Personal Data Processing Policy

Introduction and Scope

This Personal Data Processing Policy (hereinafter referred to as the “Policy”) details how the Operator collects, utilizes, stores, discloses, and safeguards personal data obtained through the website and its associated services. This Policy is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), as well as relevant provincial privacy legislation across Canada, ensuring a robust framework for data protection.

The Operator is committed to upholding the privacy rights of individuals and processing personal data transparently and lawfully. This document serves as a comprehensive guide to our practices, applicable to all interactions involving personal data within the scope of our operations in Canada.

Legal Basis for Data Processing

The Operator processes personal data strictly on established legal grounds, in accordance with Canadian privacy statutes. These bases include, but are not limited to:

The necessity of processing for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract.

Compliance with a legal obligation to which the Operator is subject under Canadian federal or provincial law.

The explicit consent of the data subject, obtained where required by law, particularly for purposes not directly related to contractual obligations or legal mandates.

The legitimate interests pursued by the Operator or by a third party, provided that such interests are not overridden by the fundamental rights and freedoms of the data subject that require protection of personal data.

Categories of Personal Data Collected

In providing its services, the Operator may collect various types of personal data. This collection is limited to data that is necessary, relevant, and proportionate to the stated purposes. Categories of data collected may include:

Identity and Verification Data: Full name, date of birth, gender, government-issued identification numbers (e.g., driver’s license, passport details), and other information required for identity verification and age validation.

Contact Information: Residential address, email address, telephone number, and other communication details.

Financial Data: Payment card details, bank account information, transaction history, and other financial records necessary for processing transactions and complying with anti-money laundering regulations.

Technical and Usage Data: Internet Protocol (IP) addresses, device identifiers, operating system, browser type, website usage patterns, access times, and diagnostic data.

Other Information: Any additional data voluntarily provided by the user or required for compliance with statutory or regulatory obligations pertinent to the service.

Purposes of Data Processing

The Operator processes personal data for specific, legitimate purposes, which are clearly defined and communicated to data subjects. These purposes include:

Account Management and Service Provision: To create and maintain user accounts, provide access to the online service, and deliver requested services.

Legal and Regulatory Compliance: To fulfill obligations under Canadian federal and provincial laws, including but not limited to age verification, anti-money laundering (AML) regulations, and responsible conduct requirements.

Security and Fraud Prevention: To detect, prevent, and investigate fraudulent activities, unauthorized access, and other security incidents, thereby protecting the integrity of the service and its users.

Communication: To communicate with users regarding their accounts, service updates, policy changes, and to respond to inquiries and support requests.

Service Improvement: To analyze user behaviour and preferences in an aggregated or anonymized form to enhance the functionality, performance, and user experience of the website.

Dispute Resolution: To resolve disputes, enforce our terms and conditions, and establish, exercise, or defend legal claims.

Data Retention Principles

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Canadian law and regulatory guidelines. The Operator adheres to strict data retention schedules, which consider the type of data, its purpose, and any legal or operational requirements.

Upon the expiration of the retention period, or when the data is no longer necessary, appropriate measures are taken to securely delete, anonymize, or destroy the data, ensuring it cannot be reconstructed or associated with an individual.

Disclosure and International Transfers

Personal data may be disclosed to third parties only when necessary for the purposes outlined in this Policy, or when legally mandated. Such disclosures are made in strict compliance with Canadian data protection laws. Categories of recipients may include:

Regulatory and Governmental Authorities: As required by law, court order, or governmental request, including bodies responsible for financial regulation and consumer protection.

Service Providers: Third-party vendors and contractors who perform services on behalf of the Operator, such as payment processors, IT support, and identity verification services. These providers are contractually bound to protect data and use it only for specified purposes.

Professional Advisors: Legal, accounting, and auditing professionals who provide services to the Operator.

In instances where personal data is transferred outside of Canada, the Operator implements robust safeguards to ensure that the data receives a comparable level of protection as required under Canadian law. This may include contractual clauses, privacy frameworks, or other legally recognized mechanisms for international data transfers.

Rights of Data Subjects

Under Canadian privacy legislation, individuals possess certain rights concerning their personal data. The Operator is committed to facilitating the exercise of these rights:

Right of Access: Individuals have the right to request access to their personal data held by the Operator.

Right to Rectification: Individuals may request the correction of inaccurate or incomplete personal data.

Right to Withdraw Consent: Where processing is based on consent, individuals have the right to withdraw that consent at any time, subject to legal or contractual restrictions.

Right to Erasure or Restriction: Individuals may request the deletion or restriction of processing of their personal data, subject to certain legal limitations.

Right to Data Portability: Where applicable, individuals may have the right to receive their personal data in a structured, commonly used, and machine-readable format.

Right to Lodge a Complaint: Individuals have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada or the relevant provincial privacy commissioner if they believe their privacy rights have been violated.

Data Security Measures and Updates

The Operator employs comprehensive technical and organizational security measures to protect personal data against unauthorized access, disclosure, alteration, and destruction. These measures include encryption, access controls, secure network architectures, and regular security assessments, all designed to meet or exceed Canadian industry standards.

This Policy may be updated periodically to reflect changes in legal requirements, technological advancements, or operational practices. Any revisions will be published on the website, and the effective date will be clearly indicated. Continued use of the website following such updates constitutes acceptance of the revised Policy.

For any inquiries regarding this Policy or the processing of personal data, please contact the support team at [email protected].