Privacy Policy

Depending on how you interact with us and the Services you request, we may collect the following categories of personal information.

We may collect personal information:

• Directly from you;
• From a company, merchant, or organization for which you act;
• From account holders, senders, recipients, beneficiaries, or transaction counterparties;
• From identity-verification and compliance service providers;
• From banks, payment processors, payment networks, foreign-exchange providers, and other financial institutions;
• From fraud-prevention and cybersecurity providers;
• From government agencies, corporate registries, sanctions lists, and publicly available sources;
• From professional advisers or commercial partners;
• Through cookies and similar technologies;
• Automatically when you access or use the Services.

Where another person provides us with your personal information, that person is responsible for having the authority to provide it to us, unless the collection is otherwise permitted or required by law.

We may collect, use, and disclose personal information for the following purposes:

• Creating, reviewing, and administering user or business accounts;
• Verifying identities and business information;
• Providing payment, collection, settlement, foreign-exchange, or related services;
• Executing, processing, and reconciling transactions;
• Communicating with users about their accounts or transactions;
• Providing customer support;
• Assessing applications and determining eligibility for Services;
• Conducting customer due diligence and enhanced due diligence;
• Screening for sanctions, politically exposed persons, and adverse media;
• Preventing, detecting, and investigating fraud, money laundering, terrorist financing, unauthorized activity, and other financial crime;
• Monitoring transactions and account activity;
• Complying with legal, regulatory, tax, accounting, reporting, and record-keeping obligations;
• Responding to lawful requests from regulators, courts, law-enforcement agencies, or government authorities;
• Managing operational, financial, compliance, and security risks;
• Securing and protecting our systems, accounts, and Services;
• Investigating disputes, complaints, errors, and suspected violations of our agreements;
• Enforcing our Terms and Conditions and other agreements;
• Improving, testing, and developing our Services;
• Conducting internal analytics, audits, and business planning;
• Managing relationships with banks, payment networks, service providers, and commercial partners;
• Sending service announcements and administrative communications;
• Sending marketing communications where permitted by law;
• Managing corporate transactions, financing, restructuring, or the sale of all or part of our business;
• Fulfilling other purposes that are disclosed to you and permitted by law.

We will limit the collection, use, and disclosure of personal information to purposes that a reasonable person would consider appropriate in the circumstances.

We obtain consent to collect, use, or disclose personal information where consent is required by law.

Consent may be express or implied depending on:

• The sensitivity of the information;
• The purpose for which it is collected, used, or disclosed;
• Your reasonable expectations; and
• The circumstances in which the information is provided.

By voluntarily providing personal information to us for an identified purpose, you consent to its collection, use, and disclosure for that purpose.

We may process personal information without consent where permitted or required by applicable law, including for legal compliance, fraud prevention, investigations, emergencies, debt collection, business transactions, or responses to lawful government requests.

You may withdraw your consent by contacting us, subject to reasonable notice and any legal, regulatory, contractual, or operational restrictions. Withdrawal of consent may prevent us from providing some or all of the Services.

We will explain the likely consequences of withdrawing consent where appropriate.

We may use automated systems and third-party tools to assist with:

• Identity and document verification;
• Biometric or liveness verification;
• Fraud detection;
• Sanctions and politically exposed person screening;
• Transaction monitoring;
• Cybersecurity;
• Account-risk assessment; and
• Regulatory compliance.

These tools may generate verification results, alerts, scores, or risk indicators. Where appropriate, alerts or decisions may be reviewed by authorized personnel.

Automated results form only part of our overall compliance and risk-management processes and may result in requests for further information, transaction delays, account restrictions, or refusal of Services where permitted by law and our agreements.

We may disclose personal information to the following recipients where reasonably necessary for the purposes described in this Privacy Policy.

Our business, financial partners, and service providers may operate in Canada and other countries.

As a result, personal information may be transferred to, stored in, or processed in another Canadian province or outside Canada. When information is processed in another jurisdiction, it may be subject to that jurisdiction's laws and may be accessible to courts, regulators, law-enforcement agencies, or government authorities in accordance with local law.

We use contractual, technical, and organizational measures designed to protect personal information transferred to service providers or partners.

Further information about relevant international processing arrangements may be requested from our Privacy Officer.

Where permitted by applicable law, we may use your contact information to send information about our products, services, promotions, or business updates.

We will obtain consent where required and will identify Encompass-Pay in our commercial electronic communications.

You may unsubscribe from marketing communications at any time by:

• Using the unsubscribe mechanism included in the communication; or
• Contacting us at contact@encompass-pay.com.

Unsubscribing from marketing communications will not prevent us from sending essential account, security, transaction, compliance, or service-related communications.

We may use cookies, pixels, software development kits, and similar technologies to:

• Operate and secure the Services;
• Remember user preferences;
• Maintain user sessions;
• Understand how the Services are used;
• Diagnose technical issues;
• Measure performance;
• Prevent fraud; and
• Improve functionality and user experience.

Some cookies are essential for the Services to function. Other cookies may be managed through browser settings or any cookie-management tools made available through the Services.

Disabling certain cookies may affect the availability or functionality of parts of the Services.

We maintain reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the personal information under our control.

These safeguards may include:

• Access controls;
• User authentication;
• Encryption in transit and, where appropriate, at rest;
• Secure hosting;
• Network and system monitoring;
• Employee confidentiality obligations;
• Role-based access restrictions;
• Internal policies and procedures;
• Security testing;
• Vendor due diligence;
• Incident-response processes; and
• Secure deletion or destruction procedures.

No method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we take reasonable measures designed to protect personal information against unauthorized access, collection, use, disclosure, copying, modification, loss, or destruction.

You are responsible for protecting your login credentials and must notify us promptly if you believe that your account or information has been compromised.

We maintain procedures to identify, investigate, and respond to suspected or confirmed privacy and security incidents.

Where required by applicable law, we will notify affected individuals and the appropriate privacy regulator of a breach that creates a legally reportable risk of harm.

We may also notify financial institutions, payment networks, law-enforcement agencies, or other relevant parties where necessary to investigate, contain, or respond to an incident.

We take reasonable steps to ensure that personal information used to make a decision affecting an individual, or disclosed to another organization, is accurate and complete.

You are responsible for providing accurate and current information and for promptly notifying us when your information changes.

We may request updated documents or information from time to time to maintain accurate records and meet regulatory requirements.

We retain personal information only for as long as reasonably necessary to:

• Provide the Services;
• Complete transactions;
• Maintain business and financial records;
• Resolve disputes and complaints;
• Enforce agreements;
• Prevent fraud;
• Support audits and investigations; and
• Satisfy legal, accounting, tax, anti-money laundering, regulatory, and record-keeping obligations.

Different categories of information may be retained for different periods.

Where personal information has been used to make a decision that directly affects an individual, we will retain it for the minimum period required by applicable law so that the individual has a reasonable opportunity to request access.

When personal information is no longer required, we will securely destroy, delete, or anonymize it, subject to legal and technical limitations. Information may remain temporarily in secure backups or archives until it is deleted in accordance with our standard retention cycle.

Subject to applicable legal exceptions, you may request:

• Confirmation of whether we hold personal information about you;
• Access to personal information under our control;
• Information about how your personal information has been used;
• Information about the organizations to which it has been disclosed; and
• Correction of inaccurate or incomplete personal information.

Requests must be submitted in writing to contact@encompass-pay.com and should include sufficient details to allow us to identify you and the information requested.

We may request additional information to verify your identity before responding.

We will respond within the period required by applicable law. In certain circumstances, the response period may be extended, and we will notify you where required.

Access may be restricted where permitted or required by law, including where disclosure would:

• Reveal personal information about another individual;
• Reveal confidential commercial information;
• Compromise an investigation;
• Threaten an individual's safety;
• Disclose information protected by legal privilege; or
• Otherwise be prohibited by law.

Where we cannot correct information as requested, we may record or annotate the requested correction where required by law.

Questions, concerns, or complaints about this Privacy Policy or our handling of personal information should first be directed to our Privacy Officer at:

We will investigate privacy complaints and respond within a reasonable period.

Where you are not satisfied with our response, you may contact the privacy regulator with jurisdiction over the matter, which may include:

• The Office of the Information and Privacy Commissioner for British Columbia; or
• The Office of the Privacy Commissioner of Canada.

The Services may contain links to websites, platforms, or services operated by third parties.

We do not control and are not responsible for the privacy, security, or content practices of third-party services. This Privacy Policy does not apply to information collected independently by those third parties.

You should review the privacy policies of third-party services before providing personal information to them.

The Services are intended for individuals who have reached the age of majority in their province or territory of residence.

We do not knowingly collect personal information directly from children without appropriate authorization. If we become aware that personal information has been collected from a child contrary to applicable requirements, we will take reasonable steps to delete or otherwise appropriately handle the information.

We may expand, reorganize, finance, sell, or transfer all or part of our business or assets.

Personal information relevant to the affected business may be disclosed to prospective or completed transaction parties, advisers, and service providers, subject to appropriate confidentiality and privacy protections.

If a transaction is not completed, the receiving party will be required to return, destroy, or otherwise protect the information in accordance with applicable law and contractual obligations.

We may update this Privacy Policy from time to time to reflect changes to:

• Our Services;
• Our information-handling practices;
• Our business operations;
• Technology;
• Legal or regulatory requirements; or
• Security and compliance standards.

The updated Privacy Policy will be made available through the Services with a revised effective date.

Where changes are material, we may provide additional notice through the website, platform, email, or other appropriate means.

Continued use of the Services following an update constitutes acknowledgement of the revised Privacy Policy, subject to any consent requirements under applicable law.

This Privacy Policy and our handling of personal information are governed by the applicable laws of British Columbia and Canada.

Nothing in this section limits any privacy rights, remedies, or regulatory authority that apply under the laws of another province, territory, or jurisdiction.

For privacy questions, requests, or complaints, please contact: