Privacy Policy

Scope

This Privacy Policy describes how Surety Minds ("Surety Minds", "we", "us" or "our") collects, uses, discloses and retains personal information in connection with (a) the website at suretyminds.com and its subdomains other than the platform (the "Website"), and (b) our business dealings with prospective and current customers. It does not govern information that our customers upload to the Surety Minds platform (the "Platform"), which is addressed in section 9 and governed by the written agreement between Surety Minds and each customer (the "Customer Agreement"). If this Policy and a Customer Agreement conflict, the Customer Agreement prevails.

The Website and the Platform are intended for professionals in the surety, insurance and construction industries acting in a business capacity. They are not directed at consumers or at individuals under the age of 18, and we do not knowingly collect information from them.

Privacy Officer

Our Privacy Officer is responsible for the protection of personal information at Surety Minds and can be reached through our contact form. All requests and inquiries under this Policy must be submitted in writing through that form, marked as a privacy request.

Information we collect

We collect only the information reasonably necessary for the purposes set out in section 4, including:

• Information you provide, such as your name, business email address, firm, role, file volume and the content of messages you send us through the Website's forms, by email or during a demonstration;
• Business contact information exchanged in the course of a commercial relationship, including information about your colleagues that you choose to give us;
• Account information of Platform users, such as name, business email, role, sign-in records and settings;
• Technical information processed automatically when you visit the Website, such as IP address, browser type, device information and the pages requested, which our hosting providers may record in standard server logs.

The Website does not currently use cookies, advertising technologies or third-party analytics tools. If we introduce any such technology, we will update this Policy and, where required by law, ask for your consent before it is activated.

How we use information

We use personal information for the following purposes:

• to respond to your inquiries and requests, and to schedule and deliver demonstrations;
• to evaluate, enter into, administer and enforce our agreements with customers;
• to provide, operate, secure and support the Platform and the Website;
• to communicate with you about our services, including service, security and administrative notices;
• to detect, investigate and prevent fraud, abuse, security incidents and unlawful activity;
• to comply with applicable laws, regulations, legal process and requests from competent authorities; and
• to establish, exercise or defend legal claims.

We may also use information that has been de-identified or aggregated so that it no longer identifies an individual, for any lawful purpose, including improving our services. We do not sell personal information.

Consent

By submitting information through the Website or otherwise providing it to us, you consent to its collection, use and disclosure as described in this Policy. Where you provide information about another person, you confirm that you are authorized to do so. You may withdraw your consent at any time by writing to our Privacy Officer, subject to legal and contractual restrictions and reasonable notice. Withdrawing consent may prevent us from responding to you or providing our services.

Disclosure of information

We do not disclose personal information to third parties except as described in this Policy, namely:

• Service providers that process information on our behalf to host, operate, secure and support our services, under written terms that require them to protect it and use it only to provide their services to us. These currently include Microsoft (Azure cloud hosting, storage and email) and Anthropic (AI processing for the Platform);
• Professional advisers, such as lawyers, accountants, auditors and insurers, under a duty of confidentiality;
• Business transactions: in connection with an actual or proposed merger, acquisition, financing, reorganization or sale of all or part of our business or assets, information may be disclosed to the parties involved and their advisers and transferred as part of the transaction, subject to this Policy or protections at least as protective;
• Legal requirements: where we believe in good faith that disclosure is required or permitted by law, legal process or a competent authority, or is necessary to protect the rights, property or safety of Surety Minds, our customers or others.

Location of processing

Our primary hosting, storage and email providers store information in data centres located in Canada. Some service providers, including our AI processing provider, may process information outside Canada, including in the United States. Information processed in another jurisdiction is subject to the laws of that jurisdiction and may be accessible to its courts and authorities. We rely on contractual protections with our service providers for information they process on our behalf.

Retention

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, to maintain our business records, and to comply with our legal, tax, accounting and contractual obligations, and to establish or defend legal claims. When information is no longer required, we destroy or anonymize it in accordance with applicable law. Residual copies may remain in backups for a limited period until they are overwritten in the normal course.

Information on the Platform

Customers decide what information to upload to the Platform, which may include financial information about their clients and personal information about principals, indemnitors and guarantors ("Customer Data"). With respect to Customer Data, the customer is responsible for the information and we process it on the customer's behalf, only to provide the Platform and as set out in the Customer Agreement. Each customer is solely responsible for having a lawful basis to upload Customer Data and for providing any notices and obtaining any consents required from its clients and their principals, indemnitors and guarantors. Requests from individuals concerning Customer Data should be directed to the relevant customer. If we receive such a request directly, we may refer it to the customer and will assist the customer as required by the Customer Agreement. Information about our security measures is available on our Security page for general information only; our binding commitments are those in the Customer Agreement.

Security

We use administrative, technical and physical safeguards that we consider reasonable in light of the sensitivity of the information. However, no method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee the absolute security of any information. Email and other communications sent to us over the internet may not be secure, and you send them at your own risk. You are responsible for keeping your Platform credentials confidential and for notifying us promptly of any unauthorized use.

If a security incident involving personal information under our control requires notification under applicable law, we will notify the affected individuals and authorities as and when that law requires.

Access and correction

Subject to the exceptions provided by law, you may request access to personal information we hold about you, its correction if it is inaccurate or incomplete, or its deletion where we are no longer permitted to retain it. Requests must be made in writing to our Privacy Officer. We will verify your identity before acting on a request and will respond within the time required by law. We may refuse a request where permitted or required by law, including where the request would reveal information about another person, confidential commercial information, or information subject to legal privilege, and we will give reasons for any refusal. A reasonable fee may be charged where the law allows.

Third-party sites

The Website may link to websites and services operated by others. We are not responsible for their content or privacy practices, and this Policy does not apply to them.

Changes to this Policy

We may amend this Policy from time to time. The amended Policy takes effect when it is posted on this page, as shown by the "Last updated" date. Your continued use of the Website or our services after that date constitutes acceptance of the amended Policy, except where applicable law requires your consent to a change.

Contact

Questions about this Policy may be sent to our Privacy Officer through our contact form.