Vynzo Media Ltd.
Global Privacy Policy
and Data Protection Notice

1. Purpose, scope and legal status

1.1.This Global Privacy Policy and Data Protection Notice explains how Vynzo Media collects, receives, uses, organizes, stores, accesses, analyzes, combines, discloses, transfers, secures, retains, deletes and otherwise processes Personal Information in connection with its business, websites, digital properties, sales activity, client relationships, supplier relationships, recruitment, workforce administration, and marketing services performed for clients.

1.2.This Policy is intended to operate as a global baseline. It applies subject to the privacy, data protection, electronic marketing, communications, consumer, advertising, employment, health, cybersecurity and sector laws that apply to a particular individual, Vynzo entity, client engagement, campaign, technology or processing activity.

1.3.Where local law gives a person stronger rights or requires stricter standards than this Policy, Vynzo will apply the stronger local requirement to the extent it is legally applicable. Where a local requirement conflicts with this Policy, the local requirement controls for the affected processing.

1.4.This Policy does not replace a client privacy notice when Vynzo acts only on a client instruction, a client Data Processing Addendum, a Business Associate Agreement where required for protected health information, a campaign specific notice, a cookie notice, a consent request, an employee or applicant notice, or any other notice required by applicable law.

1.5.Vynzo does not represent that a single public policy can create automatic compliance with every law in every country. Vynzo uses this Policy together with contractual controls, consent mechanisms, privacy reviews, records of processing, security safeguards, retention rules, vendor governance and local legal review where required.

2. Who Vynzo Media is and how to contact us

2.1.Vynzo Media is an international digital marketing, advertising, creative, growth, technology and business services organization. Vynzo operates through group entities, registered businesses and operating locations that may act separately or together depending on the service and jurisdiction.

2.2.For United Kingdom operations, Vynzo Media Ltd is registered in England and Wales under Company No. 16889451. Its United Kingdom office is 71 to 75 Shelton Street, Covent Garden, London, WC2H 9JQ.

2.3.Vynzo Media maintains a Canada office at 1281 Hornby St, Vancouver, British Columbia V6Z 0G8. The legal entity responsible for a specific Canadian engagement will be identified in the relevant contract, invoice, engagement record or other corporate documentation.

2.4.Vynzo Media also conducts operations in Bangladesh. The responsible contracting or operating business for a Bangladesh engagement will be identified in the relevant agreement or business record.

2.5.Vynzo Media Ltd is registered on the United Kingdom Information Commissioner data protection fee register under registration reference ZC056799.

2.6.Privacy questions, requests and complaints may be sent to the Vynzo Privacy Office at privacy@vynzo.ca. A request may also be directed to the Vynzo office identified in the relevant client or business relationship.

2.7.Where applicable law requires a statutory Data Protection Officer, representative, Information Officer, privacy officer, local contact, grievance officer or similar role, Vynzo will designate or publish the applicable contact in a jurisdiction specific notice or other legally required record. The use of a privacy contact in this Policy does not by itself state that a statutory appointment is required in every jurisdiction.

3. Privacy roles in Vynzo operations and client services

3.1 Vynzo as an independent controller or equivalent

Vynzo ordinarily determines the purposes and essential means of processing for its own corporate website, sales and relationship management, business development, invoicing, supplier management, security, recruitment, workforce administration, legal compliance, corporate communications and Vynzo branded marketing. In these activities Vynzo normally acts as a controller, business, responsible party, data user, data fiduciary or equivalent role under applicable law.

3.2 Vynzo as a processor, service provider, contractor or operator

When a client determines why Personal Information will be used and instructs Vynzo to handle that information only to provide contracted services, Vynzo ordinarily acts on behalf of the client. Depending on the applicable law, this can make Vynzo a processor, operator, service provider, contractor or similar service role. Vynzo will process such Client Data only for documented client purposes, applicable legal requirements and permitted service operations.

3.3 Independent or joint roles with platforms and partners

Advertising platforms, social networks, analytics providers, lead platforms and other technology providers can independently determine purposes and means for some processing. In some cases Vynzo and a client or platform may each act as an independent controller, or may have joint responsibilities for a defined operation. Role allocation depends on the facts, the platform terms and applicable law and is not determined only by the label used in a contract.

3.4 No unauthorized reuse of Client Data

As a privacy commitment, Vynzo will not use Client Data supplied solely for client services to create unrelated Vynzo prospect lists, unrelated Vynzo advertising audiences, or unrelated commercial profiles, and will not sell such Client Data for monetary consideration, unless the client has expressly authorized a separate lawful purpose and all required notices, choices and contractual terms are in place.

4. Definitions

5. Personal information we process

The information Vynzo processes depends on the relationship, service, campaign and applicable law. Vynzo applies data minimization and seeks to collect only information reasonably necessary for a defined purpose.

6. Sources of personal information

6.1.Directly from you when you contact Vynzo, request a proposal, enter a contract, submit a form, attend a meeting, subscribe to communications, exercise a privacy right, apply for a role or otherwise provide information.

6.2.From clients when they lawfully provide information or authorize Vynzo to access information for contracted marketing, creative, analytics, advertising, CRM, website, content, communications or related services.

6.3.Automatically through Vynzo websites, applications and approved technologies, subject to the consent and preference rules that apply in the relevant jurisdiction.

6.4.From advertising, social media and analytics platforms in accordance with platform terms, privacy settings, applicable law and the permissions applicable to the campaign.

6.5.From corporate websites, business registries, professional directories, industry sources, events, referrals and other public or authorized business sources where use for the relevant purpose is lawful.

6.6.From service providers and data providers that contractually represent that the information may lawfully be supplied for the intended purpose. Vynzo requires source and provenance review for prospect data obtained from third parties.

6.7.From combined data only where combining the information is compatible with the original purposes, covered by the relevant notice, authorized by the client where Client Data is involved, and permitted under applicable law.

7. Purposes of processing

8. Legal grounds and legal authorizations

The legal basis for processing differs by jurisdiction. Vynzo does not treat the European lawful basis framework as if it were the universal legal model. Vynzo identifies the basis, consent, authorization, exception or other legal permission required by the law that applies to the processing.

8.1 European Economic Area and United Kingdom grounds

Where the European Union General Data Protection Regulation or United Kingdom General Data Protection Regulation applies, Vynzo may rely on consent, performance of a contract, steps requested before entering a contract, compliance with a legal obligation, protection of vital interests where relevant, or legitimate interests where the law permits and the interests, necessity and balancing requirements are satisfied. Special category data requires an additional lawful condition where the law requires one.

8.2 Consent based processing

When consent is the appropriate legal basis, Vynzo seeks consent that is informed, specific, freely given and capable of withdrawal, subject to the standard required by applicable law. Optional marketing consent is not bundled into a service where it is not necessary to provide that service.

8.3 Contract and requested steps

Vynzo relies on contractual necessity only where the processing is genuinely required to perform the relevant contract with the individual or to take requested steps before entering that contract. Merely placing a processing activity inside contractual wording does not make the activity necessary for contract performance.

8.4 Legitimate interests

Where applicable law recognizes legitimate interests, Vynzo documents the interest, the necessity of processing, likely expectations, impact on individuals and safeguards. Direct marketing may be a legitimate interest in some circumstances, but separate electronic communications and tracking rules can still require consent or another condition.

8.5 Other jurisdictions

In jurisdictions that use different statutory structures, Vynzo processes information only where permitted by the applicable consent, purpose limitation, notice, contract, legal authorization, reasonable purpose, business purpose, exception or other local rule. Jurisdiction specific terms appear in Schedule 1.

9. Client marketing services and Client Data

Vynzo provides services that can involve substantial Personal Information. This section establishes the privacy rules that apply to those services in addition to the client contract and Data Processing Addendum.

9.1 Client responsibility for lawful input data

A client that supplies recipient lists, customer databases, advertising audiences, health related information, employee information or other Personal Information remains responsible for establishing that its collection and disclosure to Vynzo is lawful unless the contract expressly allocates a particular responsibility to Vynzo. Vynzo may request evidence of source, notice, consent, suppression and permitted use and may refuse or suspend processing that presents an unresolved legal or privacy risk.

9.2 Vynzo processor commitments

When Vynzo acts solely as processor or equivalent service role, Vynzo processes Client Data only on documented instructions, limits access to authorized personnel, applies appropriate safeguards, uses approved subprocessors, assists with rights and incident obligations as required, and returns or deletes Client Data at the end of services subject to law, backups and agreed retention requirements.

9.3 Purpose changes

If Vynzo proposes to use Client Data for a materially new purpose that is not necessary to perform the client service, the new purpose requires a separate role and legal assessment, appropriate contractual authority, and any required notice, consent or opt out before the new processing begins.

10. Direct marketing, business development and prospecting

10.1 Channels

Vynzo marketing and client campaigns may use email, telephone, text messaging, WhatsApp or other messaging services, social platforms, digital advertising, website forms, events and professional networking channels only as permitted by applicable law and platform rules.

10.2 Business prospecting

For business prospecting, Vynzo may use professional contact information obtained directly, through referrals, from public business sources, or from approved providers where the intended use is lawful. Vynzo does not treat a publicly visible email address as universal permission for unrestricted marketing. Geography, recipient type, source, relationship, channel and local electronic marketing law are considered before use.

10.3 Consent and opt out

Where prior consent is required, Vynzo or the relevant client must obtain valid consent before sending the communication. Every marketing workflow must provide the unsubscribe, opt out, objection or withdrawal mechanism required by local law. Opt outs are recorded promptly and propagated to relevant systems.

10.4 Canada

For commercial electronic messages subject to Canada Anti Spam Legislation, Vynzo applies the applicable express or implied consent rules, required sender identification and functioning unsubscribe requirements. Privacy obligations under Canadian privacy law apply separately to the collection, use and disclosure of Personal Information.

10.5 United Kingdom and European Economic Area

United Kingdom Privacy and Electronic Communications Regulations and European ePrivacy rules can impose requirements separate from the lawful basis for processing under data protection law. Vynzo therefore evaluates both the privacy basis and the channel specific electronic marketing rule.

10.6 United States

Vynzo applies applicable federal and state marketing rules, including requirements governing commercial email, telephone and text marketing, deceptive practices, sensitive data, children and state privacy opt outs where relevant. Consent requirements for telephone or text activity are assessed separately from general privacy notice obligations.

11. Advertising technology, audiences, pixels and conversion measurement

11.1.Vynzo may implement or manage advertising pixels, tags, conversion interfaces, audience tools, analytics and attribution technologies only where the client engagement authorizes the technology and applicable consent, notice and opt out controls are in place.

11.2.Advertising tags and server based conversion tools must be included in the Vynzo or client technology inventory, mapped to the data sent, recipient, purpose, retention, legal basis or authorization, geographic transfer and consent or opt out behavior.

11.3.Custom audience, customer match and similar uploads must use data that the client and Vynzo are legally permitted to disclose to the platform for that purpose. Sensitive information and children information must not be used for audience targeting unless a separate legal review expressly approves the activity.

11.4.Lookalike or similar audience generation may involve profiling by the advertising platform. Vynzo evaluates the client role, platform role, notice, consent or opt out requirements and any sensitive attribute restrictions before use.

11.5.Remarketing and behavioral advertising must be disabled or withheld where required consent has not been obtained, or where an applicable sale, sharing or targeted advertising opt out requires the relevant disclosure or processing to stop.

11.6.Vynzo does not place personal information such as email addresses, names, phone numbers, health details or other direct identifiers into page addresses, campaign parameters or tracking parameters when a less identifying method can serve the same purpose.

12. Cookies and other tracking technologies

Vynzo websites and client digital properties may use Tracking Technologies. The exact technologies used on a specific property must be disclosed through the property specific Cookie and Tracking Notice or consent manager. Schedule 3 provides the governance framework. With your analytics consent, we use Microsoft Clarity to understand interactions with our public website through session recordings, heatmaps and usage metrics. This helps us improve navigation, usability and our services. Clarity uses cookies and similar technologies. We use strict text masking to protect form entries and other text. You can reject optional analytics or change your choice through Cookie Preferences. Microsoft processes this information as described in the Microsoft Privacy Statement.

12.1 Categories

12.2 Consent design

Where consent is required, optional technologies are not preselected, consent choices are presented clearly, refusal is not made materially harder than acceptance, and consent can be withdrawn through an accessible preference control. Vynzo avoids dark patterns or interfaces intended to impair free choice.

12.3 Preference signals

Where applicable United States law requires recognition of a qualifying browser or device based opt out preference signal, Vynzo will configure covered digital properties to recognize and apply the signal to the relevant sale, sharing or targeted advertising activity.

13. Social media and platform processing

13.1.Vynzo may use social media platforms for content publishing, community management, advertising, lead forms, analytics, recruitment and client communications. Each platform independently controls certain information under its own terms and privacy notice.

13.2.When Vynzo uploads a customer list, configures a lead form, installs a platform pixel, or creates a targeted audience, Vynzo assesses whether Vynzo, the client and the platform act as separate controllers, joint controllers or in another legally defined relationship for the relevant operation.

13.3.Vynzo does not promise that deletion from a Vynzo system automatically deletes information independently retained by a social platform. Where a rights request concerns a platform controlled copy, Vynzo will provide assistance or direction appropriate to its role and legal obligations.

13.4.Client teams must not export social platform user data into unrelated spreadsheets, personal accounts or unapproved systems solely for convenience. Exported data remains subject to the original purpose, access controls, retention requirements and client instructions.

14. Artificial intelligence and automated tools

14.1.Vynzo may use artificial intelligence assisted tools for drafting, analysis, creative support, summarization, classification, quality assurance, research, analytics and workflow automation, subject to an approved business purpose and privacy review appropriate to the data and risk.

14.2.Client Data and Personal Information must not be entered into a public or unapproved artificial intelligence service where the service can retain, reuse or train on the information contrary to the client contract, Vynzo policy or applicable law.

14.3.Where Vynzo uses an artificial intelligence provider to process Client Data, that provider is subject to the same vendor, subprocessor, confidentiality, security, transfer and deletion review required for other processors.

14.4.Vynzo does not use solely automated decision making to make a legal or similarly significant decision about an individual unless the activity is lawful, appropriately disclosed, subject to required safeguards and approved through enhanced privacy review.

14.5.Artificial intelligence output that contains, infers or summarizes Personal Information must be reviewed for accuracy, relevance, bias, confidentiality and permitted purpose before it is used in a material client, employment, eligibility or other consequential context.

15. Sensitive information, health information and regulated data

15.1 General rule

Vynzo seeks to avoid collecting Sensitive Personal Information unless it is genuinely necessary for a defined engagement or legal purpose. Sensitive information receives additional access restrictions, minimization, security and legal review appropriate to its category and jurisdiction.

15.2 Health and healthcare marketing

Vynzo may provide marketing services to healthcare organizations. Client teams must not assume that ordinary marketing tools may receive patient information. Where United States protected health information is involved and Vynzo is acting as a business associate, processing requires a Business Associate Agreement that meets applicable requirements and use only for permitted purposes. A Business Associate Agreement alone does not authorize marketing uses or disclosures. Where HIPAA requires an individual authorization for marketing, that authorization must also be obtained unless an applicable exception permits the activity. Where a service does not require protected health information, the client should configure the service so that Vynzo does not receive it.

15.3 Sensitive advertising restrictions

Vynzo does not intentionally use health status, precise location, financial credentials, biometric identifiers, political beliefs, religious beliefs, sexual orientation, children information or similarly sensitive attributes for targeted advertising through Vynzo own marketing unless the use is expressly lawful, necessary, transparent and approved through enhanced privacy review. Client campaigns involving such information require equivalent review and written authorization.

15.4 Washington and similar consumer health laws

Where a United States state consumer health privacy law applies to a campaign or digital property, Vynzo and the client must determine whether information qualifies as consumer health data, provide any required health specific notice and consent, restrict sale or sharing as required, and use processors under compliant contracts.

16. Children and young people

16.1.Vynzo corporate websites and general agency services are intended for business and professional audiences and are not designed primarily for children.

16.2.Vynzo does not knowingly use children Personal Information for Vynzo own targeted advertising.

16.3.A client campaign directed to children, likely to be accessed by children, or using information about minors requires a separate legal and privacy review before launch, including age appropriate transparency, parental or guardian consent where required, platform restrictions, profiling restrictions, retention and safeguarding requirements.

16.4.Because age thresholds differ across jurisdictions, Vynzo does not rely on one global age threshold as a substitute for local law.

17. Sharing, recipients and subprocessors

Vynzo discloses Personal Information only for defined purposes, under appropriate contracts and safeguards, and subject to applicable law. Recipients may include the following categories.

17.1 Subprocessor governance

For Client Data, Vynzo maintains or will maintain a controlled subprocessor process. New subprocessors are assessed for purpose, data categories, security, retention, processing locations, cross border transfer, contractual obligations and incident handling. Client notice or authorization is provided where required by the applicable Data Processing Addendum or law.

18. Sale, sharing and targeted advertising under United States law

18.1.Vynzo does not sell Personal Information for money as part of its ordinary business model.

18.2.Certain disclosures to advertising or analytics partners can nevertheless be legally defined as sale, sharing, targeted advertising or comparable regulated activity under United States state privacy laws even when no money is paid for the information.

18.3.Where Vynzo is a covered business or controller and such activity occurs, Vynzo provides the legally required notice and opt out mechanism, including recognition of qualifying universal opt out preference signals where required.

18.4.Where Vynzo acts only as a service provider, contractor or processor for a covered client, Vynzo contractually restricts use of Client Data to the permitted service purpose and does not retain, use, disclose, sell or share Client Data outside the scope permitted by the applicable contract and state law.

18.5.The precise United States rights available to an individual depend on the state, coverage threshold, type of data and activity. Schedule 1 describes the general state privacy approach.

19. International transfers

19.1.Vynzo operates internationally and uses technology providers that can process Personal Information in more than one country. Personal Information may therefore be transferred to or accessed from a country different from the country where it was collected.

19.2.Vynzo identifies the applicable transfer rule for each material flow. Safeguards may include an adequacy decision, Standard Contractual Clauses, the United Kingdom International Data Transfer Agreement or United Kingdom Addendum, binding corporate rules where available, approved certification, contractual accountability, comparable protection requirements, local transfer contracts, consent where legally valid, or another mechanism recognized by the applicable law.

19.3.For European Economic Area restricted transfers, Vynzo applies the General Data Protection Regulation transfer framework, including adequacy or appropriate safeguards and any required transfer assessment and supplementary measures.

19.4.For United Kingdom restricted transfers, Vynzo applies the United Kingdom transfer regime, including adequacy regulations or an appropriate safeguard such as the International Data Transfer Agreement or United Kingdom Addendum where required.

19.5.For Canadian information transferred to a processor, Vynzo applies accountability, contractual and transparency requirements appropriate to the applicable federal or provincial privacy law.

19.6.For jurisdictions that restrict or condition international transfers, including China, Saudi Arabia, Turkey, Australia, Singapore, South Korea, Japan, India, Bangladesh and others, Vynzo performs the local transfer analysis required for the specific data and destination.

20. Retention, deletion and anonymization

20.1.Vynzo retains Personal Information only for as long as reasonably necessary for the defined purpose and for applicable legal, accounting, tax, security, contractual, dispute, audit and evidence requirements.

20.2.Retention is determined by the nature and sensitivity of the information, purpose, volume, risk, legal requirements, client instructions, limitation periods, backup architecture and whether information can be safely anonymized instead of retained in identifiable form.

20.3.Marketing opt out and suppression information may be retained in a minimal form for as long as reasonably necessary to prevent a person who has objected from being added back into a marketing audience. Suppression data is not used to resume marketing.

20.4.When Vynzo acts as processor, Client Data is returned or deleted after the service in accordance with the client contract and Data Processing Addendum, subject to legal retention and protected backup cycles.

20.5.Deletion from active systems may precede deletion from protected backups. Data retained temporarily in a backup remains protected and is not restored for ordinary business use. It is removed through the normal backup lifecycle unless law requires longer preservation.

20.6.When information is anonymized so that it no longer identifies or is reasonably linkable to an individual under the applicable law, Vynzo may retain and use the anonymized information for legitimate analytics, security or service improvement purposes.

21. Security and confidentiality

Vynzo uses administrative, technical and physical measures designed to protect Personal Information against unauthorized access, acquisition, disclosure, alteration, loss, misuse and destruction. Security measures are selected according to risk, sensitivity, service architecture and legal requirements.

No internet connected system can be guaranteed to be absolutely secure. Vynzo therefore avoids statements that any system is completely secure and instead maintains risk based safeguards and response capabilities.

22. Personal data breaches and incident response

22.1.Vynzo investigates suspected loss, unauthorized access, disclosure, compromise or destruction of Personal Information. The response includes containment, evidence preservation, scope assessment, risk evaluation, remediation and documentation.

22.2.When Vynzo is a controller, Vynzo notifies regulators and affected individuals when and within the period required by the applicable law. Different laws use different thresholds and time periods.

22.3.When Vynzo acts as processor for a client, Vynzo notifies the client without undue delay after becoming aware of a Personal Data Breach affecting Client Data, provides available information reasonably necessary for the client assessment, and cooperates with lawful notification and remediation obligations.

22.4.For European Economic Area and United Kingdom reportable breaches, the applicable controller framework can require regulator notification within seventy two hours after awareness where the legal risk threshold is met, with additional communication to affected people where required.

22.5.For Canada, Vynzo applies the applicable real risk of significant harm or provincial breach standard and maintains breach records where required. For Australia, Vynzo applies the Notifiable Data Breaches framework. For other jurisdictions, Vynzo applies the local notification threshold and timing.

22.6.Because Bangladesh privacy law is newly developed and implementation can evolve, Vynzo applies prompt internal escalation and obtains current local legal confirmation for reportability and notification timing when a Bangladesh related incident occurs.

23. Individual privacy rights

Depending on the applicable law and circumstances, an individual may have one or more of the following rights. A right can be limited by exemptions, identity requirements, legal duties, conflicting rights, client roles or other lawful restrictions.

24. Exercising rights, verification and authorized agents

24.1.Privacy requests may be sent to privacy@vynzo.ca. The request should identify the person, the nature of the request, the relationship with Vynzo, and any client, campaign or service relevant to locating the information.

24.2.Vynzo may request information reasonably necessary to verify identity, authority, residency or the data to which a request relates. Verification is proportionate to the sensitivity and risk of the request and will not be used to obstruct a right.

24.3.Where local law prohibits or limits identity verification for a specific opt out, Vynzo will not impose unnecessary verification as a condition of honoring that opt out.

24.4.An authorized agent may submit a request where the applicable law permits. Vynzo may request evidence of authority and may confirm the request directly with the individual where legally allowed.

24.5.If Vynzo receives a request relating to Client Data for which the client is the controller, Vynzo will normally direct or transmit the request to the client and assist the client in accordance with the Data Processing Addendum rather than independently deciding the client legal response.

24.6.Vynzo aims to respond as promptly as reasonably possible and within the legally required period. Time limits differ by jurisdiction and may be extended where the law permits and the required notice of extension is provided.

24.7.Vynzo does not discriminate against a person for lawfully exercising a privacy right.

25. Marketing objections and suppression

25.1.Every Vynzo controlled marketing channel will provide the legally required method to unsubscribe, object or withdraw consent.

25.2.When a person opts out, Vynzo applies the choice to the relevant channel and purpose and, where appropriate, stores a minimal suppression record so that the person is not inadvertently readded through a later list import.

25.3.A suppression record is used to honor the privacy choice and is not treated as permission to send further promotional communications.

25.4.A client campaign must use the client suppression list and any Vynzo campaign suppression controls relevant to the service. Client teams must not bypass an unsubscribe by exporting a recipient to another tool or campaign.

26. Profiling and automated decisions

26.1.Vynzo may use permitted segmentation and profiling to understand business interests, website engagement, campaign performance or likely relevance of services.

26.2.Where profiling is based on Tracking Technologies, consent or opt out requirements applying to those technologies are observed separately from the data protection ground for the profiling.

26.3.High risk profiling, large scale monitoring, sensitive data profiling, employment profiling, children profiling, or profiling that can produce legal or similarly significant effects requires enhanced privacy review and any impact assessment required by law.

26.4.Where the law provides a right to opt out of qualifying profiling or automated decisions, Vynzo provides or assists with the required mechanism according to its role.

27. Government, legal and corporate disclosures

27.1.Vynzo may disclose Personal Information when reasonably necessary to comply with a valid law, court order, regulatory requirement, lawful government request, legal process, tax obligation or enforceable legal duty.

27.2.Where legally permitted, Vynzo evaluates requests for scope and authority, seeks to disclose only the information legally required, and may challenge an overbroad or unlawful request.

27.3.Vynzo may disclose information to establish, exercise or defend legal claims, investigate fraud or misuse, protect rights or safety, or enforce contracts where permitted by applicable law.

27.4.If Vynzo participates in a merger, acquisition, financing, restructuring, sale of assets or similar corporate transaction, Personal Information may be disclosed under confidentiality and due diligence controls and transferred subject to applicable notice, purpose and legal requirements.

28. Complaints and regulator engagement

28.1.A privacy complaint may be sent to privacy@vynzo.ca. Vynzo will record the complaint, investigate the relevant facts, communicate an outcome and maintain evidence appropriate to the applicable law.

28.2.Individuals may also have the right to complain to a competent privacy or data protection regulator. The appropriate regulator depends on the individual location, Vynzo entity, establishment, processing activity and applicable law.

28.3.Vynzo cooperates with competent regulators as required by law while protecting Client Data, legal privilege, confidential business information and the rights of other individuals.

29. Changes to this policy

29.1.Vynzo may update this Policy to reflect changes in law, regulator guidance, technology, services, vendors, corporate structure or processing practices.

29.2.The effective date will be updated when a revised version is published. Where law requires affirmative notice or renewed consent for a material change, Vynzo will provide the required notice or choice before relying on the change.

29.3.Previous versions may be retained to identify the privacy information that applied at a particular time and to support accountability.

Schedule 1. Jurisdiction specific privacy terms

This Schedule supplements the global terms. It is designed for worldwide operations but is not a substitute for a jurisdiction specific legal review when Vynzo launches a campaign, service or data flow in a country with additional, new or sector specific rules. If this Schedule and mandatory local law differ, mandatory local law controls.

Schedule 2. Client Data Processing Addendum framework

This Schedule provides the baseline data protection terms Vynzo should incorporate into client contracts when Vynzo processes Client Personal Data on behalf of a client. The signed client agreement or a separate Data Processing Addendum controls where it contains more specific terms. This framework is not a substitute for executing Standard Contractual Clauses, a United Kingdom transfer instrument, a Business Associate Agreement, or another mandatory local instrument when required.

1. Definitions and scope

Applicable Data Protection Law means all privacy, data protection, electronic marketing and security laws that apply to the Processing. Client Personal Data means Personal Information processed by Vynzo on behalf of Client under the Services. Processing details are set out in the Statement of Work, order form or processing schedule.

2. Roles

To the extent Vynzo processes Client Personal Data solely on behalf of Client, Client acts as Controller and Vynzo acts as Processor or the equivalent roles under Applicable Data Protection Law. Each party acts as an independent Controller for Personal Information for which it independently determines purposes and essential means.

3. Client instructions

Vynzo processes Client Personal Data only on documented Client instructions, including instructions in the contract, Statement of Work and authorized written directions, unless Applicable Law requires otherwise. Where legally permitted, Vynzo informs Client before processing required by law.

4. Client lawfulness

Client is responsible for establishing that its collection, disclosure and instructions are lawful and supported by required notices, consents, permissions and opt out processes. Client will not instruct Vynzo

to process sensitive, children, biometric, precise location, protected health, financial credential or other specially regulated data unless expressly identified and approved.

5. Purpose limitation

Vynzo will not use Client Personal Data for unrelated Vynzo advertising, unrelated Vynzo lead generation or unrelated commercial profiling. Vynzo will not sell Client Personal Data for monetary consideration and will not engage in any sale, sharing or targeted advertising involving Client Personal Data except as expressly instructed by Client and permitted by Applicable Data Protection Law.

6. Confidentiality

Vynzo ensures that persons authorized to process Client Personal Data are bound by confidentiality obligations and access the data only to the extent required for their assigned responsibilities.

7. Security

Vynzo maintains technical and organizational measures appropriate to the nature, scope, context and risk of processing, including access controls, authentication, secure transmission, logging, backups, incident response, personnel controls and other safeguards appropriate to the service.

8. Subprocessors

Client grants the authorization stated in the signed agreement for Vynzo to use approved subprocessors. Vynzo imposes data protection obligations appropriate to the delegated processing and remains responsible for subprocessor performance to the extent required by law. Where general authorization applies, Vynzo provides notice of material new subprocessors and an opportunity to object on reasonable data protection grounds where required.

9. Rights assistance

Taking into account the nature of Processing, Vynzo provides reasonable assistance for Client to respond to legally valid privacy rights requests. If Vynzo receives a request relating to Client Personal Data, Vynzo will promptly notify Client and will not make the substantive Controller decision unless required by law or instructed by Client.

10. Security incidents

Vynzo notifies Client without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Data, provides available information reasonably necessary for Client assessment and notification duties, and cooperates with containment, investigation and remediation. Incident notice does not constitute an admission of fault or liability.

11. Impact assessments and regulator consultation

Vynzo provides information reasonably available to assist Client with legally required data protection impact assessments, privacy impact assessments, transfer assessments and regulator consultations relating to the Services.

12. Return and deletion

At the end of Services, Vynzo returns or deletes Client Personal Data according to Client election and the contract, unless law requires retention. Information retained temporarily in protected backups remains subject to this Addendum and is not restored for ordinary use except when needed for legitimate recovery.

13. Audit and information

Vynzo makes available information reasonably necessary to demonstrate compliance with its processor obligations. Audits are subject to reasonable confidentiality, security, proportionality, scope, frequency and non disruption conditions. Independent assurance may be used where reasonably sufficient.

14. International transfers

The parties will not make a restricted international transfer unless a lawful transfer mechanism applies. Where required, the parties will execute applicable European Standard Contractual Clauses, a United Kingdom International Data Transfer Agreement or Addendum, or another approved mechanism and will cooperate with required transfer assessments and supplementary safeguards.

15. California and other United States processor restrictions

Where Vynzo qualifies as a service provider, contractor or processor, Vynzo processes Client Personal Data only for the specified and limited purposes in the agreement, applies the contractual restrictions required by the applicable state law, does not sell or share the data except as permitted, and informs Client if Vynzo can no longer meet applicable obligations.

16. Marketing lists and audience uploads

Where Client supplies recipient lists, customer match data or advertising audiences, Client will maintain lawful provenance and required marketing permissions. Vynzo may pause or decline a campaign where evidence of lawful use is materially incomplete or where a required opt out or consent control cannot be implemented.

17. Sensitive and health data

Client will not provide protected health information or other highly regulated information unless the Statement of Work expressly requires it and the parties have executed every required sector contract, including a Business Associate Agreement where applicable, and implemented the required security and privacy controls.

18. Conflict

If this framework conflicts with a mandatory provision of Applicable Data Protection Law, the mandatory provision controls. If the signed Data Processing Addendum gives greater protection, the signed term controls.

Processing details schedule

Schedule 3. Cookie and tracking notice framework

Every Vynzo controlled digital property that uses Tracking Technologies should maintain a current technology inventory and a property specific notice. The live notice must reflect actual deployed technologies rather than a generic historic list.

A. Required technology inventory fields

B. Recommended global banner text

Your Privacy Choices. We use necessary technologies to operate and secure this site. With your permission, we may also use analytics and advertising technologies to understand site use, measure campaigns and personalize marketing. You may accept optional technologies, reject optional technologies or manage your preferences. You can change your choice at any time through Privacy Choices. Where applicable, we also honor qualifying browser based opt out preference signals.

C. Implementation rules

C.1.Advertising and other nonessential tracking must not activate before consent in jurisdictions where consent is required.

C.2.Rejecting optional technologies must be technically effective and must not be merely cosmetic.

C.3.Withdrawal must update browser and server side tracking behavior where the withdrawn choice applies.

C.4.Consent records must identify the choice, time, notice version, source and categories selected where proof of consent is required.

C.5.A tag or conversion interface added by a marketing team must pass privacy review before production deployment.

C.6.Cookie and tracking scans should be repeated periodically and after material website or campaign changes.

C.7.A privacy choice must propagate to connected advertising and analytics systems where required by law and the relevant architecture.

Schedule 4. Marketing consent and preference language

A. Optional email consent

I would like to receive marketing emails from Vynzo Media about services, insights, events and offers. I understand that I may unsubscribe at any time. The Vynzo Privacy Policy explains how my information is used and how to exercise privacy rights.

B. Inquiry form notice

Vynzo Media will use the information you provide to respond to your inquiry and manage the requested business relationship. If you separately choose marketing communications, Vynzo may also send relevant updates and service information. Additional information about processing and privacy rights is available in the Vynzo Privacy Policy.

C. Client lead form notice

The client named on this form is responsible for the purpose of this campaign. Vynzo Media may process the information on the client behalf to deliver and measure the campaign. The client privacy notice explains the client purposes and rights. Vynzo will use the information only as permitted by the client agreement and applicable law.

D. Marketing preference record requirements

Schedule 5. Privacy governance and compliance controls

Publishing this Policy is only one part of Vynzo privacy governance. The following operational controls are required to make the public commitments effective in practice.

Campaign launch privacy gate

1.Identify the client and privacy role for each material data flow.

2.Identify the audience, data categories and source.

3.Identify every target country and state.

4.Confirm the lawful basis, consent or other local authorization.

5.Confirm electronic marketing rules for the selected channel.

6.Confirm cookie, pixel and conversion tracking consent or opt out behavior.

7.Confirm whether the campaign uses custom audiences, remarketing, profiling or artificial intelligence.

8.Confirm whether sensitive information, health information or children are involved.

9.Confirm every vendor, platform and international transfer.

10.Confirm the client notice, campaign notice, consent and suppression language.

11.Confirm retention and deletion after the campaign.

12.Document the approval before launch.

Schedule 6. Principal legal references

The following legal frameworks may be relevant to Vynzo operations, services and Personal Information processing. Their application depends on the jurisdiction, activity, legal role and rules in force at the time. This reference list is not exhaustive and does not certify compliance with every law.

Privacy and administrative contacts

For privacy questions, rights requests or complaints about Vynzo operations and services, contact the Privacy Office at privacy@vynzo.ca. For administrative correspondence, contact admin.dept@vynzo.ca.

United Kingdom

Vynzo Media Ltd.
71 to 75 Shelton Street
Covent Garden, London WC2H 9JQ
United Kingdom
Phone +44 7397 085272

Canada

Vynzo Media
1281 Hornby St
Vancouver, BC V6Z 0G8
Canada

About this policy and future updates

This is Vynzo Media’s public privacy policy for its business operations, services and Personal Information processing. It applies beyond use of this website, subject to the scope, privacy roles and jurisdiction specific terms explained above.

This online policy is not a permanent statement of unchanged practices. Vynzo may revise it as its services, processing activities or applicable requirements change. You may use the published version as a reference to the privacy information and commitments applicable from its stated effective date. Check the current version and effective date when referring to it.

Updates do not by themselves authorize a new use of Personal Information or remove rights, contractual protections or legal obligations. Vynzo will provide any notice and obtain any consent required for a material change. Mandatory law and any more protective applicable contractual terms continue to apply.