FLEX^™ Administration

Tripemco's Privacy Policy

This is the privacy policy of Kerby-Reid Inc. ("Kerby-Reid"), the web host for Tripemco Insurance Group Limited's ("Tripemco") online insurance platform. To see Tripemco's privacy policy, click this button:

Kerby-Reid's Privacy Policy

This privacy policy is effective as of June 1, 2026.

Your privacy is very important to Kerby-Reid Inc. (“Kerby-Reid”).

Kerby-Reid provides underwriting software services to businesses in the insurance industry such as insurance carriers, insurance brokers, insurance agents, and managing general agents (“our clients”). In order to provide these services to our clients and to ensure we can assist our clients to make informed underwriting and claims decisions, it is necessary that we obtain information about you and / or your businesses on behalf of our clients. We will keep your personally identifiable information in confidence and access to that information will be restricted to those having a legitimate need to review or use that information.

In providing services to our clients, Kerby-Reid acts as a service provider processing personally identifiable information on behalf of those clients. Our clients remain accountable for their own use of that information. Under applicable Canadian privacy legislation, all parties to whom personally identifiable information is disclosed are required to provide protection comparable to that required by PIPEDA and applicable provincial privacy law.

Kerby-Reid complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial privacy legislation, including Quebec’s Act respecting the protection of personal information in the private sector (Law 25) where applicable. For more information about PIPEDA, please visit the Office of the Privacy Commissioner of Canada’s website at www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada.

This privacy policy covers any personally identifiable information collected by Kerby-Reid. The following is considered personally identifiable information and is explicitly protected under PIPEDA:

• Age, name, ID numbers, income, ethnic origin, or blood type;
• Opinions, evaluations, comments, social status, or disciplinary actions; and
• Employee files, credit records, loan records, medical records, the existence of a dispute, or intentions (for example, to acquire goods or services, or change jobs).

The types of personally identifiable information we collect is dependent on the type of product you request from us. We will limit the personally identifiable information we collect to that necessary for our clients to make informed underwriting and business decisions.

Accountability

Kerby-Reid is responsible for personally identifiable information under its control. Marc Sargent serves as Kerby-Reid’s Privacy Officer and is the person within the organization responsible for the protection of personal information, including for the purposes of Quebec’s Law 25. The Privacy Officer is accountable for Kerby-Reid’s policy with respect to the management of personally identifiable information and is the person to whom complaints and inquiries can be forwarded.

Marc Sargent, Privacy Officer

Phone: +1 416-583-2403

Identifying Purposes

Kerby-Reid collects, uses and discloses personally identifiable information for the following purposes:

• Offering insurance quotes, policies, bonds, and related products and services on behalf of our clients;
• Assisting our clients to make informed underwriting and claims decisions;
• Helping our clients to administer and process insurance products and services;
• Assisting our clients to establish and maintain communication with you;
• Verifying your identity and the accuracy of your personally identifiable information;
• Tracking your usage of our website and platform (see “Cookies and Tracking” below);
• Determining your eligibility for products offered on behalf of our clients;
• Facilitating and tracking your payment of premiums, fees and taxes;
• Assisting our clients to investigate and settle claims;
• Detecting and preventing fraud and unauthorized or illegal activities;
• Sharing your information with our clients, provided there are reasonable safeguards and it is legally permitted;
• Compiling statistics or aggregate data;
• Assisting our clients to report to regulatory or industry oversight entities as required by law;
• Gathering your feedback to help our clients improve their products and services; and/or
• Complying with all applicable laws.

Kerby-Reid will not use or disclose your personally identifiable information for any additional purpose unless we obtain your consent to do so.

Kerby-Reid will not sell user lists or personally identifiable information to other parties.

Consent

Canada’s privacy laws stipulate that an individual’s consent is required prior to or at the time we collect his or her personally identifiable information. Consent is also required prior to disclosing any personally identifiable information to a third party, except in certain situations identified in the legislation. We rely on the following actions by you as indications of your consent to our use of your personally identifiable information until you notify us of your withdrawal of your consent:

• Your voluntary provision of personally identifiable information directly to us or through our client, broker, agent, insurer, association, or their representative for the purpose of acquiring an insurance or surety contract or related product or service (including information previously provided to us);
• Your request for website access by signing up for a website account;
• Your logging in to one of our websites using your selected or assigned unique log in name and password;
• Your consent solicited by us (or our agent) for a specified purpose;
• Your receipt of this Privacy Policy; and/or
• Your consent given through your authorized representative such as an agent, legal guardian or holder of a power of attorney.

By providing personally identifiable information about a third party such as a family member, director, officer or employee by any of the above methods, you represent that you have obtained their consent to the collection, use and disclosure of such personally identifiable information in accordance with this Privacy Policy.

In the event you request changes, endorsements, renewals or cancellations to your policy or bond, the original consent provided to us will remain in effect.

For certain products and where allowed by law, you may be given the option to give consent for us to access limited credit information about you or your company’s shareholders from a credit reporting agency. Consent will be explicitly requested by us and you must provide explicit consent before we will attempt to obtain such credit information.

Please note that if you refuse or withdraw consent to the collection, use or disclosure of your personally identifiable information we may be unable to allow access to the secure sections of our website or provide the product or service requested.

Cookies and Tracking

Our website and platform use first-party cookies that are necessary to support functionality and to deliver the services you request, including a cookie that measures and analyzes how you use our website and platform so that we can operate, secure, and improve our services. Kerby-Reid does not use third-party tracking technologies, and we do not share website or platform usage information with third-party analytics, advertising, or social media platforms. Should we introduce any third-party tracking technologies in the future, this policy will be updated accordingly prior to their use.

You may disable cookies through your browser settings. Disabling cookies may affect your ability to use certain features of our website.

Limiting Collection

Kerby-Reid limits the collection of personally identifiable information to that which is necessary for the purposes identified.

Limiting Use, Disclosure, and Retention

Kerby-Reid will not use disclosed personally identifiable information for purposes other than those for which it was collected, except with your consent or as permitted by law. Kerby-Reid will retain personally identifiable information only as long as necessary for the fulfilment of those purposes or to satisfy our legal or business obligations.

Retention periods vary by the type of information and the purpose for which it was collected. For insurance and surety-related records, retention is governed by applicable provincial insurance statutes and regulatory requirements, which generally require records to be kept for a minimum of seven years. Where no specific legal minimum applies, Kerby-Reid retains personally identifiable information only for as long as is reasonably required for the identified purpose, after which it is securely destroyed.

Accuracy

Kerby-Reid will keep your personally identifiable information as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.

You may request corrections to your personally identifiable information in order to ensure its accuracy and completeness. A request to correct personally identifiable information must be made in writing and provide sufficient detail to identify the personally identifiable information and the correction being sought.

If the personally identifiable information is demonstrated to be inaccurate or incomplete, we will correct the information as required and send the corrected information to any organization to which we disclosed the personally identifiable information in the previous year. If the correction is not made, we will note your correction request in the file.

Safeguards

Kerby-Reid is committed to ensuring the security of your personally identifiable information in order to protect it from unauthorized access, collection, use, disclosure, copying, modification or disposal or similar risks.

Kerby-Reid will protect your personally identifiable information by various physical, technological and organizational safeguards. Kerby-Reid will protect personally identifiable information using security safeguards appropriate to the sensitivity of the information.

All interactions where we collect personally identifiable information on our website will be done using secure sockets layer protocol (encrypted).

Kerby-Reid processes and stores personally identifiable information in Canada. Where personally identifiable information is provided to Kerby-Reid from outside Canada in the course of a transaction, it is processed and stored in Canada in accordance with this Privacy Policy and applicable Canadian privacy legislation.

Kerby-Reid will use appropriate security measures when destroying your personally identifiable information.

Kerby-Reid will continually review and update our security policies and controls as technology changes to ensure ongoing personally identifiable information security.

Breach of Security Safeguards

A breach of security safeguards occurs when personally identifiable information under Kerby-Reid’s control is lost, or subject to unauthorized access, use or disclosure. Kerby-Reid has procedures in place to detect, investigate and respond to such breaches.

Where a breach creates a real risk of significant harm to an individual, Kerby-Reid will, as required by PIPEDA:

• Report the breach to the Office of the Privacy Commissioner of Canada (OPC), and, in the case of a Quebec resident, to the Commission d’accès à l’information (CAI);
• Notify affected individuals as soon as feasible; and
• Notify any other organization or government institution that may be able to reduce the risk of harm or mitigate the harm.

Kerby-Reid maintains records of all breaches of security safeguards involving personally identifiable information under its control, regardless of whether the breach creates a real risk of significant harm. These records are retained for a minimum of two years and are available to the OPC upon request.

Openness

Upon written request, Kerby-Reid will make available to you specific information about our policies and practices relating to the management of personally identifiable information.

Individual Access

Upon written request, Kerby-Reid will inform you of the existence, use, and disclosure of your personally identifiable information and will give you access to that information, subject to limited exceptions. A minimal fee may be charged for providing access to personally identifiable information. Where a fee may apply, we will inform you of the cost and request further direction from you on whether or not we should proceed with the request. If a request is refused in full or in part, we will notify you in writing, providing the reasons for refusal and the recourse available to you.

Access requests should be directed in writing to Kerby-Reid’s Privacy Officer at the address listed in the “Accountability” section above. We will respond to access requests within 30 days of receipt, or notify you of an extension where additional time is required.

Automated Decision-Making

Kerby-Reid’s platform may use automated processing of personally identifiable information to assist our clients in making underwriting decisions, including decisions related to eligibility for insurance or surety products and premium determination.

If you are a resident of Quebec, you have the right under Law 25 to be informed of any decision based exclusively on automated processing that produces legal or other significant effects concerning you, and to request that such a decision be reviewed by a person with the authority to do so. To exercise this right, please contact our Privacy Officer.

Challenging Compliance

An individual shall be able to address a challenge concerning compliance with the above principles to Kerby-Reid’s Privacy Officer using the contact information listed in the “Accountability” section above.

If you are not satisfied with Kerby-Reid’s response to your complaint or inquiry, you have the right to contact the Office of the Privacy Commissioner of Canada (OPC). The OPC can be reached at +1-800-282-1376 or at www.priv.gc.ca. If you are a resident of Quebec, you may also contact the Commission d’accès à l’information (CAI) at www.cai.quebec.ca.

Notice to United States Residents

Kerby-Reid facilitates the purchase of Canadian surety products and insurance by clients and end users located in the United States. This section applies to United States residents whose personally identifiable information is collected, used, or disclosed through our platform in the course of those transactions. It supplements the rest of this Privacy Policy; all other provisions apply equally to United States residents.

Insurance and Financial Information

Much of the personally identifiable information Kerby-Reid processes in connection with United States insurance and surety transactions is “nonpublic personal information” governed by the Gramm-Leach-Bliley Act (GLBA) and by state insurance privacy laws applicable to insurance licensees. Information governed by those regimes is generally exempt from state comprehensive consumer privacy laws. Kerby-Reid handles such information in accordance with the privacy obligations applicable to it and to its clients under those insurance and financial privacy regimes.

Our Role

For the majority of United States transactions, Kerby-Reid processes personally identifiable information on behalf of its clients (insurance carriers, managing general agents, and brokers) and acts as a service provider under applicable United States privacy law. In those cases, the client is the business responsible for determining the purposes and means of processing, and bears primary responsibility for compliance with applicable United States privacy obligations toward the individuals whose information is collected.

Where individuals transact directly through our platform without an intermediary client relationship, Kerby-Reid collects and processes their personally identifiable information for the purposes identified in this Privacy Policy and the rights described below apply directly.

Business and Consumer Transactions

Most United States clients transacting through our platform are businesses purchasing Canadian surety products or insurance. Personally identifiable information collected about individuals acting solely in their capacity as employees, officers, or authorized representatives of a business in a commercial transaction is generally outside the scope of United States consumer privacy law as it applies to Kerby-Reid.

Where individuals transact in a personal capacity — including where they are named as a principal on a surety product or insurance policy outside of a business context — the consumer privacy rights described below apply to the collection and use of their personally identifiable information.

Your Rights as a United States Resident

Depending on the state in which you reside, and to the extent the information is not otherwise governed by the insurance and financial privacy regimes described above, you may have some or all of the following rights with respect to personally identifiable information that Kerby-Reid holds about you in a consumer capacity:

• Right to Know. You have the right to know what categories of personally identifiable information we collect about you, the purposes for which it is used, and the categories of third parties with whom it is shared. This Privacy Policy provides that information.
• Right to Access. You have the right to request access to the specific personally identifiable information we hold about you.
• Right to Correction. You have the right to request correction of inaccurate personally identifiable information we hold about you.
• Right to Deletion. You have the right to request deletion of personally identifiable information we hold about you, subject to exceptions required by law. Because insurance and surety records are subject to mandatory retention requirements under applicable Canadian and United States regulatory law, we may be unable to delete certain records during the applicable retention period.
• No Sale of Personal Information. Kerby-Reid does not sell personally identifiable information to third parties, including as “sale” is defined under the California Consumer Privacy Act and its amendment, the California Privacy Rights Act (CCPA/CPRA). Kerby-Reid does not share personally identifiable information for cross-context behavioural advertising purposes.
• Right to Non-Discrimination. Kerby-Reid will not discriminate against you for exercising any of your privacy rights.

How to Submit a Privacy Rights Request

United States residents wishing to exercise any of the rights described above may submit a written request to Kerby-Reid’s Privacy Officer using the contact information in the “Accountability” section of this Privacy Policy. Please identify yourself, describe the right you wish to exercise, and provide sufficient information to allow us to locate your personally identifiable information. We will acknowledge receipt of your request within 10 business days and will respond within 45 days of receiving a verifiable request. Where additional time is required, we may extend this period by a further 45 days and will notify you of the extension and the reason for it within the initial 45-day period.

If your personally identifiable information was collected through one of Kerby-Reid’s clients rather than directly by Kerby-Reid, we will direct your request to the appropriate client as required by our service provider obligations and notify you that we have done so.

Notice to Residents of the European Economic Area, the United Kingdom, and Switzerland

This section applies to individuals located in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland whose personally identifiable information is collected or processed by Kerby-Reid. It is provided in accordance with the General Data Protection Regulation (GDPR) as it applies in the EEA, the UK GDPR as retained in UK law, and the Swiss Federal Act on Data Protection (FADP). Where this section conflicts with other parts of this Privacy Policy, this section applies to EEA, UK, and Swiss residents.

Data Transfers to Canada

Personally identifiable information collected from EEA, UK, and Swiss residents is processed and stored in Canada. Canada benefits from a recognition of adequacy for commercial personal information governed by PIPEDA from the European Commission, and a corresponding recognition under the UK and Swiss regimes. Where an applicable adequacy recognition is in effect, transfers of personally identifiable information to Kerby-Reid in Canada are generally permitted without additional transfer safeguards such as standard contractual clauses. Adequacy recognitions are subject to periodic review; Kerby-Reid monitors their status and will implement additional transfer safeguards if and when required.

Legal Basis for Processing

Under GDPR, UK GDPR, and the FADP, Kerby-Reid must identify a lawful basis for each processing activity. The primary bases on which Kerby-Reid processes personally identifiable information about EEA, UK, and Swiss residents are:

• Performance of a contract. Processing necessary to issue, administer, or service a surety product or insurance policy that you have requested or are a party to.
• Legal obligation. Processing required to comply with applicable Canadian regulatory and legal requirements, including record retention obligations.
• Legitimate interests. Processing necessary for the legitimate interests of Kerby-Reid or our clients, such as fraud detection, security, and the improvement of our platform, where those interests are not overridden by your rights and interests.
• Consent. Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Your Rights

EEA, UK, and Swiss residents have the following rights with respect to their personally identifiable information:

• Right of access. The right to obtain confirmation of whether we process your personally identifiable information and, if so, to receive a copy of it.
• Right to rectification. The right to have inaccurate personally identifiable information corrected and incomplete information completed.
• Right to erasure. The right to request deletion of your personally identifiable information where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to exceptions including our legal obligations to retain records under applicable insurance and regulatory law.
• Right to restriction of processing. The right to request that we restrict processing of your personally identifiable information in certain circumstances, such as while the accuracy of the information is contested.
• Right to data portability. Where processing is based on consent or contract and carried out by automated means, the right to receive your personally identifiable information in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.
• Right to object. The right to object to processing of your personally identifiable information where we rely on legitimate interests as the legal basis, unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Rights related to automated decision-making. The right not to be subject to a decision based solely on automated processing that produces legal or significant effects concerning you, and to request human review of any such decision. See also the “Automated Decision-Making” section of this Privacy Policy.

How to Exercise Your Rights

To exercise any of the rights described above, please submit a written request to Kerby-Reid’s Privacy Officer using the contact information in the “Accountability” section of this Privacy Policy. We will respond within one month of receiving a verifiable request. Where a request is complex or we receive a high volume of requests, we may extend this period by a further two months and will notify you accordingly.

If you are not satisfied with our response, EEA residents have the right to lodge a complaint with the data protection supervisory authority in their country of residence or establishment. UK residents have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk. Swiss residents may contact the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

Notice to Residents of Mexico

This section applies to individuals located in Mexico whose personally identifiable information is collected or processed by Kerby-Reid, in accordance with Mexico’s Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP).

Under the LFPDPPP, Mexican residents have the right to Access, Rectify, Cancel, and Object to the processing of their personally identifiable information (collectively, the “ARCO Rights”). Specifically:

• Access. The right to know what personally identifiable information we hold about you and how it is used.
• Rectification. The right to have inaccurate or incomplete personally identifiable information corrected or updated.
• Cancellation. The right to request deletion of your personally identifiable information when it is no longer necessary for the purpose for which it was collected, subject to legal retention obligations.
• Objection. The right to object to the use of your personally identifiable information for specific purposes.

To exercise your ARCO Rights, please submit a written request to Kerby-Reid’s Privacy Officer using the contact information in the “Accountability” section of this Privacy Policy. We will respond within the timeframe required by the LFPDPPP. If you are not satisfied with our response, you may contact the Mexican data protection authority. Following Mexico’s 2025 reform, responsibility for personal data protection in the private sector was transferred from the former Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) to the Secretaría Anticorrupción y Buen Gobierno, acting through Transparencia para el Pueblo.

Notice to Residents of Brazil

This section applies to individuals located in Brazil whose personally identifiable information is collected or processed by Kerby-Reid, in accordance with Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, LGPD).

Under the LGPD, Brazilian residents have the right to: confirm the existence of processing; access their personally identifiable information; correct inaccurate, incomplete, or outdated information; request anonymization, blocking, or deletion of unnecessary or excessive data; request portability of their data to another service provider; request deletion of data processed on the basis of consent; obtain information about third parties with whom data has been shared; object to processing; and withdraw consent at any time.

The primary legal bases on which Kerby-Reid processes personally identifiable information of Brazilian residents are the performance of a contract to which the data subject is party, compliance with a legal obligation, and the legitimate interests of Kerby-Reid or our clients, in each case as permitted under the LGPD.

To exercise your rights under the LGPD, please submit a written request to Kerby-Reid’s Privacy Officer using the contact information in the “Accountability” section of this Privacy Policy. We will respond within the timeframe required by the LGPD. If you are not satisfied with our response, you may contact Brazil’s Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

Notice to Residents of China

Kerby-Reid does not collect personally identifiable information directly from individuals located in China. Where Kerby-Reid processes information about Chinese individuals or entities, that information is provided to Kerby-Reid by a Canadian customs or insurance broker in the course of arranging a Canadian surety product or insurance transaction. The collection of that information and any transfer of it out of China are carried out by the broker or other parties upstream of Kerby-Reid, not by Kerby-Reid.

Kerby-Reid processes such information in Canada as a downstream service provider, in accordance with this Privacy Policy and applicable Canadian privacy legislation. Inquiries or requests concerning the original collection of that information, the consent obtained for it, or its transfer out of China are most appropriately directed to the Canadian customs or insurance broker through whom the relevant transaction was arranged. Kerby-Reid will reasonably assist any such broker in responding to a request relating to information Kerby-Reid holds.

Notice to Residents of Other Jurisdictions

Kerby-Reid facilitates the purchase of Canadian surety products and insurance by clients and end users located around the world. Individuals located in jurisdictions not specifically addressed in this Privacy Policy (including Australia, New Zealand, Japan, Singapore, South Korea, and other countries with applicable privacy legislation) may have rights with respect to their personally identifiable information under the laws of their home jurisdiction.

Kerby-Reid is incorporated in Canada and processes personally identifiable information in Canada in accordance with PIPEDA and applicable provincial privacy legislation. To the extent that additional rights or obligations arise under the laws of your jurisdiction, Kerby-Reid will make reasonable efforts to accommodate requests consistent with those rights.

Individuals in jurisdictions not addressed above who wish to exercise privacy rights, make an inquiry, or lodge a complaint regarding Kerby-Reid’s handling of their personally identifiable information should contact Kerby-Reid’s Privacy Officer using the contact information in the “Accountability” section of this Privacy Policy.

Please note that in many cases, personally identifiable information is submitted to Kerby-Reid by a Canadian insurance broker or other intermediary acting on behalf of the individual. Where this is the case, Kerby-Reid acts as a service provider to that intermediary, and the intermediary may be the more appropriate contact for privacy requests relating to the underlying transaction.