2.1 Introduction
NEMOPAY GLOBAL CORP. (“NEMOPAY”, “we”, “us” or “our”) is a British Columbia company, registered with FINTRAC as a Money Services Business and with the Bank of Canada as a payment service provider. This Privacy Policy explains how NEMOPAY collects, uses, discloses, retains and protects personal information.
This policy applies to personal information about:
- individual clients, who are sole traders, freelancers and other individuals acting for business purposes;
- directors, officers, authorized persons and beneficial owners of business clients;
- beneficiaries of payments and USDT transfers made on a client’s instruction;
- visitors to the website nemopay.io; and
- anyone who contacts NEMOPAY.
NEMOPAY’s Head of Compliance is the person accountable for NEMOPAY’s compliance with privacy law and for this policy. Privacy questions and requests can be sent to compliance@nemopay.io.
2.2 Personal Information We Collect
NEMOPAY collects the following categories of personal information, depending on your relationship with us:
- Identity information: full legal name, date of birth, occupation or business activity, nationality, identification document details and copies of identification documents.
- Contact information: residential or business address, telephone number and email address.
- Corporate and ownership information: business registration details, corporate structure, information on directors, officers and authorized persons, beneficial ownership information, ownership percentages and nature of control.
- Payment information: bank account details used to fund payments and to receive refunds, payment instructions, supporting documents such as invoices and contracts, and records of payments and USDT sales.
- Beneficiary information: the name, address and bank account details of payment beneficiaries, and the name, address and wallet details of USDT beneficiaries.
- Wallet information: wallet addresses you nominate, evidence of your ownership of those wallets, and the results of blockchain analytics screening.
- Verification and screening information: information obtained through identity verification and through sanctions, politically exposed person and adverse media screening.
- Source of funds and source of wealth information, where required.
- Technical information: IP address, browser and device information collected by our website hosting provider in server logs, and the essential cookies described in the Cookie Policy. The website does not use analytics or advertising cookies.
- Correspondence: emails and other communications between you and NEMOPAY.
- Compliance information: information collected or generated in meeting NEMOPAY’s legal and regulatory obligations.
2.3 How We Collect Personal Information
- Directly from you during onboarding and when you send instructions or correspondence.
- From the business client you work for or own, where you are its director, officer, authorized person or beneficial owner.
- From our clients, where you are the beneficiary of a payment or USDT transfer.
- From identity verification, screening and blockchain analytics service providers.
- From public registers, company registries and other publicly available sources.
- From NEMOPAY’s banking partner and from other banks and virtual asset service providers involved in a payment or transfer.
- From our website hosting provider’s server logs.
The contact form on our website opens your own email program. The website does not store the content of your message.
2.4 Purposes for Which We Use Personal Information
- Onboarding clients and providing our services.
- Verifying identity, business information and beneficial ownership as required by anti-money laundering and anti-terrorist financing law.
- Processing, reviewing and sending payments and USDT transfers.
- Detecting, preventing and investigating fraud, money laundering, terrorist financing, sanctions evasion and other financial crime.
- Sanctions, politically exposed person and adverse media screening, and ongoing monitoring of business relationships.
- Meeting our legal and regulatory obligations, including those under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (“PCMLTFA”), the Retail Payment Activities Act (“RPAA”), sanctions laws and privacy law.
- Filing reports with FINTRAC and other competent authorities where required by law.
- Answering enquiries, information requests from our banking partner and complaints.
- Protecting the security of NEMOPAY’s operations.
- Keeping records as required by law.
NEMOPAY does not use personal information for marketing profiles and does not make decisions about you based solely on automated processing.
2.5 Consent, Legal Requirements and Disclosure
NEMOPAY collects, uses and discloses personal information with your consent, which you give when you apply for or use our services, or as required or permitted by law. Some collection, use and disclosure is required by law. In particular, Canadian anti-money laundering law requires NEMOPAY to verify identity, keep records and report certain transactions to FINTRAC, and Canadian privacy law permits this without consent.
NEMOPAY discloses personal information only as needed for the purposes in section 2.4, to:
- NEMOPAY’s banking partner, which receives client and beneficiary information in payment messages and in response to its information requests.
- Banks that receive or send a payment, and virtual asset service providers that receive a USDT transfer, as required to make the payment or transfer and to meet travel rule obligations.
- Service providers engaged by NEMOPAY for identity verification, screening, blockchain analytics, travel rule messaging, wallet security, email and website hosting, under written contracts that require them to protect the information and to use it only for NEMOPAY’s purposes.
- FINTRAC, the Bank of Canada and other authorities where the law requires it.
- Law enforcement agencies and courts, only where the law requires it or where the request is made with lawful authority. NEMOPAY checks the authority for each request and keeps a record of each such disclosure.
- Legal advisers, accountants and the independent reviewer of NEMOPAY’s compliance program, under confidentiality obligations.
NEMOPAY does not sell, rent or trade personal information.
2.6 Canadian Privacy Law
NEMOPAY is subject to the Personal Information Protection and Electronic Documents Act (“PIPEDA”) for personal information it collects, uses or discloses in the course of commercial activities across provincial or national borders. The British Columbia Personal Information Protection Act (“BC PIPA”) applies where it governs NEMOPAY’s handling of personal information within British Columbia and information about its employees.
In accordance with these laws, NEMOPAY:
- Collects only the personal information needed for the purposes it has identified.
- Tells individuals why their information is collected and obtains consent where the law requires it.
- Protects personal information with safeguards appropriate to its sensitivity.
- Retains personal information only as long as needed for the identified purposes and to meet legal requirements.
- Gives individuals access to their personal information and the ability to correct it, subject to the limits set by law.
2.7 Processing Outside Canada
NEMOPAY is a small company whose people and service providers work from more than one country. Personal information is processed in the following places:
| Country or region | Processing |
|---|---|
| Canada | NEMOPAY’s registered office, compliance records and reporting to Canadian authorities |
| Poland | NEMOPAY’s Head of Compliance works from Warsaw and reviews client files, payments and USDT sales |
| United Kingdom | NEMOPAY’s Director lives in the United Kingdom and initiates payments and USDT transfers |
| European Union | NEMOPAY’s website is hosted in a European Union data centre; NEMOPAY’s banking partner and service providers may process information in the European Union |
Payment and transfer information also travels to the bank or virtual asset service provider of the beneficiary, wherever it is located. Before NEMOPAY sends personal information to a new service provider, it adds the country where that provider stores or processes the information to this section.
Personal information processed outside Canada is subject to the laws of the country where it is processed and may be accessed by the courts, law enforcement and national security authorities of that country. NEMOPAY uses contracts and other measures to protect personal information processed outside Canada at a level comparable to the protection it receives in Canada.
2.8 Retention
NEMOPAY retains personal information as long as needed for the purposes for which it was collected and to meet legal requirements:
- Client identification, beneficial ownership and business relationship records are retained for at least five years after the end of the business relationship or, where there is no business relationship, after the transaction concerned.
- Records of payments and USDT transfers are retained for at least five years from the date the record was created.
- Correspondence and complaint records are retained for the periods required by law and by NEMOPAY’s record keeping policies.
At the end of the retention period, personal information is securely destroyed or anonymized, unless the law requires NEMOPAY to keep it longer, for example because of a legal proceeding.
2.9 Security
NEMOPAY protects personal information with measures proportionate to its size and to the sensitivity of the information, including access limited to the Director and the Head of Compliance, individual credentials for each person with access, and contractual security obligations on service providers. No method of electronic transmission or storage is completely secure.
NEMOPAY keeps a record of every breach of security safeguards involving personal information. Where a breach creates a real risk of significant harm to an individual, NEMOPAY reports it to the Office of the Privacy Commissioner of Canada and notifies the affected individuals, and any organization that may be able to reduce the risk of harm, as soon as feasible.
2.10 Your Privacy Rights
Subject to applicable law, you may:
- Request access to the personal information NEMOPAY has about you.
- Request correction of personal information that is inaccurate or incomplete.
- Withdraw consent, subject to legal and contractual limits. Withdrawing consent to information that the law requires NEMOPAY to collect means that NEMOPAY cannot provide services.
Send requests to compliance@nemopay.io. NEMOPAY verifies the identity of the person making a request before it answers. NEMOPAY responds within 30 days. Where more time is needed, NEMOPAY tells you within those 30 days of the extension, which will not exceed a further 30 days, and of your right to complain to the privacy regulator.
Access may be limited where the law requires or permits it, for example where information relates to another person, is protected by legal privilege, or relates to a report made under anti-money laundering law. In some cases the law does not allow NEMOPAY to give access to information or to explain why access is refused.
2.11 Rights of Individuals in the European Union and European Economic Area
If you are in the European Union or the European Economic Area and the EU General Data Protection Regulation (“GDPR”) applies to our processing of your personal data, NEMOPAY processes your personal data on the following grounds: the performance of a contract with you or with the business you represent; NEMOPAY’s legitimate interests in preventing financial crime and in meeting its obligations under Canadian law and to its banking partner; compliance with legal obligations under EU or Member State law, where they apply; and your consent, where we ask for it.
Under the GDPR you have the right to:
- access your personal data and receive a copy of it;
- have inaccurate personal data rectified;
- have your personal data erased, where there is no legal reason for NEMOPAY to keep it;
- restrict processing in certain circumstances;
- object to processing based on legitimate interests;
- receive personal data you provided in a portable format, where processing is based on consent or contract and is carried out by automated means;
- withdraw consent at any time, where processing is based on consent; and
- lodge a complaint with the data protection supervisory authority in the EU or EEA country where you live or work, or where you believe an infringement took place.
Personal data that anti-money laundering law requires NEMOPAY to keep cannot be erased before the end of the legal retention period.
Canada is covered by an adequacy decision of the European Commission for organizations subject to PIPEDA, and the United Kingdom is also covered by an adequacy decision. Where personal data of individuals in the EU or EEA is transferred to another country outside the EU or EEA, NEMOPAY relies on an adequacy decision where one applies or uses safeguards recognized by the GDPR, such as standard contractual clauses.
Send GDPR requests to compliance@nemopay.io. NEMOPAY responds within one month, which may be extended by up to two further months for complex requests, in which case NEMOPAY tells you within the first month.
2.12 Privacy Complaints
If you have a concern about NEMOPAY’s handling of your personal information, please contact the Head of Compliance at compliance@nemopay.io first. If your concern is not resolved, you may contact:
- the Office of the Privacy Commissioner of Canada (“OPC”): www.priv.gc.ca;
- the Office of the Information and Privacy Commissioner for British Columbia (“OIPC BC”), where BC PIPA applies: www.oipc.bc.ca; or
- if you are in the EU or EEA, the data protection supervisory authority of your country.
2.13 Changes to This Policy
NEMOPAY may update this Privacy Policy. The current version is published on the website with its date. NEMOPAY notifies clients by email of material changes before they take effect. Where a change involves a new purpose that requires consent, NEMOPAY asks for consent before using personal information for that purpose.
2.14 Contact
| Field | Value |
|---|---|
| Accountable person | Head of Compliance, NEMOPAY GLOBAL CORP. |
| Privacy contact | compliance@nemopay.io |
| Address | NEMOPAY GLOBAL CORP., 1100 W 73rd Ave, Vancouver, BC V6P 6G5, Canada |