Exhibit · Legal · Privacy Policy

Privacy Policy

EFFECTIVE DATE — JULY 13, 2026
LAST UPDATED — JULY 13, 2026

Forensic Restitution

This Privacy Policy explains how Forensic Restitution ("we", "us", "our") collects, uses, stores, and protects personal information when you visit our websites, complete our fraud risk assessment, or otherwise interact with us. It applies to www.forensicrestitution.com and any domain on which the fraud risk assessment is hosted.

We are committed to processing personal information lawfully and transparently, in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy legislation, Canada's Anti-Spam Legislation (CASL), and, where applicable, the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

01Who we are

Forensic Restitution is a forensic accounting and fraud investigation firm based in Canada.

Accountable organization:
Forensic Restitution
3465 Rebecca St, Unit 205
Oakville, ON L6L 6X9, Canada
Phone: +1 416-525-1510
Email: dave@forensicrestitution.com
Website: www.forensicrestitution.com

Privacy Officer: Dave Oswalds — contactable at dave@forensicrestitution.com. Our Privacy Officer is accountable for our compliance with this policy and applicable privacy law.

02Information we collect

Information you provide directly

When you complete the fraud risk assessment and request your results, we collect:

  • Your name
  • Your email address
  • Your company name and job title (where provided)
  • Any other information you choose to include when contacting us

Your assessment responses

The assessment asks questions about your organization's internal controls, processes, and potential fraud exposure. Your answers, and the resulting risk score, are stored together with your contact details so that we can generate and deliver your results and provide relevant follow-up.

Information collected automatically

When you visit our websites, we and our service providers may automatically collect technical information such as your IP address, browser type, device type, pages viewed, referring pages, and interaction data. Where our marketing campaigns run on third-party platforms (for example, LinkedIn), those platforms may place tracking technologies (such as the LinkedIn Insight Tag) that record that you visited our site after viewing or clicking an advertisement.

03How we use your information

We use personal information to:

  • Generate, score, and deliver your fraud risk assessment results
  • Send you a confirmation and your results by email
  • Follow up with relevant information, insights, and services related to fraud risk, prevention, and investigation
  • Respond to enquiries you send us
  • Measure and improve the performance of the assessment and our marketing campaigns
  • Comply with legal and regulatory obligations

We do not sell personal information to third parties.

04Confidentiality of your assessment responses

We recognize that your assessment responses describe potential weaknesses in your organization's controls, and that this information is sensitive. We treat assessment responses as confidential. They are used only to generate your results, to inform any follow-up conversation you choose to have with us, and in aggregated, de-identified form to improve the assessment. We do not disclose your individual responses to any third party except the service providers listed in section 6, and never for their own purposes.

05Consent

Consent is the foundation of our processing under PIPEDA. By submitting your details to receive your assessment results, you consent to the collection, use, and disclosure of your personal information for the purposes described in this policy. Where we send commercial electronic messages, we do so on the basis of your express or implied consent in accordance with CASL. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting us at dave@forensicrestitution.com; withdrawing consent may mean we can no longer provide certain services (such as delivering assessment results).

For individuals in the EU/EEA, we process personal information on the basis of consent, our legitimate interests in operating and marketing our services, and compliance with legal obligations, as applicable.

06Who we share information with

We share personal information only with service providers who process it on our behalf under appropriate contractual safeguards:

  • Database and backend hosting — Supabase, which stores assessment leads and responses
  • Website hosting and deployment — Lovable and/or Vercel, which host the assessment application
  • Email delivery — GoDaddy, which sends results and follow-up emails on our behalf
  • Advertising and analytics — LinkedIn and similar platforms, in connection with campaign measurement

We may also disclose personal information where required or permitted by law, court order, or a competent regulator, or to protect our legal rights.

07Marketing communications

If you complete the assessment, we may send you follow-up emails related to fraud risk and our services. In accordance with CASL, every commercial electronic message we send identifies us, includes our contact information, and contains a functioning unsubscribe mechanism that takes effect promptly. You may opt out at any time by using the unsubscribe link or emailing dave@forensicrestitution.com. Opting out of marketing does not affect the delivery of your assessment results.

08International transfers

Some of our service providers store or process information outside Canada, including in the United States. While personal information is in another jurisdiction, it may be accessible to the courts, law enforcement, and national security authorities of that jurisdiction in accordance with its laws. We remain accountable for personal information transferred to third-party processors and use contractual and other means to ensure a comparable level of protection while it is processed on our behalf. For EU/EEA residents, cross-border transfers are made in accordance with Chapter V of the GDPR.

09Retention

We retain personal information only for as long as necessary for the purposes described in this policy: assessment leads and responses are retained for 24 months or until you request deletion, whichever is sooner, unless a longer period is required by law. De-identified, aggregated data may be retained indefinitely.

10Security

We implement reasonable technical and organizational measures to protect personal information against loss, misuse, unauthorized access, disclosure, and alteration, including access controls, encrypted transmission (HTTPS), and restricted access to our database. No method of transmission or storage is completely secure, but we review our safeguards on an ongoing basis. In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will report the breach to the Office of the Privacy Commissioner of Canada, notify affected individuals, and keep records of the breach as required by PIPEDA and, where applicable, Articles 33–34 of the GDPR.

11Your rights

Subject to applicable law, you have the right to:

  • Request access to the personal information we hold about you
  • Request correction of inaccurate or incomplete information
  • Request deletion of your personal information
  • Withdraw consent to processing, including for direct marketing purposes
  • Challenge our compliance with this policy through our Privacy Officer
  • Lodge a complaint with a supervisory authority

To exercise any of these rights, contact our Privacy Officer at dave@forensicrestitution.com. We will respond within the timeframes required by law.

You may direct complaints or enquiries to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca, 1-800-282-1376) or, where provincial legislation applies, to your provincial privacy commissioner. If you are in the EU/EEA, you may complain to your local data protection authority.

12Cookies and tracking technologies

Our websites use cookies and similar technologies for essential functionality (such as saving your assessment progress), analytics, and advertising measurement. You can control cookies through your browser settings; disabling some cookies may affect how the assessment functions.

13Children

Our websites and services are directed at business professionals and are not intended for children under 18. We do not knowingly collect personal information from children.

14Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when it was last revised. Material changes will be communicated on this page or, where appropriate, by email.

15Contact us

Questions, requests, or complaints about this policy or our handling of personal information can be directed to our Privacy Officer:

Forensic Restitution
3465 Rebecca St, Unit 205
Oakville, ON L6L 6X9, Canada
Phone: +1 416-525-1510
Email: dave@forensicrestitution.com
Website: www.forensicrestitution.com
Facebook: www.facebook.com/FraudHurts
LinkedIn: www.linkedin.com/company/forensic-restitution
X: x.com/fraudhurts

← Back to Assessment