BLACKFOX SOFTWARE LTD

PRIVACY POLICY

Version: 1.4

Version Date: October 30, 2026

Effective Date: October 30, 2026

This Privacy Policy describes how BlackFox Software Ltd ("BlackFox", "we", "our", or "us") collects, uses, discloses, and safeguards personal information in connection with our restaurant operations software (the "BlackFox Platform"), our websites at goblackfox.com and related domains (the "Websites"), and any related services (together, the "Services").

BlackFox is a corporation existing under the laws of British Columbia, with its registered office at 201-19 Dallas Road, Victoria, BC V8V 5A6.

This Privacy Policy applies to personal information handled by BlackFox in connection with the Services and the Websites. If you do not agree with this Privacy Policy, please do not access or use the Services or the Websites.

1. About This Privacy Policy#

1.1 The Two Roles BlackFox Plays. BlackFox handles personal information in two different capacities:

(a) As a service provider (processor) for Client Data. When a restaurant, hospitality business, or other organization (a "Client") uses the BlackFox Platform, the Client submits personal information about its employees and others (for example, names, contact information, hours worked, tip allocations, and payout records). BlackFox processes that personal information on the Client's behalf, in accordance with the Client's instructions and the Master Services Agreement between BlackFox and the Client. The Client, not BlackFox, is the organization primarily responsible under applicable privacy law for that information.

(b) As the controller of information BlackFox collects for its own purposes. When BlackFox collects information about visitors to the Websites, prospective clients, individuals who contact us, or account administrators at a Client, BlackFox itself determines how that information is used and is primarily responsible under applicable privacy law.

Where this Privacy Policy refers to information BlackFox handles as a service provider, questions and requests should generally be directed to the applicable Client. Where BlackFox is the controller, questions and requests should be directed to BlackFox using the contact information in Section 12.

1.2 Applicable Laws. This Privacy Policy is designed to comply with the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA") and the Personal Information Protection Act (British Columbia) ("PIPA"). Where BlackFox handles personal information subject to the privacy laws of other Canadian provinces, we handle that information in accordance with the applicable law.

2. Information We Collect#

2.1 Client Data. Clients and Authorized Users submit personal information to the BlackFox Platform in the course of using the Services. This may include:

(a) employee identifying information (name, contact information, position);

(b) employee email addresses and telephone numbers, used to deliver tip and wage payouts;

(d) tip allocations and payout records; and

(e) other operational information about the Client's business.

BlackFox handles Client Data as a service provider, in accordance with the Master Services Agreement with the applicable Client. This Privacy Policy does not describe or govern the Client's own collection, use, or disclosure of Client Data; those are the Client's responsibility.

2.2 Account Information. When a Client is set up on the Services, we collect information about the Client organization and its designated administrators, including business name, contact information, billing information, banking or credit card information for payment of Fees, and administrator names and email addresses.

2.3 Website Information. When you visit the Websites, we may collect:

(a) IP address, device information, browser type, operating system, and referral URL;

(b) pages viewed, time spent on pages, and clicks;

(d) cookies and similar technologies described in Section 2.6.

2.4 Support and Communications. When you contact BlackFox by email, phone, or through the Services, we collect the information you provide, including your name, contact details, and the content of your communication. If you subscribe to marketing communications, we collect your email address and any preferences you provide.

2.5 Employee Information (of BlackFox). We collect and use personal information about our own employees and contractors as necessary to run our business. This Privacy Policy does not describe BlackFox's handling of its own employees' information; that is governed by our internal policies.

2.6 Cookies and Similar Technologies. The Websites and the BlackFox Platform use cookies and similar technologies for authentication, session management, security, analytics, and (on the Websites) marketing measurement. You can manage cookies through your browser settings; disabling cookies may affect the functionality of the Services.

3. How We Use Personal Information#

3.1 Client Data. We use Client Data only:

(a) to provide, maintain, secure, and improve the Services on behalf of the applicable Client;

(b) to prevent or address service, security, support, or technical issues;

(d) as required or permitted by applicable law.

3.2 Account Information. We use account information to establish and administer Client accounts, process payments, send service-related notifications, and provide support.

3.3 Website Information. We use website information to operate and improve the Websites, understand how visitors interact with our content, prevent fraud and abuse, and (where consent has been obtained) provide marketing information about our Services.

3.4 Support and Communications Information. We use this information to respond to your requests, provide support, communicate with you about the Services, and (where you have consented) send marketing communications.

3.5 Aggregated and De-identified Information. We may create aggregated or de-identified information from any of the categories above and use it for any lawful business purpose, including improving the Services, benchmarking, and analytics. Aggregated and de-identified information does not identify any individual and is not personal information.

4. Legal Basis for Handling Personal Information#

BlackFox handles personal information on the following bases, as applicable:

(a) Consent, where you or the applicable Client have consented to the collection, use, or disclosure of the personal information;

(b) Contract, where the handling is necessary to perform a contract with the individual or with the applicable Client;

(d) Legitimate business purposes recognized under PIPEDA and PIPA, including preventing fraud, ensuring the security of the Services, and improving the Services, in each case subject to any express-consent requirements that apply.

5. How We Share Personal Information#

5.1 Sub-Processors. We share personal information with third-party service providers that help us deliver the Services. Our material sub-processors are:

(a) Cloud hosting and infrastructure — DigitalOcean, LLC (hosting of the BlackFox Platform, in Canada);

(b) Backup storage — Amazon Web Services, Inc. (backups of the BlackFox Platform, in Canada);

(d) Payment services — Zum Rails Inc. (electronic payouts, for Clients who use the Payment Services);

(e) Customer support — Anthropic, PBC (drafting responses to support requests);

(f) Accounting and collection of Fees — Intuit Inc. (QuickBooks); and

(g) Marketing email — The Rocket Science Group LLC (Mailchimp, an Intuit company).

This list is maintained in this Privacy Policy in accordance with Section 12.5(c) of the Master Services Agreement. Each sub-processor is subject to written obligations that protect personal information at a standard consistent with PIPEDA and PIPA.

5.2 At the Direction of the Client. For Client Data, we share personal information as directed by the applicable Client, including through settings and features the Client uses within the Services.

5.3 Legal Process. We may share personal information if we reasonably believe it is required or permitted by applicable law, legal process, or a lawful request from a governmental or regulatory authority. Where we are legally permitted to do so, we will notify the affected Client of a request for Client Data before disclosure.

5.4 Corporate Transactions. If BlackFox is involved in a merger, acquisition, financing, corporate reorganization, sale of all or substantially all of its assets, or similar transaction, personal information may be transferred as part of the transaction, subject to confidentiality obligations.

5.5 Affiliates. We may share personal information with our corporate affiliates, including our parent DarkBlack Endeavour, for business administration, professional services (including accounting), and other legitimate business purposes, subject to confidentiality obligations consistent with this Privacy Policy.

5.6 With Your Consent. We may share personal information with third parties in other circumstances with your consent.

6. International Data Transfers#

The BlackFox Platform is hosted in Canada, and its backups are stored in Canada. Certain sub-processors identified in Section 5.1 store or process personal information in the United States, specifically our customer support, transactional email, marketing email, and accounting providers. Where personal information is transferred outside of Canada, that information may be subject to the laws of the jurisdiction in which it is stored or processed, including laws that permit access by law enforcement or governmental authorities. We take reasonable steps to ensure that transfers of personal information outside of Canada are protected at a standard consistent with PIPEDA and PIPA.

7. How Long We Keep Personal Information#

7.1 Client Data. We retain Client Data in accordance with the Master Services Agreement with the applicable Client. Following termination or expiry of a Subscription Term, the Client may obtain an export of Client Data by written request made within 30 days, in accordance with Section 5.6 of the Master Services Agreement. After that period, Client Data is deleted within 90 days. Copies may persist in backup and archival systems for up to 90 days following deletion.

7.2 Account Information. We retain Client account information for as long as the Client relationship continues, and for a reasonable period after termination to enforce our agreements, comply with legal obligations, resolve disputes, and maintain business records. Financial records are retained for at least seven years to comply with Canadian tax and business record requirements.

7.3 Website and Marketing Information. We retain website and marketing information for as long as necessary to fulfil the purpose for which it was collected. Marketing subscribers can unsubscribe at any time; we retain unsubscribe records to honour those requests.

7.4 Support and Communications. We retain support communications for a reasonable period after the matter is resolved, generally no longer than two years, except where retention for a longer period is necessary for legal or business reasons.

7.5 Deletion and De-identification. When we no longer need personal information, we delete it or de-identify it in accordance with our standard practices. Some information may persist in backups or archival systems for a limited period after deletion; that information remains subject to this Privacy Policy for so long as it is retained.

8. Security#

We maintain administrative, physical, and technical safeguards designed to protect personal information against loss, misuse, unauthorized access, disclosure, alteration, or destruction. These safeguards include encryption of personal information in transit and at rest where practicable, and access controls.

No system is perfectly secure. We cannot guarantee the security of information transmitted to or stored by us.

9. Breach Notification#

9.1 Client Data. Where a breach of security safeguards involves personal information contained in Client Data, BlackFox handles that information as a service provider, and the applicable Client is the organization responsible for assessing the breach and for making any report to a regulator or notification to affected individuals. BlackFox will notify the affected Client without undue delay in accordance with Section 12.4 of the Master Services Agreement, and will provide the Client with the information reasonably necessary for the Client to meet those obligations.

9.2 Information BlackFox controls. Where a breach of security safeguards involves personal information under BlackFox's own control, and it is reasonable to believe that the breach creates a real risk of significant harm to an individual, BlackFox will report the breach to the Privacy Commissioner of Canada and notify affected individuals as required by PIPEDA and the Breach of Security Safeguards Regulations, together with any other regulator to which reporting is required.

10. Your Rights#

Subject to applicable law and the roles described in Section 1.1, you have the following rights in respect of personal information that BlackFox holds about you as a controller:

10.1 Access. You may request access to the personal information we hold about you and receive information about how it has been used and to whom it has been disclosed.

10.2 Correction. You may request correction of personal information that is inaccurate or incomplete.

10.3 Withdrawal of Consent. You may withdraw consent to our handling of your personal information, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may affect our ability to provide the Services to you.

10.4 Marketing Communications. You may opt out of marketing communications at any time by following the unsubscribe instructions in any marketing email or by contacting us using the information in Section 12.

10.5 Client Data. For personal information contained in Client Data (where BlackFox is a service provider), requests should generally be directed to the applicable Client. We will assist the Client in responding to requests as required by the Master Services Agreement.

10.6 How to Exercise Your Rights. To exercise any of these rights, please contact us using the information in Section 12. We may need to verify your identity before responding. We will respond within the timeframe required by applicable law, generally 30 days for PIPEDA and PIPA requests. There is no fee for reasonable requests.

11. Children#

The Services are not directed to individuals under 16 years of age, and we do not knowingly collect personal information from individuals under 16 through the Services or the Websites. If we become aware that we have collected personal information from an individual under 16 through the Services or the Websites in violation of this Privacy Policy, we will delete that information. Client Data about individuals under 16 (for example, employee records for underage workers) is handled by the Client in accordance with applicable law and the Client's own privacy practices.

12. Contact Us#

Questions, comments, or requests relating to this Privacy Policy or our handling of personal information may be directed to:

BlackFox Software Ltd Attention: Privacy Box 39025 James Bay Victoria, BC V8V 4X8 Email: admin@goblackfox.com

If you are not satisfied with our response to a privacy inquiry or complaint, you may contact:

For matters governed by PIPEDA: Office of the Privacy Commissioner of Canada 30 Victoria Street Gatineau, QC K1A 1H3 Telephone: 1-800-282-1376 Website: priv.gc.ca

For matters governed by PIPA (British Columbia): Office of the Information and Privacy Commissioner for British Columbia PO Box 9038 Stn Prov Govt Victoria, BC V8W 9A4 Telephone: 250-387-5629 Website: oipc.bc.ca

13. Changes to This Privacy Policy#

We may update this Privacy Policy from time to time. We will post the updated Privacy Policy at https://goblackfox.com/legal/privacy with an updated effective date. Where a change materially affects your rights, we will provide additional notice by email or through the Services. Your continued use of the Services or the Websites after the updated effective date constitutes acceptance of the updated Privacy Policy.

End of Privacy Policy