Privacy Policy

Last updated: 1 August 2026

iPay is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains the ways in which we collect, use, protect and otherwise handle your personal data, specifically referring to any information pertaining to an individual through which the User can be distinctly identified. All our data processing activities are in strict compliance with prevailing data protection laws of Canada (including Federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and provincial statutes). Additionally, to follow best market practices in our business, we voluntarily follow the fundamental principles of Regulation (EU) 2016/679, known as the General Data Protection Regulation ("GDPR").

This Privacy Policy describes the safeguards and responsible practices applied to Users Personal Data. We value the confidence you place in us when you provide such information.

Unless this Privacy Policy says otherwise, capitalized terms have the meanings given to them in the Terms and Conditions.

This Privacy Policy is intended mainly for our Users and prospective customers. Should you be an employee, contractor, or service provider affiliated with iPay, the processing of your Personal data will be governed by your employment or contractual agreement, or as required by our distinct policies. For further information about those policies, please use the contact details in the section below.

1. Definitions

In this Privacy Policy, the terms below have the following meanings:

Audio Data means data that includes complete voice recordings of calls that you either receive from us or initiate with us.

Company (or "iPay", "we", "us" or "our") refers to IPAYAPP FINANCE LIMITED.

Contact Data refers to the data, which includes your billing address, email, and phone numbers.

Content Data means data that includes photographs, videos, or other digital media uploaded to our website, which may contain personally identifiable information.

Financial Data means data that includes your bank account details and other information. Please note that most financial data is retained by our payment processor. We encourage you to review their privacy policy for further clarity.

Identity Data means data that includes your first and last name, patronymic (if applicable), date of birth, gender, passport number, ID number, driver's license number, and your photographs.

KYC data (Know your customer) means data that includes identity document information, including copies of recently dated Utility bills, Identity cards, Passport and/or Driver's Licenses, and Tax Identification Numbers (TIN).

Location Data means data that includes specifics concerning your actual geographical location when interacting with our website. This includes settings that indicate regional settings, such as your country of residence, time zone, and preferred interface language.

Marketing and Communication Data means data that includes your preferences in receiving marketing from us and your communication preferences.

Personal Data means information relating to You, including, but not limited to, details such as name, address, email address, phone number, identification numbers, location data, online identifiers, and any other information that can directly or indirectly reveal Your identity.

Privacy Policy means this policy, which describes how iPay collects, uses, discloses, and manages your personal data.

Profile Data means data that includes details of your account, username and password, your interests, personal specialty, feedback metrics and/or information received through your interaction with us withwhile providing our services and survey responses.

Technical Data means data that includes your IP address, login credentials, browser specifications, geolocation data, browser extensions, pages viewed, features used, operating system details, and other technological attributes of the devices you utilize to access our website, along with cookie data.

Terms and Conditions means the agreement between iPay and you, as outlined on the Website.

Transaction Data means data that includes data about your transactions, account balances, deposit and withdrawal amounts and methods, and any other interactions on our website.

Usage Data means data that includes details about your activities on our site and how you engage with the Website's services. This encompasses your registration date, account category, activity history. It also covers the number of complaints, the number of filed requests, and your IP history.

User (or “you” or “your”) means an individual or entity that accesses the Website as the User. Consequently, the terms "Your" and "Yours" should be interpreted in relation to You.

Website means the website available at www.ipayappfinance.com, including all subdomains, subpages, and associated online platforms operated by iPay.

2. About the Company

The Platform, providing services through IPAYAPP FINANCE LIMITED: A registered money services business (number: C100000897) with the corporate access number 2026810172, business number 784899163, authorized by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), having its registered office Suite 2700, 225 - 6th, Avenue SW, T2P 1N2, Calgary, Alberta, Canada.

We act as controller for, and are responsible for, Personal Data supplied by a User when registering an account or using services made available through the ipayappfinance.com (together with its subdomains), all subdomains and all their respective pages ("Website").

Protecting your privacy and keeping the information you provide secure are important to us. We maintain data-protection standards and review them regularly to protect User data and accounts. Your Personal Data is safeguarded by a combination of legal, administrative, and technical measures, all designed to uphold its privacy, integrity, and availability. Our Personal Data safeguards combine organizational and technical controls and are informed by annual risk assessments.

We treat our Users’ private information as confidential. Such information will only be shared upon receiving the User's written consent, unless mandated by law, necessary for identity verification, or essential for fulfilling our contractual obligations with the User. Personal Data processing is carried out by our dedicated team and select trusted third parties that offer specific services related to the User's account and our service offerings. Personal Data is stored securely in electronic and physical form under applicable law.

3. Data usage

We may collect, use, retain and share the following categories of data about you:

• Identity Data
• Contact Data
• Financial Data
• Transaction Data
• Content Data
• Technical Data
• Profile Data
• Usage Data
• Marketing and Communication Data
• KYC data (Know your customer)
• Location Data
• Audio Data

Aggregated data means statistical or demographic information. This type of data is derived from your Personal Data but is not considered as such under the law since it doesn't reveal your identity, either directly or indirectly. For instance, we might use your Usage Data to determine the percentage of users engaging with a particular feature on the Website. However, if this aggregated data, when combined with other data, identifies an individual, we will treat it with the same care as Personal data according to our policies. We ensure that your data is processed with integrity, transparency, and fairness, always keeping the intended purpose of data collection in mind. We also adhere to principles like data minimization, accuracy, and limited data storage.

We collect and process Personal Data principally to:

• To perform its contract with you;
• To comply with its legal obligations; and/or
• To safeguard its legitimate interest.

If requested information is not provided, we may be unable to make certain services available to you. In such cases, we might have to terminate a service you're using. We'll inform you if such a situation arises. It's crucial for us that the data we have on you is up-to-date and accurate. Please inform us of any changes in your data during our association.

Please note that we retain information connected with your account and transactions. This data might be referenced in case of any disputes between us and the User. It's the User's responsibility to keep us updated with accurate data. While we make efforts to ensure the data's accuracy and occasionally review the information you provide, we might not always be able to do so without your assistance. The User should recognize that we don't bear any obligation or liability due to any such reviews or inspections of the data.

4. How we collect personal data

We obtain data from and about you using several methods, including:

Direct Interactions. Most information is supplied directly by you. You provide us with your Identity, Contact, and Financial Data online via the Website and/or by filling in online forms and/or by corresponding with us by emails or otherwise. This can be done when you:

• Create an account on our platform.
• Engage with our services.
• Purchase our products or services.
• Subscribe to our updates or publications.
• Opt to receive marketing materials.
• Provide feedback or request notifications about new products or updates.
• Reach out to us with inquiries or other requests.

Automated technologies and interactions. In the course of utilizing our Services, your device automatically transmits its technical specifications to us. The Locale (a combination of parameters setting regional preferences such as residence country, time zone, and interface language) is utilized to enhance service quality within the Website. We use information such as IP addresses, cookie files, browser and operating system details, access timestamps, and requested page addresses to optimize the performance of the Website. This data is also used to monitor user behavior, thereby improving the efficiency and user-friendliness of our Services.

We use web analytics tools and cookies to track the Website's performance and the sources of user engagement. This practice is aimed at refining our marketing strategies and providing users with an enhanced browsing experience.

You have the option to cease such data transmissions at any time (within the extent feasible and as per our legal obligations) by submitting a request using the contact details provided below, using the registered email address associated with your Account. We will endeavor to address your request within 30 business days.

Cookies and Automatic Data Collection Technologies: A cookie is a small data unit, frequently including a unique identifier, sent from a website's computer to your device's browser and stored on your device's hard drive to monitor site usage. Browser settings allow a website to access only the cookies it has sent, safeguarding your privacy. This practice is commonly used by many websites to track online traffic patterns. When you visit the Website, our system automatically captures details about your visit, including Technical Data such as browser type, IP address, and referring website.

Stored cookies may outline a user's path on our site, anonymously identifying repeat visitors and highlighting popular pages. However, to preserve user privacy, personal details such as names and emails are not stored. While cookies are an industry standard widely used by major websites, it is possible to configure your browser to reject cookies from this site or even to delete cookies automatically or manually. However, please be aware that such actions may limit your access to all the functions provided on the Website.

Third parties and publicly accessible sources. We may obtain Personal data concerning you through various means, including when you visit other websites that use our cookies or from third parties such as business partners (including affiliates participating in affiliate marketing programs), subcontractors providing technical, payment, and delivery services, advertising networks, analytics providers, and providers of search information.

Content submitted by Users. You may also contribute Content Data for us to publish or showcase in public sections of the Website, or to send to other Users or third parties. You assume the responsibility for submitting Content Data for publication or transmission, understanding that it carries some inherent risk. While you have the option to configure privacy settings for Content Data through your account profile, it's important to note that no security measures are entirely flawless or invulnerable. Moreover, we lack control over the behavior of other website users with whom you decide to share your Content Data. Therefore, we cannot ensure or promise that unauthorized individuals won't have access to your Content Data.

5. Purpose for which we will use your data and on what legal basis

We process the data described above under PIPEDA and applicable provincial legislation, as amended from time to time. This processing is carried out to achieve the following objectives:

(i) Fulfillment of Contractual Obligations: We process data to effectively fulfill our contractual commitments to the User and provide them with optimal service quality.

(ii) Efficient Service Provision: Data processing supports the efficient delivery of our Services.

(iii) Legal and Regulatory Compliance: We process data to adhere to legal and regulatory requirements.

We rely on the following legal grounds when processing data:

• Compliance with Legal and Regulatory Obligations.
• Execution of Contractual Commitments towards the User.
• Protection of Legitimate Interests: We process data when it aligns with our legitimate interests, provided that your interests and fundamental rights do not supersede those interests.
• Consent Basis: Data processing may occur based on your explicit consent.

The table below sets out the intended uses of your data and the relevant legal grounds. In cases where applicable, we specify our legitimate interests as well. Please be aware that data processing may rely on multiple legal grounds, contingent on the specific purpose for which your data is used.

If you are currently a Website User and we have a valid reason to engage with you, or if you have provided us with your consent, we will collect and manage your personal information to establish communication with you for support purposes, as well as to send you newsletters, push notifications, and calls to keep you informed about our latest features, updates, events, and the effective delivery of our complete range of services. Additionally, we will employ your data to forward marketing details related to our services, which we think could be of significance to you, through email or alternative means.

The Website is intended for adults and is not directed at children. We are vigilant in avoiding the collection of data about minors. Since our services are exclusively available to individuals aged 18 or age of majority as recognized and declared by the laws of your jurisdiction, obtaining your birthdate is crucial for verifying the age of Users. Should we become aware of inadvertently or unintentionally gathering Personal data from someone under the age of 18 or the age of majority, we will without undue delay delete it. If you suspect that we have unintentionally collected data from or about someone under 18 years old or the age of majority, kindly reach out to us at [email protected].

6. Opting out

If you no longer wish to receive marketing newsletters or permit use of your data for third-party marketing purposes, or if you prefer not to receive update notifications, you can send an email to [email protected] using the email address registered and associated with your Account. In your email, kindly request us to refrain from sending such promotional material or sharing your data for marketing purposes. Upon receipt of your email and request, we will ensure that advertising content ceases to be sent to you within 7 (seven) business days.

7. Disclosure of data

We may disclose your data to third parties for the purposes described above.

We take reasonable measures to ensure that any third parties handling data on our behalf adhere to PIPEDA and relevant provincial statutes, subject to modifications. We seek to prevent our third-party service providers from utilizing your Personal data for their individual intentions, and we only permit them to process your data for explicit purposes and as per our instructions.

As a rule, our service providers process data on our behalf.

We aim to upholding confidentiality in matters related to Users and the assessments we gather. Data about you might be revealed under certain circumstances: (i) if there's a legal obligation; (ii) upon your explicit request for transaction processing or other services; (iii) as necessary for the fulfillment of our services within our contractual arrangement; and (iv) to safeguard our legitimate interests, following the guidelines of the PIPEDA and relevant provincial statutes that may change over time.

External Third Parties. Your data is shared with third-party platforms, including but not limited to:

A. Service Providers. We have the possibility of sharing your data with reliable third-party service providers. These providers, acting on our behalf, manage, uphold, and/or support our IT systems and infrastructure, as well as the Website. They handle our payment solutions conduct statistical analyses, handle marketing and advertising initiatives, send out newsletters, offer customer support, and carry out other essential services on our behalf.

B. State authorities. The information provided by the User, both past and future, during their engagement on the platform, could potentially be shared with relevant authorities by us. Such disclosure will occur only where required by applicable laws, regulations, or court orders, and strictly to the necessary extent.

C. Other disclosures. In addition to where you have given consent for data disclosure, or where disclosure is essential for achieving the purpose for which the data was collected, data may also be disclosed under specific circumstances. This includes situations where we have reasonable grounds to believe that such action is required to identify, communicate with, or take legal action against individuals causing harm or disruption to our rights, property, users, or others who may be affected by such activities. Additionally, data may be shared when necessary for initiating, pursuing, or defending legal claims.

Whenever possible, our management will ensure that third parties responsible for collecting, storing, or processing personal information on our behalf adhere to the following measures:

a. Signed agreements that align with this privacy policy and implement PIPEDA-compliant information security practices;

b. Signed non-disclosure or confidentiality agreements containing privacy provisions; and

c. Established procedures to fulfill their obligations towards third parties, ensuring personal information protection.

8. Data retention

We retain your data only for as long as is reasonably required to achieve the purposes for which it was collected, covering the fulfillment of legal, tax, or accounting obligations. In instances where a complaint is received or if there is a reasonable expectation of potential litigation about our association with you, your Personal data may be retained for an extended period.

In assessing the suitable duration for retaining your data, we evaluate factors including the quantity, type, and sensitivity of the data, the potential risks associated with unauthorized access or disclosure of the data, the objectives for processing the data, the feasibility of accomplishing those objectives through alternative methods, and the relevant legal, regulatory, tax, accounting, and other obligations.

We will retain your information for as long as is necessary (but not less than 5 years) to provide you with the services that you have requested from us or for as long as we reasonably require to retain the information for our lawful business purposes (such as to exercise our legal rights), or for as long as the law otherwise permits.

When the applicable retention period ends, the data is deleted using irreversible methods, and we also inform all third parties, to whom the data was transferred, regarding such erasure and request the implementation of similar actions on their part.

9. Your rights and how to withdraw consents and unsubscribe

Identity Accuracy: We ask you to furnish us with accurate, up-to-date, and complete information about your identity. If there are any changes in your identification details, it's imperative to inform the Company within 7 calendar days of the occurrence of such changes. If you believe any of your data with us is inaccurate or incomplete, please reach out to our support team at the contact details provided below.

PIPEDA and relevant provincial legislation give you certain rights in relation to your data. These rights can be intricate, and there might be exceptions. We recommend reaching out to us or relevant regulatory bodies for a comprehensive understanding of these rights. A brief overview of your rights includes:

A. Right to Access: You can request confirmation regarding whether we are processing your data. Additionally, you can request more specifics about the data we hold and our processing activities. You may also be entitled to receive a copy of this data.

B. Right to Rectification: If your data is incorrect or incomplete, you have the right to request its correction or completion.

C. Right to Erasure: You can ask us to delete your data if there's no valid reason for its continued processing. If you wish to delete your account and associated data, contact us using the details in the Contact Section below. However, there might be legal reasons preventing us from immediately erasing your data.

D. The right to restrict processing. You have the right to request the restriction of processing of your Personal data under the following circumstances:

(a) If the data is inaccurate.

(b) If the processing may be unlawful, but you wish to avoid data erasure.

(c) If you require us to retain the data even when it is no longer needed.

(d) If you've objected to our data usage, and we need to verify if there are overriding legitimate reasons to continue.

E. Right to Data Transferability: If our processing of your data is based on your consent and is done through automated methods, you're entitled to receive your data in a structured, widely recognized, and machine-readable format. This right might not be applicable if it negatively impacts the rights and freedoms of others or if it's technically infeasible.

F. The right to object. Depending on the legal foundation of the data processing, you have the right to object to the processing of your Personal data. Please note that there might be situations where our legitimate reasons for processing might necessitate continued processing despite your objection.

G. The right to withdraw consent. If our data processing activities are based on your consent, you have the authority to revoke that consent at any given time. This could be relevant for marketing activities or when sharing your data with third parties. If you decide to revoke your consent, we will cease to process your data, unless there's a legal or regulatory reason that mandates continued processing. Revoking your consent won't impact the legality of any processing that occurred prior to the revocation.

H. The right to complain to the data protection supervisory authority. We place importance on the protection of your data and strive to keep you informed about our processing activities. If you feel that our processing or protection of your data is inadequate, or if you have concerns about the information we've provided, we encourage you to reach out to us. We value your feedback as it helps us enhance our practices. If you wish to exercise any of your rights, please contact us.

To address your concerns or exercise your rights, please get in touch using the contact details provided in the Contact section below. When reaching out, please provide pertinent details, such as your full name and email address, to help us identify you. We aim to respond without undue delay to all inquiries.

To protect your information, we may ask for additional details to verify your identity and ensure that Personal data isn't disclosed to unauthorized individuals. We might also seek more details about your request to expedite our response.

While we strive to address all legitimate requests within a month, there are instances where it might take longer, especially if the request is intricate or if there are multiple requests. Should this happen, we'll keep you informed about the progress.

Please note that for requests deemed excessive or unreasonable, we might impose a nominal administrative fee. This also applies if you request additional copies of your data.

10. Data security and usage

Security Protocols: We use appropriate safeguards designed to protect your data from accidental loss, unauthorized access, alteration and disclosure. Moreover, access to your data is restricted. Only our employees, agents, contractors, and specific third parties with legitimate business requirements are granted access. They process your data strictly based on our instructions and are bound by confidentiality obligations.

Handling Data Breaches: We have procedures for investigating and managing suspected personal-data breaches. We aim to notifying you and the appropriate regulatory body, as required by legal requirements.

Account Security Measures: Upon registering on our Website, you will be prompted to choose a unique username and password. It's crucial to understand that we will never solicit your password. Sharing your registration details, especially in public forums, is discouraged. We cannot be held accountable for unauthorized or improper use of your account details, especially if shared. If you ever suspect unauthorized access to your account, it's imperative to alert our support team immediately.

Infrastructure Security: Our commitment to your data's security is unwavering. All equipment dedicated to data processing is housed within secure data centers, ensuring optimal protection. We use advanced network segmentation techniques and ensure that employee access to data is granted strictly based on role-specific requirements.

Threat Management: We are proactive in identifying and mitigating modern threats to data security. Continuous monitoring, analysis, and response mechanisms are in place to ensure your data's protection against threats, vulnerabilities, and malware.

Data Recovery: In case of any disruptions affecting data accessibility, we have backup and recovery solutions ready to restore your data without undue delay. Critical databases operate in high availability mode to minimize potential downtimes.

Employee Training: We place importance on the security and confidentiality of your data. To ensure this, we closely monitor all actions of our employees who have access to your data within our systems. Access permissions are granted strictly based on a "need to know" principle. We conduct regular training sessions to ensure every employee is well-versed in our data security principles and practices.

Consequences of Not Providing Data: If you choose not to provide certain data, it might hinder our ability to fulfill our contractual obligations to you. This could lead to the cancellation of services you've availed from us. The data we have about you must remain accurate and up to date. Please inform us of any changes during your association with us.

Automated Decision-making and Profiling: We generally don't employ automated decision-making in our business relationships. If we do, you'll be informed separately. We might use profiling to evaluate certain personal aspects, and you'll be informed if we do so. Optional data collection will always be indicated.

11. Our contact details

Entity Responsible for Data Processing: The organization responsible for the processing of your data is iPay. For any inquiries or communication, you can reach out to us at:

IPAYAPP FINANCE LIMITED:

Address: Suite 2700, 225 - 6th, Avenue SW, T2P1N2, Calgary, Alberta, Canada.

Email: [email protected]

Data Protection Officer (hereinafter referred to as “DPO”): We have appointed a DPO who is tasked with overseeing matters related to this Privacy Policy. If you have specific questions or concerns about this policy or any data-related issues, you can contact our DPO at:

IPAYAPP FINANCE LIMITED:

Address: Suite 2700, 225 - 6th, Avenue SW, T2P1N2, Calgary, Alberta, Canada.

Email: [email protected]

For us to efficiently process your requests, please ensure you contact us using the email address you have registered with us. We may also ask you to provide a valid form of identification to ensure the protection of the data we hold and to comply with our security obligations.

If you have any further questions or require more details about how we handle your data, feel free to contact us using the aforementioned details.

12. Links to external websites

The Website may include links to third-party websites. These external websites are not under our direct control. As such, we cannot assume responsibility or liability for the actions or policies of these third-party Websites, especially concerning data collection or disclosure. Before providing your data on any external website, it's essential to review their terms and conditions, and privacy policies.

13. Updates to this Privacy Policy

The most recent update to this Privacy Policy was on 1 August 2026. We may amend this policy from time to time so that it continues to reflect our data collection and processing practices.

Should there be any updates, we will without undue delay publish the revised Privacy Policy on our Website. These changes will become effective immediately upon their posting on our site. This policy might also be supplemented by additional information from other relevant Terms and Conditions that pertain to the Website or your interactions with us.

For any feedback, comments, or inquiries, you may contact us using the contact details provided in the Contact section above.