CitiCapital Canada, which includes CitiCapital Commercial Corporation, CitiCapital Commercial Leasing Corporation, CitiCapital Technology Finance Ltd., CitiCorp Vendor Finance, Ltd. CitiCapital Limited (collectively "CitiCapital"), values its relationship with its customers, which includes debtors, lessees and guarantors (individually a "Customer" and collectively "Customers"), and is committed to the protection of their personal information. Accordingly, CitiCapital adheres to the following privacy principles and accompanying commentary (the "Privacy Policy").

The Privacy Policy is based on the principles set out in the Personal Information Protection and Electronic Documents Act (Canada) and applicable provincial legislation (the "Acts"). "Personal Information", as used in this Privacy Policy, means information about an identifiable Customer, but does not include the name, title or business address or telephone number of an employee of an organization.

Privacy law is a new and rapidly evolving area, and CitiCapital's privacy policies are subject to review to maintain their currency and compliance with evolving law and policy in the area. This Privacy Policy is current as of the dated noted above.

Principle 1 - Accountability
CitiCapital is responsible for all Personal Information under its control.

Accountability for CitiCapital's compliance with the Acts rests with CitiCapital's Privacy Officer, even though other individuals within CitiCapital have responsibility for the day-to-day collection and processing of Personal Information and may be delegated to act on behalf of the CitiCapital Privacy Officer. Any designated individual will be made known upon request.

CitiCapital is responsible for Personal Information in its possession or custody, including information that has been transferred to a third party for processing. Processing may be done by CitiCapital's affiliates or third party providers such as data processors, storage companies and other financial organizations. CitiCapital will use contractual or other means to provide a comparable level of security protection when a third party is processing the Personal Information.

The types of Personal Information CitiCapital collects, holds, uses, discloses and exchanges about Customers may include information required to approve credit, administer accounts, and provide ongoing services, including financial and credit information, residential contact information, gender, age, nationality, date of birth, language marital status, citizenship information and motor vehicle records.

CitiCapital only collects a social insurance number on an optional basis unless otherwise required or authorized by law.

Principle 2 - Identifying Purposes
CitiCapital will identify and document the purposes for which it collects, uses, or discloses Personal Information at or before the time of collection.

The purposes will be limited to those that are related to the needs of CitiCapital's business and are appropriate in the circumstances or otherwise permitted by law.

CitiCapital collects, holds, uses, discloses and exchanges Personal Information for and about Customers for the purposes relating to: credit verification, approval and reporting; monitoring and evaluating account performance; updating credit information and securing registrations; investigation and collection of debt; offering financial services products; building customers relationships; statistical and demographic research; risk management; legal and regulatory requirements; and responding to Customer inquiries.

CitiCapital identifies to whom, and for what purposes, it discloses and exchanges Personal Information about Customers. This includes:

(a) dealers for administration requirements and credit verification; (b) credit reporting agencies and credit bureaus and persons identified by Customers for credit verification and updating; (c) collection agencies, bailiffs, investigators, searchers for investigation and collection of debt; (d) law enforcement and other government agencies, registries and insurers for legal and regulatory requirements, investigation and credit verification; (e) affiliates and branches for monitoring and account performance, risk management, statistical and demographic research, building customer relationships and offering financial services products; and (f) service providers for processing including storage, photocopying, document management.

CitiCapital's arrangements with dealers, affiliates or service providers could include third parties acting for them or on their behalf. In all such cases, CitiCapital requires that only employees with a "need to know" basis have access to the Personal Information.

If CitiCapital plans to use disclose or exchange Personal Information it has collected or held for a purpose not previously identified, it will identify this purpose beforehand or will make the information anonymous or non-identifiable.

CitiCapital will make a reasonable effort to specify the identified purposes, orally or in writing, to the Customer from whom the Personal Information is collected either at the time of collection or after collection but before use. CitiCapital will state the identified purposes in such a manner that a Customer can reasonably understand how the information will be used, disclosed or exchanged.

Principle 3 - Consent
Personal Information will only be collected, used, or disclosed with the knowledge and consent of the Customer, except where inappropriate.

The way in which CitiCapital seeks consent, including whether it is express, implied, written or oral may vary depending upon the sensitivity of the information and the reasonable expectations of the Customer. Except when otherwise permitted by law, CitiCapital obtains consent prior to collecting and in any case, prior to using Personal Information. Consent may also be intrinsic to the circumstances such as in the case where CitiCapital uses a home phone number to contact a Customer about their account.

A Customer can withdraw consent at any time (unless withdrawing the consent would frustrate the performance of legal obligations), and upon providing CitiCapital with 30 days advance written notice. CitiCapital will inform Customers of any implications of withdrawing consent, including any impact on CitiCapital's ability to service the Customer. During a term of a credit facility, for the purpose of ensuring accurate credit records and facilitate ongoing monitoring, evaluation and credit risk of an account, Customers may not withdraw consent to ongoing collection, use or disclosure of Personal Information in connection with the credit arrangements agreed to.

In any marketing communications, CitiCapital will include an easily exercisable "opt-out" function.

In certain circumstances, as permitted or required by law, CitiCapital may collect, use or disclose Personal Information without the knowledge or consent of the Customer. These circumstances include: Personal Information which is subject to solicitor-client privilege or is publicly available as defined by regulation; where collection or use is clearly in the interests of the Customer and consent cannot be obtained in a timely way; to investigate a breach of an agreement or a contravention of a law; to act in respect to an emergency that threatens the life, health or security of an individual; for debt collection; or to comply with a subpoena, warrant or court order. Other exceptions may be applied provincially from time to time.

Principle 4 - Limiting Collection
CitiCapital will limit the amount and type of Personal Information collected to that which is necessary for its identified purposes and it will only collect Personal Information by fair and lawful means.

CitiCapital always collects Personal Information by fair and lawful means including using forms, contracts, emails, mail and telephone inquires, recorded calls at call centres and direct contact. CitiCapital only collects the Personal Information necessary to fulfil the purpose identified prior to, or at the time of collection, or any other reasonable and legitimate purposes or as permitted by law.

CitiCapital generally does not collect Personal Information from any third party, without the Customer's consent, unless permitted by law.

CitiCapital does not, as a condition of supplying a product or service, require consent to the collection, use or disclosure of Personal Information beyond that reasonably required to supply the product or service or for related operational or management or legal purposes, or to comply with its obligations under applicable law.

Principle 5 - Limiting Use, Disclosure, and Retention
Personal Information will not be used or disclosed for purposes other than those for which it was collected, except with the consent of the Customer or as required by law. Personal Information will be retained only as long as necessary to fulfill the identified purposes.

CitiCapital retains Personal Information only so long as necessary for the fulfilment of the identified purposes and other legal requirements. Personal Information is generally kept in account files at the branch where the account holder sets up the account or CitiCapital's head office.

Personal Information which has been used to make a decision about a Customer will be retained for at least one year to allow the Customer access to the information after the decision that has been made and, in the event of an access request or a challenge, long enough to exhaust any recourse Customer may have under the law. Where Personal Information is no longer required to fulfill the identified purposes and to permit access, it will be destroyed, erased, or made anonymous. CitiCapital has retention policies setting out minimum and maximum retention periods.

Principle 6 - Accuracy
CitiCapital will use its best efforts to ensure that Personal Information is as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.

CitiCapital will use reasonable efforts to ensure that Personal Information that is used on an ongoing basis, including information that is disclosed to third parties, and information that is used to make a decision about a Customer, is accurate, complete, and up-to-date. CitiCapital relies on the Customer to provide it with accurate information and to advise it of any change in the information.

Principle 7 - Safeguards
CitiCapital will protect Personal Information with safeguards appropriate to the sensitivity of the information.

CitiCapital is committed to keeping secure the Personal Information provided to it and will take reasonable precautions to protect Personal Information from loss, misuse or alteration. Affiliates, branches, and service providers of CitiCapital who have access to Personal Information in connection with providing services for CitiCapital are required to have comparable levels of protection and are not permitted to use such information for any other purpose.

CitiCapital's safeguards are designed to protect Personal Information against loss or theft, as well as unauthorized access, disclosure, copying, use or modification, regardless of the format in which the information is held. CitiCapital will permit only authorized employees, who are trained in the proper handling of Customer information, to have access to the information that they need to know as required for the specified purpose. CitiCapital's employees are trained to maintain the confidentiality and to safeguard a Customer's Personal Information. CitiCapital will exercise care in the disposal or destruction of Personal Information to prevent unauthorized parties from gaining access to the information.

CitiCapital's methods of protection will include physical measures (for example, locked filing cabinets and restricted access to offices), organizational measures (for example, security clearances and limiting access on a "need-to-know" basis), and technological measures (for example, the use of passwords and encryption).

Principle 8 - Openness
CitiCapital will make specific information about its policies readily available, except to the extent this is confidential commercial information.

This information document is intended to provide CitiCapital's Customers with specific information about its privacy policies and practices. If a Customer has any other questions about CitiCapital's policies and practices, please contact the CitiCapital Privacy Officer.

Principle 9 - Customer Access
Upon written request, CitiCapital will inform a Customer of the existence, use, and disclosure of his or her Personal Information and will give the Customer access to that Personal Information. A Customer can challenge the accuracy and completeness of his or her Personal Information and have it amended as appropriate.

An account file containing the Customer's Personal Information maintained by CitiCapital will be held at CitiCapital's offices located at 123 Front Street West, 15th Floor, Toronto, Ontario. CitiCapital will respond to a written request within 30 days. In order to do so, CitiCapital may need the Customer to properly authenticate their identity. CitiCapital will assist any Customer who informs CitiCapital that they need assistance in preparing a request. CitiCapital may require a Customer to provide sufficient information to permit it to provide an account of the existence, use, and disclosure of Personal Information. Requested information will be provided or made available in a form that is generally understandable, including explaining any abbreviations or codes and using an alternative format, if required.

CitiCapital will not assess any costs to a Customer for access to their Personal Information or on CitiCapital's Privacy Policy without first providing the Customer with an estimate of the approximate costs which will be minimal, if any. the Customer may withdraw its request for access to information by notifying CitiCapital within the thirty-day notice period disclosed on the estimate. If a Customer does not notify CitiCapital within such thirty-day period, CitiCapital will send Customer a further notice indicating that the Customer will be deemed to have withdrawn its request for access unless the Customer advises CitiCapital otherwise within thirty days. If after the expiry of this thirty-day period, Customer has not so advised CitiCapital, CitiCapital will deem the request to have been withdrawn and provide the Customer with written notice to that effect.

A Customer can challenge the accuracy or completeness of the information. If Customer successfully demonstrates any inaccuracy or incompleteness or CitiCapital receives amended information from another organization, CitiCapital will amend the information as required. If a challenge is not resolved to the satisfaction of the Customer, CitiCapital will record the substance of the unresolved challenge. Where appropriate the amended information or the existence of the unresolved challenge, as the case may be, will be transmitted to third parties having access to the information in question.

In certain situations, CitiCapital may refuse a request or not be able to provide access to all the Personal Information CitiCapital holds about a Customer. Exceptions to the access requirement will be limited and specific, as permitted or required by law. Where permitted, the reasons for denying access will be provided to the Customer upon request. Exceptions may include: information that contains references to other Customers or contains confidential commercial information, where such information cannot be severed from the record; information collected in the course of investigating a breach of an agreement or in the course of a formal dispute resolution process; information that is subject to solicitor-client privilege, and in certain instances disclosure to judicial bodies and other government institutions.

Principle 10 - Challenging Compliance
Any Customer can address a challenge concerning CitiCapital's compliance with any of the Privacy Principles to CitiCapital's Privacy Officer.

CitiCapital will investigate all written complaints and will generally respond within thirty days of receipt of your complaint. If CitiCapital finds a complaint to be justified, it will take all appropriate measures, including, if necessary, amending its policies and practices.

Mr. Boubacar Leye
Compliance and Privacy Officer
CitiCapital Canada
123 Front Street West
16h Floor
Toronto ON

Tel: <416-941-6000 or toll free 1-800-991-4046*>
Fax: <416-941-6038*>
Email: citicapitalprivacyofficer@citigroup.com

CitiCapital's Privacy Officer will explain to Customer CitiCapital's complaint procedures, if Customer wishes.