Data Protection Policy

1. Our Commitment

Tenantra Inc. ("Tenantra") is committed to protecting the personal information entrusted to us by landlords, tenants, and users of our platform.

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Our data protection practices are designed to meet or exceed the requirements of Canadian privacy law.

This Data Protection Policy outlines our commitment to data security, the measures we implement, and your rights regarding your personal information.

2. Data Protection Principles

We adhere to the following data protection principles:

3. Nature of Platform Data and Role of Tenantra

Tenantra operates as a platform that facilitates identity-verified, consent-based rental history records submitted by landlords.

Information on the platform includes user-submitted data relating to rental relationships and post-tenancy reporting.

Tenantra:

• Does not independently verify all submitted information
• Does not act as a government registry, land title authority, or credit reporting agency

Data on the platform reflects submissions made by verified landlord accounts within a structured system that includes tenant consent and dispute mechanisms.

4. Security Measures

We implement comprehensive technical and organizational security measures:

Encryption

• TLS 1.3 for all data in transit
• AES-256 encryption for data at rest
• Encrypted database connections
• Secure key management practices

Access Controls

• Role-based access control (RBAC)
• Multi-factor authentication (MFA)
• Unique user credentials
• Automatic session timeout
• Privileged access management

Infrastructure Security

• Canadian-based data centres
• SOC 2 Type II certified hosting
• Redundant systems and backups
• DDoS protection
• Web application firewall (WAF)

Monitoring and Detection

• 24/7 security monitoring
• Intrusion detection systems
• Security information and event management (SIEM)
• Regular vulnerability scanning
• Penetration testing (annual)

Physical Security

• Biometric access controls
• Video surveillance
• Environmental controls
• Secure disposal of hardware

5. Data Breach Notification

In the event of a data breach, we follow a structured response process:

Detection and Assessment

• Immediate investigation upon detection
• Assessment of breach scope and impact
• Determination of affected individuals
• Evaluation of risk of significant harm

Containment

• Immediate steps to stop the breach
• Preservation of evidence
• System isolation if necessary
• Engagement of incident response team

Notification (if required)

Under PIPEDA, we will notify:

• Affected individuals as soon as feasible where there is a real risk of significant harm
• The Privacy Commissioner of Canada
• Third parties where notification may reduce risk

Notification Contents

• Description of the breach
• Types of information involved
• Steps taken to reduce harm
• Contact information
• Complaint process information

Record Keeping

We maintain records of all breaches for at least 24 months.

6. Data Location and Transfers

Data Residency

All personal information collected by Tenantra is stored on servers located in Canada. Our primary data centre is in Toronto, Ontario, with disaster recovery in Montreal, Quebec.

Cross-Border Transfers

We do not routinely transfer personal information outside of Canada. In limited cases, we ensure:

• Comparable protection levels
• Contractual safeguards
• Compliance with PIPEDA

Third-Party Processors

Our service providers include:

• AWS Canada (hosting)
• MongoDB Atlas (database)
• Postmark (email)
• Vonage (SMS)

All providers are bound by data protection agreements.

7. Sub-Processors

Identity Verification

Didit (Didit Identity Verification) — identity verification

(Data: government ID, selfie, verification results)

Communications

• Postmark — email delivery
• Vonage — SMS verification

Infrastructure

• AWS Canada
• MongoDB Atlas

We update this list when changes occur.

8. Dispute and Data Correction Framework

Tenants have the right to dispute rental reports they believe are inaccurate, misleading, or incomplete.

When a dispute is raised:

• The report may be flagged
• Supporting information may be reviewed
• Appropriate action may be taken, including updating, restricting, or removing content

Tenantra reserves the right to determine outcomes based on available information and platform policies.

9. Employee Training and Access

All employees receive:

• Privacy training
• Security awareness training
• Role-based access restrictions

Access is:

• Limited to necessary functions
• Logged and auditable
• Revoked immediately upon termination

10. Your Rights

You have the right to:

• Access your data
• Request corrections to inaccurate or incomplete information
• Withdraw consent for certain uses of your personal information
• File complaints with our Privacy Officer or the Office of the Privacy Commissioner of Canada

Requests are processed within required timelines under applicable law.

11. Limitation of Platform Responsibility

Tenantra is not responsible for decisions made by landlords or third parties based on information obtained through the platform.

The platform provides structured rental history records but does not provide legal, financial, or tenancy advice.

Users are responsible for how they interpret and use platform data.

12. Data Retention Schedule

Data is securely deleted after retention periods expire.

13. Supporting Documentation

Documents uploaded to Tenantra are used for:

• Internal records
• Audit
• Dispute resolution

They are not independently verified as proof of ownership or legal title.

14. Privacy Officer Contact

15. Office of the Privacy Commissioner

You may contact the Office of the Privacy Commissioner of Canada if you are not satisfied with our response to your inquiry or complaint.

16. Policy Updates

We may update this policy periodically to reflect changes in our practices, services, or applicable legal requirements.