Privacy Policy

Last Updated: February 12, 2026

Effective Date: February 12, 2026

Introduction

InvestPro Canada ("we", "us", "our") is committed to protecting your privacy and ensuring transparency in how we collect, use, and share your personal information. This Privacy Policy applies to all users of our website, mobile application, and trading platform. By accessing or using our services, you acknowledge that you have read, understood, and agree to the practices described in this policy.

We operate as a regulated investment dealer under Canadian securities laws and comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy legislation, and international data protection regulations including the General Data Protection Regulation (GDPR) for users in the European Economic Area and United Kingdom.

This policy is designed to meet the compliance requirements of advertising platforms including Google Ads and Meta (Facebook/Instagram) Ads, and provides full disclosure of our data practices, cookie usage, and your rights as a user.

1. Cookie Categories

We use cookies and similar tracking technologies to enhance your experience on our website. Cookies are divided into three categories, each serving distinct purposes and subject to different consent requirements.

Essential Cookies

Purpose: These cookies are necessary for core site functionality, security, session management, and account access. They enable you to navigate the website, access secure areas, and use essential features.

Examples: session_id, csrf_token, cookie_consent_status, auth_token, language_preference

Consent Required: No. Essential cookies are activated automatically as they are required for the website to function properly.

Retention: Session duration or up to 12 months for preference storage and security purposes.

Analytics Cookies

Purpose: These cookies help us measure traffic patterns, understand user behavior, analyze site performance, and identify areas for improvement. Analytics data is collected in anonymized or pseudonymized form.

Tools: Google Analytics 4

Examples: _ga, _ga_XXXXXXX, _gid, _gat

Consent Required: Yes. Analytics cookies are activated only after you accept them through our cookie consent banner or preferences panel.

Retention: Up to 14 months from the date of collection.

Marketing / Advertising Cookies

Purpose: These cookies enable us to deliver personalized advertising, measure campaign effectiveness, build remarketing audiences, and track conversions across multiple platforms and devices.

Consent Required: Yes. Marketing cookies are activated only after you explicitly accept them.

Retention: Up to 540 days (Google Ads default retention period) or as configured per platform policy.

2. Marketing Cookies - Full Disclosure

Marketing and advertising cookies are subject to strict consent requirements and transparency obligations. The following disclosures apply to all marketing cookie usage on this website:

Third-Party Ad Serving

Third-party vendors, including Google, use cookies to serve ads based on a user's previous visits to this website and other sites on the internet. These vendors may combine information collected from our website with data from other sources to create interest-based advertising profiles.

Advertising Partners

We may work with advertising partners such as Google and Meta to deliver advertisements tailored to your interests across various websites and platforms. These partners act as independent data controllers and process data according to their own privacy policies.

Remarketing

We may use remarketing services to advertise to previous visitors of our website. After visiting our site, you may see our ads on other websites, apps, or platforms you visit, including search results, news sites, social media platforms, and video streaming services. Remarketing allows us to show relevant content to users who have expressed interest in our services.

YouTube and Display Network

Advertisements may appear across Google services including YouTube, Gmail, Google Maps, and the Google Display Network, which includes millions of websites and mobile apps. Meta advertising may appear on Facebook, Instagram, Messenger, and the Audience Network.

Tracking Technologies in Use

We use the following tracking technologies on this website:

  • Cookies (first-party and third-party)
  • Tracking pixels (Google Ads tag / gtag.js, Meta Pixel)
  • Device identifiers (browser fingerprint, IP address, device type)
  • Conversion event tags
  • Local storage and session storage

Advertising Measurement and Conversion Tracking

We use conversion tracking to understand which advertisements lead to actions on our website such as form submissions, account registrations, calls, or transactions. This allows us to measure campaign effectiveness, optimize ad spend, and allocate budget appropriately. Conversion data may be shared with Google Ads and Meta in aggregated or pseudonymized form for campaign reporting and performance measurement.

Technologies Active on This Site

The following advertising and analytics technologies are active on this website when you provide consent:

  • Google Ads (gtag.js / Google Tag Manager)
  • Google Analytics 4
  • Google Remarketing Tag
  • Meta Pixel (Facebook / Instagram)

Opt-Out from Personalized Advertising

You may opt out of personalized advertising at any time through the following industry-standard opt-out mechanisms:

Opting out does not remove ads entirely. You will continue to see non-personalized advertisements that are not based on your browsing history or interests.

Cookie Preference Management

A clearly visible link labeled "Manage cookie preferences" appears in the footer of every page on this website. Clicking this link opens the cookie consent panel where you can accept or reject each cookie category independently. Your preferences are stored locally and respected on all subsequent visits for a period of 12 months.

3. Consent Requirements

Consent Banner

When you first visit our website, a cookie consent banner appears offering three options:

  • Accept All Cookies: Activates essential, analytics, and marketing cookies
  • Reject Non-Essential: Activates only essential cookies; analytics and marketing cookies remain disabled
  • Manage Preferences: Opens a detailed panel allowing you to enable or disable analytics and marketing cookies individually

Analytics and marketing cookies do not activate until you click "Accept All Cookies" or enable them individually through the Manage Preferences panel. The banner is dismissible without accepting; dismissing it without making a selection is treated as rejecting non-essential cookies.

Consent Statement

By clicking "Accept All Cookies", you consent to the storing of cookies on your device for analytics and advertising purposes, including personalized advertising delivered by Google and Meta. You may withdraw consent at any time through the cookie preferences panel without affecting the lawfulness of processing that occurred before withdrawal. Your consent choice is stored locally in your browser for 12 months.

EEA and UK Users

Users in the European Economic Area and the United Kingdom receive this consent notice in compliance with the General Data Protection Regulation (GDPR) and UK GDPR. Marketing and analytics cookies are activated solely after explicit, informed, freely given consent under GDPR Article 6(1)(a). Consent is recorded with a timestamp and may be audited upon request. You have the right to withdraw consent at any time without penalty.

Withdrawal of Consent

You may withdraw consent at any time by clicking "Manage cookie preferences" in the website footer, or by clearing cookies via your browser settings. Withdrawal does not affect processing that occurred while consent was valid. After withdrawal, analytics and marketing cookies will no longer be set, and existing cookies of those categories will be deleted from your device on your next visit.

4. Data Sharing with Advertising Partners

We share certain data with advertising partners for campaign delivery and measurement. Recipients and the data categories shared include:

Google LLC

Data Shared: Cookie identifiers, conversion events, anonymized behavioral data, remarketing lists, device type, browser type, IP address (anonymized), timestamp of visits

Governed By: Google's Privacy Policy: https://policies.google.com/privacy

Meta Platforms, Inc.

Data Shared: Pixel events, conversion data, custom audiences, hashed email addresses (for audience matching), page view events, form submission events

Governed By: Meta's Data Policy: https://www.facebook.com/privacy/policy

We do not sell personal data. All transfers to Google and Meta operate under Standard Contractual Clauses (SCCs) approved by the European Commission where applicable. Data is processed for ad targeting and campaign measurement only and is not resold to unaffiliated third parties.

Google and Meta may use this data across their own platforms in accordance with their respective policies. We encourage users to review those policies directly to understand how your data is handled by these third parties.

5. Lead Forms and Contact Requests

When you submit a contact form, request information, register interest in our services, or open an account, we collect the information you provide. This typically includes:

  • Full name
  • Email address
  • Phone number
  • Message or inquiry details
  • Account type preference (personal, joint, RRSP, TFSA, corporate)

Legal Basis: We process form submission data based on consent (GDPR Article 6.1.a) and, where a service relationship exists or is being established, performance of a contract (GDPR Article 6.1.b). By submitting a form, you provide explicit consent for us to contact you regarding your inquiry.

Retention: Form submission data is retained for up to 2 years from the date of submission, unless a longer period is required by applicable securities regulations, tax laws, or legal obligations. If you become a client, your data is retained according to our client record retention policies and regulatory requirements.

Your Rights: You may request deletion of your form submission data at any time by contacting us at the email address provided at the end of this policy. We will delete your data within 30 days unless retention is required by law.

A link to this Privacy Policy appears adjacent to every submission button on this site. Submitting a form constitutes acknowledgment of this policy and consent to the data practices described herein.

6. Google Services and Advertising

This website uses the following Google services:

Google Analytics 4

Collects anonymized usage data, device information, and behavioral signals to help us understand how visitors interact with our website. IP anonymization is enabled, meaning your full IP address is not stored. Data retention is set to 14 months. Users may opt out via the Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout

Google Ads Conversion Tracking

Records when a user completes a defined action (form submission, call, account opening, transaction) after clicking one of our ads. This data is used solely for measuring ad campaign performance and optimizing marketing spend. No personally identifiable information is transmitted to Google Ads beyond anonymized conversion events.

Google Remarketing

Allows us to show ads to previous visitors across Google's network, including search results, YouTube, Gmail, and partner websites. Remarketing lists are not created from sensitive data categories (health, finance status, religion, sexual orientation) and comply with Google's advertising policies. You can opt out of remarketing via Google Ads Settings.

Google Tag Manager

Deploys tracking tags on our behalf. No personal data is collected by GTM itself; it acts as a container for the tags listed above. All data collection occurs through the individual tags deployed via GTM.

Google's advertising products are governed by their Advertising Privacy policies: https://policies.google.com/technologies/ads

7. Meta Advertising Services

This website uses the Meta Pixel to measure the effectiveness of our advertising on Facebook and Instagram. The pixel may record:

  • Page views and time on site
  • Specific conversion events (form submissions, account registrations, transactions)
  • Custom audience membership for retargeting purposes
  • Device type, browser type, and referring URL

We do not use the Meta Pixel to collect sensitive personal data, nor to target users based on health status, financial situation, religion, political views, sexual orientation, or any other special-category attribute prohibited under Meta's advertising policies.

Meta acts as an independent data controller for data collected via its Pixel and processed within its own platform. Refer to Meta's Data Policy: https://www.facebook.com/privacy/policy

To manage your ad preferences on Meta platforms, visit: https://www.facebook.com/adpreferences/

8. Prohibited Content Self-Declaration

This website does not promote, sell, or facilitate access to prohibited product or service categories including but not limited to: weapons, controlled substances, counterfeit goods, gambling services (unlicensed), adult content, or services that make misleading health or financial claims. All advertising conducted through Google Ads and Meta Ads complies with the respective platform policies in full. We adhere to all advertising standards set by the Canadian Code of Advertising Standards and applicable securities regulations.

9. Landing Page Integrity Statement

The content of this website accurately represents the products and services advertised. No bait-and-switch practices are employed. The experience delivered to users arriving from paid advertisements is identical to the experience for all other visitors. Cloaking, automatic redirects, and content variation by traffic source are not used on this website. All claims made in our advertising are substantiated and comply with regulatory requirements.

10. Children's Privacy

This website is not directed at individuals under the age of 16. Investment services require users to be of legal age in their jurisdiction (18 or 19 years old in Canada depending on province). We do not knowingly collect personal data from minors. If we discover that data has been collected from a person under 16 without verifiable parental consent, we will delete it promptly. Contact us at the address in this policy if you believe we have received data from a minor.

11. International Data Transfers

Personal data collected through this website may be transferred to and processed in countries outside the European Economic Area and Canada, including the United States, where Google LLC and Meta Platforms, Inc. are based.

These transfers are conducted under Standard Contractual Clauses (SCCs) approved by the European Commission, which provide appropriate safeguards for personal data transferred outside the EEA. SCCs are contractual commitments between data exporters and importers that ensure personal data receives adequate protection regardless of where it is processed.

A copy of the applicable SCCs can be requested by contacting us directly at the email address provided at the end of this policy.

12. User Rights (GDPR Articles 15-22)

If you are located in the EEA or UK, you have the following rights under the General Data Protection Regulation:

  • Access (Art. 15): Request a copy of data we hold about you, including details of processing purposes, categories of data, recipients, and retention periods
  • Rectification (Art. 16): Correct inaccurate or incomplete data in our records
  • Erasure (Art. 17): Request deletion of your data ("right to be forgotten") where no legal basis for continued processing exists
  • Restriction (Art. 18): Limit how we process your data in certain circumstances, such as when accuracy is contested
  • Portability (Art. 20): Receive your data in a structured, machine-readable format and transmit it to another controller
  • Objection (Art. 21): Object to processing based on legitimate interest, including profiling and direct marketing
  • Withdraw consent (Art. 7.3): Revoke consent for processing at any time without penalty, though this does not affect the lawfulness of processing prior to withdrawal

To exercise any right, email us at [email protected] with your request. We will respond within 30 days. We may require proof of identity to process your request. There is no fee for exercising your rights unless your request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with your local supervisory authority if you believe we have processed your data unlawfully:

13. What Data We Collect

We collect the following categories of personal data through our website and platform:

Information You Provide Directly

  • Full name
  • Email address
  • Phone number
  • Mailing address
  • Date of birth
  • Social Insurance Number (for account opening)
  • Employment information
  • Investment experience and objectives
  • Form submission content and inquiries

Automatically Collected Data

  • IP address (anonymized for analytics)
  • Browser type and version
  • Device type and operating system
  • Screen resolution and viewport size
  • Cookies and tracking identifiers
  • Referring URL and traffic source
  • Pages visited, time on site, and click paths
  • Geographic location (country and city level)
  • Language preference

Conversion and Interaction Data

  • Form submissions and completion events
  • Account registration events
  • Call tracking data (if you contact us by phone)
  • Download events (e.g., educational materials, forms)
  • Video engagement metrics

14. Legal Basis for Processing (GDPR Art. 6)

We process personal data based on the following legal bases under GDPR Article 6:

  • Contact form data: Consent (Art. 6.1.a) and contract performance (Art. 6.1.b) where you are inquiring about or establishing a service relationship
  • Account opening data: Contract performance (Art. 6.1.b) and legal obligation (Art. 6.1.c) to comply with Know Your Client (KYC) and anti-money laundering regulations
  • Analytics data: Consent (Art. 6.1.a)
  • Marketing and remarketing data: Consent (Art. 6.1.a)
  • Security and fraud prevention: Legitimate interest (Art. 6.1.f) to protect our platform and users from unauthorized access and fraudulent activity
  • Regulatory compliance: Legal obligation (Art. 6.1.c) to comply with Canadian securities laws, tax regulations, and international regulatory requirements

15. Retention Periods

We retain personal data for the following periods:

  • Contact form submissions: 2 years from the date of submission
  • Account opening inquiries (not completed): 2 years
  • Client account data: 7 years after account closure, as required by securities regulations
  • Transaction records: 7 years from the date of transaction
  • Analytics data (Google Analytics 4): 14 months
  • Marketing cookies (Google Ads, Meta Pixel): Up to 540 days
  • Email communications: Duration of relationship plus 1 year
  • Server logs: 90 days
  • Cookie consent records: 3 years (audit requirement)

After the applicable retention period expires, personal data is securely deleted or anonymized. Data may be retained longer if required by law, regulatory obligation, or to establish, exercise, or defend legal claims.

16. Data Security

We implement industry-standard security measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction. These measures include:

  • TLS/SSL encryption for all data transmitted between your device and our servers
  • Two-factor authentication for account access
  • Regular security audits and penetration testing
  • Access controls limiting employee access to personal data on a need-to-know basis
  • Secure data centers with physical and network security controls
  • Encrypted backups and secure data storage
  • Incident response procedures for data breach notification

While we take all reasonable precautions to protect your data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security but will notify you promptly in the event of any data breach affecting your personal information.

17. How We Use Your Data

We use the personal data we collect for the following purposes:

  • To provide, operate, and maintain our trading platform and services
  • To process account opening applications and verify your identity
  • To execute trades and manage your investment portfolio
  • To respond to your inquiries and provide customer support
  • To send account notifications, trade confirmations, and regulatory communications
  • To comply with legal and regulatory obligations including KYC, AML, and tax reporting
  • To detect and prevent fraud, unauthorized access, and security threats
  • To analyze website usage and improve user experience
  • To deliver personalized advertising and measure campaign performance (with your consent)
  • To send marketing communications about our services (with your consent)

18. Third-Party Service Providers

We may share your personal data with trusted third-party service providers who assist us in operating our business. These providers are contractually obligated to protect your data and use it only for the purposes we specify. Third-party categories include:

  • Cloud hosting and infrastructure providers
  • Payment processors and banking partners
  • Customer support platforms
  • Identity verification and KYC service providers
  • Email and communication service providers
  • Analytics and advertising platforms (Google, Meta)
  • Legal, accounting, and compliance advisors

We do not sell, rent, or trade your personal data to unaffiliated third parties for their own marketing purposes.

19. Your Marketing Preferences

If you have consented to receive marketing communications from us, you may unsubscribe at any time by:

  • Clicking the "unsubscribe" link in any marketing email
  • Contacting us at [email protected]
  • Updating your communication preferences in your account settings

Unsubscribing from marketing emails does not affect transactional or regulatory communications, which we are required to send as part of our service or legal obligations.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When we make material changes, we will notify you via a prominent notice on our homepage at least 14 days before the changes take effect. The "Last Updated" date at the top of this policy indicates when it was most recently revised. Continued use of our website after changes take effect constitutes acceptance of the updated policy.

21. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

InvestPro Canada Inc.

250 Yonge Street, Suite 2100

Toronto, ON M5B 2L7

Canada

Phone: +1 (416) 555-0199

Email: [email protected]

Privacy Officer: [email protected]