PocketLot Privacy Policy

1. Scope and Application

This Privacy Policy applies to all personal information collected, used, or disclosed by PocketLot through our online trade-in appraisal and wholesale management platform, website, customer-facing trade-in submission forms generated by dealership subscribers, email, phone, SMS, and any other channel through which you submit personal information to us.

PocketLot operates a SaaS (software-as-a-service) platform that licensed automotive dealerships subscribe to in order to manage their trade-in appraisal and vehicle disposition workflows. As part of this platform, subscribing dealerships can generate customer-facing trade-in submission links. When a vehicle owner submits information through one of these links, that information is received directly by the relevant Dealership Subscriber's account on the Platform. PocketLot processes and stores this information as a service provider on behalf of the Dealership Subscriber.

For the purposes of this policy, "personal information" means information about an identifiable individual as defined under Alberta's Personal Information Protection Act (PIPA), including but not limited to your name, contact details, vehicle information linked to you, communications, and device or usage data.

2. Information We Collect

We may collect the following categories of information, depending on how you interact with us:

3. How We Use Your Information

We collect, use, and retain personal information only for purposes that a reasonable person would consider appropriate in the circumstances and that are disclosed to you at or before the time of collection, including:

• Operating the PocketLot platform and providing the Services to Dealership Subscribers
• Processing and storing trade-in submissions made through Dealership Subscriber-generated forms, and making those submissions available to the relevant Dealership Subscriber
• Communicating with Dealership Subscribers and their team members about their subscriptions, accounts, and platform activity
• Sending transactional notifications including account activation, appraisal updates, offer notifications, and billing notices
• Confirming identity, preventing fraud and spam, and protecting our platform from misuse
• Improving our website, platform, workflows, customer service, and features
• Maintaining records for accounting, auditing, dispute resolution, and business operations
• Complying with legal, regulatory, tax, insurance, and recordkeeping obligations
• Enforcing our Terms of Service and platform rules
• Aggregating and analyzing platform usage and activity data in de-identified or anonymized form
• Measuring the effectiveness of our advertising campaigns using analytics and advertising tracking tools

4. How We Share Information

A core function of the PocketLot platform is making customer trade-in submission data available to the specific Dealership Subscriber whose trade-in link the customer used. When a vehicle owner submits information through a trade-in link, that submission is received by the Dealership Subscriber who generated the link — not shared with multiple dealerships or sold as a lead. Each trade-in form is tied to a single Dealership Subscriber's account.

We do not sell your personal information for independent marketing purposes by unrelated third parties. We do not share your information with multiple dealerships without your knowledge — your trade-in submission goes to the one dealership whose link you used.

Dealership Subscribers who access customer trade-in data through the Platform are independently responsible for their own compliance with applicable privacy law when using that data.

5. Consent

Under Alberta's PIPA, we require your consent before collecting, using, or disclosing your personal information, except in limited circumstances where consent is not required by law.

By submitting your information through a PocketLot trade-in form, you expressly consent to the collection, use, and disclosure of your personal information for the purposes described in this policy, including the delivery of your trade-in submission to the Dealership Subscriber whose form link you used.

• You may choose not to provide certain information, but this may limit our ability to process your trade-in inquiry.
• You may withdraw your consent for future marketing or non-essential communications at any time, subject to legal or contractual limitations.
• To withdraw or modify your consent, contact us at info@pocketlot.ca.

6. Electronic Communications (CASL)

Canada's Anti-Spam Legislation (CASL, SC 2010, c 23) governs the sending of commercial electronic messages (CEMs). PocketLot complies with CASL as follows:

• Express or implied consent: We send commercial electronic messages only where we have obtained express consent or where implied consent applies under CASL.
• Identification: Every commercial electronic message we send identifies PocketLot as the sender, includes our contact information, and provides a clear unsubscribe mechanism.
• Unsubscribe: You may unsubscribe from our commercial electronic messages at any time using the unsubscribe link in any email or by contacting us at info@pocketlot.ca. We will process unsubscribe requests within 10 business days.
• Transactional messages: Messages directly related to fulfilling your request or managing your subscription (such as account activation, billing notices, appraisal notifications, or offer alerts) are not considered CEMs and may continue after unsubscribe.

Dealership Subscribers who contact customers using data accessed through the Platform are independently responsible for their own CASL compliance.

7. Retention

We keep personal information only as long as reasonably necessary to fulfill the purposes set out in this policy and to meet legal, tax, accounting, audit, and dispute-resolution requirements.

When information is no longer required for any lawful purpose, we will securely delete, anonymize, or destroy it.

8. Security Safeguards

We implement administrative, technical, and physical safeguards designed to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification. These safeguards include:

• Role-based access controls and permissions within our platform
• Password protection and multi-tenancy data scoping so each Dealership Subscriber can only access their own account's data
• Encryption of data in transit (TLS/SSL)
• Secure cloud hosting with reputable infrastructure providers (Render)
• Internal policies limiting access to personal information on a need-to-know basis
• Secure payment processing through Stripe — PocketLot does not store credit card numbers
• Regular review and updating of security practices
• Logging and monitoring of access to sensitive data

No method of internet transmission or electronic storage is perfectly secure. We cannot guarantee absolute security, but we work to reduce risk and respond promptly if we identify a potential breach.

9. Privacy Breach Notification

Under section 34.1 of PIPA, we are required to notify the Office of the Information and Privacy Commissioner of Alberta (OIPC) without unreasonable delay if a privacy breach occurs and a reasonable person would consider that there exists a real risk of significant harm (RROSH) to an individual as a result.

If a reportable breach occurs, we will:

• Take immediate steps to contain the breach and mitigate harm
• Investigate the cause, scope, and impact of the breach
• Notify the OIPC in writing without unreasonable delay
• Notify affected individuals where appropriate, including a description of the breach, the types of personal information involved, and steps individuals can take to reduce their risk
• Take measures to prevent similar incidents in the future
• Maintain a record of all breaches for compliance and audit purposes

10. Your Rights

Under PIPA, you have the following rights with respect to your personal information held by PocketLot:

To exercise any of these rights, please contact us in writing at info@pocketlot.ca. We will make reasonable efforts to verify your identity before processing your request.

11. Cookies, Analytics & Tracking

We use cookies, local storage, pixels, session identifiers, and similar technologies to keep our website functioning, understand form engagement, detect misuse, measure advertising performance, and improve our services.

• Strictly necessary: Required for login, security, session management, and form submission. These cannot be disabled.
• Analytics: We may use analytics tools (such as Google Analytics) to understand how visitors interact with our website and platform, including page views, session duration, and navigation patterns. This data is collected in aggregate and de-identified form where possible.
• Advertising and conversion tracking: We use Meta's advertising pixel (Facebook Pixel) on certain pages of our website. This technology sends anonymized event data (such as page views and form interactions) to Meta (Facebook/Instagram) to help us measure the effectiveness of our advertising campaigns and reach relevant audiences. Meta may use this data in accordance with its own data policy. You can learn more about how Meta uses this data at facebook.com/privacy/policy and can opt out of Meta's advertising practices through your Facebook Ad Preferences.

You can control cookies through your browser settings. Blocking certain cookies may affect the functionality of our website or forms. We do not use advertising tracking technologies on our Terms of Service or Privacy Policy pages.

12. Minors

Our platform and trade-in forms are intended for use by adults who have the legal authority to submit vehicle-related inquiries and enter into transactions. We do not knowingly collect personal information from individuals under the age of 18 without parental or guardian consent.

If you believe that a minor has submitted personal information to us without appropriate authorization, please contact us at info@pocketlot.ca and we will promptly review and delete the information if appropriate.

13. Cross-Border Transfers

Some of our service providers (such as Render for cloud hosting, Stripe for payment processing, and email delivery providers) may store or process personal information outside of Alberta or outside of Canada. Under PIPA, we are required to inform you of this possibility and to take reasonable steps to ensure that your information is handled in accordance with this policy and applicable law, even when processed in another jurisdiction.

By using our platform, you acknowledge that your personal information may be transferred to, stored, or processed in jurisdictions outside Alberta or Canada, where privacy laws may differ from those in Alberta. We use contractual and other safeguards to require that service providers protect your information to a comparable standard.

For questions about where your data is stored or about our service-provider arrangements, contact us at info@pocketlot.ca.

14. AMVIC & Automotive Industry Compliance

The Alberta Motor Vehicle Industry Council (AMVIC) is Alberta's automotive industry regulator, established under the Consumer Protection Act (Alberta). AMVIC regulates the conduct of automotive businesses, including advertising, sales practices, and consumer protection.

PocketLot is committed to operating in a manner consistent with AMVIC requirements and Alberta consumer protection law. In particular:

• Advertising compliance: Our advertisements and customer-facing materials are designed to comply with AMVIC advertising standards, including the prohibition on false, misleading, or deceptive statements.
• General codes of conduct: We operate in accordance with the general codes of conduct established by the Automotive Business Regulation, including honest representation, transparency, and fair dealing with consumers.
• Dealership licensing: Dealerships that subscribe to our platform are expected to hold valid AMVIC licences and to ensure their salespeople are registered with AMVIC as required by law.
• Transparent data handling: We clearly disclose how customer trade-in submission data is handled within the platform, consistent with consumer-facing transparency requirements.

15. Federal Privacy Law (PIPEDA)

Alberta's PIPA has been deemed "substantially similar" to the federal Personal Information Protection and Electronic Documents Act (PIPEDA). PIPA generally governs our collection, use, and disclosure of personal information within Alberta.

However, PIPEDA applies to personal information that crosses provincial or national borders in the course of commercial activity. Where our activities involve interprovincial or international transfers of personal information, we comply with PIPEDA's requirements, including:

• The ten fair information principles set out in Schedule 1 of PIPEDA (accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance)
• Breach of security safeguards reporting to the Office of the Privacy Commissioner of Canada (OPC) under sections 10.1–10.3 of PIPEDA, where applicable
• Record-keeping obligations for all privacy breaches

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, technology, or business relationships. When we make material changes, we will post the revised policy on this page with an updated effective date. Where the changes are material and affect how we handle previously collected information, we will take reasonable steps to notify you, such as by email or a notice on our website.

Continued use of our platform after the revised policy is posted constitutes your acknowledgment of the updated policy, to the extent permitted by law.

17. Contact Us

Questions, access requests, correction requests, consent withdrawals, or general inquiries about this Privacy Policy or our privacy practices can be directed to:

18. Complaints

If you are not satisfied with our response to a privacy concern, you have the right to escalate your complaint to the relevant authorities: