GPC FINANCIAL CORPORATION PRIVACY POLICY

Introduction
GPC Financial Corporation (GPCFC) is required to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), which came into effect in 2000 and governs the use, collection and disclosure of personally identifiable information (Personal Information) in Canada. GPCFC’s Privacy Policy (Policy), approved by its Board of Directors, operates within the corporate privacy policy and addresses key PIPEDA requirements regarding the, use, collection, and disclosure of Personal Information and our commitment to maintaining the accuracy, confidentiality, and security of Personal Information.

Scope and Application of this Policy
Systems and processes used by GPCFC are largely owned, managed, and maintained by its parent company, Global Payments Direct, Inc. (Global Payments) or its affiliates.
Global Payments provides payment products and services on behalf of GPCFC for commercial and non-commercial enterprises. Global Payments, GPCFC, and/or their affiliates have relationships with card issuers and merchants, providing products and services, which include payment card processing, point-of-sale terminal management and support, merchant accounting and funds transfer.

Definitions
Personal Information is information about an identifiable individual and does not include information about corporations, partnerships or other non- individuals. The Personal Information we may ask you for and the Personal Information that we currently have, would depend upon the nature of the services we provide to you.
Unless the context clearly indicates otherwise, the term “individual” refers to merchants who use GPCFC products and services, as well as any visitors to our web site.

Privacy Principles
The following ten privacy principles of PIPEDA govern our actions related to the collection, use and disclosure of Personal Information.

Principle 1: Accountability
GPCFC is responsible for maintaining and protecting the Personal Information under its control. GPCFC has designated individuals who are accountable for its compliance with these ten privacy principles.

Principle 2: Identifying Purposes
The purposes for which Personal Information is collected will be identified before or at the time the information is collected.

Principle 3: Consent
Knowledge and consent are required for the collection, use, or disclosure of Personal Information except where such collection, use, or disclosure is required or permitted by law.

Principle 4: Limiting Collection
The Personal Information collected in a fair and lawful manner will be limited to those details necessary for the purposes identified by GPCFC.

Principle 5: Limiting Use, Disclosure and Retention
Personal Information will only be used or disclosed for the purpose for which it was collected unless you have otherwise consented, or when such other usage or disclosure is required or permitted by law. Personal Information will only be retained for the period of time required to fulfill the purpose for which it was collected or as required by law.

Principle 6: Accuracy
Personal Information will be maintained in as accurate, complete and up-to-date form as is necessary to fulfill the purposes for which it is to be used.

Principle 7: Safeguarding Customer Information
Personal Information will be protected by security safeguards that are appropriate to the sensitivity level of the information.

Principle 8: Openness
GPCFC will make information available to our customers concerning the policies and practices that apply to the management of Personal Information.

Principle 9: Individual Access
Except where limited by law, individuals shall be informed of the existence, use and disclosure of their Personal Information and shall be given access to such Personal Information upon request. Consistent with their rights under law, individuals may verify the accuracy and completeness of their Personal Information, and may request that it be amended, if appropriate.

Principle 10: Handling Customer Complaints and Suggestions
Customers may direct any questions or enquiries with respect to the privacy principles outlined
above or about our practices by contacting:

Privacy Office
GPC Financial Corporation
P.O. Box 4010, Station B Etobicoke, ON M9W 7H8
Privacy.Office@globalpay.com

If you have questions or concerns regarding our organization's Privacy Policy and practices, you
should first contact the Privacy Officer of GPCFC directly. If you do not receive acknowledgment of
your inquiry or complaint or you do not feel it has been satisfactorily addressed within 30 days, you
may contact the Office of the Privacy Commissioner of Canada by writing to:

30, Victoria Street
Gatineau, Quebec
K1A 1H3

Types of Information We Collect
Personal Information
GPCFC may collect the following types of Personal Information from you:

Personal Information including contact information (name, address, telephone numbers, e-mail)
and Social Insurance Number (SIN);
Financial information including credit information and information related to business activity;
Merchant Information (business name, address, contact information); and
Anonymous/non-Personal Information that we do not associate with or trace back to a
specific individual or business entity. For example, our web servers collect some
anonymous/non- Personal Information automatically when you visit our website. Gathered
electronically, this information may include the pages you visited, the type of web browser you
are using, the level of encryption your browser supports and your Internet Protocol address.

Cookies
A cookie is a small computer file or piece of information that may be stored in your computer's hard
drive when you visit our website. Some web browsers are configured to accept cookies
automatically. If you prefer not to accept cookies, you may adjust your browser settings.

Cookies may be used by the GPCFC website to improve functionality and in some cases, to provide
visitors with a customized online experience. If you would like to browse the GPCFC website, you
may do so without accepting cookies. However, you should understand that if you choose not to
accept cookies, some areas of the GPCFC website may not function properly or optimally.

Consent
Your provision of Personal Information to us means that: (a) you agree and consent that we may collect, use and disclose your Personal Information for the purposes described in this policy; (b) you or your representatives are authorized to provide us with your Personal Information. Should you choose not to provide us with required Personal Information, we may not be able to provide certain services; and (c) you acknowledge and consent that GPCFC may retain service providers to perform certain services and that in the event that a service provider is located in the United States or another jurisdiction, Personal Information may be processed and stored in that jurisdiction, and that foreign courts or law enforcement or regulatory agencies may be able to obtain disclosure of Personal Information through the laws of those jurisdictions.

You have the right to withdraw your consent for GPCFC to process your Personal Information; however, this may limit our ability to provide certain services. GPCFC will collect explicit consent from you prior to using or disclosing your Personal Information for new purposes.

Collection and Use of Personal Information
At GPCFC, we collect, use and disclose Personal Information to provide you with the services you have requested, to respond to your inquiries, and to offer you additional products and services we believe you might be interested in.
GPCFC uses your Personal Information for the following purposes:

To determine your financial situation by collecting credit and related financial information from our affiliates, strategic partners, credit agencies, other financial institutions and from references provided by you;
To facilitate the provision of our services by sharing your information with our third party service providers, credit and debit card issuers, credit and debit card associations, credit agencies and similar parties connected to credit or debit card services;
To investigate potentially fraudulent or questionable activities regarding your merchant account(s) or the use of our services;
For reporting purposes under credit or debit card association rules or regulations and to credit and debit card issuers, financial institutions, consumer reporting agencies or other credit or debit card related entities;
To offer you related products and services that might benefit you;
In the course of an actual or potential sale, reorganization, consolidation, merger or amalgamation of our business; and
To comply with applicable laws and/or regulations and as otherwise required or permitted by applicable laws and/or regulations.

Disclosure to Third Parties
At GPCFC, we sometimes contract with third parties to perform services related to the purposes noted above. Our service providers may, at times, be responsible for processing and handling some of the information we receive from you. We provide only the information necessary to perform the services, and providers are prohibited from processing Personal Information for purposes other than to carry out the service they have been contracted to provide. Furthermore, as part of our agreements, our service providers are contractually obliged to protect your information in a manner that is consistent with GPCFC’s privacy policies and practices.
We may also be required to disclose Personal Information in response to requests by legal, government, or regulatory agencies with proper jurisdiction.

How We Safeguard Your Information
We use industry standard technologies and maintain current security standards in an effort to ensure that your Personal Information is protected against unauthorized access, disclosure, inappropriate alteration or misuse

Accessing and Amending Your Information
You have the right to be informed of the existence, use and disclosure of your Personal Information and to challenge the accuracy and completeness of the information and have it amended as appropriate.

Accessing Your Information
To obtain access to your records or to request a correction to a record you must make a written request. We may request payment of a small fee, in accordance with applicable law. Please describe the records you are requesting, being as specific as possible so that we can ensure our response meets your needs. We will respond to your request within 30 days or we will notify you of the need for additional information or the reasons why your access is denied.

Changing, Updating, or Amending Your Information
To help us keep your Personal Information up-to-date, we encourage you to change, update, or amend inaccuracies and make corrections as often as necessary.

To make a change or update to your Personal Information, you may do one of the following:

Submit a request in writing to 3381 Steeles Avenue East, Suite 200, Toronto, Ontario M2H 3S7
Call the relevant Customer Care Centre at 1-800-263-2970 for GPCFC merchant related matters, where one of our operators will be available to receive your request for a change in your personal contact information; or
Send a facsimile to us 416-847-4240 to request a change in your personal contact information.

If you have any questions or concerns about the GPCFC’s Privacy Policy or the information in this statement, please contact:

Attn: Privacy Office
GPC Financial Corporation
P.O. Box 4010, Station B Etobicoke, ON M9W 7H8
Privacy.Office@globalpay.com

If you would like more information on PIPEDA, please refer to the website of the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.