Privacy policy

• What personal information we collect.
• How and why we use it.
• When we may disclose it.
• How we safeguard it.
• How long we retain it.
• Your rights and choices under Canadian privacy law.

This includes information used to identify or contact an individual, such as:

• Full legal name
• Date of birth
• Residential and mailing address
• Phone number and email address
• Government issued identification details
• Selfie or biometric verification results processed by an identity verification provider where required

This information is collected to meet onboarding, identity verification, and legal compliance obligations.

For corporate or business clients, we may collect:

• Incorporation and registration documents.
• Business address and contact information.
• Corporate structure and authorized signatories.
• Beneficial ownership information.
• Tax identification numbers and regulatory identifiers where relevant.

This information is required for business verification and anti money laundering due diligence.

To operate app based accounts, wallet functionality, card features, and payment services, we may collect:

• Payment transfers, loads, withdrawals, and payouts.
• Merchant details, transaction locations, currency, and amounts.
• Card usage information, including authorizations, settlements, refunds, and chargebacks where applicable.
• Account balances, funding sources, linked payment methods, wallet addresses, and related account history.

This information is necessary for providing financial services, preventing fraud, and meeting legal and regulatory obligations.

When you access Parapay platforms, we automatically collect certain technical information, including:

• IP address and geolocation indicators.
• Device identifiers, browser type, and operating system.
• Session logs, clickstream data, and usage analytics.
• Cookies and similar tracking technologies.
• Application version, crash logs, and related diagnostics.

This information supports security monitoring, fraud detection, and performance optimization.

To comply with Canadian AML and ATF regulations and industry standards, we may collect and generate:

• Sanctions screening results.
• Politically Exposed Person and related risk information.
• Adverse media findings and risk indicators.
• Fraud risk scoring and transaction monitoring alerts.
• Ongoing monitoring information, including enhanced due diligence results where required.

This information is required by law, by regulatory guidance, or by our legitimate need to protect the platform and its users.

We collect and process personal information with your knowledge and consent, except where otherwise permitted or required by law. Consent is obtained during account creation, onboarding, or when you voluntarily provide information.

We process information as necessary to:

• Open and maintain accounts.
• Verify identity and eligibility.
• Provide payment, wallet, card, transfer, foreign exchange, and related financial services.
• Process transactions and fulfill the terms of service.

Without this processing, we would be unable to deliver our services.

As a regulated financial services business, Parapay may be required by law to:

• Conduct identity verification.
• Maintain KYC and KYB records.
• Perform sanctions and related screening.
• Monitor transactions.
• Report suspicious transactions and other reportable matters to FINTRAC or other competent authorities.

These activities are mandatory and cannot be opted out of.

We process certain information to support:

• Fraud detection and financial crime prevention.
• Platform and account security.
• System monitoring and performance optimization.
• Internal audit, compliance reviews, and risk assessment.

These interests are balanced against user privacy rights and supported by appropriate safeguards.

While personal information is protected through secure systems and controlled vendor arrangements, certain operational, technology, compliance, analytics, or verification functions may require processing by vetted and contractually bound service providers located in jurisdictions outside Canada.

Such processing may include identity verification, screening, infrastructure support, platform operations, transaction routing, payment processing, card functionality, settlement support, analytics, or secure development functions.

All such processing is governed by contractual safeguards, encryption, limited access permissions, and controls designed to protect personal information in accordance with applicable Canadian requirements regarding cross border data handling.

We use personal and business information to:

• Verify the identity of individuals and businesses.
• Authenticate documents and verification information.
• Confirm beneficial ownership.
• Assess onboarding risk.
• Determine eligibility for our services.

These activities may be required by law and by applicable financial crime compliance obligations.

We process information to fulfill mandatory obligations including:

• Sanctions and Politically Exposed Person screening.
• Ongoing monitoring and risk scoring.
• Enhanced due diligence where required.
• Recordkeeping and retention requirements.
• Mandatory reporting to FINTRAC or other competent authorities where applicable.

These activities cannot be opted out of where required by law.

We use information to:

• Operate app based accounts and related service functionality.
• Support wallet or stored value functions where offered.
• Issue, enable, or support card related services where offered.
• Process payments, transfers, payouts, exchanges, and settlements.
• Validate and authorize transactions.
• Maintain accurate account and transaction records.

Information processed in this category is necessary to provide core financial services.

We use personal and technical data to:

• Detect suspicious activity.
• Prevent account takeover, misuse, or unauthorized transactions.
• Monitor system integrity and platform security.
• Conduct investigations related to fraud or regulatory risk.

This processing supports legal obligations and our legitimate interest in maintaining secure financial operations.

We use information to:

• Respond to inquiries and resolve issues.
• Provide notifications regarding accounts, transactions, or service updates.
• Improve products, services, and user experience.
• Support testing, reliability monitoring, and quality assurance.

We use information for:

• Internal and external audits.
• Regulatory inspections and compliance reviews.
• Legal claims, dispute resolution, and enforcement of agreements.
• Reporting required by FINTRAC, banking partners, card partners, or other authorities.

We may share limited personal and transactional information with banking partners and financial institutions involved in:

• Maintaining account or settlement functionality.
• Issuing cards or supporting wallet related services.
• Processing deposits, loads, transfers, payouts, and settlements.

These partners require this information to fulfill their regulatory and operational responsibilities.

We may share data related to:

• Card authorizations and settlements.
• Merchant interactions.
• Payment routing and clearing.

Card networks and processors require this information to enable secure payment transactions and comply with network rules.

To comply with identity verification and financial crime requirements, we may share information with trusted, audited service providers that support:

• Document verification.
• Biometric comparison or liveness checks.
• Sanctions and PEP screening.
• KYC and KYB compliance checks.

These partners process data strictly for compliance, authentication, and fraud prevention purposes.

We may share certain technical, transactional, or behavioral indicators with fraud prevention and analytics providers that support:

• Fraud detection and mitigation
• Transaction monitoring
• Risk scoring
• Account security operations

These providers help maintain the integrity of our platform and reduce financial crime risk.

We may share limited information with infrastructure partners who support system operations, including providers supporting backend systems, operational monitoring, secure platform infrastructure, analytics, diagnostics, or related technical functions.

These partners operate under contractual data protection obligations and controlled access arrangements.

We are required by law to disclose certain information to FINTRAC and other regulators where mandated under applicable legislation.

We may disclose information to law enforcement, courts, or government authorities when:

• Required under a lawful order, subpoena, warrant, or similar legal process.
• Necessary to investigate fraud, financial crime, misuse, or safety concerns.
• Needed to protect the rights, property, or security of Parapay or its users.

We review requests to ensure they comply with applicable legal standards.

Customer and business information is stored in secure environments subject to controls such as:

• Encryption in transit and at rest where appropriate.
• Access controls based on least privilege.
• Network protections and monitoring.
• Regular security reviews and assessments.

Cross border processing is protected through:

• Contractual data protection agreements aligned with Canadian privacy requirements
• Encryption and secure transmission protocols
• Role based and limited permission access controls
• Vendor due diligence and security assessments
• Operational and compliance oversight

These measures are designed to help ensure that personal information processed outside Canada receives a level of protection appropriate to the nature of the information and the relevant risks.

We implement policies, procedures, and governance measures to support secure handling of personal information, including:

• Access control and authorisation policies
• Employee security and compliance training
• Confidentiality obligations and role based permissions
• Vendor due diligence and oversight programs
• Incident response and breach management protocols
• Internal audit and compliance reviews

Technical protections may include:

• Encryption in transit and at rest
• Multi factor authentication for relevant administrative or account access
• Secure system architecture and hardened infrastructure
• Firewalling, network protections, and intrusion detection or monitoring
• Continuous monitoring for anomalous or suspicious activity
• Regular vulnerability assessments and penetration testing
• Tokenization for sensitive data where appropriate

Physical protections may include:

• Secure data center or hosting environments with controlled access.
• Environmental controls, monitoring, and redundancy.
• Hardware access restrictions and secure device management.

When trusted service providers process data on our behalf, we require:

• Contractual data protection obligations.
• Encryption and secure transmission standards.
• Restricted, role based access controls.
• Appropriate audit, assurance, or security review measures.
• Ongoing oversight and periodic risk evaluation.

These controls are intended to help ensure that personal information handled by third parties receives a high level of protection.

In accordance with applicable legal and regulatory requirements, Parapay may be required to retain identity verification records, KYC or KYB documentation, beneficial ownership information, and related due diligence materials for the period required by law.

Transactional information, including payments, loads, withdrawals, card activity, settlement data, and monitoring alerts, may be retained to:

• Meet statutory reporting requirements.
• Support dispute resolution.
• Maintain accurate accounting and reconciliation.
• Fulfill obligations to card networks, banking partners, and other financial institution partners.

Suspicious transaction reports, risk assessments, ongoing monitoring logs, screening results, and related compliance records may be retained as required under legal, regulatory, or internal compliance requirements.

Information used for customer support, service improvement, system monitoring, or internal governance is retained only for as long as necessary to:

• Fulfill operational requirements.
• Maintain platform integrity.
• Enforce agreements.
• Manage risk and security.

Where possible, data is anonymized or pseudonymized once it is no longer needed in identifiable form.

If Parapay is involved in an audit, investigation, regulatory inquiry, or legal claim, certain information may be retained beyond standard retention periods until the matter is resolved.

Once retention periods expire and data is no longer required, Parapay securely deletes, anonymizes, or destroys the information using methods appropriate to the nature of the data and the systems involved.

Some analytics, verification, security, or infrastructure tools used by Parapay may deploy their own cookies or device identifiers. These technologies may support:

• Identity verification.
• Transaction risk analysis.
• Platform monitoring and diagnostics.

Any third party cookie usage is governed by contractual and technical safeguards.

You may manage or disable cookies through your browser settings. However:

• Disabling essential or security cookies may prevent the platform from functioning correctly.
• Some features, such as logging in or completing transactions, may not be available if cookies are disabled.
• You may also clear existing cookies at any time using your browser or device controls.

You may request access to the personal information we hold about you, including:

• What information we have collected.
• How it has been used.
• With whom it has been shared.

We will provide access unless restricted by law, including where access would interfere with a legal or regulatory process.

You may request that we correct or update any inaccurate, incomplete, or outdated personal information.

You may request deletion of your personal information. However, we may be unable to delete records that must be retained under legal or regulatory requirements, including identity verification records, transaction records, screening results, and compliance monitoring materials.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not apply to:

• Mandatory compliance processing.
• Legal and regulatory obligations.
• Required operational processing tied to service delivery.

Where withdrawal affects your ability to use the service, we will inform you.

You may request additional details about:

• How your personal information is processed.
• The purposes for which it is used.
• The categories of third parties with whom it is shared.
• Cross border processing and related safeguards.

We will provide this information unless restricted by legal or supervisory requirements.

To submit a request, you may contact us at:

• Email: info@parapay.com
• Website: www.parapay.com

We may require identity verification before responding to your request to protect your account and personal information.