Privacy Policy Effective Date: September 21, 2026 Last Updated: September 21, 2026 BasementCloud (“BasementCloud,” “we,” “us,” or “our”) is an Ontario-based technical managed service provider (“MSP”) committed to protecting the privacy and security of personal information entrusted to us. This Privacy Policy explains what personal information we collect, how we collect, use, disclose, retain, and protect it, and the choices and rights available to individuals. 1. Who We Are BasementCloud is a technical managed service provider located in Ontario, Canada. BasementCloud 46 Thornbush Crescent Waterloo, ON Canada N2T 1B2 Privacy Contact: privacy@basement.cloud Website: basement.cloud BasementCloud provides technical services including managed IT, cloud, cybersecurity, network, backup, monitoring, technical support, and related services. 2. Privacy Legislation BasementCloud is committed to complying with applicable Canadian privacy laws. Depending on the nature of the information and activity involved, this may include the Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable federal or provincial privacy legislation. PIPEDA establishes principles relating to accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, retention, accuracy, safeguards, openness, individual access, and challenging compliance. O Office of the Privacy Commissioner +1 This Privacy Policy is intended to explain our privacy practices in a clear and accessible manner. 3. Personal Information We Collect “Personal information” generally means information about an identifiable individual. Depending on how you interact with BasementCloud, we may collect: Name; Company and job title; Email address; Telephone and mobile telephone numbers; Business or mailing address; Account and billing information; Information provided through support tickets and service requests; Communications with BasementCloud; Login, authentication, and account-management information; Device, computer, network, system, and security information; IP addresses, logs, browser information, and similar technical information; Information necessary to provide managed IT, cybersecurity, cloud, backup, monitoring, and technical services; SMS/text-message opt-in information and communication preferences; and Other information reasonably necessary to provide our services or operate our business. We limit the collection of personal information to information that is reasonably necessary for identified purposes. O Office of the Privacy Commissioner 4. How We Collect Personal Information We may collect personal information: Directly from you; From your employer or organization when you are an authorized contact or user; When you contact us for technical support; When you submit a form or request information; When you create or use an account; Through our website; Through support, monitoring, security, and service-management systems; Through communications with BasementCloud; From service providers where reasonably necessary to provide our services; or From other sources where permitted by applicable law. 5. How We Use Personal Information We may use personal information to: Provide and administer our services; Provide managed IT and technical support; Respond to support requests and service tickets; Configure, maintain, monitor, troubleshoot, and secure IT systems; Provide cybersecurity, backup, cloud, networking, and related services; Manage customer accounts and relationships; Process payments and billing; Communicate about services, support requests, maintenance, outages, security matters, and accounts; Send marketing communications where permitted by law and where applicable consent has been obtained; Send SMS/text messages where you have provided the required consent or where otherwise permitted by law; Detect, investigate, and prevent fraud, abuse, security incidents, and unauthorized access; Maintain business and service records; Comply with applicable legal, regulatory, contractual, and professional obligations; Resolve disputes and enforce agreements; and Improve our services, systems, website, and customer experience. We will not use personal information for a new purpose that is incompatible with the purpose for which it was collected without obtaining additional consent where required by law. 6. Consent Where required by applicable law, BasementCloud will obtain meaningful consent before collecting, using, or disclosing personal information. Consent may be express or implied depending on the circumstances and applicable law. We generally seek express consent where information is sensitive or where the collection, use, or disclosure falls outside an individual's reasonable expectations. O Office of the Privacy Commissioner You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may affect our ability to provide certain services where the information is necessary to provide those services. O Office of the Privacy Commissioner 7. SMS and Text Messaging If you provide your mobile telephone number and opt in to receive SMS/text messages from BasementCloud, we may use your number to send the types of messages described at the time of opt-in. These messages may include: Service notifications; Support or appointment updates; Account-related communications; Security and maintenance notifications; and Marketing or promotional messages where applicable and where required consent has been obtained. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Your SMS opt-in information will not be sold, rented, or provided to third parties for their independent marketing campaigns. Where BasementCloud uses a third-party communications or SMS provider to deliver messages on our behalf, that provider may process information necessary to provide the messaging service. Such providers are not authorized to use your SMS opt-in information for their own independent marketing purposes. SMS Consent and Unsubscribe Commercial SMS messages may constitute commercial electronic messages (“CEMs”) under Canada's Anti-Spam Legislation (“CASL”). Where CASL applies, BasementCloud will obtain the required consent before sending CEMs and will provide the required identification information and a functional unsubscribe mechanism. The CRTC confirms that CASL applies to commercial text messages sent to mobile devices. C CRTC +1 You may withdraw consent to marketing SMS messages at any time by following the unsubscribe instructions contained in the message, such as replying STOP where supported, or by contacting us at privacy@basement.cloud. Unsubscribe requests will be processed in accordance with applicable law. Under CASL, unsubscribe requests must generally be honoured within 10 business days. C CRTC Withdrawing consent to marketing communications does not prevent BasementCloud from sending essential service, security, account, or other non-marketing communications where such communications are necessary and legally permitted. 8. How We Share Personal Information BasementCloud does not sell personal information. We may disclose personal information where reasonably necessary to operate our business and provide our services, including to: Cloud and technology service providers; Hosting and infrastructure providers; Cybersecurity, monitoring, backup, and communications providers; Payment processors; Contractors and service providers working on our behalf; Professional advisors, including lawyers, accountants, insurers, and auditors; Courts, regulators, government authorities, or law-enforcement agencies where required or permitted by law; A purchaser, successor, or other party involved in a merger, acquisition, financing, restructuring, or sale of all or part of our business; or Other parties where you have provided consent or disclosure is otherwise permitted or required by law. Where we engage a third party to process personal information on our behalf, we take reasonable steps to require that the information be protected and used only for authorized purposes. PIPEDA guidance specifically recognizes an organization's responsibility for information transferred to third-party processors. O Office of the Privacy Commissioner We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. 9. Customer Systems and Managed IT Services As an MSP, BasementCloud may have authorized access to customer systems, computers, servers, networks, applications, cloud environments, files, logs, credentials, communications, and other information. We access and process customer information only as reasonably necessary to: Provide contracted services; Troubleshoot and resolve technical issues; Monitor and maintain systems; Investigate or respond to security incidents; Perform cybersecurity services; Maintain backups and infrastructure; Respond to authorized customer requests; or Fulfill our contractual and legal obligations. Customers remain responsible for determining what personal information they collect and store within their own systems and for complying with privacy obligations applicable to their organization. Customer agreements, managed services agreements, data-processing agreements, or other contracts may impose additional requirements concerning customer information. 10. Website, Cookies, and Analytics Our website at basement.cloud may use cookies and similar technologies to: Operate and secure the website; Remember preferences; Understand website usage; Measure website performance; Detect abuse or security threats; and Improve our website and services. We may use third-party website, analytics, hosting, or security providers for these purposes. You may be able to control cookies through your browser settings or through any cookie-consent mechanism made available on our website. 11. Security Safeguards BasementCloud uses administrative, technical, and physical safeguards appropriate to the sensitivity of the personal information we handle. Safeguards may include: Access controls and least-privilege practices; Authentication and authorization controls; Encryption; Network and endpoint security; Logging and monitoring; Backup and recovery procedures; Security awareness and employee training; Physical security measures; and Incident-response procedures. PIPEDA requires organizations to protect personal information using safeguards appropriate to its sensitivity. O Office of the Privacy Commissioner Although we take reasonable precautions, no electronic transmission, storage system, or security measure can be guaranteed to be completely secure. 12. Data Retention We retain personal information only for as long as reasonably necessary to: Fulfill the purposes for which it was collected; Provide our services; Maintain appropriate business and financial records; Resolve disputes; Enforce agreements; Comply with legal obligations; and Protect our legitimate business interests. When personal information is no longer required, we will take reasonable steps to securely delete, destroy, or anonymize it, subject to applicable legal, contractual, backup, and record-retention requirements. 13. Access and Correction Subject to applicable law, you may request access to personal information that BasementCloud holds about you. You may also request that inaccurate, incomplete, or outdated personal information be corrected. We may need to verify your identity before processing an access or correction request. We will respond to requests in accordance with applicable privacy legislation. 14. Privacy Complaints If you have a question, concern, complaint, access request, correction request, or other inquiry regarding BasementCloud's privacy practices, please contact: Privacy Contact BasementCloud 46 Thornbush Crescent Waterloo, ON N2T 1B2 Canada Email: privacy@basement.cloud We will investigate privacy complaints and respond within a reasonable period and in accordance with applicable law. If you are not satisfied with our response, you may have the right to make a complaint to the applicable privacy regulator, including the Office of the Privacy Commissioner of Canada, depending on the legislation applicable to your circumstances. O Office of the Privacy Commissioner 15. Cross-Border Processing BasementCloud is located in Ontario, Canada and does not provide services specifically to customers in the United States. However, some third-party technology, cloud, hosting, communications, security, or other service providers we use may operate outside Ontario or Canada. As a result, personal information may in some circumstances be processed or stored outside Canada and may be subject to the laws of another jurisdiction. Where personal information is transferred to a third-party service provider for processing, BasementCloud takes reasonable steps to ensure that appropriate contractual or other safeguards are in place. Canadian privacy guidance recommends assessing risks associated with transfers to service providers outside Canada and using contractual or other measures to provide comparable protection. O Office of the Privacy Commissioner 16. Third-Party Websites and Services Our website or services may contain links to third-party websites, applications, or services. BasementCloud is not responsible for the privacy practices, security, or content of third-party websites or services. We encourage you to review the applicable privacy policies before providing personal information to third parties. 17. Children BasementCloud's services are intended primarily for businesses and adults. We do not knowingly collect personal information from children where such collection is not provisions. One operational item I would make sure is actually implemented before publishing is a documented process for recording SMS consent and handling STOP/unsubscribe requests, since CAS appropriate or permitted by law. If you believe a child has provided personal information to BasementCloud, please contact us at privacy@basement.cloud. 18. Changes to This Privacy Policy BasementCloud may update this Privacy Policy from time to time to reflect changes in our services, technology, business practices, or applicable legal requirements. When appropriate, we may provide notice of material changes through our website, email, or another appropriate method. The Effective Date at the beginning of this Policy indicates when the current version took effect. 19. Contact Us Questions, concerns, privacy requests, or complaints may be directed to: BasementCloud 46 Thornbush Crescent Waterloo, ON Canada N2T 1B2 Privacy Email: privacy@basement.cloud Website: https://basement.cloud Effective Date: September 21, 2026 Last Updated: September 21, 2026 © 2026 BasementCloud. All rights reserved.