Privacy at Zogo | Canada

Last Updated: September 16, 2026

Zogo and its subsidiaries (“we,” “us,” or “our”) respect the privacy of our users (“you” or “your”). This privacy policy (“Privacy Policy”) applies to the websites, mobile applications, and related services we operate on which this Privacy Policy is provided. This Privacy Policy describes our practices concerning the collection, use, disclosure, transfer, storage, and protection of your personal information. Our websites and mobile applications may contain links to third-party websites. This Privacy Policy will not apply to any information you may provide while on such third-party websites and we recommend you review and become familiar with their privacy policies as well.

This Privacy Policy includes the following sections:

• Information We Collect
• Cross-Border Transfer of Personal Information
• What About Cookies?
  • Managing Your Cookie Preferences
• Retaining Personal Information
• Security of Personal Information
• Privacy Rights
  • Exercising Your Privacy Rights
• Changes to Our Privacy Notice
• Questions

Information We Collect

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual (in this Privacy Policy we refer to this as “personal information”). We collect personal information for the purposes described in this Privacy Policy, consistent with applicable privacy laws, and where required, with your consent. In particular, we may collect the following categories of personal information:

• Basic Identifiers
  • Examples: Name, username, email address, phone number, IP address, and BMO program participation or referral information where applicable
  • Source(s): Directly from the user
  • Purpose of Collection (including business purposes): Maintaining and servicing your account, providing customer service, administering rewards, supporting fraud prevention and security, operating the partner program where applicable, analytics, and product improvement
• Demographic information
  • Examples: Zip code, year of birth, survey responses
  • Source(s): Directly from the user
  • Purpose of Collection (including business purposes): Maintaining and servicing your account, providing customer service, processing rewards
• Protected classifications
  • Examples: Age
  • Source(s): Directly from the user
  • Purpose of Collection (including business purposes): Maintaining and servicing your account, providing customer service, processing rewards
• Internet or network activity
  • Examples: IP address, device identifiers, operating system, browser or app information, approximate location derived from device or network information, and app usage events
  • Source(s): Directly from App and analytics providers
  • Purpose of Collection (including business purposes): Operating and securing the Services, calculating usage levels, diagnosing server or application problems, improving features, measuring program engagement, analytics, product improvement, and, where permitted, advertising or marketing
• Inferences
  • Examples: User profiles to determine preferences, behaviors, characteristics, etc.
  • Source(s): Directly from the user
  • Purpose of Collection (including business purposes): Providing advertising or marketing services, for analytical purposes

• Security information
• Examples: Name, email address, phone number, address, date of birth, and other information used by the identity verification provider to verify identity and support account security and rewards-fraud prevention.
• Source(s): Directly from the user and third-party identity verification service
• Purpose of Collection (including business purposes): Verifying that an account belongs to a real person, supporting account security, and preventing rewards fraud
• Retention: For as long as necessary for the purposes described in this Privacy Policy or as otherwise required by law or the applicable identity verification provider’s retention requirements, subject to Zogo’s retention and deletion practices

Disclosure of Personal Information

We may share your personal information with third-party service providers who assist us with various aspects of our business, including: cloud infrastructure, analytics, communications, app functionality, customer relationship management, marketing where permitted, internal operations, customer support, rewards programs, push notifications, optional SMS authentication, and identity verification.

We may also share your personal information with a partner sponsor institution when directed or consented to by you, including for purposes of administering the partner program, providing rewards, and enabling our partner to contact you in accordance with the partner’s consent language and their own privacy policies.

Please reference the information listed in the “Information We Collect” section above for a list of categories of personal information that we may transfer or disclose to third parties. We do not sell your personal information for money. If applicable law treats certain disclosures, transfers, analytics, or advertising activities as a “sale” or “sharing” of personal information, you may have the right to opt out as described in this Privacy Policy.

We may also disclose personal information for the following purposes:

• Fraud Prevention: We may disclose your personal information when we believe disclosure is necessary to investigate, prevent, or respond to suspected illegal or fraudulent activity or to protect the safety, rights, or property of us, our users, or others.
• Law enforcement or legal requests: We may disclose your personal information with government authorities, such as law enforcement authorities, courts, or regulators to comply with the law.
• Corporate Restructuring: We may transfer your information to a third party if we or any of our affiliates are involved in a corporate restructuring, including a sale, merger, or other transfer of some or all of our assets.

Your personal information may be collected, processed, stored, accessed, or otherwise handled outside your state, province, territory, or country of residence, including in the United States and Canada, by Zogo and its service providers. As such, your personal information may therefore be subject to the laws of the jurisdictions where it is processed or stored, which may differ from the laws in your home jurisdiction, and may be subject to access by the authorities in those jurisdiction in accordance with applicable law. We maintain technical, organizational and contractual safeguards designed to protect your information, including encryption at rest and in transit, access controls, and data processing agreements with service providers.

What About Cookies?

We, our service providers, and certain third parties use cookies, pixels, tags, software development kits (SDKs), mobile identifiers, or similar tracking technologies (“Collection Technologies”) to gather certain information when you use, access, or otherwise interact with our websites, mobile applications, or Services. Below we have described how we use Collection Technologies.

Our use of Collection Technologies generally falls into the following categories:

• Necessary/Essential Cookies
  • Type: Session Cookies
  • Administered by: Us
  • Purpose: These Cookies are essential to provide You with services available through the Website and to enable You to use some of its features. They help to authenticate users and prevent fraudulent use of user accounts. Without these Cookies, the services that You have asked for cannot be provided, and We only use these Cookies to provide You with those services.
• Functionality Cookies
  • Type: Persistent Cookies
  • Administered by: Us
  • Purpose: These Cookies allow us to remember choices You make when You use the Website, such as remembering your login details or language preference. The purpose of these Cookies is to provide You with a more personal experience and to avoid You having to re-enter your preferences every time You use the Website.
• Tracking and Performance Cookies
  • Type: Persistent Cookies
  • Administered by: Third-Parties
  • Purpose: These Collection Technologies are used to understand traffic to our websites and mobile applications and how users use the Services. The information gathered through these Collection Technologies may directly or indirectly identify you because it is typically linked to a pseudonymous identifier associated with the browser or device you use to access the Services. We may also use these technologies to test new content, pages, features or functionality and, where applicable, to support analytics, measurement, advertising or marketing, subject to any opt-out, consent, or preference rights available under applicable law.

Managing Your Cookie Preferences

You may opt out or manage your preferences at any time by using the cookie notice or preference centre provided on our website, using any consent-management or notification settings made available in the Zogo application, following the instructions provided in the relevant communication, or using other opt-out mechanisms that may be required or recognized under applicable law. If you have previously elected to accept cookies from the website, you may need to clear your site cookies and/or cache in order to opt out going forward.

You can also choose how web browser cookies are handled by your device via your browser settings. Some devices allow you to control this through your device settings. If you choose not to receive cookies at any time, websites may not function properly, and certain services will not be provided. Each browser and device are different, so check the settings menu of the browser or device to learn how to change your settings and cookie preferences. You can find information on how to manage cookie settings on certain browsers via the following links:

• Cookie settings in Chrome
• Cookie settings in Firefox
• Cookie settings in Internet Explorer
• Cookie settings in Safari

The online advertising industry also provides websites from which you may opt out of receiving targeted ads from data partners and other advertising partners that participate in self-regulatory programs. You can access these and learn more about targeted advertising and user choice and privacy by visiting the Network Advertising Initiative and the Digital Advertising Alliance.

Retaining Personal Information

We keep your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, as may be required by law (e.g., for tax and accounting purposes), or as otherwise communicated to you. This is based on the nature of the data, why the data was collected and processed, and additional applicable legal retention requirements. When personal information is no longer required, we will delete, destroy, or anonymize it in accordance with applicable law and our retention practices.

Security of Personal Information

We are committed to protecting the security of your personal information and employ a comprehensive security program designed to safeguard your data. This includes encrypting all user data both at rest and in transit. Our systems reside within a secure, enterprise-grade cloud infrastructure with multiple layers of security controls. We regularly conduct security assessments and vulnerability testing to identify and mitigate potential weaknesses, and we undergo annual independent third-party assessments.

We continuously monitor our systems for security events and proactively review and update our security practices to address emerging threats. These measures include appropriate physical, technical, and administrative safeguards. While no security system is impenetrable, we are dedicated to maintaining the confidentiality, integrity, and availability of your personal information and continually strive to enhance our security program.

Privacy Rights

Depending on where you are located, you may have certain privacy rights under applicable law, which may be subject to limitations and/or restrictions. We believe in the importance of privacy rights and will endeavor to fulfill privacy rights requests even if you do not have them available to you under law. The privacy rights that may be available to you include the following:

• The Right to Know and Access: You may have the right to request information about the personal information we hold about you, including the categories or specific pieces of personal information we have collected, used, disclosed, sold, shared or otherwise processed, the purposes for which it was collected, and the third parties or categories of third parties to whom it has been disclosed. You may also request a copy of the personal information we hold about you.
• The Right to Deletion or Withdrawal of Consent: You may have the right to request that we delete personal information that we collected from you and retained, subject to legal and operational exceptions. If we rely on consent under applicable law, you may also withdraw consent to our collection, use or disclosure of your personal information, subject to legal or contractual restrictions and reasonable notice.
• The Right to Correct: You have the right to request that we correct any inaccurate personal information that we have collected from you and maintain.
• The Right to Opt Out or Manage Preferences: You may have the right to opt out of targeted advertising, marketing communications, certain analytics, the sale or sharing of personal information where applicable, or other optional uses of your personal information. You may also have the right to limit the use or disclosure of sensitive personal information where applicable. If you would like to opt out of targeted advertising or manage Collection Technologies, please see the “Managing Your Cookie Preferences” section above.

If you are a Quebec resident, you may have additional rights under Quebec privacy law, including rights to access, correct, withdraw consent, obtain information about processing, request de-indexing in certain circumstances, and obtain computerized personal information in a structured, commonly used technological format where the portability right applies. Where required by applicable law, a French version of this Privacy Policy and related notices will be made available.

Please see the “Exercising Your Privacy Rights” section below for details on how to submit a Right to Know and Access, Deletion, Withdrawal of Consent, Correction, Opt Out, or Limit Use request, where those rights apply.

We will not discriminate against you for exercising any of your privacy rights listed above.

Depending on where you are located and the applicable privacy laws, you may have the right to appeal our decision if we deny one of your requests listed above. Please see the “Exercising Your Privacy Rights” section listed below for details on how to submit this request.

Exercising Your Privacy Rights

If you would like to exercise your rights as outlined, please contact us via e-mail at support@zogofinance.com and provide details of the right(s) you wish to exercise. We will respond to your request within the timeframe required by applicable law (e.g., 30 or 45 days, depending on where you live).

If you use an authorized agent to make a request on your behalf, we may ask the agent to verify their own identity and confirm with you that you provided the authorized agent permission to submit the request.

Changes to Our Privacy Notice

We may revise or supplement this Privacy Policy from time to time on our website. If we make changes that materially affect our use of your personal information or your privacy rights, we will announce the changes by providing a notice to you through our website, application or via an email distribution.

This Privacy Policy supersedes all previous notices or statements regarding our privacy practices and the terms and conditions that govern them in respect of privacy.

Questions

If you have questions regarding our Privacy Policy or your privacy rights as described above, please contact our Privacy Officer at support@zogofinance.com. You may also contact our partner sponsors directly for questions about their own collection, use or disclosure of personal information.