Privacy Policy — PaySaxas FSC

This Privacy Policy explains how PaySaxas Financial Solutions Corporation (“the Company”) collects, uses, discloses and otherwise processes the personal information of its Clients (and, where applicable, their representatives, beneficial owners and authorised persons) in connection with the Service described in the Company’s Terms of Service. This Privacy Policy should be read together with the Company’s Terms of Service and with the Platform Privacy Policy, which describes data processing at the level of the wider PaySaxas group and its shared Website. Capitalised terms not defined in this Privacy Policy have the meanings given in the Terms of Service, and “Personal Data” has the same meaning as “Personal Information” in the Terms of Service. If this Privacy Policy and the Platform Privacy Policy conflict in relation to the Service, this Privacy Policy prevails, except for any joint processing with other PaySaxas group companies described in the Platform Privacy Policy, to which that policy applies.

1. General Compliance

The Company handles Personal Data in accordance with applicable privacy and data-protection laws, including the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (PIPEDA) and, where applicable, the Personal Information Protection Act (British Columbia) (BC PIPA) and other substantially similar provincial legislation. The Company, as the organization accountable for Personal Data under its control, undertakes to collect, use and disclose Personal Data only for purposes that a reasonable person would consider appropriate in the circumstances, and in accordance with the fair information principles set out in PIPEDA (accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance). PIPEDA is the federal privacy legislation of Canada that governs the collection, use, and disclosure of personal information in the course of commercial activities, including where Personal Data crosses provincial or national borders. BC PIPA and other provincial private-sector privacy legislation may also apply to Personal Data collected, used or disclosed within a province.

2. Purposes of Collection, Use and Disclosure

The Company collects, uses and discloses Personal Data only for the following purposes (the “Purposes”):

(a) the performance and enforcement of the Company's Terms of Service and the provision of the Service;

(b) the fulfilment of the Company’s legal obligations, including but not limited to anti-money-laundering (“AML”) and counter-terrorist-financing (“CTF”) requirements under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (the "AML Act"), and obligations under the Retail Payment Activities Act (S.C. 2021, c. 23, s. 177), sanctions legislation and tax legislation;

(c) maintaining, improving, and securing the Service, verifying identity, detecting and preventing fraud, and ensuring compliance and operational continuity, where these purposes are reasonable and have been disclosed to the Client;

(d) communicating with the Client about the Service and, with the Client’s consent where required, about other products and services of the Company or PaySaxas Affiliates (see Section 17); and

(e) facilitating the Client’s access to the services of the Approved Sub-Providers (see Sections 12 and 13).

3. Consent

The Company collects, uses and discloses Personal Data with the Client’s consent, except where PIPEDA or other applicable law permits or requires the Company to do so without consent (for example, to comply with the AML Act, in response to a lawful order, or to detect and prevent fraud). By opening an Account and accepting the Terms of Service, the Client consents to the collection, use and disclosure of Personal Data for the Purposes described in this Privacy Policy. Where the Company relies on implied consent, it does so only where that is appropriate having regard to the sensitivity of the Personal Data and the Client’s reasonable expectations. The Company will obtain the Client’s express consent before using Personal Data for a new purpose that is not described in this Privacy Policy, and will send marketing communications only with the consent that the law requires (see Section 17).

Where the Client provides Personal Data about another individual (such as a beneficial owner, director or authorised user), the Client confirms that it is authorised to provide that information and has informed the individual of the Purposes and obtained any consent required.

Biometric information. Where the Client’s identity verification involves biometric information (such as facial-verification data or a video recording), the Company will collect it only with the individual’s separate express consent, obtained before the verification, and will not make that consent a condition of accepting the Terms of Service beyond what is necessary to verify identity. Where practicable, the Company will offer an alternative verification method. The individual may withdraw consent as described in Section 4; in that case, the Company will offer an alternative verification method where practicable and, if none is available, may be unable to complete the verification or to continue to provide the Service.

4. Consequences of Not Providing Personal Data

Provision of identity, KYC/AML verification, and related Personal Data is both a requirement under the AML Act and a contractual requirement necessary for the Company to enter into and perform the Company's Terms of Service. If the Client does not provide this data, or does not keep it up to date, the Company will be unable to open an Account for the Client, or may be required to suspend or terminate an existing Account.

The Client may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting the Privacy Officer (Section 18). Withdrawal does not affect processing already carried out and may not be possible where the processing is required by law (for example, record-keeping under the AML Act). If the Client withdraws consent to processing that is necessary to provide the Service, the Company may be unable to continue to provide the Service and may close the Account in accordance with the Terms of Service.

5. Categories of Personal Data

The Company may collect the following categories of Personal Data from the Client and their representatives, from identity-verification and screening providers, from the Approved Sub-Providers, from other financial institutions and virtual asset service providers in connection with Transactions, and from publicly available sources:

(a) identification data (including full name, date of birth, nationality, identification number and copies of identification documents and, where the Client completes video or electronic identity verification, photographs, video recordings and related facial-verification data);

(b) contact data (including address, telephone number, and e-mail address);

(d) verification and compliance data (including KYC/KYB documentation, AML, sanctions and politically-exposed-person screening results, source-of-funds and source-of-wealth information, beneficial-ownership information, and risk assessment data);

(e) technical data (including device information, IP address, and session activity);

(f) correspondence and communication records with the Company;

(g) tax residency and tax identification information, where required by law; and

(h) Cryptocurrency wallet addresses and blockchain transaction data.

The Service is not intended for individuals who have not reached the age of majority in their province or territory of residence, and the Company does not knowingly collect their Personal Data.

6. Data Accuracy

The Client shall ensure that all Personal Data provided to the Company is accurate, complete, and kept up to date throughout the duration of the Company's Terms of Service. The Company shall take reasonable steps to ensure that any inaccurate or outdated Personal Data is corrected, updated or deleted, as appropriate, without undue delay.

7. Data Minimisation and Purpose Limitation

The Company collects and processes only such Personal Data as is adequate, relevant, and limited to what is necessary for the purposes set out in this Privacy Policy or the Platform Privacy Policy. Personal Data shall not be used or disclosed for purposes other than those for which it was collected, except with the Client’s consent or as permitted or required by law.

8. Openness and Transparency

Further information regarding the Company’s policies and practices for handling Personal Data is available in this Privacy Policy and, as regards processing at the level of the wider PaySaxas group and its shared Website, in the Platform Privacy Policy, including cookies and similar technologies, automated fraud-prevention tools used on shared sign-in and registration forms, group-level marketing, and any processing that the Company carries out jointly with other PaySaxas group companies.

9. Automated Decision-Making and Profiling

The Company may use automated tools, including for identity verification, AML and sanctions screening, risk scoring and fraud detection, to assist in decisions such as whether to open, restrict, suspend or close an Account or to execute a Transaction. These tools are used in accordance with PIPEDA’s principles of accountability, accuracy and openness. Where an automated tool contributes to a decision that significantly affects the Client, the Client may ask the Privacy Officer for an explanation of the decision and for a person to review it, and the Company will arrange that review, consistent with its legal obligations.

10. Data Retention

Personal Data shall be retained only for as long as necessary to fulfil the purposes for which it was collected, including for the performance of contractual obligations, compliance with statutory retention periods, or resolution of disputes. Upon the expiry of the applicable retention period, Personal Data shall be securely deleted or irreversibly anonymised in accordance with the Company’s internal data retention policy. Under the AML Act and related regulations the Company is generally required to keep client identification, transaction and other records for at least five (5) years, measured as those laws prescribe; Personal Data subject to those requirements will not be deleted before the end of the applicable period, even if the Client asks for deletion. Other Personal Data, such as technical data, data about prospective clients and records of marketing consents, is kept only for as long as necessary for the purpose for which it was collected and, where relevant, for the applicable limitation period.

Where an application to open an Account is declined or withdrawn, the Company keeps the identification, verification and screening records that it is required to keep for at least five (5) years from the date of the decision or withdrawal, or for such other period as the AML Act and its regulations prescribe, and deletes or anonymises other application data within twelve (12) months of that date.

11. Data Sharing and Third-Party Processors

Personal Data may be shared with:

(a) PaySaxas Affiliates (which may be located outside Canada, including in the European Union), for internal administrative and operational purposes; PaySaxas Oy also holds the Company’s account for Clients’ funds in euro and processes information about payments to and from that account for its own regulatory purposes, including sanctions screening, transaction monitoring and reports to Finnish authorities;

(b) the Company’s banking partners, the Approved Sub-Providers, payment processors, AML/KYC verification providers, and other authorised third-party service providers involved in the provision and maintenance of the Service, and professional advisers such as auditors and legal counsel;

(c) competent courts, regulators (including FINTRAC, the Bank of Canada and the Canada Revenue Agency), law enforcement or other governmental agencies when required or permitted by law or pursuant to a valid order, including in reports that the Company is required to make under the AML Act;

(d) a purchaser or successor in connection with a proposed or actual merger, acquisition, financing or sale of all or part of the Company’s business, subject to confidentiality obligations and to use of the Personal Data only for the purposes for which it was collected;

(e) the payers and payees of Transactions, the financial institutions and virtual asset service providers involved in a Transaction, and payment and clearing systems, to the extent necessary to execute the Transaction and to provide the information that the AML Act requires to accompany it; and

(f) third parties to which the Client instructs the Company to disclose information, such as an auditor named by the Client.

Where a third party processes Personal Data on the Company’s behalf, the Company remains accountable for that Personal Data and uses written contractual or other means to provide a comparable level of protection, including as to confidentiality and data security. Third parties that collect and use Personal Data as separate organizations, including the Approved Sub-Providers in respect of their own regulatory obligations, do so under their own privacy policies (see Section 12).

12. Approved Sub-Providers and Cryptocurrency Providers

Where the Client asks the Company to arrange an account, payment or currency exchange service in the Client’s own name with an Approved Sub-Provider, as described in the Terms of Service, the Company discloses to that Approved Sub-Provider the identification, contact, verification and transaction data of the Client and of its representatives and beneficial owners that the Approved Sub-Provider needs to open and operate that account or service, to carry out its own identity verification and AML and sanctions checks, and to comply with its own legal obligations. Before the Company applies on the Client’s behalf, it informs the Client, through the Client Platform or by e-mail, of the name, registered office and regulatory status of the Approved Sub-Provider and of the terms and privacy policy that apply to its services. Each Approved Sub-Provider collects, uses and discloses that Personal Data as a separate organization, for its own regulatory and business purposes and under its own privacy policy, which the Client should read, and may disclose it to the financial institutions through which it provides the account or service.

To hold Cryptocurrency for the Client and to execute exchanges and transfers, the Company uses wallet and key-management technology supplied by third-party technology providers and may engage custodians and liquidity providers, as described in the Terms of Service. These providers receive only the Personal Data, if any, that they need to perform their function, such as wallet addresses and transaction details. Where a provider processes Personal Data on the Company’s behalf, Section 11 applies; where a custodian collects and uses Personal Data as a separate organization, it does so under its own privacy policy. The Company informs the Client, through the Client Platform or by e-mail, of any custodian that holds Client Cryptocurrency.

13. International Data Transfers

Personal Data may be transferred to, stored in and processed in jurisdictions outside Canada, including the European Union, where PaySaxas Affiliates and some of the Company’s service providers are located, and other jurisdictions in which the Company’s service providers, the Approved Sub-Providers, custodians and other financial institutions involved in a Transaction are located. Where a third party processes Personal Data on the Company’s behalf, the Company remains accountable for it under PIPEDA and uses contractual or other means to provide a comparable level of protection while it is being processed. Personal Data that is processed outside Canada is subject to the laws of the jurisdiction in which it is located and may be accessible to courts, law enforcement and national security authorities in that jurisdiction. The Client may contact the Privacy Officer for further information about the Company’s policies and practices regarding service providers outside Canada.

14. Security of Processing

The Company protects Personal Data with security safeguards appropriate to its sensitivity, designed to protect it against loss or theft and against unauthorised access, disclosure, copying, use, alteration or destruction. Such measures include, without limitation, encryption, pseudonymisation, restricted access controls, secure storage environments, employee confidentiality undertakings, and periodic security assessments. The Company maintains and periodically reviews its incident-response plan to ensure timely mitigation of potential data breaches.

15. Personal Data Breach Notification

In the event of a breach of security safeguards involving Personal Data under the Company’s control, the Company shall promptly assess whether it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to any individual. Where it does, the Company shall report the breach to the Office of the Privacy Commissioner of Canada (OPC), notify affected individuals as soon as feasible, and notify any other organization or government institution that may be able to reduce the risk of harm, as PIPEDA and any applicable provincial legislation require. The Company keeps a record of every breach of security safeguards involving Personal Data for at least twenty-four (24) months.

16. Client Rights

Subject to applicable law and to the limits described below, the Client has the right to:

(a) request access to their Personal Data held by the Company, and information about its use and about the third parties to which it has been disclosed;

(b) challenge the accuracy and completeness of their Personal Data and have it amended as appropriate;

(c) withdraw consent in accordance with Section 4, and request deletion of Personal Data that is no longer required for the Purposes or for the Company’s legal and regulatory retention obligations;

(d) ask the Company to limit or stop using their Personal Data for a particular purpose, other than a purpose required by law, including marketing;

(e) request a copy of their Personal Data in a commonly used electronic format, where technically feasible; and

(f) make a complaint about the Company’s handling of their Personal Data, as described below.

Requests should be sent to the Privacy Officer at dpo_privacy@paysaxas.com. The Company may need to verify the requester’s identity before responding. The Company will respond to an access request within thirty (30) days of receiving it (which may be extended by up to a further thirty (30) days in the circumstances PIPEDA permits) and will not charge a fee, or will charge only a minimal cost of which the Client has been told in advance. The Company may refuse access where permitted or required by law (for example, where the information relates to a report made under the AML Act, is subject to legal privilege, or would reveal Personal Data about another individual) and will give reasons where it is legally permitted to do so.

If the Client is not satisfied with the Company’s response to a request or complaint, the Client may complain to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca; 1-800-282-1376) or, for matters covered by BC PIPA, to the Office of the Information and Privacy Commissioner for British Columbia.

17. Electronic Marketing Communications (CASL)

Where the Company sends the Client a commercial electronic message (as defined under Canada's Anti-Spam Legislation (S.C. 2010, c. 23), “CASL”), the Company will only do so with the Client's express or implied consent, will identify itself and provide contact information in the message, and will include a functional unsubscribe mechanism in every such message, which will remain effective for at least 60 days after the message is sent. The Company will give effect to an unsubscribe request without delay and in any event within ten (10) business days. The Client may withdraw consent to receive commercial electronic messages at any time using that mechanism or by contacting support@paysaxas.com. This Section does not apply to transactional or service messages necessary to operate the Account, which are not sent to encourage participation in a commercial activity or are otherwise exempt from CASL’s consent and unsubscribe requirements.

18. Privacy Officer

The Company has appointed a Privacy Officer, who is accountable for the Company’s compliance with this Privacy Policy and applicable privacy legislation and is the primary contact for the Office of the Privacy Commissioner of Canada and other privacy regulators. The Privacy Officer may be contacted at dpo_privacy@paysaxas.com, or by mail at the Company’s registered office (Privacy Officer, PaySaxas Financial Solutions Corporation, 422 Richards Street, Unit 170, Vancouver, BC V6B 2Z4, Canada), for any inquiry about the handling of Personal Data, to request access or correction, to withdraw consent or to make a complaint.

The Privacy Officer's mailbox (dpo_privacy@paysaxas.com) is shared with the Data Protection Officer appointed by other PaySaxas Affiliates under the GDPR.

19. Updates to this Privacy Policy

The Company shall review and, where necessary, update this Privacy Policy to ensure continued compliance with applicable data protection laws, including PIPEDA and applicable provincial legislation. In the event of any material change affecting the processing of personal data, the Company shall notify Clients in a clear and timely manner, by e-mail or through the Service, before such change takes effect, and will obtain the Client’s consent where the change involves a new purpose for which consent is required by law. The date of the latest update is shown at the top of this Privacy Policy.