Privacy Policy

1. Introduction

1.1 Scope

This Privacy Policy applies to all personal information collected by Invincible Pay through our e-wallet platform, website, mobile applications, and related services. It covers information collected from customers who use our services to send and receive funds, manage their digital wallets, and conduct electronic payment transactions.

1.2 Compliance With Applicable Laws

Invincible Pay is committed to compliance with all applicable privacy laws and regulations, including:

• Personal Information Protection and Electronic Documents Act (PIPEDA): Canada's federal privacy law
• Provincial privacy legislation where applicable
• General Data Protection Regulation (GDPR), for European Union residents
• California Consumer Privacy Act (CCPA), for California residents
• Retail Payment Activities Act, as a registered Payment Service Provider

As a registered Money Services Business with FINTRAC and a Payment Service Provider registered with the Bank of Canada, we also comply with anti-money laundering and counter-terrorist financing regulations that govern the collection and retention of certain personal information.

1.3 Policy Updates and Amendments

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will notify you by email, through our platform, or by posting a prominent notice on our website. Your continued use of our services after such notice constitutes acceptance of the updated policy.

2. Purpose

2.1 Commitment to Privacy

At Invincible Pay, we recognize that trust is fundamental to our relationship with our customers. We are committed to being transparent about our data practices and ensuring that your personal information is collected, used, and protected responsibly. This policy is designed to help you understand:

• What personal information we collect and why
• How we use and protect your information
• When and with whom we share your information
• Your rights regarding your personal information
• How you can contact us with privacy concerns

2.2 Legal Basis for Processing Personal Data

We process personal information only when we have a lawful basis to do so. Depending on the circumstances and applicable law, our processing may be based on:

• Consent: You have given explicit permission for specific processing activities
• Contract Performance: Processing is necessary to provide services you've requested
• Legal Obligation: We must process data to comply with laws and regulations
• Legitimate Interests: Processing serves our legitimate business interests while respecting your privacy rights

3. Definitions

3.1 Personal Information

Personal Information means any information about an identifiable individual. This includes information that can be used on its own or in combination with other information to identify, contact, or locate a specific person. Examples include names, email addresses, phone numbers, financial account information, government-issued identification numbers, IP addresses, and transaction records.

3.2 Processing

Processing refers to any operation or set of operations performed on personal information, whether by automated means or not. This includes collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, transmission, alignment, combination, restriction, erasure, or destruction of personal information.

3.3 Data Subject

A Data Subject is an identifiable individual to whom personal information relates.

3.4 Controller and Processor

A Data Controller determines the purposes and means of processing personal information. A Data Processor processes personal information on behalf of the controller. Invincible Pay acts as a data controller with respect to customer information we collect and process to provide our services.

3.5 Consent

Consent means a freely given, specific, informed, and unambiguous indication of your wishes by which you agree to the processing of your personal information.

3.6 Other Key Terms

• E-Wallet: A digital account that allows you to store funds electronically and conduct transactions
• Payment Services: Electronic fund transfer and payment processing services provided through our platform
• Transaction: Any transfer, payment, deposit, or withdrawal of funds through your e-wallet
• KYC (Know Your Customer): Identity verification procedures we're required to perform under applicable regulations

4. Types of Information We Collect

4.1 Information You Provide Directly

We collect information that you provide when you register for an account, use our services, or communicate with us:

Account Registration Information

• Full legal name
• Date of birth
• Email address
• Phone number
• Residential address
• Government-issued identification (driver's license, passport, etc.)
• Social Insurance Number (when required for tax reporting or verification)

Financial Information

• Bank account details for linking to your e-wallet
• Payment card information (encrypted and tokenized)
• Transaction history and payment details
• Payment recipient information
• Funding source details

Verification and Compliance Information

• Copies of identity documents
• Proof of address documentation
• Source of funds information (when required)
• Business information for commercial accounts
• Beneficial ownership information for entities

Communications

• Customer support inquiries and correspondence
• Survey responses and feedback
• Marketing preferences

4.2 Information We Collect Automatically

When you use our services, we automatically collect certain technical and usage information:

Device and Technical Information

• IP address and location data
• Device type, model, and operating system
• Browser type and version
• Unique device identifiers
• Mobile network information

Usage and Activity Information

• Pages visited and features used
• Transaction patterns and frequency
• Login times and session duration
• Clickstream data and navigation paths
• E-wallet balance and transaction history

Security and Fraud Prevention Data

• Authentication data and security credentials
• Risk assessment scores
• Fraud detection indicators
• Device fingerprinting information

4.3 Information From Third Parties

We may receive information about you from third-party sources, including:

• Identity Verification Services: Information confirming your identity and address
• Credit Bureaus: Credit history and verification data (with your consent where required)
• Financial Institutions: Bank account verification and transaction information
• Fraud Prevention Services: Risk and fraud indicators
• Public Records: Information from publicly available sources
• Referral Partners: Information if you were referred to our services

4.4 Sensitive Information

We collect certain types of sensitive information only when necessary and with appropriate safeguards:

• Government Identifiers: Social Insurance Numbers, driver's license numbers (for KYC compliance)
• Financial Account Details: Bank account and routing numbers (encrypted and protected)
• Biometric Data: If you use biometric authentication features (face ID, fingerprint)

5. How We Use Your Information

5.1 To Provide E-Wallet and Payment Services

• Creating and maintaining your e-wallet account
• Processing electronic fund transfers and payments
• Facilitating deposits and withdrawals
• Managing your account balance and transaction history
• Linking external bank accounts and payment methods to your e-wallet
• Sending transaction notifications and confirmations
• Providing customer support and resolving issues
• Improving and personalizing your user experience

5.2 Verification and Compliance

• Verifying your identity during account registration (Know Your Customer, KYC)
• Conducting ongoing monitoring of transactions and account activity
• Screening against sanctions lists and politically exposed persons (PEP) databases
• Filing required reports with FINTRAC and other regulatory authorities
• Maintaining records as required by anti-money laundering laws
• Responding to lawful requests from law enforcement and regulators

5.3 Fraud Prevention and Risk Management

• Detecting and preventing fraudulent transactions
• Identifying suspicious patterns or unusual activity
• Assessing transaction risk in real-time
• Preventing unauthorized access to accounts
• Investigating security incidents and disputes
• Protecting against identity theft and account takeover

5.4 Customer Support and Communication

• Responding to your inquiries and support requests
• Sending service announcements and important updates
• Notifying you of changes to our terms or policies
• Requesting feedback about our services
• Resolving disputes and addressing complaints

5.5 Marketing and Product Development

With your consent where required, we may use your information for:

• Sending promotional offers and information about new features
• Conducting market research and surveys
• Analyzing usage patterns to improve our services
• Developing new products and features
• Personalizing your experience on our platform

You can opt out of marketing communications at any time using the unsubscribe link in our emails or by updating your account preferences.

5.6 Text (SMS) Messaging and Two-Factor Authentication

If you provide us with your mobile phone number and opt in to text messaging, we use your phone number to send you:

• One-time passcodes (OTP) for two-factor authentication (2FA), login verification, and identity confirmation
• Account, security, and fraud alerts
• Transaction notifications and payment status updates
• Customer-care and service messages

Message frequency varies based on your account activity. Message and data rates may apply. You may opt out at any time by replying STOP to any message, and you can reply HELP for assistance. Opt-in consent is collected during account registration on our platform or within your account settings, and is never assumed by default. For full program terms, see the Text Messaging (SMS) Terms in our Terms of Service.

5.7 Legal Obligations and Enforcement

• Comply with legal and regulatory requirements
• Respond to court orders, subpoenas, and legal processes
• Enforce our Terms of Service and other agreements
• Protect our rights, property, and safety or those of others
• Investigate and prevent illegal activity

6. Legal Bases for Processing

6.1 Consent

We rely on your consent when we collect and process personal information for purposes such as: marketing communications, optional features like biometric authentication, sharing information with third parties for their own purposes, and non-essential cookies and analytics. You may withdraw consent at any time.

6.2 Contractual Necessity

We process personal information when necessary to fulfill our contract with you, including: creating and maintaining your e-wallet account, processing payment transactions and fund transfers, providing customer support, and managing your account balance and transaction history.

6.3 Legal Obligation

We must process certain personal information to comply with legal and regulatory requirements: customer identification and verification (KYC/AML regulations), transaction monitoring and suspicious activity reporting, record retention requirements under PCMLTFA, tax reporting obligations, responding to lawful requests from authorities, and sanctions screening and compliance.

6.4 Legitimate Interests

We process personal information when necessary for our legitimate business interests: fraud detection and prevention, network and information security, internal research and product development, business analytics and operational improvements, protecting our legal rights, and preventing misuse of our services.

7. How We Share Information

7.1 With Service Providers and Partners

We share personal information with trusted third-party service providers who assist us in operating our platform and providing services: payment processors, identity verification services, cloud service providers, fraud prevention services, customer support tools, and analytics providers. All service providers are contractually obligated to protect your information.

7.2 With Regulatory and Law Enforcement Authorities

We disclose personal information to regulatory bodies and law enforcement when required by law, including: FINTRAC, Bank of Canada, Canada Revenue Agency, law enforcement agencies, and other applicable regulators.

7.3 With Financial Institutions

We share necessary information with banks and financial institutions to verify and link external bank accounts, process electronic fund transfers, and reconcile transactions and resolve disputes.

7.4 International Transfers

Some of our service providers may be located outside of Canada. When we transfer personal information internationally, we ensure appropriate safeguards are in place.

7.5 Business Transfers

If Invincible Pay is involved in a merger, acquisition, asset sale, or bankruptcy proceeding, personal information may be transferred as part of that transaction.

7.6 With Your Consent

We may share your personal information with other third parties when you explicitly consent to such sharing.

Important: We never sell your personal information to third parties for their marketing purposes.

7.7 Mobile Information and SMS Opt-In Data

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above-listed categories of sharing exclude text messaging originator opt-in data and consent; this information will not be shared with, or sold to, any third parties.

Your phone number and SMS opt-in status may be shared only with our SMS delivery service providers, acting on our behalf and under contractual confidentiality obligations, solely to deliver the text messages you have requested (such as two-factor authentication passcodes and account notifications), and as required by law.

8. International Data Transfers

8.1 Transfers Outside Canada

While Invincible Pay is a Canadian company and our primary operations are in Canada, some of our service providers may store or process personal information in other countries, including the United States.

8.2 Safeguards for International Transfers

We implement appropriate safeguards for international data transfers, including: standard contractual clauses, data processing agreements, adequacy decisions, encryption, and access controls.

8.3 EU/EEA Residents

For residents of the European Union or European Economic Area, we comply with GDPR requirements for international transfers.

9. Your Rights and Choices

9.1 Access and Correction

You have the right to access, correct, and obtain information about how your data has been used and shared.

9.2 Data Deletion

You may request deletion of your personal information, subject to legal retention requirements (e.g., 5-year retention under AML regulations).

9.3 Consent Withdrawal

Where we rely on your consent, you may withdraw it at any time.

9.4 Data Portability

In certain circumstances, you have the right to receive your personal information in a structured, commonly used, and machine-readable format.

9.5 Object to Processing

You may object to processing based on legitimate interests or for direct marketing.

9.6 California Residents (CCPA)

California residents have additional rights under the CCPA, including: Right to Know, Right to Delete, Right to Opt-Out, Non-Discrimination, and the right to use an Authorized Agent.

9.7 How to Exercise Your Rights

Email our Privacy Officer at info@invinciblepay.com or submit a request through your account settings. We will respond within 30-45 days.

10. Data Retention

10.1 Retention Periods

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to comply with our legal obligations, and to enforce our agreements.

10.2 Specific Retention Requirements

10.3 Deletion and Anonymization

When retention is no longer necessary, personal information is securely deleted or destroyed. Information may be anonymized for statistical purposes.

11. Security of Personal Information

11.1 Our Security Commitment

Protecting your personal information is a top priority at Invincible Pay. We implement comprehensive technical, administrative, and physical safeguards to protect the confidentiality, integrity, and availability of your data.

11.2 Technical Safeguards

• Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
• Secure Infrastructure: Hosted in SOC 2-compliant data centres
• Firewalls and Intrusion Detection: Multi-layered network security
• Multi-Factor Authentication: Required for account access and sensitive operations
• Secure Development: Code reviews, vulnerability testing, and secure coding practices
• Data Minimization: We collect only what is necessary
• Tokenization: Sensitive payment data is tokenized to reduce exposure

11.3 Administrative Safeguards

• Role-based access controls with least-privilege principles
• Regular employee security awareness training
• Background checks for employees with access to personal information
• Confidentiality agreements for all staff and contractors
• Vendor risk management and due diligence
• Documented incident response plan

11.4 Physical Safeguards

• Secure data centres with 24/7 monitoring
• Restricted physical access with biometric controls
• Secure disposal of physical media and documents
• Environmental controls (fire suppression, climate control)

11.5 Data Breach Response

In the event of a data breach that poses a real risk of significant harm, we will:

• Investigate immediately and contain the breach
• Notify affected individuals as soon as feasible
• Notify regulatory authorities as required by law (including the Office of the Privacy Commissioner of Canada)
• Implement additional measures to prevent recurrence

11.6 Your Security Responsibilities

You play an important role in protecting your information. We recommend that you:

• Keep your password confidential and use a strong, unique password
• Enable multi-factor authentication on your account
• Do not share your login credentials with anyone
• Keep your contact information up to date
• Review your transaction history regularly
• Log out after using shared or public devices
• Report any suspicious activity to us immediately

12. Cookies and Tracking Technologies

12.1 What Are Cookies?

Cookies are small text files placed on your device when you visit our website or use our platform. They help us provide a better experience, maintain security, and understand how our services are used.

12.2 Types of Cookies We Use

12.3 Managing Cookie Preferences

You can manage your cookie preferences through your browser settings, your account preferences on our platform, or by using third-party opt-out tools. Note that disabling essential cookies may affect the functionality of our services.

12.4 Other Tracking Technologies

In addition to cookies, we may use other tracking technologies including web beacons, local storage, device fingerprinting, and software development kits (SDKs) in our mobile applications.

12.5 Do Not Track Signals

Our systems do not currently respond to "Do Not Track" browser signals. We will update this policy if we adopt a Do Not Track standard in the future.

13. Children's Privacy

Our services are intended for individuals who are 18 years of age or older. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at info@invinciblepay.com.

14. Third-Party Websites and Services

Our website may contain links to third-party websites, applications, or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services before providing them with your personal information.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Invincible Payment Systems Limited (Invincible Pay)

• Email: info@invinciblepay.com
• Phone: +1 (587) 288-5511
• Mailing Address: 200-4909 50 Street, Red Deer, Alberta, T4N 6X2, Canada

Response Timeline: We will acknowledge your request within 30 days. Complex requests may require up to 60 days, in which case we will notify you of the extension.

Filing Complaints

If you are not satisfied with our response to a privacy concern, you may file a complaint with the appropriate regulatory authority:

• Office of the Privacy Commissioner of Canada: www.priv.gc.ca, 1-800-282-1376
• Provincial Privacy Commissioners in your province of residence
• EU residents: Your local data protection authority
• California residents: The California Attorney General's office

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or business operations. Material changes will be communicated through email notification, a prominent notice on our platform, and an updated effective date at the top of this policy.

17. Glossary of Terms