This policy is in effect as of the Effective date below. Not a substitute for legal advice; we may update it.

PPMP Ready Privacy Policy

Effective date: October 7, 2026 Last updated: October 12, 2026

This Privacy Policy explains how PPMP Ready LLC ("PPMP Ready", "we", "us" or "our") collects, uses, discloses and protects personal information when you use:

• our marketing website at ppmpready.com (the "Site"), and
• our software-as-a-service application at app.ppmpready.com, including the PACE CPD planning module (together, the "Service").

We wrote this policy in plain language. If anything is unclear, contact us using the details in Section 16.

1. Who we are

PPMP Ready LLC is a limited liability company organized in the State of Wyoming, United States.

Our customers are mainly engineering and geoscience firms in Canada, especially in Alberta and British Columbia, and the people who work at those firms. We aim to handle personal information in line with:

• Canada's Personal Information Protection and Electronic Documents Act (PIPEDA);
• Alberta's Personal Information Protection Act (Alberta PIPA);
• British Columbia's Personal Information Protection Act (BC PIPA); and
• applicable United States federal and state laws.

Privacy Officer. We have designated a Privacy Officer who is responsible for our compliance with this policy and with privacy law. You can reach our Privacy Officer through the contact form on ppmpready.com. Our mailing address is available on request through the same form.

2. Our role: when we decide, and when your firm decides

How we handle information depends on whose information it is and why we have it.

• Information about you as a customer contact, account holder or Site visitor. We decide how this information is used, and this policy applies directly.
• Information your firm puts into the Service. This includes PPMP documents, staff lists, employee acknowledgments and sign-offs, and action log entries. We handle it on behalf of your firm, to provide the Service. Your firm is responsible for having the authority, notice and consent needed to give us that information, including information about its employees. If you are an employee and have questions about how your employer uses your information, please contact your employer first. We will help your firm respond to requests where we can.
• PACE profile information. When you upload your own resume (including a LinkedIn profile saved as a PDF), or log your own CPD activities, we use that information to provide PACE to you. If your firm sponsors your PACE seat, your firm can see some of your PACE information as described in Section 6.

3. Information we collect

3.1 Information you give us

3.2 Information we collect automatically

When you use the Site or Service, we and our service providers may automatically collect:

• Device and log information: IP address, browser type, operating system, pages visited, date and time of access, referring pages, and error logs.
• Usage information: features used, actions taken in the Service, and login events. We use this for security, troubleshooting and product improvement.
• Email information: whether our emails were delivered. We do not track whether you open our emails or click links in them; open and click tracking is turned off for our sending domain.
• Cookies and similar technologies: see Section 12.

The Site uses one advertising-measurement tool, the LinkedIn Insight Tag, described in Section 3.4. The Service (app.ppmpready.com) does not use analytics, advertising or tracking scripts.

3.3 Information from others

• Your firm. An administrator at your firm may add you to the Service, for example to request your acknowledgment of a PPMP document or to assign you a PACE seat, and give us your name, email and role.
• Stripe. Stripe tells us the status of payments and subscriptions.
• LinkedIn. If you reach the Site by clicking one of our LinkedIn ads, the link may include a LinkedIn click identifier (li_fat_id) and campaign tags. We keep these with any request-access form you send (see Section 3.4). LinkedIn also gives us aggregated reports about how our ads perform; those reports do not tell us who you are. The Service does not connect to LinkedIn or use LinkedIn's API. If you choose to upload a LinkedIn profile you have saved as a PDF, we treat it like any other resume file you upload.

Please don't upload information we don't need. The Service is not designed to hold sensitive information such as health information, government ID numbers (for example Social Insurance Numbers), or banking details. Please remove that kind of information from resumes and documents before uploading them.

3.4 Advertising measurement on the Site (LinkedIn)

We advertise on LinkedIn. To learn whether those ads work, the Site (ppmpready.com) uses the LinkedIn Insight Tag, a small piece of code provided by LinkedIn. The Service (app.ppmpready.com) does not use it.

What the Insight Tag collects. When you visit the Site, the tag loads a script from LinkedIn, and LinkedIn may set or read its own cookies and a similar LinkedIn ad identifier in your browser (see Section 12). The tag sends LinkedIn the address of the page you are on, the page you came from, your IP address (which LinkedIn truncates or hashes), your browser and device type, and the time of your visit. When you send our request-access form, the tag also tells LinkedIn that a form was submitted. We do not send LinkedIn the name, email, firm or message you type into the form.

What we keep with your request. If the link you arrived on includes campaign details, the Site keeps them in your browser's session storage until you close the tab, and sends them with any request-access form you submit. These details are: the campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content and utm_term), the LinkedIn click identifier (li_fat_id) if there is one, and the page you first landed on. We store them with your request in our database and include them in the internal email that tells our team about your request.

Why we use it. To see which ads and pages lead to requests, to decide where to spend our advertising budget, and to read the aggregated results LinkedIn reports to us. We do not use this information to make decisions about you.

What LinkedIn does with it. For visitors in Canada, the data goes to LinkedIn Corporation in the United States. LinkedIn is not only our service provider: it also uses this data for its own purposes under its own policies. Depending on your LinkedIn settings, that includes matching a visit to a LinkedIn account to measure ads and to improve how LinkedIn delivers ads. LinkedIn reports results to us only in aggregate and does not tell us who visited. LinkedIn says it removes information that directly identifies a member within seven days and deletes the remaining pseudonymized data within 180 days. See LinkedIn's Privacy Policy and LinkedIn's Cookie Policy.

We do not upload customer or lead lists to LinkedIn, and we do not use Site visits to build LinkedIn retargeting audiences.

Your choices.

• In your browser: block or delete cookies, or use a private window. The Site works normally without them.
• If you have a LinkedIn account: turn off "Data from others for ads" and "Measure ad success" in the Advertising data section of your LinkedIn settings. See how LinkedIn uses data from others for ads.
• If you don't have a LinkedIn account: use LinkedIn's guest opt-out. It applies only to the browser you use and is lost if you clear your cookies.
• Campaign details already sent with a request: ask us to delete them through the contact form on ppmpready.com.

4. How we use information

We use personal information only for purposes that a reasonable person would consider appropriate in the circumstances. Those purposes are to:

1. Provide the Service, including creating accounts, storing documents, running AI analysis of PPMP documents against regulator requirement packs, producing scorecards and gap lists, sending regulatory alerts, managing employee acknowledgments and sign-offs, and keeping the action log.
2. Provide PACE, including reading your resume into a profile, suggesting courses, keeping your CPD Activities log, sending renewal and CPD reminders, and helping you prepare CAPG application materials.
3. Send service emails, such as reminders, acknowledgment requests, alerts, account notices, security notices and receipts.
4. Process payments, manage subscriptions, and keep financial records.
5. Provide support and respond to your questions.
6. Protect the Service and our users, including detecting, preventing and investigating fraud, abuse, security incidents and violations of our Terms of Service.
7. Maintain and improve the Service, including troubleshooting and analyzing usage in aggregated or de-identified form.
8. Measure our advertising, using the LinkedIn Insight Tag and the campaign details described in Section 3.4.
9. Send marketing messages, only where permitted by law (see Section 11).
10. Comply with law, respond to lawful requests, and establish, exercise or defend legal claims.

We will not use your personal information for a new purpose without telling you and, where required, getting your consent.

5. AI processing

Some features use artificial intelligence (AI) services provided by third-party large language model (LLM) providers. We currently use Anthropic (Claude) and Google (Gemini). These features include PPMP document analysis, scorecards and gap lists, regulatory alert review, course suggestions, and PACE resume reading. If we add or change AI providers, we will update this policy.

What this means for you:

• Your content is sent to an AI provider for processing. When you use an AI feature, the relevant text (for example the text of a PPMP document) is sent to one of these providers through its API so its model can generate a result. That result is then returned to us. The calls are made from our servers, not from your browser.
• Resumes. AI resume reading is off unless your firm's administrator turns it on. When it is on, only the extracted text of your resume (up to about 12,000 characters) is sent to the AI provider. The resume file itself is never sent. Our logs record only technical details about the request, not the resume text.
• Training. We do not use your content to train our own AI models. We use their API and do not opt in to training where the provider lets us disable it. In particular:

- Anthropic's commercial terms say it may not train its models on customer content sent through its API. - Google's Gemini API terms say that on paid services Google does not use prompts or responses to improve its products. Google's terms for unpaid (free-tier) use are different and allow Google to use content to improve its products.

• Provider retention. AI providers keep inputs and outputs for a limited time under their own terms, mainly for abuse and safety monitoring. Anthropic says it deletes API inputs and outputs within about 30 days, but may keep content flagged for policy violations for up to 2 years. Google says it keeps Gemini API prompts and responses on paid services for up to 55 days for abuse monitoring. Unless we have a separate agreement with a provider, its standard retention applies.
• AI output can be wrong. AI-generated scorecards, gap lists and profiles may be incomplete or inaccurate. A qualified person should review them. We do not use AI to make decisions that have legal or similarly significant effects on individuals. Your firm and its professionals make all decisions.

6. Who can see your information inside your firm

Within your firm's workspace, users with administrator or similar permissions may be able to see documents, staff lists, acknowledgment and sign-off status, action log entries, and other workspace content.

PACE visibility. If your firm gives you a PACE seat, your firm's administrators and compliance officers ("officers") can see different things depending on your sharing choices:

• Always visible to officers (status and counts only):

- your name, email, role, job title and discipline; - your seat start date, professional designation and registration number; - your renewal date, current CPD period, days to renewal, and whether you are required to report CPD or exempt; - your PACE plan status (none, draft or signed), version number and signed date; - the number of CPD activities you have logged (total, technical and other), and whether you have met the minimum; - your myAPEGA module records (module names, completion dates and counts); - whether you have opted out of reminders, and when the last reminder was sent; and - whether you have chosen to share your plan content and evidence.

Officers can export this status information as a spreadsheet (CSV).

• Visible only if you choose to share (sharing is off by default):

- Plan content: your PACE plan drafts and signed plan versions, your CPD activity entries with their descriptions, and your five-year career track. - Evidence: your CPD evidence list and the evidence files you upload.

You can turn each kind of sharing on or off in PACE.

• Never visible to your firm: your resume file, and your private PACE profile details (such as an exemption note and your sharing settings), other than the status fields listed above. Only you can open your resume file.

If you ask someone to review your PACE plan through the Service, that reviewer can see the plan version you sent them.

Our staff. A small number of PPMP Ready staff can access account and PACE data when needed to provide support, operate and secure the Service, or comply with law. Our staff cannot open your resume file.

7. How we share information

We do not sell personal information. We do not rent or trade it. The only advertising-related sharing is the LinkedIn Insight Tag on the Site, which sends LinkedIn information about Site visits so we can measure our ads (see Section 3.4). You can block the tag in your browser's cookie settings or with an ad blocker, and you can opt out in LinkedIn's ad settings.

We share personal information only as follows:

7.1 Service providers

We use trusted service providers to run our business. They may handle personal information only to provide services to us, and must protect it.

LinkedIn. We use LinkedIn to advertise and, through the Insight Tag on the Site, to measure those ads. LinkedIn is not only our service provider: LinkedIn Corporation (United States) also uses the information the tag sends for its own purposes, under LinkedIn's Privacy Policy. See Section 3.4. We do not use any other analytics, advertising or tracking provider.

7.2 Other sharing

• Within your firm, as described in Section 6.
• At your direction. For example, if you export a document or CAPG material and send it to a regulator, the Government of Alberta or a training provider, that recipient's own privacy practices apply. We do not send information to regulators or government bodies on your behalf unless you clearly ask us to.
• Legal reasons. We may share information if we believe in good faith that the law requires it, for example to respond to a subpoena, court order or other lawful request, or to protect the rights, safety or property of our users, the public or PPMP Ready.
• Business transfers. If we are involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction. It will remain subject to protections consistent with this policy, and we will notify you where required by law.

8. Where your information is stored (cross-border transfers)

Our main database and file storage, including PPMP documents, resumes and CPD evidence, are hosted in Canada (Montréal). However, PPMP Ready is a US company, and some of your personal information is processed outside Canada:

• emails are sent through our email provider in the United States;
• content sent for AI processing goes to our AI providers, mainly in the United States;
• the server functions that handle AI requests, text extraction and emails run on a global network and may process data outside Canada;
• when you visit the Site, the LinkedIn Insight Tag sends information about your visit to LinkedIn, mainly in the United States;
• the web app and Site files are delivered from a global network; and
• our staff, and our payment and banking providers, are in the United States.

While it is outside Canada, your information is subject to the laws of those countries. That may include lawful access by courts, law enforcement and national security authorities there.

We use contracts and other measures with our service providers so that your information receives a level of protection comparable to what it would receive in Canada.

Alberta residents: You can get written information about our policies and practices for service providers outside Canada, or ask questions about how those providers collect, use, disclose or store personal information for us. To do so, contact our Privacy Officer through the contact form on ppmpready.com.

9. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires.

If we use personal information to make a decision that directly affects you, we will keep it long enough for you to be able to ask for access to it, as required by Canadian law.

10. How we protect information

We use reasonable administrative, technical and physical safeguards suited to the sensitivity of the information. These include:

• Encryption. Information is encrypted in transit (TLS). Our database and file storage provider, Supabase, states that it encrypts customer data at rest with AES-256, which covers our database and stored files, including resumes and CPD evidence.
• Access controls. Database and storage rules limit each user to the information they are allowed to see. Resume and evidence files are kept in private storage, and file downloads use short-lived links that expire after about two minutes.
• Limited staff access, to those who need it.
• Security headers on the Site and the app that help protect against common web attacks.

Sign-in. You sign in with your email and password, through our provider Supabase. Multi-factor authentication is not currently available in the Service, so please use a strong password that you do not use anywhere else.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your login credentials confidential and tell us right away if you suspect unauthorized access to your account.

Breaches. If a privacy breach happens involving personal information under our control, we will assess it promptly. Where the law requires, for example under PIPEDA and Alberta PIPA where there is a real risk of significant harm, we will notify affected individuals, the relevant privacy commissioner and other organizations. Where we handle information on behalf of a firm, we will notify that firm without undue delay so it can meet its own obligations.

11. Emails from us

• Service emails. These include reminders, acknowledgment requests, regulatory alerts, receipts, and security and account notices. They are sent from mail.ppmpready.com through our provider Resend, with open and click tracking turned off. They are part of the Service, and you may not be able to opt out of essential ones while you have an account. You can opt out of PACE reminder emails in the app.
• Marketing emails. We send commercial electronic messages only in line with Canada's Anti-Spam Legislation (CASL) and the US CAN-SPAM Act. Every marketing email includes our identification and an easy way to unsubscribe. We process unsubscribe requests within 10 business days.

12. Cookies and similar technologies

• Site (ppmpready.com). The Site uses the LinkedIn Insight Tag (see Section 3.4). The tag loads a script from LinkedIn, and LinkedIn may set or read its own cookies and a similar LinkedIn ad identifier in your browser. Examples include li_fat_id, li_giant, li_sugr, bcookie, lidc, UserMatchHistory and AnalyticsSyncHistory, lasting from about a day to a year. Names change over time; see LinkedIn's cookie table. These are advertising-measurement cookies, not strictly necessary ones. The Site itself does not set cookies. It keeps campaign details from the link you arrived on in your browser's session storage until you close the tab.
• Service (app.ppmpready.com). The app does not set cookies. To keep you signed in, it stores your login session in your browser's local storage. This is strictly necessary for the Service to work, and it is not used for tracking. The app does not use analytics, advertising or tracking tools.

Apart from the LinkedIn Insight Tag on the Site, we do not use advertising or cross-site tracking cookies. You can block the tag in your browser's cookie settings or with an ad blocker, and you can opt out in LinkedIn's ad settings.

You can clear your browser's storage through your browser settings at any time. If you do, you will be signed out of the Service.

13. Your rights and choices

Subject to the limits the law allows, you can:

• Access the personal information we hold about you, and learn how it has been used and to whom it has been disclosed;
• Correct personal information that is inaccurate or incomplete;
• Withdraw consent to our use of your personal information, with reasonable notice. If you withdraw consent, we may no longer be able to provide some or all of the Service;
• Delete your account, PACE profile or resume file, or ask us to delete personal information we no longer need;
• Control sharing of your PACE plan content and evidence with your firm; and
• Unsubscribe from marketing emails at any time.

How to make a request. Use the contact form on ppmpready.com and tell us what you are asking for. We may need to confirm your identity before acting on your request. We will respond within 30 days, or within any longer period the law allows, and we will tell you if we need more time. We usually do not charge for requests. If a fee applies, we will tell you in advance.

If your request is about information your firm put into the Service, we may send your request to your firm and help the firm respond.

US residents. Depending on the state you live in, you may have additional rights under state privacy laws. Contact us to make a request. We will not discriminate against you for exercising your rights.

Complaints. If you have a concern, please contact our Privacy Officer first so we can try to resolve it. You also have the right to complain to a privacy regulator:

• Office of the Privacy Commissioner of Canada: www.priv.gc.ca
• Office of the Information and Privacy Commissioner of Alberta: www.oipc.ab.ca
• Office of the Information and Privacy Commissioner for British Columbia: www.oipc.bc.ca

14. Children

The Site and Service are for professionals and businesses. They are not directed to anyone under 18 years of age, and we do not knowingly collect personal information from children.

15. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify account holders by email or through the Service before the changes take effect. Where the law requires, we will ask for your consent. The "Last updated" date at the top shows when the policy was last changed.

16. Contact us

For privacy questions, requests or complaints, contact our Privacy Officer, or for anything else contact our support team, through the contact form on ppmpready.com.

PPMP Ready LLC Attn: Privacy Officer Mailing address available on request through the contact form.