Privacy Policy

Relationship To Terms Of Service

This Privacy Policy is incorporated into the Company's Terms of Service by reference. The Terms of Service are the controlling instrument governing the commercial relationship between the Company and its clients. In the event of any inconsistency between this Privacy Policy and the Terms of Service, the Terms of Service control with respect to commercial, intellectual property, ownership, liability, indemnification, and risk-allocation matters; this Privacy Policy controls with respect to the technical mechanics of personal information handling.

In particular, this Privacy Policy does not modify Section 12 of the Terms of Service (Deliverables, Ownership & Usage), which governs the ownership and licensed use of imagery and other deliverables, including the Company's portfolio rights.

1Accountability

The Company is responsible for personal information under its control and has implemented policies and procedures to ensure compliance with Canadian privacy laws. We have designated a Privacy Officer responsible for compliance with this Policy and PIPEDA.

PRIVACY OFFICER

Anthony Morra Smart Earth Build Solutions Toronto, Ontario, Canada Email: contact@smartearthbuildsolutions.com

Individuals may contact the Privacy Officer regarding:

• questions about this Policy
• requests to access personal information
• corrections or deletion requests
• requests for removal from aerial imagery (see Section 6)
• complaints regarding privacy practices

2Identifying The Purposes For Collection

We collect personal information only for purposes that a reasonable person would consider appropriate in the circumstances. These purposes include:

SERVICE DELIVERY

• providing professional drone photography, videography, and aerial data services
• preparing quotes, estimates, and proposals
• scheduling flights, site visits, and consultations
• managing contracts, work orders, and project communications
• capturing aerial imagery and video as requested by the client

CUSTOMER RELATIONSHIP MANAGEMENT

• responding to inquiries and booking requests
• providing customer support and flight updates
• maintaining client records and project history
• managing cancellations, rescheduling, and refunds

BUSINESS OPERATIONS

• processing payments and maintaining financial records
• managing insurance and liability documentation
• complying with Transport Canada regulations (flight logs, registration, pilot certificates)
• meeting legal, tax, or regulatory obligations

WEBSITE FUNCTIONALITY

• responding to website contact forms and booking requests
• analytics to improve website performance
• security monitoring

MARKETING (with consent only)

• sending newsletters, promotions, and updates to individuals who have opted in, in compliance with Canada's Anti-Spam Legislation (CASL)

3Consent

We obtain knowledge and consent before collecting, using, or disclosing personal information except where permitted or required by law.

Consent may be obtained through:

• signed Engagement Documents (quotes, work orders, contracts)
• online booking forms
• website contact forms
• documented verbal consent during consultations (with written follow-up confirmation for any sensitive matters)
• email communication
• express opt-in for marketing communications

Individuals may withdraw consent at any time, subject to legal or contractual restrictions, by emailing the Privacy Officer at contact@smartearthbuildsolutions.com with the subject line "Withdrawal of Consent." We will action withdrawal requests within fifteen (15) business days. Withdrawal of consent may prevent the Company from continuing to provide services and does not apply retroactively to information already lawfully collected, used, disclosed, or licensed prior to the date of withdrawal (including imagery already delivered to or licensed by the Company under the Terms of Service).

4Limiting Collection

We limit the collection of personal information to what is necessary for the purposes identified in this Policy.

Examples of information we may collect:

CONTACT INFORMATION

• name; phone number; email; mailing address; property or event location address

PROJECT INFORMATION

• property details (real estate listings, resort grounds, construction sites)
• event details (date, venue, schedule)
• flight instructions or shot requests
• photos or site documentation provided by the client

FLIGHT & OPERATIONAL INFORMATION (retained for Transport Canada compliance)

• flight dates, times, and durations
• flight logs, telemetry data, and maintenance records
• drone registration and pilot certificate numbers
• GPS coordinates and altitude data associated with flights

AERIAL IMAGERY DATA

• photographs, video, and 3D models captured by the Company's RPAS
• location metadata (GPS / EXIF data) embedded in such imagery
• LiDAR or photogrammetric point-cloud data
• faces, license plates, addresses, or other identifying details incidentally captured during flight (see Section 6)

FINANCIAL INFORMATION

• billing details
• payment information (processed via secure third-party payment processors)
• invoices and receipts

We do not collect personal information indiscriminately and ensure all information is collected through fair and lawful means.

5Limiting Use, Disclosure, And Retention

Personal information is used only for the purposes for which it was collected unless additional consent is obtained or disclosure is required by law.

Information may be shared with:

• subcontractors or visual observers assisting with a flight (under confidentiality obligations)
• payment processors when introduced (e.g., Stripe, PayPal)
• hosting and form-processing providers (e.g., Netlify)
• video hosting providers (e.g., Cloudflare Stream)
• cloud storage and email providers (e.g., Google Workspace, Dropbox)
• mapping and processing providers (e.g., Pix4D, DroneDeploy, where applicable)
• insurers (for claims or policy administration)
• legal or regulatory authorities (Transport Canada, NAV CANADA, law enforcement) when required by law

Personal information is retained only as long as necessary to:

• complete the contracted services
• maintain financial records (CRA: typically seven (7) years)
• maintain flight records and logs (Transport Canada: as required)
• comply with legal and tax obligations

Once no longer required, personal information is securely destroyed or anonymized. Aerial imagery deliverables and raw footage are retained according to the Company's standard practice (typically up to five (5) years from project completion) unless a longer or shorter retention period is required by contract or law.

6Aerial Imagery And Bystander Privacy

The nature of drone services means that aerial photography and video may incidentally capture identifiable individuals, vehicles (including license plates), private property, and other potentially identifying details ("Incidental Data"). The Company addresses this as follows.

• plans flights to minimize incidental capture of non-subject persons and properties where reasonably feasible
• on request from the Client (and at the Client's cost where applicable), blurs faces, license plates, or other identifying details prior to publication of imagery
• does not publish imagery of identifiable individuals without an appropriate legal basis (which may include the Client's representation under Section 12 of the Terms of Service that required releases have been obtained)

THIRD-PARTY REQUESTS FOR REMOVAL OR ANONYMIZATION. Any individual who appears in publicly displayed Company imagery (such as on the Company's website or social media) and wishes to be removed, anonymized, or blurred may submit a request to the Privacy Officer. The Company will:

• acknowledge the request within five (5) business days
• assess the request and respond within thirty (30) days
• where the request is granted, remove or anonymize the imagery on Company-controlled platforms within thirty (30) days, subject to reasonable technical limitations

The Company's obligations under this Section apply only to imagery displayed on Company-controlled platforms and do not extend to imagery licensed to or republished by clients or third parties.

7Accuracy

We make reasonable efforts to ensure personal information is accurate, complete, and up to date. Clients may request corrections by emailing the Privacy Officer.

8Safeguards

We implement physical, organizational, and technological safeguards to protect personal information from unauthorized access, loss, theft, disclosure, or misuse.

PHYSICAL: secure offices and storage; restricted access to sensitive documents.

TECHNICAL: password-protected computers and accounts; multi-factor authentication where supported; secure cloud storage with encryption at rest; encrypted data transmission (TLS 1.2 or higher) for all transfers of sensitive data.

ORGANIZATIONAL: limited access to personal information on a need-to-know basis; written confidentiality obligations for subcontractors; internal privacy procedures and periodic review.

9Cross-Border Data Transfers

The Company uses third-party service providers that may store or process personal information outside of Canada, including in the United States. Personal information transferred outside of Canada may be subject to the laws of the foreign jurisdiction, including lawful access requests by foreign government authorities (such as under the U.S. CLOUD Act). The Company contracts with service providers that provide a comparable level of protection for personal information and takes reasonable steps to ensure compliance with PIPEDA's accountability principle for transferred data.

Examples of foreign-located service providers include U.S.-based cloud storage providers, payment processors, and analytics tools listed in Section 11.

10Website Privacy And Cookies

Our website may collect limited technical information including IP address, browser type, device information, and pages visited. This information may be collected using cookies and similar technologies.

We use the following categories of cookies:

• ESSENTIAL: required for the website to function (e.g., session management, security). These cannot be disabled
• ANALYTICS: used to measure website performance and improve user experience (e.g., Google Analytics)
• MARKETING: used only with opt-in consent to deliver relevant content. Not used unless you opt in

You may manage cookie preferences through the cookie banner displayed on the website or by adjusting your browser settings to refuse cookies. Refusing non-essential cookies will not affect your ability to use the core features of the website.

11Third-Party Services

Our website and operations may involve third-party services, which may change from time to time. As of the effective date of this Policy, these include or may include:

• WEBSITE HOSTING: Netlify (United States)
• WEBSITE FORM PROCESSING: Netlify Forms (United States) — used to receive and store submissions from the website contact form; a copy of each submission is delivered to the Privacy Officer's email and a copy is retained in the Netlify dashboard
• DOMAIN REGISTRATION: Wix (Israel/United States), retained from a prior arrangement, scheduled to transition to a different registrar at renewal
• VIDEO HOSTING & STREAMING: Cloudflare Stream (United States) — used to host and serve video content displayed on the Company's website
• EMAIL & PRODUCTIVITY: Google Workspace (United States), including Gmail for the contact@smartearthbuildsolutions.com inbox
• PAYMENT PROCESSORS: To be selected; Stripe or PayPal may be used for invoicing and online payment when introduced
• ANALYTICS: Privacy-respecting website analytics may be introduced (e.g., Plausible, Fathom, or Google Analytics 4); none active as of the effective date of this Policy
• CLOUD STORAGE: Google Drive (within Google Workspace), with Dropbox or other providers used as required for specific client engagements
• DRONE SOFTWARE / DATA: DJI services (where applicable), and mapping or processing tools such as Pix4D or DroneDeploy where used for a specific engagement
• SOCIAL MEDIA: TikTok and any other platforms where the Company maintains a public presence; please consult those platforms' own privacy policies for their data handling

These service providers are required, by contract or by their published terms, to protect personal information and use it only for the services they provide. Some of these providers store data outside Canada (see Section 9).

12Children'S Privacy

The Company's services are not directed at children. The Company does not knowingly collect personal information directly from children under the age of thirteen (13) without parental consent.

Where drone services are provided at events that include children (including weddings, school functions, and family gatherings), the Client (or the event organizer, where applicable) is responsible for obtaining all necessary parental or guardian consents for the capture and use of imagery of minors, consistent with Section 12 of the Terms of Service (Model and Property Releases).

13Marketing Communications (Casl)

The Company complies with Canada's Anti-Spam Legislation (CASL). Commercial electronic messages are sent only with express or implied consent and include:

• clear identification of the Company as sender
• a valid mailing address and contact information
• an unsubscribe mechanism that is functional for at least sixty (60) days following the message

You may unsubscribe from marketing communications at any time using the mechanism in any commercial email or by contacting the Privacy Officer.

14Individual Access

You have the right to request access to personal information we hold about you. Upon written request to the Privacy Officer, we will:

• acknowledge the request within five (5) business days
• inform you whether we hold personal information about you
• provide access to that information
• explain how it has been used or disclosed
• respond within thirty (30) days, unless an extension is permitted under PIPEDA (in which case we will notify you in writing of the reason and expected timeline)

We may require reasonable identification to verify your identity before processing the request. There is no fee for routine access requests; if a request is unusually voluminous, we may charge a minimal fee with prior notice and your agreement.

15Challenging Compliance

You may challenge our compliance with this Policy by contacting the Privacy Officer. If concerns cannot be resolved directly, you may contact:

Office of the Privacy Commissioner of Canada Website: https://www.priv.gc.ca

16Data Breach Procedures

In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm, the Company will:

• notify affected individuals as soon as feasible
• report the breach to the Office of the Privacy Commissioner of Canada
• notify other organizations or government institutions where required
• maintain a record of the breach for at least twenty-four (24) months as required by the Breach of Security Safeguards Regulations under PIPEDA, regardless of whether notification is triggered

17Jurisdictional Scope

This Policy is designed to comply with PIPEDA and Ontario privacy law. The Company's services are offered primarily in Ontario. To the extent the Company collects personal information from individuals located in Quebec, the Company will take additional steps as required by Quebec's Act respecting the protection of personal information in the private sector (Law 25), including assessment of cross-border transfers and provision of additional disclosures on request. Individuals located in other jurisdictions should contact the Privacy Officer for information specific to their jurisdiction.

18Changes To This Privacy Policy

The Company may update this Policy from time to time to reflect changes in business practices, legal requirements, or services offered. The updated version will be posted on our website with an updated "Last Updated" date. Material changes will be communicated to active clients by email at least fourteen (14) days before they take effect. Your continued use of our services after the effective date of an update constitutes acceptance of the updated Policy.

19Contact Information

For questions, access requests, or privacy concerns, please contact:

Privacy Officer: Anthony Morra Smart Earth Build Solutions Toronto, Ontario, Canada Email: contact@smartearthbuildsolutions.com