Quebec Residents - Additional Rights

3. Anti-Fraud Agency Specific Provisions1. Data Controller

4. Appendix 4: United Kingdom - Services Restriction and Eligible Categories

In this Notice, "we," "our," or "us" refers to First Class Payments Inc., operating as 1Klas, the entity responsible for the handling of your personal data (known as the "data controller").

Corporate Information:

• Legal Name: First Class Payments Inc.

• Operating Name: 1Klas

• FINTRAC Registration: M23574478

• Ontario Corporation Number: 1000681482

• Principal Address: 80 Birmingham St, C6, Toronto, Ontario, M8V 3W6, Canada

• Website: www.1klas.com

• Privacy Email: privacy@1klas.com

2. Personal Data We Collect About You

Personal data, or personal information, means any information about an identified or identifiable individual. It can include data that you provide to us (such as your name, address, or contact details) and data that we collect about you during your interaction with our Services (such as device information, IP address, etc.). It does not include anonymous data, which cannot be linked back to an individual.

We collect and process personal data about you in the following ways:

2.1 Information You Give Us

Information we hold about you will often be information you provided to us directly. For example, when you sign up for a 1Klas Service or take part in online discussions or promotions, you provide certain data that's necessary for your experience. This includes:

Contact Details: your name, email address, postal address, and phone number;

Personal Details: date of birth, passport number or other form of identification information including national identification number, tax residency, tax reference number (such as Social Insurance Number or SIN), proof of address, and proof of residency;

Financial Information: your bank account number, credit or debit card numbers, and financial history;

Your Image in Photo or Video Form: In some jurisdictions we may also collect facial scan data extracted from your photo or video (known as 'biometric data') for identity verification purposes;

The Content of Your Communications with Us: emails, telephone call recordings, and online chat messages;

Information About Your Personal Circumstances: information that could make you susceptible to harm or in need of extra care to meet our regulatory obligations to support vulnerable customers;

Source of Funds: information regarding the source of funds or source of wealth, which may include a copy of your bank account statements.

Important: If you fail to provide any information which we tell you is needed to meet legal requirements, it might affect our ability to provide our Services to you.

You can ensure that your contact details are current, complete, and accurate by logging into your account and updating them at any time in account settings.

Third-Party Information: If you provide personal data about anyone other than yourself, including a payment beneficiary, a friend you have recommended, or any other person who has a relevant relationship with 1Klas (a "connected person"), you confirm that you have their agreement or are otherwise entitled to provide this information to us. That includes bringing this Notice to their attention if legally necessary.

2.2 Information We Collect About You From Your Use of Our Services

This includes:

Transaction Data: details of the transactions you carry out when using our Services (for example, payments into and out of your account including beneficiary details and the geographic location from which the transaction originates);

Information About Your Devices: details of the internet protocol (IP) address used to connect your device to the internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, the type of device you use, whether your device uses a virtual private network (VPN), a unique device identifier (for example, your device's IMEI number, the MAC address of the device's wireless network interface, or the mobile phone number used by the device), mobile network information, your mobile operating system, and the type of mobile browser you use;

Information About How You Are Using Our Website or App: details of the products you viewed or searched for, page interaction information, and, if you've installed the app, installed applications on your mobile device that have remote access permissions;

Behavioural Biometrics: details of the way you login and interact with our website or app such as typing cadence, keystroke, touch, and mouse behavior to support the detection of fraudulent and suspicious attempts to access your 1Klas Account;

Information Stored on Your Device: including your contact list if you give us access to your phone book.

2.3 Information We Receive From Other Sources

This includes:

Information From Financial Institutions: we may receive personal information from other banks and financial institutions. For example, when you ask us to, we may collect information about bank accounts that you choose to connect to your 1Klas account (for example, when you're setting a direct debit method such as EFT in Canada);

Information From Connected Persons: if you are a "connected person" for a 1Klas customer, then that 1Klas customer may provide your personal data to us. For instance, if you're a payment beneficiary, data could include name, account details, email, and additional verification information if necessary for fulfilling our legal obligations or requested by the recipient bank;

Advertising Networks, Analytics Providers, and Search Information Providers: may provide us with information about you, including confirmation of how you found our website;

Information From Fraud Prevention Agencies and Government or Private Databases: In some jurisdictions, we may check the information you have provided to us with government or private identity record databases, fraud prevention agencies, other private entities, or with credit reference agencies to confirm your identity and to combat fraud;

Information From Publicly Available Sources: We may collect information from publicly available sources, such as media stories, online registers or directories, and websites for enhanced due diligence checks and KYC purposes.

2.4 Information From Social Networks

If you log into our Services using your social network account (including Apple ID, Facebook, or Google) we will receive the information that is necessary for us to authenticate your access, such as your profile and email address, in accordance with the social network's privacy policy.

When visiting our social network pages, the social media networks (such as Facebook or Instagram) collect personal data about you that they compile into statistics. While we can view these aggregated statistics, we cannot access the underlying personal data or link it to specific individuals or followers.

We also collect information about you when you use our social network pages (such as Instagram or LinkedIn) to contact us by creating your own post, tagging us, commenting on our posts, or sending us private messages.

Occasionally, we'll use publicly available information about you from selected social media networks or media to carry out enhanced due diligence checks.

3. Ways We Use Your Information

3.1 Legal Basis

We will only use your personal data when the law allows us to. In most cases, our legal basis will be one of the following:

Contract Necessity: where processing personal data is necessary to carry out or enter into our agreement with you (for example, if the processing is needed to make and receive payments);

Legal Obligation: where we have a legal obligation to process your personal data to comply with laws and regulations (such as collecting identification documents to comply with anti-money laundering laws);

Legitimate Interests: where we have a legitimate reason to process your personal data that is reasonable when balanced against your rights and interests (for example, to understand how our Services are used and to improve them);

Consent: where you have given us your consent to process your data;

Substantial Public Interest: where we process sensitive or special category data (revealing or relating to someone's health, ethnicity, political views, religious beliefs, sexual orientation, or other protected characteristics) and that processing is in the substantial public interest (for example, to support vulnerable customers).

3.2 Purposes for Which We Will Use Your Personal Data

The ways we plan to use your personal data, along with the corresponding legal bases, are described below:

What We Use Your Data For	The Legal Basis for Doing So
To Determine if You Are Eligible to Use Our Services We carry out checks to verify your identity during onboarding in order to comply with Know Your Customer "KYC" obligations under anti-money laundering laws. In some countries, as part of our KYC processes we may extract face scan information (known as "biometric data") from a selfie or video that you provide to compare with the picture of you on identity documents.	Legal obligations Consent (for biometric data collection)
To Provide Our Products and Services to You We will process personal data as necessary to:• Provide you with the money transfer and 1Klas account Services you've requested; • Provide you with customer support services, and to monitor or record any communications between you and us, including phone calls, for training and quality purposes; • Provide features which make it easier for you to find, be found, and connect with other 1Klas customers (see section 4 for more details).	Contract necessity Legal obligation Legitimate interests (it is in our legitimate interests to monitor service quality and help 1Klas customers find each other and transfer money easily) Consent (to access your mobile phone contact list and for certain discoverability features - see section 4)
To Ensure Account Safety, Including Protecting You From Fraud We process personal data: • To prevent, detect, or protect against actual or suspected fraud, unauthorised transactions, claims, liability, and financial or other crimes. In some cases this may include collecting biometric data. For example, if you change the phone number linked to your account or to recover access to your account. To keep our anti-fraud measures effective, we can't always share all the details about how we prevent fraud; • As part of our efforts to keep our Services safe and secure.	Contract necessity Legal obligation Legitimate interests (it is in our legitimate interests to detect, prevent, and investigate fraud, money laundering and other crimes to protect our business and our customers)Consent for biometric data collection
Compliance with Legal and Regulatory Obligations, Protecting Our Business, and Enforcing Our Rights We may process your personal data: • To comply with legal and/or regulatory requirements, including to respond to requests from public and government authorities, possibly outside your country of residence, upon demonstration of lawful authority; • To prevent, detect, or protect against actual or suspected fraud, unauthorised transactions, claims, liability, and financial or other crimes, including conducting or co-operating with investigations of fraud or other illegal activity where we believe it is reasonable and appropriate to do so; • To take steps to recover amounts owed to us, including via insurance claims, and to allow us to recover or limit damages that we may sustain; • To allow a third party or a financial institution that incorrectly sent money to recover money received by you in error or due to fraud; • To verify information you provide to us, and to enforce our Customer Agreement with you; • To investigate, manage, and resolve complaints; • To prevent and manage incidents of abusive or aggressive behaviour towards our employees.	Legal obligations Legitimate interests (it is in our legitimate interests to protect our business, customers and employees from harm)
Marketing and Analytics • To personalise the marketing messages you receive about products and services we offer so they are more relevant and interesting; • To measure or understand the effectiveness of our advertising and to deliver relevant advertising to you; • To provide you with information about other similar products and services we offer which we feel may interest you.	Legitimate interests (it is in our legitimate interests to let our customers know about our products and services which may interest them, to personalise marketing communications and to understand the effectiveness of our advertising) Consent where we are required to collect your consent by law
Maintaining and Improving Our Services We may process your personal data: • To administer our Services and for internal operational, planning, audit, troubleshooting, data analysis, testing, research, statistical, and survey purposes; • To undertake system or product development, including helping third party suppliers improve the services they provide to us; • To improve our Services and to ensure that they are presented in the most effective manner; • We may use Artificial Intelligence ("AI"), including machine learning models and generative AI large language models (LLMs) to improve the efficiency and effectiveness of our Services and our financial crime and fraud prevention processes. We will always let our customers know if they are interacting with an AI system.	Legitimate interests (it is in our legitimate interests to maintain, develop and improve our Services)
Understanding if You Need Extra Support We process your personal data to help you if your personal circumstances indicate that you may need extra assistance (for example if you have suffered a bereavement or are experiencing financial difficulties);In some countries, it's a legal requirement for us to proactively identify and assist vulnerable customers.	Substantial public interest (if we process your sensitive personal data to adhere to legal requirements that apply to us) Consent where we are required to collect your consent by law

4. How We Share Your Personal Data

We may share your personal data with the following third parties:

4.1 Other 1Klas Companies

Other 1Klas affiliated entities may assist in providing our Services to you, improving our operations, and supporting business functions such as customer support, technology, marketing, fraud prevention, and compliance.

4.2 Service Providers Acting on Our Behalf and Other Partners

We may share your data with trusted third-party service providers and partners, such as:

Banks and Other Financial Institutions: we work with to provide you our Services (such as supporting the execution of payments, or provision of the 1Klas account). These third parties act as independent, separate data controllers who determine why and how they will process your data;

Advertisers and Advertising Networks: to select and serve relevant advertisements to you and others. This includes social media networks (with whom we share data like your mobile number and email address in a secure format) so they can match this to personal data they already hold about you. They can then display messages to you and others about our products and services, or make sure you do not get irrelevant ads (for example, if you're already using the 1Klas product that we want to advertise);

Analytics and Search Engine Providers: that assist us in the improvement and optimisation of our site;

Cloud Storage Providers and Other Technology Service Providers: that provide hosting, IT services, maintenance, and technical support to ensure our platforms and Services function smoothly.

These service providers and partners are required to process your data securely and only for the purposes specified in our agreement with them.

4.3 Beneficiaries

Payment beneficiaries receive limited information when you initiate a payment transaction.

4.4 Regulators, Law Enforcement Agencies, and Public Authorities

Including judicial and administrative courts, if we are under a duty to disclose or share your personal data in response to a subpoena, warrant, court order, properly constituted police request or as otherwise required by law, or in order to enforce or apply our Customer Agreement and other applicable agreements, or to protect the rights, property, or safety of 1Klas, our customers, our employees, or others.

4.5 Fraud Prevention Agencies and Providers of Fraud Prevention Services

To prevent, detect, or protect against actual or suspected fraud, unauthorised transactions, claims, liability, and financial or other crimes, including conducting or co-operating with investigations of fraud or other illegal activity where we believe it is reasonable and appropriate to do so, or where required by law.

4.6 Third Parties or a Financial Institution

To recover debt or in relation to your insolvency or to allow them to recover money received by you in error or due to fraud.

4.7 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the relevant parties involved in the transaction, subject to confidentiality agreements and applicable data protection law.

4.8 Other 1Klas Customers

Discoverability Features: Our discoverability features allow other 1Klas customers to find you using the email or phone number linked to your 1Klas account without the need for bank details. Default settings might vary depending on the country where you live. You can change them anytime in the app.

Contact List Syncing: If you sync your phone's contact list, we will add any of your contacts who are also 1Klas customers and have discoverability enabled to your recipient list, making it easy to send them money. When other 1Klas customers who have you as a contact sync their contacts, you will be added to their recipient list if you have discoverability enabled.

4.9 With Your Consent

In some cases, we may share your information with other third parties when you provide explicit consent to do so.

If you would like further information about who we have shared your data with, or to be provided with a list specific to you, you can request this by writing to privacy@1klas.com.

5. International Data Transfers

5.1 Global Operations

As a provider of money transfer services and multi-currency accounts, it is sometimes necessary to transfer your personal data to countries other than your country of residence or to use services supported by our staff (including those of outsourced partners) in other jurisdictions.

5.2 Data Protection Compliance

When transferring personal data to other countries we take measures to comply with data protection laws applicable to those transfers. In particular, where a transfer is to a country with data protection regulations that do not offer an equivalent level of data protection to your country, we will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Notice.

5.3 Transfer Mechanisms

When a data transfer mechanism is mandated by applicable law we:

(i) Transfer to countries or recipients that are recognised as having an adequate level of protection for personal data under applicable law;

(ii) Enter into standard contractual clauses approved by relevant data protection authorities with the data importer;

(iii) Employ other lawful methods available to us under applicable law.

More information about the third parties to whom we may transfer personal data, their locations, and the contractual arrangements in place to comply with applicable data protection laws can be provided to you if you send a request to privacy@1klas.com.

6. Profiling and Automated Decision Making

6.1 Personalisation

We may use some elements of your data, such as your country of residence and transaction history, to customise our Services and the information we provide to you, and to address your needs. For example, if you frequently send funds from one particular currency to another, we may use this data to inform you of new product updates or features that may be useful for you. If you do not want us to process your personal data to personalise electronic marketing communications, you can opt out of receiving electronic marketing communications at any time (see section 10 below).

6.2 Automated Decisions

We use automated processes to check that your application to access 1Klas Services and your use of 1Klas Services meet our required standard, including verifying your identity, and to help prevent fraud or other illegal activities. These processes may make an automated decision to reject your application or a proposed transaction, to block a suspicious attempt to log into your 1Klas account, or to close your account. If this happens, you will be notified and offered the opportunity to request further information about how the decision was reached and request a manual review. In any case, if you feel that an automated process may have impacted you, please contact 1Klas Customer Support.

6.3 Fraud Risk Determination

If we, a fraud prevention agency, or other third parties providing fraud prevention services determine that a fraud or money laundering risk is posed, we may refuse to provide the Services requested or we may stop providing existing products and services to you. A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, or these other third parties, and may result in others refusing to provide services, financing, or employment to you.

7. Cookies

7.1 Cookies and Similar Technologies

Our website and app use small files known as cookies, along with similar technologies like pixel tags and web beacons. These help us distinguish you from other users, see how you use our site and products while providing you with the best experience. They also enable us to improve our Services and make sure that the ads you see online are more relevant to you and your interests. For more information about the cookies and technologies we use, as well as their purposes, see our Cookie Policy.

7.2 Email Tracking

We also use pixels or web beacons in some of our emails to help us understand whether our email was delivered and opened, and whether links within the email were clicked. We use this information to measure the performance of our email campaigns, and to help us improve our future email communications.

8. Data Retention

8.1 Retention Periods

We will retain your personal data only for as long as is necessary to fulfil the purposes for which we collected it. As a regulated financial institution, 1Klas is required by law to store some of your personal and transactional data beyond the closure of your account with us. Typically we are required to retain that personal data for between five and ten years following account closure, depending on applicable laws.

8.2 Automatic Deletion

We will always delete data that is no longer required by a relevant law or jurisdiction in which we operate. We do this automatically, so you don't need to contact us to ask us to delete your data. Deletion methods include shredding, destruction and secure disposal of hardware and hard-copy records, and deletion or over-writing of digital data.

9. How We Protect Your Personal Information

9.1 Security Measures

We take the safeguarding of your information very seriously. The transmission of information via the internet is not completely secure. Although we do our best to protect your personal data, we cannot guarantee the security of your data during transmission. Any transmission is at your own risk. Once we have received your information, we use strict procedures and security features to ensure it stays secure, including:

• Communications over the internet between you and 1Klas systems are encrypted using strong asymmetric encryption. This makes it unreadable to anyone who might be listening in;

• We update and patch our servers in a timely manner;

• We run a responsible disclosure and bug bounty program to identify any security issues in 1Klas Services;

• Our technical security team proactively monitors for abnormal and malicious activity in our servers and services;

• When information you've given us is not in active use, it is encrypted at rest.

9.2 Security Certifications

We are regularly audited to confirm we remain compliant with our security certifications, including SOC 2 and PCI-DSS. As part of these audits, our security is validated by external auditors.

9.3 Access Controls

We restrict access to your personal information to those employees of 1Klas who have a business reason for knowing such information and third party service providers processing data on our behalf. All 1Klas employees who have access to your personal data are required to adhere to this Notice and all third-party service providers are requested by 1Klas to ensure appropriate safeguards are in place. In addition, contracts are in place with third-party service providers that have access to your personal data, to ensure that the level of security and protective measures required in your jurisdiction is in place, and that your personal data is processed only as instructed by 1Klas.

9.4 Employee Training

We continuously educate and train our employees about the importance of confidentiality and privacy of customers' personal information. We maintain physical, technical, and organisational safeguards that comply with applicable laws and regulations to protect your personal information from unauthorised access.

10. Your Rights

You may have certain rights in relation to the processing of your personal data. Whether or not your local law requires it, 1Klas will always respond to requests for information about personal data processing, requests for a copy of the personal data we hold about a customer, requests to delete personal data, and requests to opt out from receiving direct marketing communications. Other rights may be available depending on your country.

If you have any questions about our use of your personal data, contact us at privacy@1klas.com.

Your Right	How to Exercise Your Right
Request a copy of your personal data	If you ask us, we will provide you with a copy of the personal data we hold about you. To comply with laws globally and within your region, we will need to exclude certain data such as personal data of third parties and information relating to prevention or detection of crime.
Request correction of your personal data	We will correct inaccurate or out of date information about you where you ask us to. We may need to verify the accuracy of the new data you provide to us. Certain details can be updated under your settings on the app or website, but we are always happy to assist you via Customer Support channels as well.
Request deletion of your personal data	You can ask us to delete personal data when:(i) there is no good reason for us to continue to process it;(ii) you have successfully exercised your right to object to processing (see below);(iii) we may have processed your personal data unlawfully;(iv) we are required to delete your personal data to comply with laws, or(v) we have been processing with your consent and you withdraw your consent. We may not always be able to comply with your deletion request. As a regulated financial institution we are required to hold customers' personal data for a period after the account closure. If we cannot delete your personal data we will always explain why.
Withdraw your consent	Where our lawful basis for processing is based on your consent, you can withdraw your consent at any time. This will not affect the lawfulness of processing which may have taken place before consent was withdrawn. If you withdraw your consent, we may not be able to provide certain products or services to you.
Request to stop direct marketing to you	If you ask us to, we will stop sending direct marketing to you. Our marketing activities may involve profiling you for the purpose of direct marketing. If you object, you can opt out of direct marketing, by contacting us or adjusting your notification preferences in the settings section of your account.
Request human review of an automated decision	Where we use wholly automated decision making-processes, you may request that we provide information about the decision-making methodology and ask us to verify that an automated decision that results in a significant impact on you has been made correctly. We will inform you where we make solely automated decisions that may significantly impact you. You can request human review of automated decisions by contacting Customer Support.
Object to processing based on legitimate interests	If our legal basis for any processing is based on legitimate interests and you disagree with it, you can request an assessment. If there is an overriding reason why we need to process the data (other than in the case of direct marketing) we may not accept your request but we will always explain why we need to process your data.
Ask us to suspend processing	You can ask us to suspend the processing of your personal data in the following situations:(i) if you want us to determine the data's accuracy;(ii) where our processing of the data is unlawful but you do not want us to delete it at this time;(iii) where you want us to retain the data even if we no longer need it because you need it to establish, exercise or defend legal claims; or(iv) you have objected to us using your data but we need to confirm whether or not we have overriding legitimate grounds to continue using it.
Request transfer of your data to another company	If you ask us to, we will provide your chosen third party with the personal data you provided to us in a structured, commonly used, machine-readable format.

11. Changes to Our Privacy Notice

To keep up with changing legislation, best practice, and changes in how we process personal information, we may revise this Notice at any time. In the case of significant or material changes to this Notice, we will let you know.

12. Contact

12.1 Privacy Inquiries

Please send any questions, comments, or requests about this Notice to our privacy team at privacy@1klas.com, where you can also contact our Data Protection Officer. You can also write to us or our Data Protection Officer at our registered office:

First Class Payments Inc.
80 Birmingham St, C6, Toronto, Ontario, M8V 3W6, Canada
Email: privacy@1klas.com

12.2 Complaints

If you feel that we have not addressed your questions or concerns adequately, or you believe that your data protection or privacy rights have been infringed, you can complain to the Privacy Commissioner of Canada or any provincial privacy commissioner with jurisdiction over your matter:

Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
Toll-free: 1-800-282-1376
Website: www.priv.gc.ca

Country-Specific Provisions

If there is a conflict or inconsistency between the main Privacy Notice and the appendices below, the relevant appendix prevails.

Appendix 1: Canada - Provincial Privacy Laws

Federal and Provincial Privacy Legislation

1Klas complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, including:

• Personal Information Protection Act (PIPA) in Alberta and British Columbia • An Act Respecting the Protection of Personal Information in the Private Sector (Quebec Privacy Act) in Quebec • The Personal Health Information Protection Act (PHIPA) in Ontario for health-related information

Your Rights Under PIPEDA

Under PIPEDA and provincial privacy laws, you have the right to:

• Know why your personal information is being collected, used, or disclosed; • Expect your personal information to be protected by appropriate safeguards; • Challenge the accuracy and completeness of your personal information and have it amended as appropriate; • File a complaint with the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

Consent

In most cases, we will ask for your consent to collect, use, or disclose your personal information. Consent can be express or implied and can be provided directly by you or by an authorized representative. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.

Access to Information

You can request access to your personal information by contacting privacy@1klas.com. We will respond to your request within 30 days or provide an explanation if we need more time.

Appendix 2: Quebec Residents - Additional Rights

If you are a Quebec resident, you have additional rights under Quebec's Act Respecting the Protection of Personal Information in the Private Sector:

Additional Quebec Rights

Right to De-indexing: You have the right to request the de-indexing of certain personal information that appears in search engine results following a search conducted using your name or other identifying information.

Right to Portability: You have the right to request that your personal information be transmitted to another service provider in a structured, commonly used, technological format.

Automated Decision-Making: You have the right not to be subject to a decision based exclusively on automated processing of personal information if the decision has a significant impact on you, including producing legal effects.

Special Protections for Sensitive Information: Quebec law provides enhanced protections for sensitive information, including biometric data, which can only be collected, used, or disclosed with your explicit consent unless otherwise required by law.

Exercising Your Quebec Rights

To exercise any of these rights, please contact us at privacy@1klas.com. We will respond within the timeframes required by Quebec law.

Quebec Privacy Complaints

If you have concerns about our privacy practices, you may file a complaint with:

Commission d'accès à l'information du Québec
525, boul. René-Lévesque Est, bureau 1.200
Québec (Québec) G1R 5Y4
Telephone: 418-528-7741 or 1-888-528-7741
Website: www.cai.gouv.qc.ca

Appendix 3: Anti-Fraud Agency Specific Provisions

Fraud Prevention Checks

Before we provide Services to you, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process personal data about you.

The personal data you have provided, we have collected from you, or we have received from third parties will be used to prevent fraud and money laundering, and to verify your identity.

Details of Personal Information Processed: The personal information that will be processed includes, for example: name, address, date of birth, contact details, financial information, employment details, device identifiers including IP address, and transaction details.

Legal Basis

We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate, and prevent crime.

We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the Services you have requested.

Data Retention by Fraud Prevention Agencies

Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.

Automated Decision-Making

As part of the processing of your personal data, decisions may be made by automated means. This means we may automatically decide that you pose a fraud or money laundering risk if our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct, or is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity. You have rights in relation to automated decision making. If you want to know more, please contact us at privacy@1klas.com.

Consequences of Fraud Determination

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the Services you have requested, or we may stop providing existing Services to you.

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing, or employment to you. If you have any questions about this, please contact us at privacy@1klas.com.

International Transfers for Fraud Prevention

Fraud prevention agencies may allow the transfer of your personal data outside of Canada. This may be to a country where the government has decided that your data will be protected to Canadian standards, but if the transfer is to another type of country, then the fraud prevention agencies will ensure your data continues to be protected by ensuring appropriate safeguards are in place.

Your Rights

Your personal data is protected by legal rights, which include your rights to object to our processing of your personal data, request that your personal data be erased or corrected, and request access to your personal data.

For more information or to exercise your data protection rights, please contact us at privacy@1klas.com.

You also have a right to complain to the Privacy Commissioner of Canada, which regulates the processing of personal data.

Appendix 4: United Kingdom - Services Restriction and Eligible Categories

Services Not Available to UK Retail Clients

The services of First Class Payments Inc., operating as 1Klas, are not available to retail clients in the United Kingdom. All communications, marketing materials, and services are directed exclusively to persons who qualify as exempt categories under the Financial Services and Markets Act 2000 ("FSMA 2000") and the Financial Services and Markets Act 2000 (Financial Promotion) Order 2005 ("FPO").

Eligible Categories

Our communications and services may lawfully be directed only to the following categories of persons:

1. Investment Professionals (Article 19(5) FPO)

Persons who qualify as investment professionals, including:

• Persons authorised under FSMA 2000 to conduct investment activities

• Exempt persons under FSMA 2000

• Certain bodies corporate whose ordinary business activities involve carrying on investment activity and who can reasonably be expected to understand the risks associated with the services

2. High Net Worth Companies, Unincorporated Associations, and Partnerships (Article 49(2)(a)–(d) FPO)

Entities that meet the following financial thresholds:

• Bodies corporate with:

  • Called-up share capital or net assets of at least £500,000 (if the entity has more than 20 members or is a subsidiary of an undertaking with more than 20 members); or

  • Called-up share capital or net assets of at least £5 million (if the entity has 20 or fewer members)

• Partnerships or unincorporated associations with net assets of at least £5 million

• Trustees of high value trusts where the aggregate value of the cash and investments forming part of the trust's assets is £10 million or more, or has been £10 million or more at any time during the year immediately preceding the date on which the communication is made

3. Certified High Net Worth Individuals (Article 48 FPO)

Individuals who have signed a certificate, within the period of twelve months ending with the day on which the communication is made, confirming that:

• During the financial year immediately preceding the date of the certificate, the individual had an annual income of not less than £100,000; or

• Throughout the financial year immediately preceding the date of the certificate, the individual held net assets to the value of not less than £250,000 (excluding primary residence, rights under qualifying contracts of insurance, and benefits payable on termination of service or on death or retirement)

The individual must also confirm that they are aware of and accept the risks associated with the investment or service, including the risk of losing all invested capital.

4. Certified Sophisticated Investors (Article 50 FPO)

Individuals who have been certified by an authorised person under FSMA 2000 as sufficiently knowledgeable to understand the risks associated with the investment or service. The certificate must:

• Be signed within the twelve months immediately preceding the date on which the communication is made

• State that the authorised person has taken reasonable steps to ensure that the individual has sufficient knowledge and experience to understand the risks

• Confirm that the individual qualifies as a sophisticated investor

5. Self-Certified Sophisticated Investors (Article 50A FPO)

Individuals who self-certify that they meet at least one of the following criteria:

• Member of a network or syndicate of business angels (for at least six months prior to certification)

• Made more than one investment in an unlisted company in the two years prior to certification

• Working or have worked in the previous two years in a professional capacity in the private equity sector, or in the provision of finance for small and medium enterprises

• Currently or have been in the previous two years a director of a company with an annual turnover of at least £1 million

The individual must also confirm that they have not been made bankrupt or entered into an individual voluntary arrangement, and that they are aware of and accept the risks, including the risk of losing all invested capital.

6. Other Lawfully Permitted Persons

Any other persons to whom the communication may lawfully be made in accordance with the FPO or other applicable UK financial services regulations.

Confirmation and Acknowledgment

By accessing, engaging with, or using the services of First Class Payments Inc. (1Klas) in the United Kingdom, you explicitly confirm, represent, and warrant that:

1. You fall within one or more of the exempt categories listed above;

2. You understand that our services are not available to retail clients in the UK;

3. You have sufficient knowledge, experience, and professional advice to understand and evaluate the risks associated with the services;

4. You accept full responsibility for ensuring your eligibility to receive communications and services from 1Klas under UK law;

5. You will immediately notify us if your circumstances change such that you no longer qualify under any exempt category.

Important Notice

First Class Payments Inc. (1Klas) does not provide services to retail clients in the United Kingdom. If you do not qualify under one of the exempt categories specified above, you must not proceed to use our services or rely on any communications from us.

Regulatory Disclaimer

1Klas is not authorised by the Financial Conduct Authority (FCA) to provide services to retail clients in the United Kingdom. The protections provided by the UK regulatory framework, including access to the Financial Ombudsman Service and the Financial Services Compensation Scheme (FSCS), do not apply to services provided to persons who qualify under the exempt categories.

Contact for UK Eligibility Questions

If you have questions regarding your eligibility to use our services in the United Kingdom, or if you require clarification about the exempt categories, please contact:

First Class Payments Inc.
Email: compliance@1klas.com
Subject: UK Eligibility Inquiry

We reserve the right to request evidence or certification of your eligibility status at any time and may suspend or terminate services if we determine that you do not qualify under an exempt category.

In the event of an inconsistency between this Privacy Notice and the English version, the English version will prevail.