Privacy Policy

1 Scope and Application

This Policy applies to personal information collected through the Site, through onboarding and know-your-business/know-your-customer ("KYB/KYC") processes, through our banking and payment partners, and through any other interaction you have with Polaris. It does not apply to third-party websites or services that may be linked from the Site, which are governed by their own privacy policies.

We process personal information in accordance with the British Columbia Personal Information Protection Act ("BC PIPA"), the Personal Information Protection and Electronic Documents Act ("PIPEDA"), where applicable, and other applicable Canadian privacy legislation, as well as applicable anti-money laundering and anti-terrorist financing ("AML/ATF") laws, including the Proceeds of Crime (Money Laundering) and Terrorist Financing Act ("PCMLTFA"), associated regulations and applicable FINTRAC requirements.

2 Information We Collect

2.1 Information you provide directly

We collect information you submit through the Site or during onboarding, which may include:

• Identification information, including full name, date of birth, nationality, government-issued identification and passport details, photographs and selfie verification images;
• Contact information, including business and personal address, email address and telephone number;
• Corporate and beneficial ownership information, including company name, registration number, articles of incorporation, registers of directors and shareholders, ultimate beneficial owner details and ownership structure;
• Financial information, including bank account details, source of funds and source of wealth documentation, transaction history and expected transaction volumes;
• Background and verification information, including proof of address, utility bills, employment or business background, CVs or other supporting documentation where required for due diligence purposes; and
• Correspondence you send us, including support enquiries and onboarding communications.

2.2 Information collected automatically

When you visit the Site, we and our service providers may automatically collect technical information such as IP address, browser type, device identifiers, operating system, referring URLs, pages viewed and timestamps, using cookies and similar technologies (see Section 8).

2.3 Information from third parties

We may receive personal information from identity verification providers, sanctions and politically exposed person ("PEP") screening providers, credit reference and adverse media databases, our banking and payment partners, corporate registries, and publicly available sources, for the purposes of identity verification, due diligence and regulatory compliance.

3 How We Use Personal Information

We use personal information for the following purposes:

• To provide, operate and maintain our money transmission, virtual asset exchange, and payment processing and settlement services;
• To carry out customer identification, KYC/KYB, enhanced due diligence, beneficial ownership verification, sanctions and PEP screening;
• To comply with FINTRAC requirements and applicable AML/ATF, tax and financial services laws, including transaction monitoring and suspicious transaction reporting;
• To assess and manage risk, prevent fraud, and detect and investigate unauthorised or illegal activity;
• To communicate with you regarding your account, onboarding status, transactions and service updates;
• To maintain, operate and improve the Site and our internal systems; and
• To comply with legal, regulatory and contractual obligations, and to respond to lawful requests from courts, regulators and law enforcement authorities.

4 Consent and Authority for Processing

We collect, use and disclose personal information with consent where required by applicable law. Depending on the circumstances and the sensitivity of the information, consent may be express or implied.

We may also collect, use or disclose personal information without consent where permitted or required by applicable law, including for purposes related to regulatory compliance, fraud prevention, investigations, legal proceedings, and compliance with applicable AML/ATF obligations.

Where consent is relied upon, you may withdraw your consent, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may affect our ability to provide certain services where the relevant personal information is necessary to provide those services or satisfy our legal or regulatory obligations.

5 Disclosure of Personal Information

We do not sell personal information. We may disclose personal information to:

• Regulatory and governmental authorities, including FINTRAC and other competent authorities, where required or permitted by law or pursuant to a lawful request;
• Banking partners, payment processors and settlement providers involved in providing or executing our services and transactions;
• Identity verification, sanctions screening, blockchain analytics and fraud prevention service providers engaged to support our compliance obligations;
• Professional advisers, including legal, audit and compliance consultants;
• Law enforcement agencies, courts or other third parties where disclosure is required or permitted by law, including where necessary to protect our rights or investigate suspected fraud or illegal activity; and
• A successor entity in connection with a merger, acquisition, reorganisation or sale of assets, subject to applicable legal requirements and appropriate confidentiality safeguards.

Service providers who process personal information on our behalf are required to protect such information appropriately and to process it only for authorised purposes.

6 International Data Transfers

Personal information may be transferred to, stored or processed in countries other than Canada or the country in which it was originally collected, including jurisdictions where our banking partners, payment processors or technology service providers operate.

Where personal information is transferred internationally, we take reasonable steps to ensure that it is handled in accordance with applicable privacy requirements and appropriate safeguards. Personal information processed in another jurisdiction may also be subject to the laws of that jurisdiction and may be accessible to courts, law enforcement or regulatory authorities in accordance with applicable local law.

7 Data Retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes described in this Policy and to satisfy applicable legal, regulatory, tax, contractual and record-keeping requirements.

Certain records relating to customer identification, transactions, business relationships and due diligence must be retained for periods prescribed by applicable AML/ATF legislation and FINTRAC requirements, which are generally at least five (5) years from the applicable statutory retention date. Different retention periods or commencement dates may apply depending on the type of record.

We may retain information for longer where required or permitted by applicable law, including where necessary in connection with legal proceedings, regulatory matters or investigations. When personal information is no longer required, we take reasonable steps to securely delete, destroy or anonymise it, as appropriate.

8 Cookies and Similar Technologies

The Site may use cookies and similar technologies to operate essential functions, remember preferences and analyse Site usage.

You can control cookies through your browser settings; however, disabling certain cookies may affect the functionality of the Site.

We do not use cookies to serve targeted third-party advertising.

9 Data Security

We maintain reasonable administrative, technical and organisational safeguards designed to protect personal information against unauthorised access, disclosure, alteration, loss, theft or misuse, having regard to the sensitivity of the information and other relevant circumstances.

These measures may include, as appropriate, access controls, encryption, secure communication channels, multi-factor authentication, monitoring and periodic review of security practices.

Although we take reasonable measures to protect personal information, no method of electronic transmission or storage is entirely secure, and we cannot guarantee absolute security.

10 Your Privacy Rights

Subject to applicable law, you may have the right to:

• Request access to personal information we hold about you;
• Request correction of inaccurate or incomplete personal information;
• Request deletion or disposal of personal information, where applicable and subject to our legal and regulatory retention obligations;
• Withdraw consent where our processing relies on consent, subject to applicable legal and contractual restrictions; and
• Make a complaint to the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Privacy Commissioner of Canada, or another competent privacy authority, as applicable.

To exercise your privacy rights, please contact us using the details in Section 13.

We may need to verify your identity before responding to a request. Certain requests may be restricted or refused where permitted or required by applicable law, including where we are required to retain information for AML/ATF, regulatory, legal or other compliance purposes.

11 Children's Privacy

The Site and our services are intended for businesses and individuals who are at least 18 years of age. Our services are not directed to children, and we do not knowingly collect personal information from children.

If we become aware that we have inadvertently collected personal information from a child, we will take appropriate steps to delete or otherwise handle that information in accordance with applicable law.

12 Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, services, legal or regulatory requirements.

The "Effective Date" at the top of this Policy indicates when it was last revised. We encourage you to review this Policy periodically. Where appropriate or required by applicable law, material changes will be communicated through the Site or by other appropriate means.

13 Contact Us

If you have questions, concerns or requests regarding this Privacy Policy or our handling of personal information, please contact us at: