Privacy Policy

Introduction

Good Home Capital Inc. ("Good Home Capital," "we," "us," "our") is a licensed Ontario mortgage brokerage (FSRA Mortgage Brokerage Licence #12596). We collect personal information in the course of arranging mortgage financing for our clients. This policy explains what information we collect, why we collect it, how we use and protect it, and the choices available to you.

We handle personal information in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy legislation, as well as the requirements of the Financial Services Regulatory Authority of Ontario (FSRA) and the Mortgage Brokerages, Lenders and Administrators Act, 2006 (MBLAA).

What information we collect

We collect personal information from you directly, with your knowledge and consent. The categories of information we may collect include:

• Contact information: name, mailing address, phone number, email address.
• Identification information: date of birth, government-issued ID details (where required to verify identity for anti-money-laundering compliance).
• Financial information: employment status, income, assets, debts, monthly obligations, banking details, credit profile.
• Property information: address, estimated value, existing mortgage details, intended transaction (purchase, refinance, renewal).
• Co-applicant information: the same categories above for any co-applicant on a joint application, with that person's consent.
• Communications: records of phone calls, emails, and messages between you and our brokers.

We also collect limited technical information from visitors to our website (such as IP address, browser type, and pages viewed) for security and analytics purposes.

Why we collect it (purpose)

We use personal information for the following purposes:

• To respond to your inquiry and arrange a consultation.
• To assess the suitability of mortgage products for your needs and circumstances, as required by MBLAA s.27.
• To submit applications to lenders on your behalf, with your consent.
• To meet record-keeping and disclosure obligations under FSRA Rule 2014-001 and MBLAA.
• To comply with anti-money-laundering, anti-terrorist-financing, and other legal requirements.
• To communicate with you about your file and, where you have consented, about products and services that may be relevant to you.

We do not collect or use personal information for purposes other than those listed without first obtaining your consent.

Consent

We obtain your consent before collecting, using, or disclosing personal information, except where the law permits or requires otherwise. Consent may be express (for example, your signature on a mortgage application) or implied (for example, when you provide information voluntarily in the course of an inquiry). You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawing consent may affect our ability to continue providing services.

How we share information

We share personal information only with parties involved in arranging or completing your mortgage, and only with your consent. These parties may include:

• Lenders: banks, credit unions, monoline lenders, alternative (B) lenders, and private lenders to whom we submit applications on your behalf.
• Service providers: appraisers, real estate lawyers, title insurers, and other professionals required to complete a mortgage transaction.
• Credit reporting agencies: when you provide consent for a credit check, we may obtain a credit report from Equifax or TransUnion.
• Regulators and government bodies: when required by law (for example, FSRA examinations, FINTRAC reporting, court orders).

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

How we store and protect information

We use reasonable physical, technical, and administrative safeguards appropriate to the sensitivity of the information. These include encrypted storage of digital files, restricted access on a need-to-know basis, secure email transmission for sensitive documents, and confidential disposal of paper records. No security system is perfect, however, and we cannot guarantee absolute security.

Retention

We retain personal information for as long as is necessary to fulfill the purposes for which it was collected and to meet our legal and regulatory obligations. Mortgage broker records in Ontario are subject to retention requirements under MBLAA and FSRA Rule 2014-001 (typically a minimum of seven years from the end of the brokerage relationship). After the retention period expires, we securely destroy or de-identify the information.

If a breach occurs

Under PIPEDA's Breach of Security Safeguards Regulations (in force November 1, 2018), an organization must report and notify breaches of security safeguards involving personal information that pose a real risk of significant harm to an affected individual.

If we identify a breach involving your personal information, we will:

• Assess whether the breach poses a real risk of significant harm, considering the sensitivity of the information involved and the probability that the information has been or will be misused.
• Notify you as soon as feasible, in plain language, with enough information about the breach to allow you to understand its significance and take any steps you can to reduce the risk of harm.
• Report the breach to the Office of the Privacy Commissioner of Canada (OPC) where the real-risk-of-significant-harm threshold is met.
• Notify other organizations or government institutions that may be able to mitigate the risk of harm, where appropriate.
• Maintain a record of every breach of security safeguards involving personal information under our control for at least 24 months, as required by the regulations, regardless of whether the breach met the notification threshold.

Concerns about the security of your personal information, or to inquire about a possible breach, may be directed to the Privacy Officer using the contact details below.

Your rights (access and correction)

Subject to legal exceptions, you have the right to:

• Be informed of the existence, use, and disclosure of your personal information.
• Access your personal information and request a copy.
• Challenge the accuracy and completeness of your information and have it corrected as appropriate.
• Withdraw consent for the collection, use, or disclosure of your information (subject to legal and contractual restrictions).
• File a complaint with us, and if not satisfied with our response, with the Office of the Privacy Commissioner of Canada.

Office of the Privacy Commissioner of Canada

If you are not satisfied with our response to a privacy concern, you may contact the Office of the Privacy Commissioner of Canada:

• Website: www.priv.gc.ca
• Phone: 1-800-282-1376

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent version. Material changes will be highlighted through our website or other appropriate channels.