Privacy Policy

1. Introduction

MM NOVA TECH LTD (“NOVACRM,” “we,” “us,” or “our”) is committed to protecting the privacy and security of personal information collected through our website and software services. This policy explains what information we collect, how we use it, with whom we share it, and the rights you have regarding that information.

This policy applies to both our public Internet Data Exchange (IDX) website and, where applicable, our authenticated Virtual Office Website (VOW) services. By using our website, you consent to the practices described in this policy.

2. Information We Collect

2.1 IDX Site Visitors (no registration required):

• Standard web server logs (IP address, browser type and version, operating system, pages visited, referring URLs, timestamps)
• Cookies necessary for site functionality, security, and anti-scraping measures
• Aggregated analytics data (no personally identifying information)
• Information you voluntarily submit through contact forms or property inquiries

2.2 VOW Registrants and Account Holders:

• Full name (first and last)
• Valid email address (verified before account activation)
• Telephone number (where provided)
• Username and password (passwords stored only as cryptographic hashes - never in plaintext)
• Search history, saved listings, and property preferences
• IP address and session data for security monitoring and fraud prevention
• Communications you send to us through the platform

2.3 Information We Do Not Collect:

• Financial account numbers, credit card numbers, or banking information through general site forms
• Government-issued identification numbers
• Health information
• Biometric data

3. How We Use Your Information

Personal information collected from registrants is used only for the purposes of permitting Authorized Users to access and use the software as contemplated in our license agreements with Pillar 9, TRREB, CREA, and other MLS boards from which we receive data. Specifically, we use your information to:

• Verify your identity and email address during registration
• Provide you with access to MLS listing data through the IDX or VOW
• Send Terms of Use confirmation emails, account notifications, and listing alerts you have requested
• Respond to property inquiries you submit
• Monitor for unauthorized use, scraping, data harvesting, or other prohibited activities
• Comply with compliance monitoring and inspection requirements imposed by Pillar 9, TRREB, CREA, and other MLS boards
• Improve our website functionality and user experience
• Comply with applicable laws, regulations, and lawful requests from authorities

We do not use your personal information for unrelated marketing, advertising, profiling, or any purpose beyond those listed above unless you have provided separate, explicit consent.

4. MLS Listing Data - Sources and Restrictions

Real estate listing information displayed on this website is sourced from multiple Canadian MLS boards under separate Data Access License Agreements, including:

• Pillar 9 - Alberta One Realty Listing Services Inc. (Alberta listings)
• Toronto Regional Real Estate Board (TRREB) - Greater Toronto Area listings
• Canadian Real Estate Association (CREA) - National listing data
• Other regional MLS boards as applicable

Each board retains ownership of its listing data and imposes specific rules on how the data may be displayed, stored, and used. We comply fully with each board's rules. Listing data is provided for the personal, non-commercial use of consumers and may not be copied, redistributed, scraped, or used for any purpose other than identifying prospective properties to purchase or lease.

All MLS data is deemed reliable but is not guaranteed accurate by the source boards or by NOVACRM. Listing data is refreshed at least every 24 hours.

5. Disclosure of Registrant Information

We will not sell, rent, trade, or otherwise provide the identity of Registrants to any other entity for compensation. Your registration information will not be disclosed to third parties for marketing or commercial purposes without your explicit, written consent.

We may disclose personal information only when one or more of the following applies:

• You have provided explicit, informed consent for the specific disclosure
• Disclosure is required by law, court order, subpoena, or regulatory authority
• Disclosure is necessary to comply with compliance monitoring and inspection requirements imposed by Pillar 9, TRREB, CREA, or other MLS boards under our license agreements
• Disclosure is necessary to investigate, prevent, or respond to suspected fraud, unauthorized access, scraping, or violations of our Terms of Use
• Disclosure is to a service provider acting on our behalf under a written confidentiality agreement (e.g., hosting provider, email delivery service), and only to the extent necessary for them to perform their service

6. Security Measures

We hold all Personal Information in strict confidence and maintain reasonable administrative, technical, and physical security measures to protect against loss, theft, unauthorized access, use, modification, or disclosure. Our security measures include:

• TLS 1.2+ encryption for all data in transit
• Encryption at rest for sensitive data stores
• Industry-standard password hashing (bcrypt or equivalent) - we never store plaintext passwords
• Role-based access controls limiting employee access on a need-to-know basis
• Regular security audits and vulnerability assessments
• Rate limiting, bot detection, and Web Application Firewall protections to prevent data harvesting and unauthorized scraping
• Written confidentiality agreements with all employees and contractors who handle personal information
• Secure off-site backups with the same protections as production data

Despite these measures, no system is 100% secure. We cannot guarantee absolute security but we will respond promptly to any incident in accordance with section 8 below.

7. Your Rights - Access, Correction, and Withdrawal

Under PIPEDA, Alberta's PIPA, and other applicable privacy legislation, you have the right to:

• Know what personal information we collect about you and why
• Request access to the personal information we hold about you
• Request correction of inaccurate or incomplete personal information
• Withdraw your consent for the collection, use, or disclosure of your personal information (subject to legal and contractual restrictions)
• Request deletion of your account and associated data
• File a complaint with a privacy regulator if you believe your rights have been violated

We will process correction requests promptly. Where a correction has been instructed by a partner MLS board (such as Pillar 9), we will make the correction within 5 business days of being notified.

To exercise any of these rights, contact our Privacy Officer using the information in section 11 below.

Note: Withdrawing consent may result in loss of access to VOW listing data and account features, as registration and email verification are required under the Pillar 9, TRREB, and CREA rules that govern access to MLS data.

8. Breach Notification

In the event of any unauthorized access to, or modification, use, or disclosure of, Personal Information that creates a real risk of significant harm, we will:

• Notify affected individuals as soon as reasonably possible
• Notify the Office of the Privacy Commissioner of Canada and/or the Office of the Information and Privacy Commissioner of Alberta as required by PIPEDA and PIPA
• Immediately advise Pillar 9, TRREB, CREA, and any other affected MLS board of the breach as required by our license agreements
• Cooperate fully with any investigation by privacy regulators or MLS boards
• Maintain a record of all breaches as required by law

9. Reporting of Access Requests and Consent Withdrawals

We will immediately advise the relevant MLS board (including Pillar 9) of any requests we receive for access to or correction of any Personal Information related to that board's data, and of any withdrawals of consent affecting our license to use that data, in accordance with our license agreements.

10. Cookies and Similar Technologies

We use cookies and similar technologies for the following purposes:

• Strictly necessary cookies - required for the website to function (authentication, session management, security)
• Performance cookies - aggregated analytics to help us understand how visitors use the site
• Security cookies - bot detection, rate limiting, and fraud prevention

We do not use third-party advertising cookies on our IDX or VOW pages. You can control cookies through your browser settings, but disabling strictly necessary cookies will prevent the website from functioning properly.

11. Data Retention and Destruction

We retain personal information only for as long as necessary to fulfill the purposes described in this policy or as required by law. When personal information is no longer needed, it is securely deleted or anonymized.

Upon termination of any of our license agreements with Pillar 9, TRREB, CREA, or another MLS board, all Permitted Data, Access Information, and confidential information from that board will be destroyed within the timeframes prescribed by the applicable agreement, with written certification of destruction provided to the board within 15 days of termination as required.

12. Storage and International Transfers

Personal information is stored on servers located in Canada and the United States. When personal information is transferred outside of Canada, it remains subject to the laws of the jurisdiction in which it is held, which may differ from Canadian privacy law. We require all service providers to maintain protections substantially equivalent to those required under PIPEDA and PIPA.

13. Children's Privacy

Our website and services are not directed to children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact our Privacy Officer immediately so we can delete it.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or MLS board rules. The “Effective Date” at the top of this policy will indicate when it was last updated. We encourage you to review this policy periodically. Continued use of the website after changes have been posted constitutes your acceptance of the revised policy.