NETFIRMS, INC. ("NETFIRMS") PRIVACY POLICY

Introduction

At Netfirms respecting privacy is an important part of our commitment to our customers. Our Privacy Policy is a statement of principles and guidelines regarding the minimum requirements for the protection of personal information provided by Netfirms to its customers. The objective of Netfirms' Privacy Policy is to promote responsible and transparent personal information management practices in a manner consistent with the provisions of the Personal Information Protection and Electronic Documents Act ("PIPEDA") of Canada . The policy is organized along the privacy principles of PIPEDA and applies to personal information collected, used, or disclosed by Netfirms in the course of its business activities.

Scope

The policy will apply to and protect all personal information collected, used or disclosed by Netfirms, except information that is aggregated in such a manner that it cannot be connected to a person and/or information which is publicly listed in a written or online directory or typically made available through directory assistance as permitted by law. For example, Netfirms may share non-personal, non-individual information with our partners in aggregate form for research analysis.

Personal information which may fall under the policy may include but is not limited to:

• Statistics regarding your website, including unique hits, bandwidth and disk space; Domain name registration information;
• Internet user names and activity reports;
• User names and passwords;
• Technical support records;
• Credit history/performance information;
• Credit card information;
• Payment and banking information; and
• Information you upload onto your websites.

Any information that Netfirms collects from you is intended to improve and personalize your experience for using Netfirms' services.

Note: With respect to domain name registration services, Netfirms is required by the applicable domain registries to collect certain personal information and Netfirms collects such information in order to register your domain names with the applicable domain registry.

Definitions

To better understand our policy, Netfirms has set out some basic definitions to use when reading and interpreting the principles below.

Collection: the act of gathering, acquiring, recording, or obtaining personal information from any source, including third parties, by any means.

Consent: voluntary agreement to the collection, use and disclosure of personal information for defined purposes. Consent can be either express or implied and can be provided directly by the individual or by an authorized representative. Express consent can be given orally, electronically or in writing, but is always unequivocal and does not require any inference on the part of Netfirms. Implied consent is consent that can reasonably be inferred from the circumstances or from an individual's action or inaction. For example, uploading personal information on your websites is considered implied consent for Netfirms to use such personal information to provide you with the associated services (i.e. hosting your website so that it is accessible on the World Wide Web).

Disclosure: making personal information available to a third party.

Personal Information: information about a customer, including an identifiable individual that is recorded in any form, but does not include aggregated information that cannot be associated with a specific customer. For a customer, such information does not include that which is aggregated in such a manner that it cannot be connected to him/her and/or information which is publicly listed in a written or online directory or typically made available through directory assistance.

Use: the treatment, handling and management of personal information by and within Netfirms.

Principles

Principle #1 - Accountability

Netfirms is responsible for personal information under its control and has designated its Privacy Officer accountable for the company's compliance with the PIPEDA principles.

1. Accountability for Netfirms' compliance with the principles rests with the Privacy Officer, who may designate one or more persons to be responsible for the day-to-day collection and processing of personal information. In addition, other individuals within the organization may be delegated to act on behalf of the Privacy Officer.
2. Netfirms will make known, upon request, the title of the person or persons designated to oversee Netfirms' compliance with this policy.
3. Netfirms is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. Netfirms' shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.
4. Netfirms shall implement policies and practices to give effect to these principles, including:
1. implementing procedures to protect personal information;
2. establishing procedures to receive and respond to complaints and inquiries;
3. training staff and communicating to staff information about Netfirms' policies and practices; and
4. developing information to explaining Netfirms' policies and procedures.

Principle #2 - Identifying Purposes

Where appropriate, Netfirms will identify the purposes for which personal information is collected at or before the time the information is collected.

1. Our primary business is to provide web hosting services and domain name registration services. Netfirms collects information for the following purposes:
1. To provide services to you, including registering, adding, maintaining and renewing hosting, domains and other services you use.
2. To establish and maintain responsible commercial relations with its customers and to communicate with its customers (which will include, but not be limited to, billing, collection, technical support, advertising, promotion of new products and services and special offers and account verification).
3. From time-to-time, Netfirms may organize contests or email surveys. Participation in these surveys or contests is completely voluntary and you therefore have a choice whether or not to disclose the information requested.
4. To understand our customer needs and preferences.
5. To meet legal and regulatory requirements.
2. Except where the collection of personal information is reasonably necessary in order to carry out the express wishes of the customer, Netfirms shall specify orally, electronically or in writing the identified purposes to the customer at or before the time personal information is collected.
3. Persons collecting personal information will be able to explain to individuals the purposes for which the information is being collected, or will refer the customer to a designated person at Netfirms who will explain the purposes.
4. Unless required by law, Netfirms will not use or disclose personal information for any purpose other than those described above without first identifying and documenting the new purpose and obtaining the consent of the customer, where such consent may not be reasonably implied.
5. Our communications are primarily done through email and we may try to reach you by phone regarding billing or support issues. We also send emails regarding site and service announcements. Our site uses cookies to gather broad demographic information and other statistics. We use IP addresses to analyze trends, improve our site and optimize your browsing and purchasing experience. The information from these IP addresses and cookies is not linked to any personally identifiable information.

Principle #3 - Consent

The knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except in certain circumstances as described below:

1. In certain circumstances, personal information can be collected, used, or disclosed without the knowledge and consent of the individual. For example, legal or security reasons may make it impossible or impractical to seek consent. When information is being collected for the detection and prevention of fraud or for law enforcement, seeking the consent of the individual might defeat the purpose of collecting the information. In other instances, information may be publicly available.
2. Where appropriate, Netfirms will generally seek consent for the use or disclosure of the information at the time of collection. In certain circumstances, consent with respect to use or disclosure may be sought after the information has been collected but before use (for example, when Netfirms wants to use information for a purpose other than those identified above).
3. In obtaining consent, Netfirms will use reasonable efforts to ensure that a customer is advised of the identified purposes for which personal information collected will be used or disclosed.
4. The form of consent sought by Netfirms may vary, depending upon the circumstances and type of information disclosed. For example, at the time you sign up for our services, you will be required to review and accept the terms of this Privacy Policy and consent to the use and disclosure of the information provided to us during the sign-up process for the purposes described herein. We seek the positive affirmation of all customers to our Privacy Policy.
5. In determining the appropriate form of consent, Netfirms shall take into account the sensitivity of the personal information and the reasonable expectations of its customers.
6. Netfirms will seek consent when the information is likely to be considered sensitive. Implied consent will generally be appropriate where the information is less sensitive or where it can be reasonably inferred that you are consenting to the use and disclosure of personal information for certain purposes. For example, uploading personal information on your websites is considered implied consent for Netfirms to use such personal information to provide you with the associated services (i.e. hosting your website so that it is accessible on the World Wide Web).
7. An individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Netfirms will inform the individual of the implications of such withdrawal. In order to withdraw consent, an individual must provide notice to Netfirms in writing.

Principle #4 - Limiting Collection

The collection of personal information will be limited to that which is necessary for the purposes identified by Netfirms. Information will be collected by fair and lawful means.

1. 1. Netfirms collects personal information from its customers for the purposes described under Principle #2.
2. 2. Netfirms will not release any personally identifiable information unless you specifically authorize us to do so or unless required by the appropriate law enforcement officials.

Principle #5 - Limiting Use, Disclosure and Retention

Personal information will not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information will be retained only as long as necessary for the fulfillment of those purposes.

1. Netfirms may collect, use or disclose personal information without the individual's knowledge or consent in certain circumstances as described in Principle #3.1.
2. Netfirms may disclose a customer's personal information to:
1. Domain Name Registries: In the case of domain registration, Netfirms operates as a domain registrar. Domain registrars are organizations who have been accredited by the domain registries to sell and manage domains to their customers (a "registrant"). Netfirms will be required to disclose personal information regarding a registrant to the applicable domain registries. Further, the registries may disclose certain information about domain registrants over the Internet through the WHOIS database. This WHOIS information is controlled by the domain registries.
2. Third Party Services Providers: Netfirms also offers certain third party services to its customers. Netfirms will disclose personal information to such third parties to the extent necessary for such third parties to provide the customer with the services requested.
3. Companies involved in providing online credit card processing services and online payment services.
4. Netfirms' agents and affiliates.
5. A person or company, who in the reasonable estimation of Netfirms is an agent of the customer.
6. Any other third party, upon receiving the consent of the customer or as required by law.
3. Only Netfirms' employees with a business need to know, or whose duties reasonably so require, are granted access to personal information about customers.
4. Netfirms will retain personal information for only as long as required to fulfill the identified purposes or as required by law.
5. Netfirms offers customers an option to no longer receive newsletters and promotional emails by simply clicking "unsubscribe" at the bottom of such emails.
6. Personal information that is no longer required to fulfill the identified purpose will be destroyed, erased or made anonymous according to the guidelines and procedures established by Netfirms. We retain information according to our retention schedules, which depend on any legal or contractual requirements with which we might need to comply. However, customers may request to have their account canceled, which will result in all personal information being destroyed, erased or made anonymous.

Principle #6 - Accuracy

Personal information shall be as accurate, complete and up-to-date as is necessary for the purposes for which it is to be used.

1. It is important that the information that we act on (such as contact information, billing information, email addresses, etc.) is accurate. We provide our customers with a member section where they can make corrections and updates to their information. In addition, users may call, fax or email Netfirms with changes and updates to this information. We may require that you follow certain procedures that are used by us for the verification of ownership of the account before we can assist with your request.

Principle #7 - Safeguards

Personal information shall be protected by security safeguards appropriate to the sensitivity of the information. Netfirms takes every precaution to protect our customers' information on-line as well as off-line.

1. Netfirms' sign-up/order forms are located on secure web pages and we use SSL encryption to protect sensitive information such as credit card numbers. We maintain state of the art firewall and anti-virus protection on our servers, which are located in a secure and climate-controlled environment with restricted access.
2. We also train our staff and grant access on a need-to-know basis. We utilize physical measures such as filing cabinets which are kept locked when not in use and restricted access to their locations. We use technological measures such as the use of passwords and restricted access to servers which house personal information.
3. Netfirms makes its employees aware of the importance of maintaining the confidentiality of personal information. All of Netfirms' employees with access to personal information will be required as a condition of employment to contractually respect the confidentiality of personal information.
4. Netfirms also protects the personal information it discloses to third parties through contractual agreements stipulating the confidentiality of the information and the purposes for which it is to be used.
5. Care will be used in the disposal or destruction of personal information to prevent unauthorized parties from gaining access to the information.

Principle #8 - Openness

Netfirms will make readily available to individuals specific information about its policies and practices relating to the management of personal information.

1. The intention of this policy is to answer your questions about our privacy policy and practices. Should you be interested in more detailed information about our procedures and practices, please contact our Privacy Officer at privacyofficer@netfirms.com. When you email Netfirms a request or concern, the Privacy Officer will review your email and send a response within 2-3 business days.
2. Netfirms will make this privacy policy available at http://www.netfirms.ca/legal/.

Principle #9 - Individual Access

Netfirms provides each customer with a password protected account upon sign-up. Our customers can access their account to review, update and manage products and services and personal information. In addition to on-line tools, we process customer requests by phone, chat and email. Before any changes can be made to an account, we need to authenticate your identity by asking certain questions. Once we have, to our satisfaction, verified your identity, our representatives will be happy to assist you. Please note that the provisions under PIPEDA are not intended to replace existing policies and practices of Netfirms

Upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

NOTE: In certain circumstances, Netfirms may not be able to provide access to all the personal information it holds about a customer. Exceptions may include information that is prohibitively costly to provide, information that contains references to other individuals, information that cannot be disclosed for legal, security or commercial proprietary reasons, information that is subject to solicitor-client or litigation privilege. Netfirms will provide the reasons for denying access upon request.

1. Upon request, Netfirms will inform an individual whether or not the organization holds personal information about the individual, and will provide that individual with a reasonable opportunity to review any personal information which Netfirms may possess about the individual.
2. Requests concerning personal information held by Netfirms should be in writing and should include sufficient information to permit Netfirms to provide an account of the existence, use, and disclosure to any third parties of this personal information. Netfirms may require that you provide account verification information prior to the release of such personal information. Netfirms will use such a request only for the purpose of providing you with an opportunity to review your personal information.
3. Netfirms will respond to application request for individual access to personal information within a reasonable time and at minimal or no cost to the individual. The requested information will be provided or made available in a form that is generally understandable.
4. Netfirms will be as specific as possible in providing an account of third parties to which it has disclosed personal information about an individual. When it is not possible to provide a list of the organizations to which it has actually disclosed information about an individual, Netfirms will provide a list of organizations to which it may have disclosed information about the individual.
5. When an individual successfully demonstrates the inaccuracy or incompleteness of personal information, Netfirms will amend the information as required. Depending upon the nature of the alleged inaccuracy, amendment involves the correction, deletion or addition of information. Where appropriate, the amended information will be transmitted to third parties having access to the information in question.
6. When an alleged inaccuracy is not resolved to the satisfaction of the individual, Netfirms will record the substance of the unresolved issue. When appropriate, the existence of the unresolved issue will be transmitted to third parties having access to the information in question.

Principle #10 - Challenging Compliance

An individual will be able to address a challenge concerning compliance with the above principles to Netfirms' Privacy Officer.

1. Netfirms will maintain procedures for addressing and responding to all inquiries or complaints from its customers about Netfirms' handling of personal information.
2. Netfirms will inform individuals who make inquiries or lodge complaints of the existence of relevant complaint procedures.
3. The person or persons accountable for compliance with this privacy policy may seek external advice where appropriate before providing a final response to individual complaints.
4. Netfirms shall investigate all complaints. If a complaint is found to be justified, Netfirms will take appropriate measures, including, if necessary, amending its policies and procedures.

For More Information

We appreciate hearing any comments that you may have about our policies, practices and customer service. Please contact our Privacy Office as follows:

E-mail:

privacyofficer@netfirms.com

Mail
Netfirms, Inc.

7030 Woodbine Ave. Suite 800

Markham, ON L3R 6G2

Canada

Attention: Privacy Office