Data Privacy Policy

Pellopay Finance Ltd. (“Pellopay”, “we”, “us” or “our”) provides open-banking and card-payment processing services to online businesses that sell goods or services (“Merchants”). Our principal operating location is Vancouver, British Columbia, Canada. Our registered office is 422 Richards Street, Suite 170, Vancouver, BC Canada, V6B 274. Pellopay is registered with the Financial Transactions and Reports Analysis Centre of Canada (“FINTRAC”) as a money services business, registration number M23328189.

This Policy explains how we collect, use, disclose, retain and protect information about identifiable individuals (“Personal Information”) in connection with our websites, payment interfaces, application programming interfaces, Merchant onboarding, payment processing, account-information services, support and related operations (together, the “Services”).

It covers Merchant representatives, directors, owners and beneficial owners; individuals purchasing or paying for a Merchant’s goods or services (“Payers”); and website visitors and other individuals who communicate with us. A Payer may interact with our Services at a Merchant’s checkout without holding a Pellopay account or having a direct service contract with Pellopay. Information about a company is covered where it also identifies an individual.

This Policy is a privacy notice, not a payment instruction, banking-access authorisation, guarantee of payment, guarantee of security or amendment to a Merchant service agreement. Reading it or continuing to use a website does not, by itself, provide any consent or authorisation that must be separately obtained. Nothing in it excludes mandatory privacy rights or Pellopay’s responsibilities under applicable law.

We apply the privacy and data-protection laws applicable to the relevant activity. These may include the Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”), British Columbia’s Personal Information Protection Act and other applicable provincial legislation. Where their territorial and other requirements are met, the EU General Data Protection Regulation (“EU GDPR”), the UK GDPR and the UK Data Protection Act 2018, as amended, also apply. Applicable rules on cookies and electronic communications apply to the relevant activity. An individual’s residence alone does not determine which laws apply.

2.1 Information for our own purposes

Pellopay determines how Personal Information is used for its own onboarding, regulatory compliance, fraud prevention, security, payment administration, reconciliation, support, complaints and legal-claims purposes. For processing governed by the EU or UK GDPR, Pellopay acts as a controller to the extent it determines the purposes and essential means of that processing.

2.2 Information processed on another organisation’s instructions

For particular contracted activities, Pellopay may process Personal Information solely on a Merchant’s or another organisation’s documented instructions. Where the EU or UK GDPR applies, Pellopay acts as a processor for those activities and the relevant data-processing agreement governs its instructions. Pellopay does not treat processing for its independent compliance or other own purposes as processor-only activity. Roles depend on the actual activity and agreement, not merely on the label used by a party.

2.3 Merchants and payment partners

Merchants determine how information is used for their sales, order fulfilment, customer accounts, advertising and other own purposes. Banks, card issuers, acquiring institutions, card networks and open-banking providers may also determine their own processing purposes. Their privacy notices apply to their own activities. We remain responsible for processing for which applicable law makes us responsible, including appropriate oversight of providers processing on our behalf. This Policy does not authorise another organisation’s processing or replace its notice.

The information collected depends on the Service, integration, transaction, individual’s role and legal requirements. We do not require every category from every individual. Information may include:

• Identity and contact information: name, email address, telephone number, billing or residential address and, where relevant to verification or compliance, date of birth, nationality, identification-document information and copies, signature and verification results.
• Merchant-related information: an individual’s business role, authority to act, directorship, ownership or beneficial ownership, business contact details and information needed to verify the Merchant and people associated with it.
• Payment and transaction information: payer and payee identifiers, payment amount, currency, time, Merchant and order reference, payment method, payment status, authentication results, transaction identifiers, settlement, refund and chargeback records, and relevant billing and delivery information.
• Card information: cardholder name, permitted card-account information, expiry date, payment tokens, masked account numbers and authentication information, to the extent received through the relevant payment flow. Some card information may be collected directly by payment partners rather than by Pellopay.
• Open-banking information: bank or account-provider identity, account-holder and account identifiers, payment instructions, payment-status information and, where enabled and specifically authorised for the relevant Service, account information, balances and transaction history within the scope of that access.
• Compliance and risk information: verification records, sanctions and politically exposed person screening results, relevant adverse-media information, source-of-funds or source-of-wealth information where necessary, transaction-monitoring indicators and investigation records.
• Technical and security information: IP address, browser and device information, session and connection information, access logs, error records, approximate location inferred from technical information and indicators of suspicious or abusive activity.
• Communications and preferences: enquiries, support requests, complaints, relevant correspondence, privacy choices, authorisation and consent records and marketing preferences. Calls or other communications are recorded only where recording is used, notified appropriately and lawful.

Financial, identity and compliance information may be sensitive. We limit its collection, use and access according to the relevant purpose and applicable requirements. Precise device location, biometric identification and other particularly sensitive information are not implied by a general reference to technical or identification information; if such processing is introduced, we provide the required additional information and obtain any necessary consent or other authorisation.

We obtain Personal Information from individuals using or enquiring about the Services; Merchants and their checkout or account systems; banks, card issuers, acquirers, card networks and payment partners; authorised open-banking providers; identity-verification and compliance providers; relevant public or official registers and screening sources; competent authorities where lawful; and technical interactions with our Services.

When a Merchant or other organisation supplies information about an individual, it is expected to have the necessary authority and to provide appropriate privacy information. We do not rely on that expectation as a substitute for our own legal obligations. We may request evidence of the source, accuracy, notice, consent or authority supporting a disclosure and may decline unnecessary or unlawfully supplied information.

We identify the purposes of processing at or before collection, including through this Policy and any transaction-specific notice. Depending on the Services and circumstances, we use and disclose Personal Information to:

• assess, onboard, verify and administer Merchants and authorised users, and manage the related business relationship;
• receive, authenticate, route and process payment instructions, obtain payment-status information, reconcile and settle transactions, and administer refunds, reversals, chargebacks and payment disputes;
• provide an authorised account-information Service within the disclosed scope of bank access;
• communicate about transactions and Services, provide support, investigate complaints and respond to privacy requests;
• meet applicable anti-money laundering, counter-terrorist financing, sanctions, record-keeping, reporting and other legal obligations, including disclosures to FINTRAC or other competent authorities where required or permitted;
• detect, assess, prevent and investigate fraud, unauthorised payments, account misuse, prohibited activities and threats to individuals, Merchants, partners or Pellopay;
• operate, maintain, troubleshoot and secure the Services, assess performance and improve reliability and user experience in a manner consistent with the disclosed purposes;
• administer contracts, billing, insurance, audits and corporate governance, and establish, exercise or defend legal claims;
• send permitted marketing communications in accordance with the marketing section below; and
• produce appropriately aggregated or anonymised analysis, subject to the safeguards below.

A reference to risk management or service improvement is not unlimited authority to use Personal Information for unrelated purposes. Where a new purpose requires additional notice, consent or another legal step, we take that step before commencing the new processing. We do not use Payers’ bank-account histories or payment details for unrelated advertising merely because they make a payment through Pellopay.

6.1 Canadian processing

Where Canadian privacy law applies, we obtain the consent required for the relevant collection, use or disclosure, unless a specific legal exception permits or requires processing without consent. The form of consent reflects the information’s sensitivity, the purpose, the individual’s reasonable expectations and applicable law. We do not treat a GDPR-style “legitimate interests” assessment as a general substitute for consent required under Canadian law.

Where appropriate and lawful, consent may be obtained through a Merchant or payment partner. We distinguish necessary processing from optional processing and do not make optional marketing or unrelated access to bank information a condition of a payment Service.

6.2 EU and UK processing

Where the EU or UK GDPR applies, we identify an appropriate lawful basis for each processing activity. Depending on the circumstances, these are:

• Contract: processing objectively necessary for a contract with the individual, or requested steps before entering that contract. A contract with a Merchant company does not, by itself, establish this basis for every Payer, employee or beneficial owner.
• Legal obligation: processing necessary to meet a legal obligation recognised under the applicable EU or UK framework. A Canadian obligation is not automatically treated as an EU or UK legal-obligation basis; another available basis and relevant transfer requirements may need to be assessed.
• Legitimate interests: necessary and proportionate processing for payment administration, fraud prevention, security, business communications, limited service improvement or legal-claims purposes, following an assessment of those interests against the individual’s interests, rights and freedoms. This is not used where the applicable law requires consent or prohibits the processing.
• Consent: processing for an optional activity for which valid consent is the appropriate basis, including relevant marketing, cookies or particularly sensitive activities where required. Consent may be withdrawn as described below.

Where an additional condition is required for special-category information, criminal-offence information or other restricted processing, we establish that condition before processing. Any additional basis required for solely automated significant decisions is considered separately. We provide more specific information where the nature of the activity requires it.

6.3 Missing information and withdrawal

If necessary information, verification or authorisation is not provided, we may be unable to onboard a Merchant, process or complete a payment, provide an account-information Service, resolve a dispute or continue a relationship. We may restrict, suspend or decline the affected Service where justified by the circumstances, applicable law and relevant contract.

Individuals may withdraw consent for consent-based processing, subject to lawful restrictions, by contacting us or using the relevant controls. We explain relevant consequences. Withdrawal does not invalidate earlier lawful processing and does not necessarily require deletion of records or stopping processing supported by another lawful authority. Marketing withdrawal does not prevent necessary transaction, security or legal communications.

7.1 Open-banking integrations

Our open-banking integrations may support payment initiation, payment-status information or access to account information, balances and transaction history. In some integrations the third-party provider handles bank access and Pellopay receives only payment results. The information actually available to Pellopay depends on the integration and the permissions authorised for it. We do not assume access to an entire banking history simply because a Payer initiates a payment.

Before account access, the relevant flow identifies the requested Service and permissions, the accounts and information covered, the relevant providers and the period or frequency of access as applicable. Permissions must be limited to the disclosed purpose. A payment authorisation, a provider’s technical access permission and privacy consent are distinct requirements; one does not automatically satisfy the others.

You should authenticate through the designated bank or provider interface and must not send online-banking passwords, PINs or one-time codes to Pellopay by email, chat or support message. Bank credentials are handled only through the designated authorised authentication flow, not requested as support information. We use tokens or other access mechanisms only where supported by the relevant integration and within its authorised scope.

You may revoke future access through the relevant bank or provider controls and contact Pellopay for assistance with Pellopay-controlled permissions. Revocation may prevent further account access or affected Services. It does not necessarily cancel a payment already submitted, reverse a completed payment or remove records that must lawfully be retained. Payment cancellation and refund rights are addressed through the applicable payment process and terms.

7.2 Card processing

We limit access to card information according to the relevant role and payment architecture, and apply applicable payment-card security requirements to systems within our responsibility. We do not retain card verification values, full magnetic-stripe or equivalent chip authentication data, or PIN data after authorisation. We do not request those details through ordinary support communications. This Policy does not represent that Pellopay or a partner holds any particular security certification.

We disclose only information appropriate to the purpose and recipient, subject to applicable law. Recipients may include:

• The relevant Merchant: information needed to identify and reconcile the payment, confirm status, handle refunds or investigate a dispute. Making a payment does not, by itself, authorise giving the Merchant unrestricted access to your bank balances or transaction history.
• Payment and banking participants: banks, card issuers, acquirers, card networks, payment processors, settlement providers and open-banking providers necessary to deliver the relevant Service or handle related disputes and compliance.
• Service providers: hosting, infrastructure, security, verification, screening, communications, customer-support and other providers engaged for the disclosed purposes.
• Professional advisers and other support recipients: legal advisers, auditors, insurers and other professional advisers where appropriate and subject to applicable confidentiality requirements.
• Authorities and legally entitled recipients: FINTRAC, regulators, law-enforcement bodies, courts and other recipients where disclosure is required or permitted by law, including lawful investigations or proceedings. We assess requests and do not regard every request as automatically authorising disclosure.
• Corporate transaction participants: a prospective or actual buyer, successor or adviser in a financing, reorganisation, sale or other corporate transaction, only to the extent lawful and necessary, with appropriate confidentiality, use restrictions and any required notices or consent.

Affiliates receive information only where involved in a disclosed purpose and subject to appropriate safeguards; affiliation does not confer unrestricted access. Providers acting on our behalf are subject to appropriate contractual instructions, confidentiality and security obligations and risk-based oversight. Independent controllers remain responsible for their own purposes and obligations. Where a joint-controller arrangement is required, we document it and make the required information available.

We do not sell Personal Information to data brokers or provide it for unrelated third-party advertising. Disclosures necessary for payment processing, compliance, support or a lawful corporate transaction are described above. This restriction applies across our Services.

Our core infrastructure is hosted using Amazon Web Services in Ireland, and Personal Information is primarily stored and processed within the EU/EEA. Authorised personnel and providers may also access or process information from Canada and other countries where relevant payment participants or service providers operate. Overseas remote access is assessed as processing and, where applicable, as an international transfer; the physical location of a server is not the sole consideration.

Information processed in another country may be subject to that country’s laws and lawful access by its authorities. We assess relevant arrangements and implement contractual, technical and organisational safeguards appropriate to the data, recipients and applicable requirements. Where Canadian law requires continuing accountability for outsourced processing, we maintain that accountability and use appropriate measures to support comparable protection.

Where EU or UK transfer rules apply, we use a valid transfer mechanism. This may be an applicable adequacy decision, approved contractual clauses, the relevant UK transfer instrument, or another mechanism permitted in the particular circumstances. Canada’s adequacy treatment is not assumed to cover every recipient or every transfer. Where necessary, we assess the destination and implement supplementary safeguards. Our Canadian identity and Irish hosting do not, by themselves, establish compliance for all transfers.

You may contact us for information about relevant processing countries and safeguards and, where applicable, a copy or summary of the relevant transfer safeguards, subject to appropriate redaction of confidential information. International processing arrangements are reviewed as Services and providers change.

We implement technical and organisational safeguards appropriate to the sensitivity, volume and use of the information and the associated risks. These include measures for access control, secure transmission and storage, authentication, logging, vulnerability management, personnel confidentiality and training, provider oversight and incident handling, as appropriate to the relevant systems. We review safeguards as risks and Services evolve.

No system or transmission method is completely secure. We do not guarantee absolute security, uninterrupted availability or that every unauthorised act will be prevented. This statement does not limit our obligation to apply appropriate safeguards or any responsibility imposed by law. Individuals and Merchants should protect their devices and credentials and promptly report suspected misuse; these precautions do not transfer Pellopay’s own obligations to them.

We assess suspected incidents, contain and investigate them, preserve appropriate records and take remediation measures. We notify competent authorities, affected individuals, relevant controllers or other parties where required, under the thresholds, timing and content requirements applicable to the particular processing. A single notification rule does not apply to every country: Canadian and British Columbia requirements are assessed separately from EU and UK requirements. Where the EU or UK GDPR requires controller notification within 72 hours, that requirement applies subject to its statutory conditions; as a processor we notify the relevant controller without undue delay as required.

Incident disclosures may be limited where necessary and lawful to protect investigations, security, privilege or third-party rights. We maintain required breach records and cooperate with competent authorities. Merchants and partners should promptly report incidents affecting information exchanged with Pellopay and cooperate in accordance with their agreements and applicable law.

We retain Personal Information only for as long as necessary and lawful for the relevant purpose. Retention depends on the record category and legally specified starting event, not on a universal period beginning when information was first collected.

• Onboarding and relationship records: for the relationship and any justified post-relationship period needed for compliance, administration, audits or claims.
• AML and other regulatory records: for at least the applicable statutory minimum, calculated from the trigger specified for the particular record, and longer only where another lawful and proportionate retention purpose applies. A five-year requirement, where applicable, is not treated as a universal maximum.
• Payments, settlement, refunds and disputes: for necessary reconciliation and dispute periods and applicable accounting, regulatory and legal-claims requirements.
• Bank-access tokens and permissions: while necessary and authorised for the relevant access, with invalidation, expiry or deletion as appropriate when access ends; evidence of the authorisation may be retained separately where justified.
• Technical logs, communications and enquiries: for the period justified by security, support, investigation and other identified purposes.
• Consent, objection and suppression records: for as long as necessary to respect preferences and demonstrate compliance, even where the underlying marketing activity has ended.

We maintain a category-based retention schedule. Legal holds, investigations and pending claims may require restricted retention beyond ordinary disposal dates. They are reviewed and removed when no longer justified. Expired information is securely deleted or irreversibly anonymised; copies in backups are protected, not used for ordinary processing, and removed through the applicable backup lifecycle. We do not promise immediate deletion from every backup when a deletion request is received.

We use essential session, authentication and security technologies where needed to operate the Services. Optional analytics, personalisation or advertising technologies, if used, are subject to the relevant notice and consent controls. We do not describe a technology as essential merely because it benefits Pellopay commercially. Before optional technologies are used where consent is required, the relevant choice is presented and respected. Details of active technologies, purposes, providers and lifetimes are available in Cookie notice URL.

We send marketing only where permitted by applicable privacy and electronic-marketing rules and obtain required consent. Marketing choices are separate from payment or bank-access authorisation. You may unsubscribe using the message controls or contact us. We retain necessary suppression records and continue necessary non-marketing communications. A Merchant’s marketing permission does not automatically authorise marketing by Pellopay.

We may use proportionate analysis of Service and transaction activity for security, fraud prevention, reliability and other disclosed purposes, subject to the relevant authority for processing. We may create and use aggregated or anonymised information where individuals cannot reasonably be identified in the relevant circumstances. Removing names or replacing them with tokens does not automatically anonymise information. Identifiable or pseudonymised datasets remain subject to applicable protections; we do not represent that all statistical datasets fall outside privacy law.

We may use automated checks and risk indicators to assist verification, sanctions screening, transaction monitoring, fraud detection and security. Depending on the integration and applicable requirements, checks may flag a payment for review, require additional authentication or contribute to restricting, delaying or declining an affected Service. Relevant inputs may include verification results, transaction characteristics, technical indicators and patterns suggesting misuse. We limit processing to relevant purposes and applicable legal authority.

Where a decision is made solely by automated processing and produces legal or similarly significant effects on an individual under applicable EU or UK law, we use it only where permitted and apply required safeguards. We provide the required activity-specific information about the decision-making, its significance and expected consequences and the applicable route for human intervention, representations and challenge. Canadian and provincial transparency, access and other applicable requirements are addressed separately.

You may contact us about a decision affecting you. Our ability to explain or change a result may be limited by lawful confidentiality, financial-crime restrictions or a decision made independently by a bank, Merchant or other provider. We identify an appropriate review route where possible. We do not use “AML compliance” as a blanket exemption from requirements governing automated decisions. Automated processing disclosures, if any, are kept consistent with the Services in use.

Depending on the applicable law and circumstances, you may request confirmation of processing, access to your Personal Information and information about its use or disclosure; correction of inaccurate or incomplete information; withdrawal of consent; or investigation of a privacy complaint. Where the EU or UK GDPR applies, rights may also include erasure, restriction, objection, portability and rights relating to solely automated significant decisions, subject to their respective legal conditions. Rights do not apply identically in every jurisdiction.

An erasure request is assessed on its own conditions and exceptions, not automatically refused merely because processing has a contractual basis. We may need to retain information for regulatory obligations, legal claims or another applicable exception. Access may be restricted where lawfully necessary to protect another individual, privilege, an investigation or information whose disclosure is prohibited. Where appropriate, we separate or redact restricted information rather than refuse an entire request.

To make a request, contact our Privacy Officer below and describe the information or Service concerned. We may ask for proportionate information to verify identity or authority, but do not routinely require a complete identification document if less intrusive verification is sufficient. Requests are handled within applicable legal time limits; any permitted extension, charge or refusal is explained as required. We do not use verification requests to create an unjustified delay.

If we process the relevant information solely on a Merchant’s or another controller’s instructions, we may direct the request to that controller and assist as required. Requests concerning Pellopay’s own processing can be made to Pellopay even if the individual has no account with us. Objections and withdrawals do not necessarily affect independently lawful records or an already-submitted payment.

You may contact Pellopay to seek a resolution, without losing your right to complain to a competent authority. Depending on the processing, relevant authorities may include the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, another competent provincial authority, an EU/EEA supervisory authority or the UK Information Commissioner’s Office. Where the EU GDPR applies, a complaint may be made to the competent supervisory authority in the Member State of habitual residence, place of work or alleged infringement, as applicable. You are not required to exhaust Pellopay’s internal process before exercising a statutory complaint right.

Merchants should provide accurate privacy notices to Payers and associated individuals, obtain necessary consents and authorisations, send only relevant information, secure their systems and integrations, and support lawful privacy and incident-response cooperation. The binding allocation of instructions, responsibilities, security requirements and remedies between Pellopay and a Merchant is set out in their service and data-processing agreements. This Policy does not create an indemnity, liability cap or waiver by a Payer or impose new contractual duties on a Merchant merely through publication.

Pellopay’s payment role does not, by itself, make Pellopay the seller of a Merchant’s goods or services. Questions about goods, fulfilment and the Merchant’s own marketing should ordinarily be directed to the Merchant. Questions about Pellopay’s processing, payment support or applicable dispute routes may be directed to Pellopay. This distinction does not restrict statutory rights, applicable chargeback or payment-dispute procedures, or responsibilities that law imposes on Pellopay.

Privacy Officer

Compliance Officer

Privacy email

contact@pellopay.com

Postal address

422 Richards Street, Suite 170, Vancouver, BC Canada, V6B 274

Website

pellopay.com

Where an EU or UK representative or a Data Protection Officer must be appointed for relevant processing, their contact details are provided in Representative and DPO contact notice URL. Our Privacy Officer remains the primary contact for Canadian privacy enquiries.

We may update this Policy to reflect changes to the Services, processing arrangements or applicable requirements. The updated Policy identifies its effective date. We give notice of material changes where appropriate or legally required and obtain any additional consent needed before the relevant new processing. Changes do not retrospectively authorise incompatible processing or diminish mandatory rights. Where a supplemental notice applies to a particular Service, it should be read with this Policy.