Personal Information Processing Agreement

This agreement was last updated: November 6, 2026.

PARTIES

(1) The entity that accepts this Processing Agreement through its authorized representative's electronic acceptance of the Master Agreement incorporating it (the "Customer"). (2) 16334016 Canada Inc., (dba Be Safe), a Canadian corporation, with offices located at 15 Cranberry Circle SE Calgary AB T3M 0M1 (the "Provider"). (Customer and Provider may be referred to as a "Party", or collectively, the "Parties").

RECITALS

WHEREAS, the Customer and the Provider entered into the Be Safe Terms of Service agreement (the "Master Agreement") that may require the Provider to process personal information provided by or collected on behalf of the Customer; and

WHEREAS, this personal information processing agreement (the "Processing Agreement") sets out additional terms, requirements and conditions for collecting, processing, disclosing, transferring or storing Personal Information when the Provider provides services under the Master Agreement;

NOW, THEREFORE, in consideration of the mutual covenants and agreements contained in this Processing Agreement and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

1. Definitions and Interpretation

1.1 The following definitions and rules of interpretation apply in this Processing Agreement.

"Business Purpose" means the services described in the Master Agreement or any other purpose specifically identified in Appendix A.

"Data Subject" means an individual who is the subject of Personal Information.

"Personal Information" means any information the Provider collects, uses, processes or maintains for the Customer that: (i) relates to an identifiable individual and identifies or can be used to identify that individual, directly or indirectly, either alone or in combination with other personal or identifying information that is or can be associated with that specific individual, including but not limited to: (a) first and last name; (b) home or other physical address, including street name and name of city or town and/or province or territory; (c) email address or other online information, such as a user name and password; (d) telephone number; (e) government-issued identification or other number; (f) financial or payment card account number; (g) date of birth; or (h) health information, including information regarding the individual's medical history or mental or physical condition, or medical treatment or diagnosis by a health care professional; and any information that is combined with any of (a) through (h) above; or (ii) the relevant Privacy and Data Protection Requirements otherwise define as protected personal information.

"Processing, processes, or process" means any activity that involves the use of Personal Information or that the relevant Privacy and Data Protection Requirements may otherwise include in the definition of processing, processes, or process. It includes obtaining, recording, or holding the data, or carrying out any operation or set of operations on the data including, but not limited to, organizing, amending, retrieving, using, disclosing, erasing, or destroying it. Processing also includes transferring Personal Information to third parties.

"Privacy and Data Protection Requirements" means all applicable federal and provincial laws and regulations relating to the processing, protection, or privacy of the Personal Information, including where applicable, the guidance and codes of practice issued by regulatory bodies in any relevant jurisdiction. This includes but is not limited to the Personal Information Protection and Electronic Documents Act, SC 2000 c 5.

"Security Breach" means any act or omission that compromises the security, confidentiality, or integrity of Personal Information or the physical, technical, administrative, or organizational safeguards put in place to protect it. The loss of or unauthorized access, disclosure, or acquisition of Personal Information is a Security Breach whether or not the incident rises to the level of a security breach under the Privacy and Data Protection Requirements.

1.2 This Processing Agreement is subject to the terms of the Master Agreement and is incorporated into the Master Agreement. Interpretations and defined terms in the Master Agreement apply to the interpretation of this Processing Agreement.

1.3 The Appendices form part of this Processing Agreement and will have effect as if set out in full in the body of this Processing Agreement. Any reference to this Processing Agreement includes the Appendices.

1.4 A reference to writing or written includes email but not faxes.

1.5 In the case of conflict or ambiguity between:

(a) any provision contained in the body of this Processing Agreement and any provision contained in the Appendices, the provision in the body of this Processing Agreement will prevail;

(b) the terms of any accompanying invoice or other documents annexed to this Processing Agreement or any provision contained in the Appendices, the provision contained in the Appendices will prevail; and

(c) any of the provisions of this Processing Agreement and the provisions of the Master Agreement, the provisions of this Processing Agreement will prevail.

2. Personal Information Types and Processing Purposes

2.1 The Customer retains control of the Personal Information and remains responsible for its compliance obligations under the applicable Privacy and Data Protection Requirements, providing any required notices and obtaining any required consents, and for the processing instructions it gives to the Provider.

2.2 Appendix A describes the general Personal Information categories and Data Subject types the Provider may process to fulfill the Business Purposes of the Master Agreement. The Customer discloses Personal Information to the Provider only for the limited and specified Business Purposes.

2.3 Customer is fully responsible for providing the correct information about all Data Subjects. Customer is fully responsible for any instructions provided to Provider, including unclear or contradictory instructions. Customer is fully responsible for removing the information of Data Subject that no longer work for the Customer.

3. Provider's Obligations

3.1 The Provider will only process the Personal Information to the extent, and in such a manner, as is necessary for the Business Purposes in accordance with the Customer's written instructions. The Provider will not process the Personal Information for any other purpose or in a way that does not comply with this Processing Agreement, the Privacy and Data Protection Requirements or the Provider’s Privacy Policy. The Provider must promptly notify the Customer if, in its opinion, the Customer's instructions will not comply with the Privacy and Data Protection Requirements.

3.2 The Provider must promptly comply with any Customer request or instruction requiring the Provider to amend, transfer, or delete the Personal Information, or to stop, mitigate or remedy any unauthorized processing.

3.3 The Provider will maintain the confidentiality of all Personal Information and will not disclose Personal Information to third parties unless the Customer or this Processing Agreement specifically authorizes the disclosure in compliance with Privacy and Data Protection Requirements, or as otherwise required by law. If a law requires the Provider to process or disclose Personal Information, the Provider must first inform the Customer of the legal requirement and give the Customer an opportunity to object or challenge the requirement, unless the law prohibits such notice.

3.4 The Provider will reasonably assist the Customer with meeting the Customer's compliance obligations under the Privacy and Data Protection Requirements, considering the nature of the Provider's processing and the information available to the Provider.

3.5 The Provider must promptly notify the Customer of any changes to Privacy and Data Protection Requirements that may adversely affect the Provider's performance of the Master Agreement.

3.6 The Customer acknowledges that the Provider is under no duty to investigate the completeness, accuracy, or sufficiency of any specific Customer instructions from Authorized Persons or the Personal Information other than as required under the Privacy and Data Protection Requirements.

3.7 The Provider will only collect Personal Information for the Customer using a notice or method that the Customer specifically pre-approves in writing.

3.8 The Provider is responsible for its compliance obligations under the applicable Privacy and Data Protection Requirements.

3.9 Appendix A contains the default instructions to process the information of the Customer’s Data Subjects.

4. Provider's Employees

4.1 The Provider will limit Personal Information access to:

(a) those employees or contractors who require Personal Information access to meet the Provider's obligations under this Processing Agreement and the Master Agreement; and

(b) the part or parts of the Personal Information that those employees or contractors strictly require for the performance of their duties.

4.2 The Provider will ensure that all employees or contractors:

(a) are informed of the Personal Information's confidential nature and use restrictions;

(b) have undertaken training on the Privacy and Data Protection Requirements relating to handling Personal Information and how it applies to their particular duties; and

(c) are aware both of the Provider's duties and their personal duties and obligations under the Privacy and Data Protection Requirements and this Processing Agreement.

4.3 The Provider will take reasonable steps to ensure the reliability, integrity, and trustworthiness of all of the Provider's employees or contractors with access to the Personal Information.

5. Security

5.1 The Provider must at all times implement appropriate technical and organizational measures designed to safeguard Personal Information against unauthorized or unlawful processing, access, copying, modification, storage, reproduction, display, or distribution, and against accidental loss, destruction or damage including, but not limited to, the security measures set out in Appendix B. The Provider must document those measures in writing and periodically review them, at least annually, to ensure they remain current and complete.

5.2 The Provider must take reasonable precautions to preserve the integrity of any Personal Information it processes and to prevent any corruption or loss of the Personal Information, including but not limited to establishing effective back-up and data restoration procedures in compliance with Privacy and Data Protection Requirements or other applicable laws.

6. Security Breaches and Personal Information Loss

6.1 The Provider will promptly notify the Customer if any Personal Information is lost or destroyed or becomes damaged, corrupted, or unusable.

6.2 The Provider will within 36 hours notify the other Party if it becomes aware of:

(a) any unauthorized or unlawful processing of the Personal Information; or

(b) any Security Breach.

6.3 Immediately following any unauthorized or unlawful Personal Information processing or Security Breach, the Parties will co-ordinate with each other to investigate the matter. The Provider will reasonably co-operate with the Customer in the Customer's handling of the matter, including:

(a) reasonably assisting with any investigation;

(b) gather information from the Provider's employees, former employees, and others involved in the matter; and

(c) making available all relevant records, logs, files, data reporting, and other materials required to comply with all Privacy and Data Protection Requirements or as otherwise reasonably required by the Customer.

6.4 The Provider will not inform any third party of any Security Breach without first obtaining the Customer's prior written consent, except when Privacy and Data Protection Requirements, or other laws or regulations, require it.

6.5 The Provider agrees that the Customer has the sole right (except when Privacy and Data Protection Requirements, or other laws or regulations, require it) to determine: (a) whether to provide notice of the Security Breach to any Data Subjects, regulators, law enforcement agencies or others, as required by Privacy and Data Protection Requirements or other laws or regulations, or at the Customer's discretion, including the contents and delivery method of the notice; and

(b) whether to offer any type of remedy to affected Data Subjects, including the nature and extent of such remedy.

6.6 The Provider will cover all reasonable expenses associated with the performance of the obligations under Section 6.2 and Section 6.3, unless the matter arose from the Customer's specific instructions, negligence, willful default or breach of this Processing Agreement, in which case the Customer will cover all reasonable expenses.

6.7 The Provider will also reimburse the Customer for actual reasonable expenses the Customer incurs when responding to and mitigating damages, to the extent that the Provider caused a Security Breach, including all costs of notice and any remedy as set out in Section 6.5

6.8 The Provider will maintain records of any Security Breach in accordance with Privacy and Data Protection Requirements.

7. Cross-Border Personal Information Transfers

7.1 If the Privacy and Data Protection Requirements restrict cross-border Personal Information transfers, the Customer will only transfer Personal Information to the Provider under the following conditions:

(a) the Provider, either through its location or participation in a valid cross-border transfer mechanism under the Privacy and Data Protection Requirements, as identified in Appendix A, may legally receive that Personal Information, however, the Provider must immediately inform the Customer of any change to that status;

(b) the Customer obtained valid Data Subject consent to the transfer under the Privacy and Data Protection Requirements; or

(c) the transfer otherwise complies with the Privacy and Data Protection Requirements for the reasons set forth in Appendix A.

7.2 The Provider will not transfer any Personal Information to another country unless the transfer complies with the Privacy and Data Protection Requirements.

8. Subcontractors

8.1 The Provider may only authorize a third party (subcontractor) not listed in Appendix A to process the Personal Information if: (a) the Provider enters into a written contract with the subcontractor that contains terms substantially the same as those set out in this Processing Agreement and, upon the Customer's written request, provides the Customer with copies of such contracts; and

(b) the Provider maintains control over all Personal Information it entrusts to the subcontractor;

8.2 The Provider must list all approved subcontractors in Appendix A and include any subcontractor's name and location.

8.3 Where the subcontractor fails to fulfill its obligations under such written agreement, the Provider remains liable to the Customer for the subcontractor's performance of its agreement obligations.

8.4 The Provider is deemed to control any Personal Information that is controlled by or in the possession of its subcontractors.

9. Complaints, Data-Subject Requests and Third-Party Rights

9.1 The Provider must notify the Customer immediately if it receives any complaint, notice, or communication that directly or indirectly relates to the Personal Information processing or to either Party's compliance with the Privacy and Data Protection Requirements.

9.2 The Provider must notify the Customer within 2 working days if it receives a request from a Data Subject for access to their Personal Information or a request to correct, delete, or withdraw its consent from any use by Customer or Provider of same.

9.3 The Provider will give the Customer its full co-operation and assistance in responding to any complaint, notice, communication, or Data Subject request.

9.4 The Provider must not disclose the Personal Information to any Data Subject or to a third party unless the disclosure is either at the Customer's request or instruction, permitted by this Processing Agreement, or is otherwise required by law.

10. Term and Termination

10.1 This Processing Agreement will remain in full force and effect until the later of the following:

(a) the Master Agreement remains in effect; or

(b) the Provider retains any Personal Information related to the Master Agreement in its possession or control (the "Term").

10.2 Any provision of this Processing Agreement that expressly or by implication should come into or continue in force on or after termination of the Master Agreement to protect Personal Information will remain in full force and effect.

10.3 The Provider's failure to comply with the terms of this Processing Agreement is a material breach of the Master Agreement. In such event, the Customer may terminate any part of the Master Agreement authorizing the processing of Personal Information effective immediately upon written notice to the Provider without further liability or obligation.

10.4 If a change in any Privacy and Data Protection Requirement prevents either Party from fulfilling all or part of its Master Agreement obligations, the Parties will suspend the processing of Personal Information until that processing complies with the new requirements. If the Parties are unable to bring the Personal Information processing into compliance with the Privacy and Data Protection Requirement within 30 days, they may terminate the Master Agreement upon written notice to the other Party.

10.5 The Provider may unilaterally change or update this Processing Agreement without notice to the Customer. Within 30 days of a change Customer may terminate this Processing Agreement upon written notice to the Provider.

11. Data Return and Destruction

11.1 At the Customer's request, the Provider will give the Customer a copy of or access to all or part of the Customer's Personal Information in its possession or control in the format reasonably specified by the Customer.

11.2 On termination of the Master Agreement for any reason or expiration of its term, the Provider will securely destroy or, if directed in writing by the Customer, return and not retain, all or any Personal Information related to this Processing Agreement in its possession or control, except for one copy that it may retain and use for one year for audit purposes only.

11.3 If any law, regulation, or government or regulatory body requires the Provider to retain any documents or materials that the Provider would otherwise be required to return or destroy, it will notify the Customer in writing of that retention requirement, giving details of the documents or materials that it must retain, the legal basis for retention, and establishing a specific timeline for destruction once the retention requirement ends. The Provider may only use this retained Personal Information for the required retention reason or audit purposes.

11.4 The Provider will certify in writing that it has destroyed the Personal Information within seven days after it completes the destruction.

12. Records

12.1 The Provider will keep detailed, accurate, and up-to-date records regarding any Personal Information processing it carries out for the Customer, including but not limited to, the access, control, and security of the Personal Information, approved subcontractors and affiliates, the processing purposes, and any other records required by the applicable Privacy and Data Protection Requirements (the "Records").

12.2 The Provider will ensure that the Records are sufficient to enable the Customer to verify the Provider's compliance with its obligations under this Processing Agreement.

12.3 The Customer and the Provider must review the information listed in the Appendices to this Processing Agreement once a year to confirm its current accuracy and update it when required to reflect current practices.

13. Audit

13.1 If a Security Breach occurs or is occurring, or the Provider becomes aware of a breach of any of its obligations under this Processing Agreement or any Privacy and Data Protection Requirements, the Provider will:

(a) two days of the triggering event, conduct its own audit to determine the cause;

(b) produce a written report that includes detailed plans to remedy any deficiencies identified by the audit;

(c) provide the Customer with a copy of the written audit report; and

(d) remedy any deficiencies identified by the audit within 30 days.

14. Representations and Warranties

14.1 The Provider represents and warrants that:

(a) it and its employees, subcontractors, agents, and any other person or persons accessing Personal Information on its behalf are reliable and trustworthy and have received the required training on the Privacy and Data Protection Requirements;

(b) it and anyone operating on its behalf will process the Personal Information in compliance with both the terms of this Processing Agreement and all applicable Privacy and Data Protection Requirements and any other applicable laws, enactments, regulations, codes, orders, standards, and other similar instruments;

(c) it has no reason to believe that any Privacy and Data Protection Requirements prevent it from providing any of the Master Agreement's contracted services or the services hereunder; and

(d) considering the current technology environment and implementation costs, it will take appropriate technical and organizational measures to prevent the unauthorized or unlawful processing of Personal Information and the accidental loss or destruction of, or damage to, Personal Information, and ensure a level of security appropriate to:

(i) the harm that might result from such unauthorized or unlawful processing or accidental loss, destruction, or damage;

(ii) the nature of the Personal Information protected; and

(iii) comply with all applicable Privacy and Data Protection Requirements and its information and security policies, including the security measures required in Section 5.1.

14.2 The Customer represents and warrants that the Provider's expected use of the Personal Information for the Business Purpose and as specifically instructed by the Customer under this Processing Agreement will comply with all Privacy and Data Protection Requirements.

15. Indemnification

15.1 The Provider agrees to indemnify, keep indemnified and defend at its own expense the Customer against all costs, claims, damages, or expenses incurred by the Customer or for which the Customer may become liable due to:

(a) any failure by the Provider or its employees, subcontractors, or agents to comply with any of its obligations under this Processing Agreement or applicable Privacy and Data Protection Requirements and any other applicable laws, enactments, regulations, codes, orders, standards, and other similar instruments; and

(b) any breach of its representations warranties, covenants, and other obligations under this Processing Agreement.

15.2 Any limitation of liability set forth in the Master Agreement will apply to this Processing Agreement's indemnity or reimbursement obligations.

16. Insurance

16.1 During the Term, the Provider must, at its own cost and expense, obtain and maintain insurance, in full force and effect, sufficient to cover the Provider's potential indemnity or reimbursement obligations. The Provider will produce the policy and premium payment receipt to the Customer on request.

16.2 Policy Terms. All insurance policies required pursuant to this Section shall:

(a) be issued by insurance companies; and

(b) waive any right of subrogation of the insurers against the Customer;

16.3 Coverage. To the extent any insurance coverage required under this Section is purchased on a "claims-made" basis, such insurance shall cover all prior acts of Provider during the Term and any additional periods during which Provider does or is required to perform the services hereunder, and such insurance shall be continuously maintained.

16.4 Certificates of Insurance. Upon Customer's written request, Provider shall provide Customer with copies of the certificates of insurance and policy endorsements for all insurance coverage required by this Section. Provider shall not do anything to invalidate such insurance. Provider shall give 30 days' prior written notice to Customer of any cancellation, non-renewal or material change in coverage, scope or amount of any insurance policy required by or affecting the Customer's rights or remedies under this Agreement.

16.5 Non-Waiver. This Section is not intended to and shall not be construed in any manner as to waive, restrict or limit the liability of either party for any obligations under this Agreement (including any provisions hereof requiring a party to indemnify, defend and hold harmless the other party).

17. Notice

17.1 Any notice or other communication given to a Party under or in connection with this Processing Agreement must be in writing and delivered to:

For the Provider: drizzi@be-safe.ca.

17.2 Section 17.1 does not apply to the service of any proceedings or other documents in any legal action or, where applicable, any arbitration or other method of dispute resolution.

APPENDIX A

Personal Information Processing Purposes and Details

Business Purposes:

• Tracking the location of workers working alone in the field, facilitating regular safety check-ins of those workers, and providing information to emergency services where required to ensure the safety of the worker when a worker misses a check-in and is unable to be reached.

Default Instructions:

• The Customer authorizes the Provider to:

  • Record and access the Data Subjects’ location and other collected data.

  • Save the data in the Provider and its subcontractor’s data bases.

  • Share the data with employees and subcontractors of the Provider.

  • Contact the Data Subject in-app, through text messages and through a phone call when a check-in is missed.

  • Escalate a missed check-in to a Customer’s employee supervisor if they are available.

  • If the Data Subject cannot be reached, share the Data Subject’s data with police and emergency services

Personal Information Categories:

• Name

• Home Address

• Phone number

• Location and location over time

• Device specifications

• Workplace

• Work Title

• Other personal information shared directly by the Data Subject or Customer

Data Subject Types:

• Employees or contractors of Customer working alone in the field. Location data is only tracked when said person is checked in on a shift

Approved Subcontractors:

• Stettler Telephone Answering Service 2014 (English Call Centre Service)

  • 5000 50th Avenue, Stettler, AB T0C 2L0, Canada

• Kewix Télécommunication Inc. (French Call Centre Service)

  • 4388 Rue Saint-Denis, Montreal Quebec H2J 2L1

• Amazon Web Services, Inc./Amazon Data Services Canada, Inc. (Data Processing and Storage)

  • 120 Bremner Blvd, 26th Floor Toronto, ON M5J 0A8 Canada

• Google LLC (Virtual Map Services)

  • 1600 Amphitheatre Parkway, Mountain View, CA 94043

• Slack Technologies, LLC (Internal Communications)

  • 415 Mission St, Suite 300 (3rd Floor), San Francisco, CA 94105, USA

• Atlassian, Inc. (Jira) (Internal Communications)

  • 350 Bush Street, Floor 13, San Francisco, CA 94104, USA

• Stripe, LLC (Payment Processing)

  • 354 Oyster Point Boulevard, South San Francisco, California, 94080

• Intuit Inc. (QuickBooks) (Accounting)

  • 700 Coast Avenue, Mountain View, California 94043, USA

• Twilio, Inc. (SendGrid) (Emailing Users)

  • 375 Beale Street, Suite 300, San Francisco, CA 94105, USA

• 2330455 Alberta Inc. (Software Development)

  • 15 Cranberry Circle SE Calgary AB T3M 0M1

Countries where the Provider may receive, access, transfer or store Personal Information:

• Canada

• United States of America

APPENDIX B

Security Measures

Required Technical and Organizational Data Security Measures:

Physical Access Controls

Be Safe’s production application data is hosted using Amazon Web Services in the AWS Canada (Central) Region, ca-central-1. Backup replication is configured to the AWS Canada West Region, ca-west-1.

Be Safe does not directly operate physical data centres. Physical security controls for the underlying cloud infrastructure are provided by AWS under the AWS shared responsibility model. AWS employs industry-standard physical access controls, including controlled facility entry points, professional security staff, surveillance, detection systems, electronic access controls, and multi-factor access mechanisms for authorized data centre personnel.

System Access Controls

Access to Be Safe’s AWS infrastructure is strictly limited. The only individual with human administrative access to the AWS infrastructure is Mike Cottingham, Be Safe’s CEO / CTO. No other Be Safe partner, internal team member, or call centre staff member has AWS infrastructure access.

All AWS access requires multi-factor authentication. Users, supervisors, operators, and other application users do not access AWS infrastructure directly. They access Be Safe data only through the Be Safe application, subject to authentication, authorization, role-based access controls, and application-level logging.

Be Safe uses Amazon Cognito for user authentication and Cognito groups to control access to company data. AWS CloudTrail is enabled to log AWS account and infrastructure activity. Cognito breach detection / threat protection and logging are also enabled.

Data Access Controls

Be Safe uses role-based access control within the application. The primary user roles are:

• Worker: Access is limited to the worker’s own account, shift, check-in, and safety-related information as required to use the service.

• Supervisor: Supervisor accounts can access worker accounts and safety information within their assigned company.

• Operator: Operator accounts are used by call centre staff responsible for live monitoring, missed check-ins, emergency response workflows, and operational support. Operators have access to company data across Be Safe as required to perform monitoring and incident response functions.

Tenant access is logically segregated using company identifiers and Cognito group-based authorization. Company data is not physically separated into separate databases per customer, but application authorization rules enforce company-level access separation for normal customer and supervisor use.

All supervisor and operator activity is logged within the application’s Activity Log, which is available for review. This includes relevant operational and administrative actions taken by supervisors and operators.

Transmission Controls

Be Safe uses industry-standard encryption in transit. Application traffic is transmitted using HTTPS/TLS.

Primary application data stored in Amazon DynamoDB is encrypted at rest using AWS-owned encryption keys managed by AWS. Be Safe does not currently use customer-managed KMS keys.

Input Controls

Be Safe maintains application-level logging for supervisor and operator actions through the Activity Log. This provides accountability and traceability for actions taken inside the application.

At this time, Be Safe does not require dual approval or separate supervisory approval for all data entry, modification, or operator actions. Authorized supervisors and operators may perform actions permitted by their application role. These actions are logged for review and auditability.

The application also uses role-based authorization to limit actions based on user role and company access. Where applicable, the application validates required fields and enforces business rules through the application layer and backend services.

Data Backups

Be Safe uses Amazon DynamoDB point-in-time recovery for all production DynamoDB tables. Point-in-time recovery provides continuous backup coverage and allows restoration to a specific point in time within the configured recovery window. Production backups are configured to replicate from AWS Canada (Central), ca-central-1, to AWS Canada West, ca-west-1, for disaster recovery purposes.

Data Segregation

Be Safe operates as a multi-tenant application. Customer data is logically segregated by company identifier and role-based authorization rules. Cognito groups are used to control access to company-specific data.

Be Safe does not currently provide physical customer-by-customer segregation into separate AWS accounts, separate databases, or separately selected AWS regions. Production data is hosted in AWS Canada (Central), with backup replication configured to AWS Canada West.

Staff Confidentiality and Data Protection Requirements

Be Safe requires its call centre service providers and call centre staff to comply with confidentiality obligations. Call centre staff are required to expressly accept and be bound by confidentiality agreements prohibiting them from disclosing sensitive, personal, customer, or operational information obtained through the Be Safe platform.

Be Safe currently relies on contractual confidentiality obligations. Be Safe provides training materials to its employees and call centre service providers. Access to the Be Safe application is limited based on role and operational need, and supervisor/operator actions are logged in the application Activity Log.

Logging, Monitoring, and Auditability

Be Safe uses multiple layers of logging and monitoring:

• AWS CloudTrail is enabled for AWS account and infrastructure activity.

• Amazon Cognito breach detection / threat protection and logging are enabled.

• Supervisor and operator actions are logged in the Be Safe application Activity Log.

• Safety and operational events are recorded for monitoring, support, incident review, and audit purposes.

Third-Party Service Providers

Be Safe uses the following third-party service providers in connection with the operation of the platform:

• Amazon Web Services: Cloud hosting, authentication, database, storage, logging, monitoring, messaging, and related infrastructure services.

• SendGrid: Delivery of system-generated emails to users.

• Expo: Native modules and Push notification facilitation for the mobile application.

• Apple and Google: Mobile application distribution through the Apple App Store and Google Play Store, and operating-system-level mobile notification infrastructure where applicable.

• Slack: Internal team communications and application-generated operational or billing notifications. Be Safe does not intentionally send end-user personally identifiable information to Slack. Slack notifications are primarily company-level billing reports, operational notices, and limited contact form or business-level information.

• Stripe: Automated invoicing and payment processing.

• QuickBooks: Accounting system of record for expenses, distributions, and accounting records.

• Stettler Telephone Answering Service and Kewix Telecom: Call centre monitoring and operator services for Be Safe safety workflows.

Data Retention

Be Safe retains safety archive and location history data for at least one year. Communications-related records, including SMS or satellite communication records, are generally retained for approximately three months. Basic user and company account data is retained while the customer account remains active, unless deletion is requested or required.

Billing and accounting records may be retained for longer periods as required for accounting, tax, audit, contractual, or legal purposes.

Current Limitations and Planned Improvements

Be Safe’s current controls rely on role-based access control, company-level logical segregation, AWS infrastructure controls, MFA-protected administrative access, CloudTrail, Cognito security features, and application-level Activity Logs.

Be Safe does not currently provide customer-specific physical database segregation, customer-managed encryption keys, formal privacy/security training for all staff, or dual-control approval workflows for all supervisor/operator actions. These may be considered for future security maturity improvements based on customer requirements, legal requirements, and operational risk.