Canada Privacy Supplement

---

How to read this Supplement

This Supplement is issued with, and must be read together with, the Zeus Privacy Policy (https://fieldzeus.com/legal/privacy). It states the additional information that Canadian federal and provincial privacy law requires Zeus to give Canadian data subjects, and the Canadian versions of the rights, contacts and procedures described in the Privacy Policy. It is a Supplement to the Privacy Policy: it controls only to the extent mandatory Canadian law requires different or additional content, and nothing in it reduces, replaces or dilutes the global positions stated in the Privacy Policy or in any Zeus contractual document outside that mandatory scope. Capitalized terms have the meanings given in the Privacy Policy and the Zeus Terms of Service.

---

1. Application, Status and Consent Framing

1.1 Application, non-contractual status and precedence

This Supplement applies to Personal Information about individuals located in Canada that Zeus collects, uses, discloses or stores in connection with the Services. The Privacy Policy and this Supplement are informational notices: they are expressly not part of the Terms, the Agreement, or any other contract with Zeus, and they create no contractual rights or warranties. By creating an account, accessing or using the Services, or otherwise providing Personal Information to Zeus, you acknowledge the Privacy Policy and this Supplement, including as each is revised from time to time, and — where consent is the operative legal basis in Canada — you consent to the collection, use, disclosure and storage they describe. Where mandatory Canadian federal or provincial privacy law grants you a right, or requires a disclosure, that differs from the global Privacy Policy, this Supplement states the Canadian position, and it applies only to that extent; all other global positions remain unchanged. Privacy-related claims remain subject to the liability cap and dispute-resolution terms of the Terms of Service, as stated there.

1.2 Canadian consent framing

In Canada, Zeus relies on your consent — implied or express, as appropriate to the sensitivity of the information and the reasonable expectations of the individual — as the primary legal basis for collecting, using and disclosing Personal Information for the purposes described in the Privacy Policy. By accessing or using the Services, or by providing Personal Information to Zeus, you consent to the practices described in the Privacy Policy and this Supplement. For collections that Canadian regulators treat as potentially sensitive — such as the snapshot Location Data functions described in Sections 3.2 and 8.1 — Zeus obtains your express, feature-level consent through the operating-system permission prompt and any in-app enablement step for that function before the function operates; each such function remains inactive for you unless and until you grant that permission. You may withdraw consent as described in Section 5.7.

1.3 Zeus's two roles; where to direct requests

Zeus is the organization accountable under Canadian privacy law (the "controller"- equivalent) only for Account Data — registration, billing, device-telemetry, diagnostics and site data that Zeus collects for its own purposes. For End-Customer Data and Worker Data — information about your Customer's clients, workers, subcontractors and other individuals that a Customer or its Authorized Users enter into or collect through the Services — the Customer is the accountable organization, and, unless otherwise required by law, Zeus acts solely as a service provider (processor) on the Customer's instructions. If you are a Client, worker, Helper or other individual whose information a Customer has entered into the Services, direct any question, complaint, or access, correction, deletion or withdrawal request concerning that information to that business; Zeus will refer such requests to the relevant Customer and will provide reasonable assistance to the Customer as described in Section 5.

1.4 Providing information is voluntary; your alternative is not to use the Services

You are not obliged to provide Personal Information to Zeus. However, if you choose not to provide it, or you withhold or revoke a device permission a feature depends on, Zeus may be unable to provide you with some or all of the Services, and some functions may be prevented or severely constrained. If you disagree with the practices described in the Privacy Policy or this Supplement, your remedy is to not use, or to discontinue using, the Services.

1.5 Third-party websites, products and services are outside this Supplement

The Privacy Policy and this Supplement do not apply to third-party websites, products or services — including third-party map, video or content providers whose materials may be displayed within the Services, app stores, device operating systems, and any service you reach through a link — even where they link to or interoperate with the Services. Those third parties handle information under their own privacy practices and policies, which you should review carefully. Zeus does not control and is not responsible for them.

1.6 Commercial electronic messages: CASL consent, content and unsubscribe

Canada's Anti-Spam Legislation ("CASL") governs every commercial electronic message ("CEM") Zeus sends to an electronic address in Canada. This Section states how Zeus complies with it. It describes the messages Zeus sends about its own products and services; it does not describe the messages a Customer sends to its own Clients, which are the Customer's own under Section 1.3 and under the SMS, Email and Messaging Terms.

Zeus sends a CEM only with your express consent. Zeus asks for that consent separately from any other request and obtains it by an affirmative act you take — never a pre-ticked box, never silence, never your continued use of the Services, and never as a condition of signing up. When Zeus asks, it tells you that the purpose of the request is to obtain consent to send commercial electronic messages, who is asking, the mailing address of Omni Data Tech Inc. and an address at which Zeus can be contacted, and that you may withdraw at any time. Zeus does not rely on implied consent under CASL — not on an existing business or non-business relationship, not on the conspicuous publication of your address, and not on your having enquired about the Services. A consent that Zeus cannot evidence is treated as a consent Zeus does not have.

Every CEM identifies Zeus and carries a working unsubscribe. Each message states that it is sent by Omni Data Tech Inc., gives Zeus's registered mailing address and an address at which Zeus can readily be contacted, and sets out an unsubscribe mechanism that is clearly and prominently presented, that can be readily performed at no cost to you, and that remains functional for at least sixty (60) days after the message is sent. Zeus gives effect to an unsubscribe request without delay and in any event within ten (10) business days of receiving it. Zeus does not require you to sign in, create an account, pay a fee, answer a question or give a reason in order to unsubscribe.

Zeus keeps the proof of consent. For each consent it relies on, Zeus records what you were shown, the date, the act by which you gave it and the version of the wording you agreed to, together with any later withdrawal and its date. That record is retained under the Data Retention and Deletion Policy so that Zeus can show the basis on which it wrote to you. A record that Zeus holds a consent is evidence of that consent; it is not itself the consent.

Service and administrative messages are not CEMs and are unaffected. The messages described in Section 11.1 of the Privacy Policy — account, verification, security, billing, subscription, technical and legal notices, and the document-delivery messages your business triggers — are sent because you hold an account and have a transaction with Zeus, are not sent to encourage participation in a commercial activity, and continue regardless of any unsubscribe. Withdrawing consent to marketing never suspends them, and Zeus never uses an administrative message to carry marketing content.

Complaints. CASL is enforced by the Canadian Radio-television and Telecommunications Commission, which receives reports through the Spam Reporting Centre. Section 6.1 describes how to raise a concern with Zeus first and how to escalate to a regulator.

---

2. Accountability and Privacy Contacts

2.1 Accountable individual (PIPEDA)

Zeus has designated an individual who is accountable for Zeus's compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Zeus's privacy program:

Accountable individual: Privacy Officer, Omni Data Tech Inc. Privacy contact: [email protected] Postal: Omni Data Tech Inc., 3601 Highway 7 East, Suite 1006, Markham, Ontario, L3R 0M3, Canada

The accountable individual is responsible for Zeus's privacy policies and procedures that are designed to protect Personal Information, and questions or concerns about Zeus's privacy practices or this Supplement may be directed to the privacy contact above.

2.2 Québec person in charge of the protection of personal information

Zeus does not offer the Services in Québec (Section 8.6). Zeus will designate the person in charge of the protection of personal information required by the Act respecting the protection of personal information in the private sector (as amended by Law 25, s 3.1), and publish that person's title and contact information on its website at https://fieldzeus.com/legal/privacy, before making the Services available in Québec. Until then, privacy requests may be addressed to the contacts in the final Section of this Supplement.

---

3. Information Given at Collection (Québec ss 8 and 8.1)

Zeus does not currently offer the Services in Québec (Section 8.6). This Section states how Zeus will meet Québec's collection-notice requirements if and when it does; it is not a description of an operative Québec collection process today.

3.1 Content of the collection notice

When Zeus collects Personal Information from a person in Québec, Zeus informs the person, at or before the time of collection, of: (a) the purposes for which the information is collected (the purposes stated in the Privacy Policy); (b) the means by which the information is collected; (c) the person's rights of access and rectification; (d) the person's right to withdraw consent (Section 5.7); and (e) where applicable, that the information may be communicated outside Québec (Section 4.3). The Privacy Policy and this Supplement are drafted in clear and plain language and together constitute that notice for collections made through the Services.

3.2 Technologies with location or identification functions (Québec s 8.1)

The Services include technology functions that allow a device's location to be collected. Each function is a snapshot collection — Zeus has no background or continuous location-tracking capability — and each operates only if you activate it by granting the corresponding operating-system permission (and, where applicable, enabling the feature), which you may withdraw at any time in your device settings:

(a) clock-in / clock-out coordinates — when a worker clocks in or out, the app may capture the device's coordinates at the moment of that event; (b) photo location fallback — a captured photo may be stamped with the device's current location only when the photo itself lacks embedded location metadata (foreground use only); (c) photo-library metadata matching ("Find Nearby Photos") — with your photo-library permission, the app reads location and capture-date metadata embedded in your own photos to suggest matches to job sites;

(d) optional location at signing — a signer's device location may be recorded as part of the signing evidence record if permission is granted at signing; (e) address geocoding and map display — street addresses entered into the Services are converted to coordinates, and map tiles are requested, to display job locations; (f) receipt and expense capture — where the "record where I scanned this" switch is on, the device's coordinates are captured when a receipt or expense form is opened and when a receipt is scanned, and stored on that record; this applies to a receipt entered by hand as well as one photographed, the switch is on by default, and it is presented on the capture screen itself so it can be seen and turned off by the person it applies to.

Location Data collected through these functions is never used for advertising or marketing and is never sold.

---

4. Cross-Border Transfers and Storage Locations

4.1 Consent to processing in the United States, Canada and elsewhere

By using the Services or providing information to Zeus, you — expressly including users located in Canada — consent to the transfer, storage and processing of your information in the United States, in Canada, and in any other location where Zeus or its service providers maintain facilities. You acknowledge that the laws of those jurisdictions regarding Personal Information may be less stringent or less protective than the laws of your province or of Canada, and that while your information is located there it may be accessible to the courts, law enforcement and national-security authorities of those jurisdictions in accordance with their laws. If you do not consent to this transfer, storage and processing, you should not use the Services; continued use constitutes consent.

4.2 Storage locations stated as fact; no data-residency warranty; named providers

As a statement of current operational practice only, Zeus's primary cloud object storage is region-pinned to an Eastern North America region, and Zeus's core databases and services are operated by Zeus and its infrastructure providers in North America; Zeus gives no warranty, representation or commitment of data residency, and no specific storage location is promised to meet your residency requirements. Without limiting the foregoing, content delivery and traffic may be processed at the network edge location closest to the requesting user, and backups, diagnostics and support access may occur from other locations. Product analytics and crash and error diagnostics are processed in the United States by the processors named in the Privacy Policy and on Zeus's subprocessor page. Zeus may relocate data between facilities and regions at any time. For PIPEDA cross-border transparency: Zeus currently uses service providers resident in or operating from the United States — including Cloudflare, Inc. (infrastructure, content delivery and object storage), Resend, Inc. (transactional email delivery), and the product-analytics, crash-diagnostics and push-notification providers named in the Privacy Policy — to process Personal Information on Zeus's behalf, and Personal Information handled by them may be processed in and accessible to the authorities of the United States as described in Section 4.1. Zeus's address-geocoding provider is established in Cyprus and hosts its service in European Union data centres. The current list of Subprocessors and their locations is published at https://fieldzeus.com/legal/subprocessors.

4.3 Communication of Personal Information outside Québec

Zeus does not currently offer the Services in Québec (Section 8.6); this Section states the assessment Zeus will carry out if and when it does. If you are in Québec: Personal Information collected from you may be communicated outside Québec — including to service providers in the rest of Canada and in the United States as described in Sections 4.1 and 4.2 — and, before communicating Personal Information outside Québec, Zeus carries out the assessment required by section 17 of the Private Sector Act.

---

5. Your Rights and Response Timelines

5.1 Rights exist as provided by applicable law and are not absolute

Subject to applicable Canadian federal and provincial privacy law, you may request access to, and rectification (correction) of, Personal Information about you that Zeus holds, and you may make the other requests described in this Section; these rights are not absolute, and Zeus may limit or deny a request where the law permits or requires it to do so, or where Zeus is unable to adequately verify your identity. Zeus does not discriminate against you for exercising a privacy right.

5.2 Requests about data a business entered: routed to that business

Zeus cannot honor requests concerning End-Customer Data or Worker Data directly from Clients, workers or other individuals, because Zeus processes that information on the relevant Customer's instructions; Zeus will refer your request to that Customer with reasonable details and will provide reasonable assistance to the Customer in honoring it in a timely manner. Where a request reaches Zeus directly, Zeus may instruct you on how to fulfill it yourself through in-product settings or the channels in Section 5.3, refer you to the relevant Customer or its administrators, or require additional information and documents needed to locate the data or verify the request. This routing applies unless applicable law prohibits it for a particular request.

5.3 Self-service channels come first

The designated channels for access, portability and deletion are the self-service tools built into the Services: an Account Owner may export the Workspace's data in-app (a structured export delivered as a ZIP archive) and may delete the account in-app; requests that can be fulfilled through these tools should be made through them. Requests that cannot be self-served may be sent to [email protected].

5.4 Identity verification

Zeus must be able to verify that you are who you say you are before acting on a request: Zeus may request up to three pieces of Personal Information to compare against its records, may ask you to provide copies of relevant identity documents, and may take additional anti-fraud steps. If you use an authorized agent, Zeus requires written proof that you have permitted the agent to submit the request and requires you to verify your identity directly with Zeus; failure to do so may result in denial of the request. Failure to verify identity may result in denial of the request.

5.5 Grounds on which Zeus may refuse or charge for a request

Where allowed under applicable law, Zeus may refuse requests that are manifestly unfounded or excessive, and may decline to process requests that are unreasonably repetitive, require disproportionate technical effort, jeopardize the privacy of others, are extremely impractical, or for which the requested action is not otherwise required by the law that applies to Zeus. If it is not reasonable, practical or appropriate for Zeus to process your request in the manner you have requested, or Zeus determines the request to be frivolous or vexatious, Zeus will advise you accordingly. Zeus may charge a reasonable fee — or refuse to comply — if your request is clearly unfounded, repetitive or excessive; otherwise, no fee applies to exercising your rights except any minimal fee applicable law permits and Zeus notifies in advance. In certain limited circumstances Zeus may not be able to make all relevant information available to you, such as where that information also pertains to another individual or is subject to legal privilege or confidentiality; in those cases Zeus discloses what it can with the protected content redacted, and will provide reasons for a denial on request, as applicable law requires.

5.6 Response timelines

Zeus responds to verifiable requests within the timeline the applicable statute sets, with any extension the statute permits (in which case Zeus will tell you about the extension as the statute requires):

5.7 Withdrawing consent

You may withdraw your consent to Zeus's collection, use or disclosure of your Personal Information at any time, subject to legal or contractual restrictions and reasonable notice; however, withdrawing consent may result in your inability to continue using some or all of the Services. If you withdraw consent, Zeus reserves the right to continue processing your Personal Information to the extent that processing is required or permitted by law — including information Zeus must retain for legal, regulatory, audit, security or record-keeping purposes. You may not opt out of administrative or transactional communications that are necessary to operate your account or the Services, such as messages confirming your requests or notifying you of changes to this Supplement.

5.8 Deletion: two phases, and what survives

Account deletion is two-phase: on a verified in-app deletion request the account is immediately deactivated and sessions are revoked, and the underlying data is purged in a later, separate step; Zeus does not commit to a fixed automatic purge timeline and purges as soon as reasonably practicable. Zeus may decline to fulfill a deletion request, in whole or in part, where Zeus (or its service providers) is required or permitted to retain the Personal Information — including to complete transactions and maintain business records, to protect the security and integrity of the Services, to comply with legal obligations, for fraud prevention, dispute resolution and the enforcement of agreements, and for internal uses compatible with the context in which the information was provided. By design, append-only audit and financial records survive account purge, backup copies are removed only on scheduled backup rotation rather than by targeted deletion, and residual copies may persist for a period in systems and backups; uninstalling the mobile app deletes nothing server-side.

---

6. Complaints and Regulators

6.1 How to complain, and to whom

If you have a question or complaint about Zeus's handling of your Personal Information, contact Zeus first at [email protected] (or by post, attention: Privacy Officer, Omni Data Tech Inc., 3601 Highway 7 East, Suite 1006, Markham, Ontario, L3R 0M3, Canada). Zeus will investigate complaints it receives and respond as described in Section 5.6. If you are not satisfied with Zeus's response, you may complain to the privacy regulator with jurisdiction:

• Federal (PIPEDA): Office of the Privacy Commissioner of Canada (OPC);
• Québec: Commission d'accès à l'information du Québec (CAI) — including the right to apply to the CAI for review of a refused access or rectification request;
• Alberta: Office of the Information and Privacy Commissioner of Alberta;
• British Columbia: Office of the Information and Privacy Commissioner for British Columbia.

---

7. Security Incidents and Breach Notification in Canada

7.1 Statutory breach regimes are preserved

Canadian law imposes breach-of-security-safeguards duties directly on the organization accountable for the affected information. Nothing in any Zeus document limits, and this Supplement preserves in full, the duties that mandatory law imposes on the accountable organization, including: under PIPEDA, reporting to the OPC and notifying affected individuals where a breach creates a real risk of significant harm, and maintaining records of every breach; under the Québec Private Sector Act (Law 25, ss 3.5–3.8), notifying the CAI and affected individuals where a confidentiality incident presents a risk of serious injury, and keeping an incident register; under Alberta PIPA (s 34.1), reporting to the Alberta Commissioner, who may order individual notification. (British Columbia PIPA imposes no mandatory private-sector breach-notification duty; any BC notification is voluntary.) Where Zeus is the accountable organization (Account Data), these duties are Zeus's; where a Customer is the accountable organization (End-Customer Data and Worker Data), these duties are the Customer's, and Zeus's role is to inform the Customer and assist as described in the DPA.

7.2 How Zeus notifies; what notification is not

Where Zeus is required by law to notify a Customer or an individual of a Security Incident, Zeus notifies the contact details associated with the relevant account, to the extent required by applicable Data Protection Laws; the Customer is solely responsible for ensuring its notification contact details are valid and accurate. A "Security Incident" excludes unsuccessful attempts and activities that do not compromise the security of Personal Information — such as failed log-in attempts, pings, port scans and denial-of-service attacks — except where a mandatory statutory definition applies, in which case that definition governs for that statute's purposes. No notification of, or response to, a Security Incident by Zeus is or will be construed as an acknowledgment or admission by Zeus of any fault or liability with respect to the incident. For incidents that are general and not specific to an identifiable user or Workspace, Zeus may provide notice through its status page, release notes or equivalent channels; incidents specific to a user or Workspace are notified to the affected party directly.

7.3 Your duty to tell Zeus

Customers and Authorized Users must notify Zeus without undue delay at [email protected] upon learning of any suspected or actual security breach, unauthorized disclosure or compromise of privacy involving their account, credentials, devices or data handled through the Services.

---

8. Québec and Provincial Specifics

Zeus does not currently offer the Services in Québec (Section 8.6). Sections 8.1 and 8.3 below state how Zeus will meet Québec's requirements if and when it does, except where a subsection already states that it describes Zeus's current practice.

8.1 Québec: location-dependent features

The global positions on Location Data apply unchanged in Québec, together with the Québec-specific notices in Sections 3.2 and 4.3:

The Customer (the business that enables a location-dependent feature) represents and warrants that it has provided all required notices and obtained all required consents from employees, contractors, subcontractors, its own customers, property owners, and other individuals before collecting or processing location, photo, media or field data through the Services, and must not use location-based features (including any location snapshot function) without the notice and consent required by law. Worker clock-in/clock-out coordinates and time-tracking data are made available to the Account Owner and the administrators of the Workspace. Location, time and field data may be inaccurate, unavailable, delayed or incomplete, and may be affected by device settings, permissions, network conditions, user behavior, GPS limitations and third-party systems; Zeus does not warrant its accuracy, availability, timeliness or completeness. Location Data is used to provide the Services to the business that owns the Workspace, is never used for advertising or marketing, and is never sold.

8.2 Workforce monitoring: the employer's responsibilities; visibility inside a Workspace

The Customer (as employer or principal) is solely responsible for compliance with all employment, workplace-monitoring, privacy, surveillance and consent laws that apply to its use of time tracking, clock-in/clock-out location snapshots, assignment and activity data about its workers — including, where applicable, Ontario's electronic-monitoring policy requirement (ESA s 41.1.1), and BC and Alberta PIPA employee-personal-information notice duties — and must obtain all requisite approvals and authorizations from its personnel for the creation, display, analysis and distribution of monitoring data before enabling such features. Zeus is a conduit for this data: worker time, location-snapshot and activity data is processed for, and made available to, the business that owns the Workspace and its administrators, and Members and Helpers should have no expectation that their in-tenant activity or data is private from the Account Owner — content and activity within a Workspace may be accessed, monitored, processed and analyzed by the Account Owner and administrators. The Services maintain an always-on, append-only activity and audit log that users cannot turn off. Worker requests about Worker Data are routed to the employer per Section 5.2.

8.3 Québec: data portability

If you are in Québec, you may request that computerized Personal Information collected from you be communicated to you in a structured, commonly used technological format (Private Sector Act s 27, third paragraph). The designated channel for this right is the in-app data export described in Section 5.3, which delivers the Workspace's computerized data as a structured ZIP archive; requests that the export tool does not satisfy may be sent to [email protected] and are handled under Sections 5.4–5.6.

8.4 Québec: confidentiality by default

As a statement of current practice for the technological products Zeus offers to the public: Zeus operates no advertising SDKs, no audience-matching technology and no session-replay technology. Product analytics and crash diagnostics are processed by the third-party processors named in the Privacy Policy and on Zeus's subprocessor page. How optional analytics are controlled differs between the mobile application and the website. In the Zeus mobile application, product analytics are on by default, and you can turn them off at any time in Settings › Privacy › Share Usage Data; turning them off stops both collection and transmission from that device. On the Zeus website, analytics load nothing and send nothing unless you affirmatively allow them when Zeus asks on your first visit or afterwards at https://fieldzeus.com/legal/privacy-choices, where a browser sending the Global Privacy Control signal is treated as a decline. Before making the Services available in Québec, Zeus will set the privacy parameters of its technological products as Law 25 s 9.1 requires.

8.5 Québec: cessation of dissemination and de-indexation

If you are in Québec, you may ask Zeus to cease disseminating Personal Information about you, or to de-index a hyperlink attached to your name that provides access to that information, where the conditions of section 28.1 of the Private Sector Act are met. Requests may be sent to [email protected] and are handled under Sections 5.4–5.6.

8.6 Québec: French language

Zeus's legal document set, including this Supplement, currently exists in English only. Under the Charter of the French language (as amended by Bill 96), contracts of adhesion must be remitted in French first, application and website surfaces must be available in French, and related commercial documents must be in French or bilingual. Because Zeus has not published a French document set, the Services are not offered in Québec. Zeus will publish the French document set, and update this Supplement, before making the Services available in Québec.

---

9. Changes to this Supplement

9.1 Revision, effectiveness and continued use

Zeus reserves the right to change this Supplement, and the Privacy Policy it supplements, at any time in its sole discretion. An amended version is effective as of the date it is published, with the version identifier updated; when a change is material, Zeus will give notice as appropriate under the circumstances. Your continued use of the Services after the effective date constitutes acknowledgment of, and — where consent is the operative basis — consent to, the amended version. If you disagree with an amended version, your remedy is described in Section 1.4.

---

10. Contacting Zeus

Privacy questions, requests and complaints: [email protected] Postal: Omni Data Tech Inc., 3601 Highway 7 East, Suite 1006, Markham, Ontario, L3R 0M3, Canada (attention: Privacy Officer). Legal pages: https://fieldzeus.com/legal · Privacy Policy: https://fieldzeus.com/legal/privacy · Subprocessor list: https://fieldzeus.com/legal/subprocessors.