1. Who We Are and Who Is Responsible

Capitalised terms used in this policy have the meanings given in the Sutton Wealth Terms of Service, which should be read together with this policy.

Cornerstone Platform Inc. ("Cornerstone," "we," or "us," or "our") is the data controller responsible for all personal information collected through the Sutton Wealth platform, including information collected during onboarding initiated by a Portfolio Issuer.

Our Privacy Officer is accountable for our compliance with this policy and applicable privacy law.

Privacy Officer: Antoni Wisniowski, Cornerstone Platform Inc.

Email: privacy@cornerstoneplatform.ca

2. Scope and Governing Law

This policy applies to personal information collected through the Sutton Wealth platform and any communications we send in connection with it. It does not apply to third-party websites or services linked from the platform.

We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. PIPEDA's fair information principles — accountability, identifying purposes, consent, limiting collection, limiting use, accuracy, safeguards, openness, individual access, and challenging compliance — guide how we handle your personal information.

We are monitoring the progress of Canada's proposed Consumer Privacy Protection Act and will update our practices as required when it comes into force.

3. What Personal Information We Collect

We collect personal information only to the extent necessary to deliver the services described in our Terms of Service.

This includes information necessary to create and manage your account and verify your identity, information associated with your property portfolio, and data necessary to operate and secure the platform, including session data, audit logs, and communications data. When we send you emails, our email service provider records delivery and engagement events. We do not collect or store government-issued identity documents, biometric data, or banking credentials.

4. How We Use Your Information

We use your personal information to operate your account, verify your identity, build and manage your portfolio, and maintain the security and integrity of the platform.

With your consent, your portfolio data may be shared with Trust Network Members and, where you choose to engage a service provider through the platform, with that provider. Cornerstone may receive a fee in connection with those interactions. You are always in control of whether that sharing happens and with whom.

We do not use your personal information for advertising or marketing purposes. We do not sell it.

5. How We Share Your Information

We do not share your personal information without your consent except as described below.

Service providers. We work with third-party service providers to deliver the platform. These providers access personal information only to the extent necessary to perform their function, under contractual obligations that prohibit any other use.

Legal requirements. We may disclose personal information if required by applicable law, court order, or regulatory authority.

Business transfers. In the event of a merger, acquisition, or sale of substantially all assets, your personal information may transfer to the successor entity as part of that transaction. We will notify you of any change to this policy that results from such a transfer, and you will have the opportunity to delete your account if you do not wish to continue.

6. Anonymized and Aggregated Data

Cornerstone may retain anonymized or aggregated data derived from platform activity. This data does not identify any individual, does not constitute personal information under PIPEDA, and is not subject to the consent or deletion rights described in this policy.

7. Security

We implement safeguards designed to protect your personal information against unauthorized access, use, or disclosure, including encryption, multi-factor authentication, and access controls. No system is completely secure and we cannot guarantee absolute security. In the event of a breach that creates a real risk of significant harm, we will notify you and the applicable Privacy Commissioner as required by PIPEDA.

8. Data Retention

We retain your personal information for as long as your account is active.

9. Account Deletion

To request deletion of your account, contact privacy@cornerstoneplatform.ca or use the account settings where available.

When your account is deleted, your personal information and any associations between you and your portfolio are removed from the platform and any active sharing permissions are terminated. Property data is not personal information and may be retained. Certain information may be retained where required by law or for legitimate operational purposes such as security and audit records. Anonymized or aggregated data derived from your portfolio activity may also be retained as described in Section 6 and cannot be linked back to you.

10. Your Rights

Under PIPEDA you have the right to access the personal information we hold about you, to request correction of inaccurate or incomplete information, to withdraw consent for specific uses, and to ask us to delete personal information that is no longer necessary for the purposes described in this policy.

To exercise any of these rights, contact our Privacy Officer at privacy@cornerstoneplatform.ca. We will acknowledge your request promptly and respond within 30 days. If we require additional time we will notify you.

If you believe your privacy rights have been violated, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.

11. Cookies

The platform uses session cookies only for authentication and session management. We do not use cookies for advertising, analytics, or cross-site tracking and we do not set third-party cookies.

12. Changes to This Policy

We may update this policy from time to time. Changes will be posted on the platform with an updated date. For changes that reduce the privacy protections described in this policy, we will notify you before those changes take effect and seek your renewed consent where required.

13. Contact

Privacy Officer: Antoni Wisniowski, Cornerstone Platform Inc.

Email: privacy@cornerstoneplatform.ca

British Columbia, Canada