Purpose

This Policy explains how Digital Twin Ontario collects, uses, discloses, and safeguards the personal information that its customers or third parties provide to Digital Twin Ontario. Providing personal information or authorizing a third party to disclose personal information to Digital Twin Ontario signifies consent to Digital Twin Ontario’s collection, use, and disclosure of personal information in accordance with this Policy. For the purposes of this Policy, “personal information” means information that can identify an individual directly or through other reasonably available means. The meaning of “personal information” shall be interpreted in a manner that conforms with the minimum requirements of applicable provincial and federal privacy legislation.

Scope

This Privacy Policy applies to Digital Twin Ontario Inc. and its affiliates, (collectively “Digital Twin Ontario”). Digital Twin Ontario values the trust that its customers and third parties have placed in its business. Digital Twin Ontario has adopted this Privacy Policy (the “Policy”) to affirm its commitment to maintaining the accuracy, confidentiality, and security of personal information.

Applicable Government Legislation

Municipal Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. M.56

Personal Information Protection and Electronic Documents Act

Policy

Digital Twin Ontario’s Privacy Policy, which due to privacy laws is applicable to individuals and not to businesses, is available on Digital Twin Ontario’s public website and may be changed from time to time. The current version reads as follows:

Purpose

Digital Twin Ontario will identify the purpose for collecting your personal information at or before the time it is collected.

Digital Twin Ontario collects, uses, and discloses personal information about you for purposes which are permitted or required by law.

Examples of such purposes would include providing technological, administrative, analytical, clerical services or other professional or operations support services; contacting customers; providing information to customers about utility rates, programs, initiatives or services, or the utility industry; verifying a customer’s identity; managing any special needs of customers; monitoring or assessing quality of service by means such as recording telephone conversations; responding to customer inquiries; providing information to third party service providers; investigating, reporting or responding to government inquiries related to error, fraud or theft, dangerous use of power or other unlawful activities; protecting the rights, property, and safety of Digital Twin Ontario, its employees, customers and others; billing or collecting payments; conducting customer surveys, contests and consultations; promoting and administering conservation and demand management programs; preparing financial records; facilitating a business transaction involving Digital Twin Ontario assets; meeting regulatory and legal requirements; and responding to requests in criminal investigations, legal or tax proceedings or pursuant to a court order.

Client personal information may also be collected, used or disclosed internally for the purpose of compliance with Digital Twin Ontario policies and processes or in order to allow us to offer services or products that may be of interest to clients.

Digital Twin Ontario may also collect, use or disclose personal information about clients and prospective clients for the purpose of sending news and information updates.

Digital Twin Ontario may also aggregate personal information with information from other sources for the purpose of improving quality and service, and for use in presentations to clients and non-clients, in a form where such information is sufficiently de-identified so as not to be attributable to any individual or organization.

Consent: Limiting the Collection, Use and Disclosure of Your Personal Information

Digital Twin Ontario will not collect, use or disclose your personal information without your informed consent, unless required or permitted to do so by law. Consent may be provided orally, in writing, electronically or may be implied. Subject to certain legal restrictions and reasonable notice, you can refuse to provide your consent or withdraw your consent to the collection, use and disclosure of your personal information, but refusing to provide consent or withdrawing consent may limit Digital Twin Ontario’s ability to provide you with some of its products or services. Under the laws of Canada and Ontario, Digital Twin Ontario may have a duty or right to collect, use or disclose your personal information without your knowledge or consent.

Digital Twin Ontario limits collection of personal information to information, which is necessary for the purposes identified in this Policy, that is otherwise consented to by you, or permitted or required by law. The examples of types of personal information that Digital Twin Ontario may request or keep include: name, address, phone number, email address, account number, driver’s license details, date of birth, banking information, service orders, electricity usage, invoice history, and billing history.

Personal information may be collected in a number of ways, including in person, over the phone, by mail, by fax, over the Internet, or from third parties who have been authorized to disclose personal information to Digital Twin Ontario.

Web cookies are very small text files that are stored on your computer from a webpage to keep track of information about your browsing on that site. Through the use of web cookies or other tracking providers, when you visit Digital Twin Ontario’s website, Digital Twin Ontario may capture standard web traffic information, such as the time and date you visited the website, your IP address, and your browser information. In no circumstances do the cookies or other tracking provider capture any information that can personally identify you.

If you believe that a third party has inappropriately disclosed your personal information to Digital Twin Ontario, please contact that third party directly. If the third party does not sufficiently respond to your inquiries, please let Digital Twin Ontario know immediately.

Digital Twin Ontario will only disclose your personal information to third parties if you have so consented or if required or permitted by law. Only the information specifically requested is disclosed. If a request is made to Digital Twin Ontario by phone, Digital Twin Ontario will take steps to verify the caller’s identity. Where a request for personal information is made by a governmental authority, Digital Twin Ontario will take steps to satisfy itself that the authority making the disclosure request has legitimate grounds to do so.

Digital Twin Ontario may disclose your personal information to third parties in connection with the proposed or actual financing, insuring, sale, securitization, assignment or other disposal of all or part of Digital Twin Ontario’s business or assets (including accounts) for the purposes of evaluating and/or performing the proposed transaction. These purposes may include, for example, permitting such parties to determine whether to proceed or continue with the transaction, fulfilling any reporting or audit requirements to such parties, and/or disclosing personal information as part of concluding a sale or transfer of assets.

Digital Twin Ontario may perform activities outside of Canada through third parties and in such cases, your personal information may be processed, used, stored or accessed in other countries and will be subject to the laws of those countries. For example, information may be disclosed in response to valid demands or requests from governmental authorities, courts, or law enforcement in other countries. Except as specifically provided for in this Policy, Digital Twin Ontario does not disclose any personal information to third parties.

Keeping Your Information Accurate

Digital Twin Ontario will make reasonable efforts to keep your personal information as accurate, complete and up to date as necessary. If desired, you may verify the accuracy and completeness of your personal information in Digital Twin Ontario’s records in accordance with the Governing Law Section below.

Despite Digital Twin Ontario’s best efforts, errors may occur. Should you identify any incorrect or out-of-date information in your file, Digital Twin Ontario will remedy any such errors on a timely basis upon receipt of notice from you of such incorrect or out-of-date information. In the event that inaccurate information is mistakenly sent to a third party, Digital Twin Ontario will communicate relevant changes to the third party where appropriate and possible.

Protecting Your Personal Information

Digital Twin Ontario employees understand the importance of keeping personal information private and are required to abide by Digital Twin Ontario’s privacy standards. All employees are required to agree to this Policy that prohibits employees from accessing or disclosing personal information without authorization and prohibits the disclosure of any personal information to unauthorized parties. The failure to comply with this code of conduct will result in appropriate disciplinary measures. Except as otherwise permitted or required by law, your personal information will be retained for so long as is reasonably necessary to fulfil the purposes for which it was collected.

To ensure that your personal information is protected, Digital Twin Ontario utilizes security safeguards that are consistent with the industry standard. Digital Twin Ontario uses modern technologies to ensure that personal information is not compromised. Digital Twin Ontario server environment and firewall infrastructure are well maintained, and its security practices are reviewed on a regular basis.

Customers who call Digital Twin Ontario’s customer service centre will be required to verify their identity. Digital Twin Ontario keeps electronic customer files in a highly secured environment with restricted access. Paper- based files are stored in locked filing cabinets to which access is also restricted. Safeguards include physical, organizational, and technical measures, including but not limited, to: – Security card access to

• Restriction of employee access to files on a “need to know”
• Confidentiality undertakings by all
• Securing personal information and not leaving it unattended or in plain view.
• Firewalls, antivirus, passwords, encryption and software solutions for technical – Regular reviews of privacy compliance
• Regular audit processes to assess controls in

Digital Twin Ontario requires its service providers and third-party partners contractually commit to protecting personal information and have mature security controls in place.

Openness

Upon request, Digital Twin Ontario will provide you with a copy of this Policy and its employees will discuss any of its content with you. Upon request, Digital Twin Ontario will also inform you of the type of personal information it has collected about you, how it has been used, and, where permitted by law, the names of any third parties to whom your personal information has been disclosed.

Any changes to Digital Twin Ontario’s privacy standards and information handling practices will be reflected in this Policy in a timely manner. Digital Twin Ontario reserves the right to change, modify, add to, or remove portions of this Policy at any time. Please check this page periodically for any modifications. To determine when this Policy was last updated, please refer to the revision date at the top of this Policy.

Individual Access

Digital Twin Ontario will provide you access to your personal information within a reasonable time and no later than 30 days after receipt of a written request and satisfactory identification. Digital Twin Ontario may charge a reasonable fee for producing the requested information and will notify you of the costs before processing the request.

Digital Twin Ontario may deny access to personal information where permitted or required by law. In this case, Digital Twin Ontario will provide in writing its reasons for the refusal. Such refusal may be challenged by a customer in accordance with law.