In this policy “we”, “us”, “our” or “banpay” refers to BanPAY (CA) Limited, “you”, “your” or “yours” refers to the persons to whom this policy applies. “The Banpay Group” refers to The Banpay Group Holdings Limited and its affiliates. “You”, “your” or “yours” refers to the “Client” or persons to whom this policy applies to. Furthermore, “Applicable regulations” refers to the Canadian Personal Data (Privacy) Ordinance, Canada’s Anti-Spam Legislation (CASL), and the Personal Information Protection and Electronic Documents Act (PIPEDA), as well as all regulations applying to banpay. At banpay, we highly value the security of personal data, comply with applicable regulations, and protect all personal data stored with us. This policy is set out under the basis on which banpay may collect, use, disclose, process, and manage personal data.

Please read this policy (the “Policy”) thoroughly to understand in detail the implemented practices regarding personal data carefully before using any of the banpay Global Accounts. This Agreement shall govern the availability and use of the various services provided by banpay and its affiliated entities (“banpay services” = “BASE”). By accessing or using any or part of the BASE, you (the “Client”, “you”/ “your”, “any authorized user”) agree to become bound by the terms and conditions of this Agreement. If you do not agree to all the terms and conditions of this Agreement, please do not access, or use any of banpay’s Services. By visiting banpay.com you are accepting and consenting to the practices described within this policy.

1. Collection and Data Processing
   
   
   1. Information given to banpay by the Client. The Client may give banpay information by filling in forms on banpay’s website or by corresponding banpay’s service teams by phone, e-mail or otherwise, including information providing when registering to use our website, subscribe to services, place orders, transact on the website or report a problem with our banpay.com website. The information received may include: a) personal particulars (such as name, contact details, residential address, date of birth, passport/identity card) information; b) financial details (such as income, expenses); c) images and voice recordings of our communications with you; d) employment details (such as occupation, directorships and other positions held, employment history, salary, and/or benefits); e) personal opinions disclosed to us (such as feedback on our products and website); f) information obtained from a mobile device with the Client’s consent; g) specimen signatures(s); h) beneficiaries, shareholders, ultimate beneficial owners, trustees, directors; and/or i) commercial and/or identification information allowing us to comply with our obligations in terms of anti-money laundering and anti-terrorist financing.
   
   
   2. Information banpay collects about the Client. During each visit to banpay.com, we may automatically collect technical information, including but not limited to: the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform; information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our website (including date and time); products & services viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number.
   
   
   3. Information banpay receives from other sources. banpay works closely with second and third parties including partners, sub-contractors in technical, payment and delivery services, analytics providers, search information providers, credit reference agencies among others, and may ask to receive information about any Clients activity from them. In the applicable case, banpay will ensure all data protection is stored under full compliance with applicable regulations.



2. How banpay uses Client Information
   
   
   1. Information given to banpay, and information collected by banpay about a Client. The collected information will be used to develop and provide banpay’s solutions through our products and services including but not limited to:
      
      
      1. Executing commercial transactions, clearing, or reporting transactions; carrying out research; data planning, statistical analysis; analytics for the development or improvement of available products, services, security, service quality, and advertising strategies.
      
      
      2. Assessing and processing applications, instructions, or requests.
      
      
      3. Communicating and providing the Client with updates on changes to products, services, and facilities including additions, expansion, suspension, and replacement of or to such products, services and facilities and their terms and conditions.
      
      
      4. Managing banpay’s infrastructure and business operations while complying with internal policies and procedures.
      
      
      5. Carry out obligations arising from any contracts entered between the Client and banpay to provide information on the requested products and services.
      
      
      6. Provide information about other products and services offered by banpay.
      
      
      7. Notify the Client about changes to any BASE conditions or parameters.
      
      
      8. Respond to any enquiry made through banpay.com website, via phone, e-mail or otherwise.
      
      
      9. Comply with applicable legal obligations as a data controller and regulated business.
      
      
      10. Protect Client’s vital interests or that of another natural person.
      
      
      11. Administer the banpay.com website for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes.
      
      
      12. Improve banpay.com website to ensure that its content is presented in the most effective manner for the Client and for optimal view (computer and handheld devices).
      
      
      13. Allow the Client to participate in interactive service features when chosen to do so.
      
      
      14. Measure and understand the effectiveness of advertising offered, delivering relevant advertising to each Client.
      
      
      15. Respond to queries or feedback.
      
      
      16. Address or investigate any complaints, claims or disputes.
      
      
      17. Verify the Client’s identity for the purposes of providing optimal products or services.
      
      
      18. Conduct screenings and due diligence checks as may be required under applicable law, regulation, or directive.
      
      
      19. Comply with all applicable laws, regulations, rules, directives, orders, instructions, and requests from any local or foreign authorities, including regulatory, governmental, tax and law enforcement authorities or other authorities.
      
      
      20. Financial reporting, regulatory reporting, management reporting, risk management (including monitoring credit exposures), audit and record keeping purposes.
      
      
      21. Enforced obligations owed to banpay; and/or seeking professional advice, including legal advice.
      
      
   
   
   2. Information we receive from other sources. banpay may use this information for the purposes set out above.
   
   
   3. Information banpay discloses about the Client. banpay may share a Client’s personal information with any member of the banpay Group or to selected third parties, whether located in Canada or elsewhere, under full compliance with applicable regulations. The following are the types of third parties we may share some of your personal data with:
      
      
      1. Business partners – suppliers and subcontractors for the performance of any services provided under an entered agreement.
      
      
      2. Analytics – search engine and analytics providers that assist banpay in the improvement and optimization of the banpay.com website.
      
      
      3. Compliance – service companies used to meet our anti-money laundering and anti-terrorist financing obligations.
      
      
      4. Data storage – providers who supply physical or cloud-based storage services.
      
      
      5. Banking and payments network – providers who support banpay’s payments network including banks, PSPs and liquidity providers. These providers will have their own legal obligations when processing the Client’s data. We facilitate payments to numerous jurisdictions where we may not have a direct relationship with the businesses in these jurisdictions – for example the beneficiary bank. If a Client is making a payment to a beneficiary in a certain jurisdiction, Client’s data will by default be processed by this entity.
      
      
      6. Communications – providers who supply communications solutions both internally and externally.
      
      
      7. Prospective Buyers/Sellers – banpay may transfer, store, process and/or deal with your personal data outside Canada. In doing so, banpay will strictly comply with applicable regulations. banpay will never sell your personal data without your consent. Notwithstanding the foregoing, if any business or assets were sold, we may then disclose your personal data to the prospective buyer of such business or assets. If the Company were to be sold, the company or any substantial assets to a third party, the Client’s personal data may then be one of the transferred assets.
      
      
   
   
   4. Use of personal data for marketing purposes. banpay may use a Client’s personal data to offer dedicated products or services, including special offers, promotions or entitlements that may be of interest to you or for which you may be eligible. Such marketing messages may be sent to the Client through various channels including but not limited to electronic mail, direct mailers, short message service, telephone calls, and other mobile messaging services, in compliance with applicable regulations.
      
      Marketing messages to a Client’s Canadian telephone number via short message service (SMS), telephone calls, facsimile, and other mobile messaging services, banpay shall only do so if under clear and unambiguous recorded consent, or if the Client has not otherwise made the appropriate registration of that number with the Do-not-call Registers. (If a Client has not indicated not to receive telemarketing messages, banpay may send telemarketing messages to that number related to the subject of our ongoing relationship via short message service, facsimile and other mobile messaging services (other than a voice or video call). A Client may at any time request that banpay stop contact for marketing purposes via selected, or all notification ways. To find out more on how to change personal data usage for marketing purposes, please contact banpay (consult through the “Contact us” section below).
      
      Marketing messages to a Client’s Canadian telephone number via short message service (SMS), telephone calls, facsimile, and other mobile messaging services, banpay shall only do so if under clear and unambiguous recorded consent, or if the Client has not otherwise made the appropriate registration of that number with the Do-not-call Registers. (If a Client has not indicated not to receive telemarketing messages, banpay may send telemarketing messages to that number related to the subject of our ongoing relationship via short message service, facsimile and other mobile messaging services (other than a voice or video call). A Client may at any time request that banpay stop contact for marketing purposes via selected, or all notification ways. To find out more on how to change personal data usage for marketing purposes, please contact banpay (consult through the “Contact us” section below).
      
      Nothing in this section shall vary or supersede the terms and conditions that govern our relationship with you.
   
   


3. Where Client’s Personal Information is Stored
   
   

   The data collected from the Client may be transferred to, and stored at, a destination outside Canada. It may also be processed by staff operating outside Canada who work for banpay, its subsidiaries or vetted suppliers. Such staff may be involved in the provision of support services to fulfill a Client’s order.

   
   


4. Cookies
   
   

   banpay operates under “implied consent” for processing cookies. Upon first visit to banpay.com, we will inform you of the cookies we use and that by continuing to browse our website you are implying your consent for us to use cookies. (A cookie is a very small text file placed on your computer, that allows us to distinguish you from other users of our website. These cookies help us to provide you with a good experience when you browse our banpay.com website.
   
   We use the following cookies:

   
   
   1. Strictly necessary cookies – Cookies required for the operation of the banpay website. These include cookies enabling secure login into banpay.com website.
   
   
   2. Analytical/performance cookies – Recognize and count the number of visitors and usage. (This helps improve website flow by ensuring users are finding what they are looking for).
   
   
   3. Functionality cookies – Used to recognize a user or Client upon return to the website. This enables personalized content by remembering marked preferences (i.e., language, region, and previously registered interest).
   
   

   *Please note third parties (including but not limited to providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies are likely to be analytical/performance cookies or targeting cookies. You may block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts and correct functionality of the banpay.com website.

   
   


5. Access and Correction
   
   

   You may contact Our Data Protection Officer, [email protected] to exercise your rights. You may check whether we hold your personal data and request access to such personal data or make corrections to personal data held by banpay. Subject to applicable regulations, processing fees may apply. Such fees will depend on the nature and complexity of the access request received. Information on any processing fees will be made available to you. GDPR also provides relevant individuals with additional rights including the right to obtain information on how banpay processes your individual personal data, receive certain information provided in an electronic format and/or request that these be transmitted to a third party, request for your information to be erased, object or restrict the use or processing of your information in some circumstances, subject to ongoing obligations imposed on us pursuant to any applicable law or regulation, and/or our legitimate reason or entitlement to continue processing your information, and/or to refuse that request. Please contact banpay (please see the “Contact Us” section below) for details on how to request access or correction to/or exercise your rights with respect to the processing of your personal data.

   
   


6. Data Retention
   
   

   The period for which banpay will retain the Client’s data is dependent upon any statutory retention periods we are required to adhere to as a regulated organization under applicable laws. After the expiration of that period, personal data shall be securely deleted, if it is no longer required for the fulfillment of any contract, initiation of a contract or in relation to other legal proceedings.



7. Soft Token
   
   

   The app will pair the mobile number with the one previously registered by users in their account to avoid linking a Soft Token in an unauthorized mobile phone. The mobile phone will require access to both Camera and Contacts.
   
   The device’s unblocking mechanism will authenticate the user’s identity to let users turn the Soft Token on and off. The app itself will not authenticate the user internally but will rather rely on the device’s security so that users can choose the authentication method of their preference. Recommended methods are face recognition for IOS users and fingerprint for Android and Harmony.
   
   The Soft Token will be linked via a QR code that matches the phone number, email, etc. that was previously given by the user. No new data will be collected.

   
   


8. Third-party Websites
   
   

   Our website may contain links to other websites which are not maintained by us. This policy only applies to our website. When visiting these third-party websites, please read their privacy policies which will apply to your use of the third-party websites.

   
   


9. Contact Us
   
   

   To contact banpay on any relevant topic of this policy, your personal data, or to provide any detailed feedback, please reach out to us.
   
   Support Team: [email protected]
   Data Protection Officer (DPO): [email protected]
   
   BanPAY (CA) Ltd.
   535 Yates St., Suite 311
   Victoria BC, V8W 2Z6

   
   


10. Changes to banpay Privacy Policy
    
    

    Any changes made to this policy will be published on this page and where appropriate, a formal email notification will be sent out. Please consult frequently to verify any updates or changes to our Privacy Policy.