This Policy applies to:

• Visitors to our website.
• Users of the VSF Investor Portal.
• Investors in Capital Markets products.
• Clients of Wealth Management and Capital Structuring.
• Individuals providing information during communications, onboarding, or events.

• Identification Data – name, address, date of birth, ID documents.
• Contact Data – email, phone, mailing address.
• Financial Data – banking details, payment instructions, investment history.
• KYC/AML Data – occupation, source of funds, beneficial ownership.
• Corporate Records (Capital Structuring) – ledgers, tax filings, shareholder registers.
• Technical Data – IP address, browser type, portal usage, cookies.
• Communications – emails, calls, correspondence with VSF.

We process personal information to:

• Comply with securities, tax, and anti-money laundering laws.
• Execute transactions (subscriptions, distributions, redemptions).
• Provide portfolio management, planning, and reporting.
• Deliver bookkeeping, tax preparation, and structuring services.
• Maintain the Investor Portal and secure data rooms.
• Communicate updates, reports, and notices.
• Monitor cybersecurity, fraud, and operational risks.

• Express consent is required for sensitive information (e.g., banking details).
• Implied consent may apply in operational contexts (e.g., portal logins).
• Consent may be withdrawn at any time, subject to legal obligations.

We may share information with:

• Affiliates and Subsidiaries – supporting Capital Markets, Wealth Management, and Capital Structuring.
• Service Providers – IT providers, custodians, accountants, administrators, legal counsel.
• Regulators & Authorities – ASC, CRA, FINTRAC, or courts when required.
• Business Transactions – during mergers, acquisitions, or restructuring.
• Cross-Border Transfers – see Section 6.

Data may be transferred outside Canada, including to the U.S., subject to contractual safeguards.

We retain personal information only as long as necessary:

• KYC/AML records – 5 years post-relationship.
• Capital Structuring records – 7 years (tax law).
• Transaction records – 7 years (CRA).
• Corporate records – indefinite (corporate law).
• Portal logs – 12 months.
• Marketing consent – until withdrawn.

We use layered security measures:

• Physical – secure offices, restricted file access.
• Technical – encryption, firewalls, multi-factor authentication.
• Organizational – policies, staff training, segregation of duties.
• Incident Response – breach notification in line with PIPEDA.

You may request:

• Access to your information.
• Corrections to inaccurate data.
• Deletion (subject to legal retention).
• Data portability where feasible.
• To file complaints with the Privacy Commissioner of Canada.

We use cookies to improve performance. Categories include:

• Essential – for secure logins.
• Functional – remembering preferences.
• Performance & Analytics – monitoring usage.
• Advertising – limited, with opt-out.

We are not responsible for the privacy practices of linked websites or third-party integrations.

We may amend this Policy. Updates will be posted with a new effective date.

This Policy is governed by Alberta law and applicable Canadian federal laws. U.S. disclaimers apply for U.S. users.