Privacy Policy

Document owner: Compliance and the designated privacy function

About this Policy

1001148579 ONTARIO CORPORATION, trading as Altivest ("we", "us" or the "Company"), is a Canadian MSB registered with FINTRAC under C10001709 and is responsible for the Personal Information it handles in operating its website and fiat-to-cryptocurrency purchase service. This Policy explains what information we collect, why we use it, when it is shared, how it is protected and how you can exercise your privacy rights.

Our primary commercial focus is Canada. Customers obtain the service directly through our website, complete required onboarding, select cryptocurrency before fiat payment by bank transfer, and receive purchased cryptocurrency at their nominated external wallet after the required checks. We do not accept cash or card funding or customer cryptocurrency deposits, provide customer crypto custody or crypto-to-crypto exchange, or offer a facility for customers to sell cryptocurrency back to us.

This notice applies to website visitors, applicants, customers and relevant individuals connected to organizational customers. It is not a general employee privacy notice. Service eligibility is governed separately by our Terms and jurisdictional controls; this notice does not authorize service in any country.

1. Consent, Notification and Modification

1.1 Meaningful notice and consent

We handle Personal Information in accordance with applicable privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies. Other applicable privacy laws may provide additional requirements and rights. The EU General Data Protection Regulation (GDPR) is addressed only where it applies to the relevant processing; a customer-initiated relationship is not itself a privacy-law exemption.

Before or when information is collected, we explain the relevant purpose, information, recipients and material consequences, using this Policy and additional notices where needed. We seek the appropriate form of consent when consent is required, including express consent for sensitive information where required. Merely visiting the website, accepting the Terms or acknowledging this Policy is not blanket consent to every use or disclosure.

Some collection, use, retention or disclosure is required or permitted by law without consent, including applicable financial-crime reporting and lawful investigations. We rely on those exceptions only within their legal scope. A privacy notice does not remove our responsibility to limit processing to appropriate, identified purposes.

1.2 Necessary information and your choices

Identity and eligibility checks are required before customers may transact. We obtain proof of address for every customer under our Company standard, and additional source-of-funds or source-of-wealth evidence where required by risk or applicable obligations. If required information cannot lawfully be obtained or verified, we may be unable to open, continue or complete the relevant service. Not every document we request is independently mandated by a particular statute; some requests implement our risk-based controls.

You can contact us to withdraw consent for processing that relies on consent, subject to applicable legal or contractual restrictions and reasonable notice. We will explain the effect on the service. Withdrawal does not undo prior lawful processing, remove a mandatory retention obligation or automatically require deletion of every record. We will consider whether a lawful alternative is available where necessary verification is affected.

1.3 Optional communications and information about other people

Where optional promotional messages are offered, you can decline or unsubscribe through the message or our privacy contact. Required service, security and compliance communications are separate. An unsubscribe request for commercial electronic messages is actioned within the applicable period, no later than ten business days where Canada's anti-spam rules apply. Privacy consent does not override our restrictions on active EU solicitation.

When you provide information about a director, beneficial owner, representative, joint account holder or another individual for a legitimate purpose, provide the notice and obtain the permission that the law requires, or identify the other lawful basis for doing so. This does not transfer our own privacy responsibilities to you or authorize prohibited third-party transactions.

Changes to this Policy follow Section 5. Continued use is not treated as a substitute for renewed consent where the law requires it. Privacy requests and complaints are explained in Section 6.

2. Collection and Receipt of Information

"Personal Information" means information about an identifiable individual. It may identify someone directly or when combined with other information. Wallet addresses, transaction references, device information and screening results can be Personal Information when linked or reasonably linkable to a person.

2.1 Information relevant to the service

We limit collection to information reasonably necessary for the identified purpose. The categories below apply according to your interaction with us, the customer type and the checks required; a website visitor is not asked for an entire customer file simply to read the site.

We do not ask you to send staff your password, one-time authentication code, wallet private key or seed phrase. Do not submit unrelated sensitive material. Where a source document contains information about others or unrelated matters, ask us about permitted redaction; do not alter evidence needed for verification or investigation.

2.2 Identity verification and biometric information

Our Sumsub-supported workflow uses government-issued photo identification and selfie/liveness checks to authenticate the document and compare it with the person completing onboarding. Depending on the configured process, this can involve facial measurements or a biometric template for identity verification and fraud prevention. The verification notice explains the specific processing and provider role before the check occurs.

We treat biometric information as sensitive. Where consent is the applicable basis, we obtain the required express consent before sensitive biometric processing and explain the purpose, material consequences, retention and any available alternative. You may contact us about an alternative verification method; we cannot promise an alternative that does not satisfy the applicable requirements. Biometric verification is not authorization for unrelated profiling or advertising.

Required verification evidence is retained under Section 3.5. Raw samples and biometric templates must have a necessary, documented retention period; the existence of a five-year AML recordkeeping rule does not automatically require every raw biometric item to be kept for the same period.

2.3 Sources of information

Information is obtained from you through the website, onboarding workflow and communications; from authorized organizational representatives; from approved banking or settlement counterparties; and from identity, screening and blockchain-analysis providers. Relevant lawful public sources can include corporate registers, sanctions lists and publicly accessible blockchain records. Public accessibility does not remove applicable privacy restrictions.

We may receive information needed to investigate an incident or respond to a lawful authority request. We assess relevance, accuracy and lawful authority before using it. You may ask about the sources and recipients of your information, subject to applicable disclosure restrictions.

2.4 Cookies and similar technologies

The website may use cookies or similar technologies for sessions, authentication, security and necessary functionality. These usually work through identifiers or tokens; this notice does not authorize storage of readable passwords in cookies. Cookie and device information is not automatically anonymous.

Any optional analytics or advertising technologies require purpose-specific notice and the choice or consent required by law before use. You can use available browser controls to block or remove cookies, although necessary website functions may be affected. Contact us for information about the technologies currently used and available choices.

2.5 Screening technology and human review

Automated tools support document checks, liveness, screening and risk analysis. Their outputs may prompt further evidence requests, a pause or Compliance review. The Company remains responsible for decisions; a provider result does not resolve every concern. You may ask for review of an apparent error or adverse result. Any legally required explanation or safeguard for automated decision-making applies; restricted investigation details may not be disclosable.

3. Use and Disclosure of Personal Information

3.1 Why we use the information

We use relevant information to manage onboarding and customer records; assess identity, authority and eligibility; process the requested fiat-funded purchase and external-wallet settlement; provide support and handle complaints; detect and investigate fraud, account takeover, money laundering, terrorist financing and sanctions evasion; keep required records and submit legally required reports; and respond to lawful requests.

We also use information where lawfully necessary to enforce the Terms, resolve disputes, protect rights or property, and maintain and improve the website's accuracy, reliability and security. New purposes or materially different disclosures require further notice and consent where required. Improvements are not blanket permission to reuse sensitive identification or biometric information.

3.2 Who receives information

We do not sell, rent or license your Personal Information. Access and disclosure are limited to the relevant purposes described here and applicable law. Recipients may include:

Providers processing information for us are subject to contractual or other safeguards, purpose and access restrictions, confidentiality and appropriate security. A bank, regulator or other recipient acting under its own legal responsibilities is not necessarily our processor; its separate obligations and privacy notice may also apply. We verify authority and scope before disclosures rather than treating every request as compulsory.

3.3 Blockchain settlement

A settlement broadcasts the relevant wallet addresses, asset/amount and transaction information to the selected network. On public blockchains this information can be visible worldwide, copied and retained by others. We cannot erase or rewrite an independently maintained public blockchain. We do not publish identity documents or private Travel Rule information on-chain. Public availability does not remove our duties for the linked records we control.

3.4 Cross-border processing

Information may be processed or accessed in Canada and in other countries through authorized personnel, service providers and financial counterparties. A Canadian company or a provider's head-office location does not mean all information stays in that country. Information abroad may be subject to access by courts, law-enforcement or national-security authorities under the laws of that jurisdiction.

We remain accountable for information processed on our behalf and use contractual or other measures to provide comparable protection, including appropriate purpose, access, security and retention controls. Foreign laws cannot be overridden by contract. You can contact us for information about relevant international processing arrangements and safeguards, subject to lawful confidentiality limits.

3.5 Retention and disposal

We keep Personal Information for identified service, compliance, fraud-prevention, dispute and legal purposes, and not indefinitely merely because storage is possible. The applicable record category, legal minimum, continuing necessity and any legal hold determine the period. Information used to make a decision is kept long enough to permit applicable access and challenge rights.

Prescribed AML records generally require at least five years, with different start events. Exchange and transfer records generally run from creation; required report copies follow their applicable report-specific period; prescribed entity service-agreement records run from the last transaction. Our Company standard keeps necessary relationship-supporting verification, risk and investigation evidence at least five years after the later of creation or the last relationship transaction, subject to applicable law. This is not a statement that every website log or biometric template must be retained on that basis.

Unsuccessful applications, enquiries, optional cookie data and other non-prescribed information follow a purpose-specific schedule based on necessity, disputes, fraud risks and applicable obligations. Records subject to an access request or legal hold are preserved as required. When information is no longer needed and no retention duty remains, we securely delete it or irreversibly anonymize it; provider copies and backups are addressed through the applicable deletion and recovery arrangements.

Truly anonymized or aggregated information is used only where individuals cannot reasonably be identified. Replacing a name with a reference number is not necessarily anonymization. We do not use an "anonymous" label to bypass protections for identifiable information.

3.6 Additional requirements where GDPR applies

GDPR applicability is assessed separately from permission to provide cryptocurrency services. Where it applies, the processing must have an appropriate legal basis and the required transparency information must be provided. Depending on the activity, this can involve a requested contract, consent, appropriately balanced legitimate interests in security/fraud prevention, or a qualifying legal obligation. Canadian AML law alone is not automatically a GDPR Article 6(1)(c) basis.

Biometric identification and criminal-offence information require their additional legal conditions. Transfers subject to GDPR require an applicable transfer mechanism and information about safeguards; consent to the Terms is not a universal transfer authorization. Relevant processing-specific notices supplement this Policy where required. Rights and contact routes are in Section 6.

4. Security

4.1 Safeguards and staff access

We use reasonable organizational, physical and technical safeguards appropriate to the sensitivity of the information to reduce risks of loss, theft, misuse, unauthorized access, disclosure, alteration or destruction. These include role-based access, confidentiality requirements, appropriate authentication, protected storage and transmission, and review of security incidents and provider arrangements. Controls must reflect the systems actually in use; this notice is not a claim of a particular certification or a guarantee against every attack.

Access to identity documents, source evidence and investigation records is limited to authorized people with a relevant need. Required provider-held evidence remains retrievable for lawful compliance and access purposes. Formal staff refresher training is once a year, with new-hire induction and necessary event-driven instructions separately, consistent with the Company's compliance program.

No system can guarantee absolute security. This does not limit our legal responsibilities or your statutory rights. Protect your credentials, use the available authentication controls and contact us promptly about suspected account compromise. Do not send identity documents or wallet secrets through unapproved channels; ask for the appropriate secure process.

4.2 Personal-information incidents

Suspected privacy or security incidents are escalated to the responsible privacy, Compliance and technical functions for containment, investigation and assessment. Where PIPEDA applies and a breach creates a real risk of significant harm, we report to the Privacy Commissioner of Canada and notify affected individuals as soon as feasible. We also notify other organizations or authorities where required to reduce or mitigate harm.

We record every breach of security safeguards covered by PIPEDA, including cases not requiring notification. Those breach records are retained for at least 24 months from determining that the breach occurred; longer applicable evidence periods or legal holds remain separate. Other applicable privacy laws may require different notices or deadlines. Confidentiality of an AML or fraud investigation does not by itself cancel a mandatory privacy notification.

5. Changes to this Privacy Policy

We maintain a version history and publish the effective date of each approved notice. For ordinary material changes, we retain the original advance-notice approach: the change will ordinarily take effect no earlier than 15 days after the updated notice is posted, with direct notice where appropriate or legally required.

A shorter period may be necessary for a legal requirement or urgent security protection; we explain the change and provide notice as required. Where a new use or disclosure requires fresh consent, we obtain it before that processing starts. Posting an update or continuing to use the website is not a substitute for legally required consent, nor does a new version retrospectively authorize previously unlawful processing.

We review this Policy at least annually and when material practices or laws change.

6. Privacy Officer and Data Protection Contact

The Company is accountable for its privacy practices. Send privacy questions, requests and complaints to the designated privacy contact through Compliance:

Request the current postal contact or details of the person responsible for privacy through the primary email. Any formally appointed Data Protection Officer or required representative will be identified through the applicable contact notice. Referring a request to Compliance does not waive your rights or make you responsible for identifying the correct legal role.

6.1 Access, correction and consent requests

You may ask whether we hold Personal Information about you, request access, ask how it has been used and to whom it has been disclosed, and challenge inaccurate or incomplete information. You may also ask about deletion, retention or withdrawal of consent. We assess the request under the applicable law; deletion is not automatic where a valid legal or necessary retention purpose remains.

Describe the information or issue and provide a means of responding. We may request proportionate evidence of identity or representative authority to prevent unauthorized disclosure, and use it for that purpose. We help clarify a request where needed; we do not require you to know a particular legal citation.

For PIPEDA access requests, we respond within 30 calendar days, subject only to a lawful extension and required notice. Access is provided at minimal or no cost; any lawful charge is explained in advance. Where an error is established, we correct or annotate the record and communicate the correction to relevant recipients where appropriate. If a disagreement remains, it is recorded.

6.2 Lawful restrictions and further rights

Access may be limited where the law requires or permits it, including protection of another person's information, legal privilege or specified investigation/disclosure restrictions. We provide severable information where required and explain a refusal and available recourse unless the law restricts that explanation. An internal confidentiality label is not, by itself, a legal reason to refuse an otherwise valid request.

Where GDPR applies, applicable rights can also include erasure, restriction, portability, objection and safeguards for certain solely automated decisions. Requests are generally answered within one month; lawful extensions are explained within that period. Rights depend on the processing and legal basis. Withdrawal of consent does not affect prior lawful processing. Contact us to exercise the applicable rights or request relevant safeguards information.

6.3 Complaints and regulators

We investigate privacy complaints and respond with the outcome and available next steps. You may complain to the Office of the Privacy Commissioner of Canada or another competent privacy authority; you need not give up that right by using our service. Where GDPR applies, you may complain to the competent supervisory authority, including in your habitual residence, workplace or the place of the alleged infringement.

Office of the Privacy Commissioner of Canada: 1-800-282-1376. Information about privacy rights and complaints is available through its official website. Our privacy contact can help identify the appropriate route. You may request a copy of this Policy in an accessible format.