Consumer Privacy Policy
1. Introduction
OTT Pay Inc. (“OTT Pay,” “we,” “us,” or “our”) is committed to protecting the privacy, confidentiality, integrity, and security of Personal Information entrusted to us in connection with the financial products and services we provide.
This Consumer Privacy Policy explains what Personal Information we collect, the purpose for which we collect, use, or disclose it, when we share it, how we protect it, how long we retain it, and the rights individuals may have in relation to that information.
This Policy applies to Personal Information collected, used, disclosed, stored, or otherwise processed by OTT Pay in connection with payment processing, electronic funds transfers, settlement services, fraud prevention, customer support, and related financial services.
In this Policy, “Personal Information” means any information that can be used to identify you directly or indirectly. For clarity, personal information does not include information that does not permit the direct or indirect identification of an individual (i.e. anonymized information).
2. What Personal Information We Collect and How We Collect It
The Personal Information we collect depends on the service being used and the nature of the transaction. We may collect the following categories of Personal Information:
- Identity and contact information, such as name, address, date of birth, email address, and telephone number.
- Financial and banking information, such as bank account information and transaction-related payment details.
- Transaction information, such as payment amount, date and time, currency, sender or recipient details, and transaction references.
- Technical and device information, such as Internet Protocol (IP) address, device type, operating system, browser type, and general location information associated with a transaction.
- Verification and compliance information, such as government-issued identification, occupation information, sanctions or fraud screening results, or other information required for identity verification, fraud prevention, or compliance with legal obligations.
- Customer support and communications information, such as support inquiries, complaint records, and call recordings where permitted by law.
- Limited information about other individuals involved in a transaction, where needed to complete that transaction.
We collect Personal Information using the following methods:
- Directly from you: when you register for an account, submit an application, complete a transaction, contact customer support, respond to surveys, or otherwise interact with us through our websites, mobile applications, or Services.
- Automatically: through your use of our systems or Services, including through cookies, web beacons, device identifiers, server logs, and similar technologies that collect information about your device, browser, IP address, location data, and interactions with our platforms.
- From third parties: in some cases, we may collect Personal Information from financial institution partners, identity verification providers, fraud prevention providers, credit bureaus, public sources, or other third parties involved in processing a transaction or providing Services to you.
3. How We Use Personal Information and Consent
OTT Pay uses Personal Information only for legitimate business, service, compliance, and security purposes connected to the Services, including:
- Providing and administering the Services: including account setup, transaction processing, customer onboarding, and ongoing service delivery.
- Processing transactions: including payments, transfers, settlements, and related financial transactions.
- Verifying identity and conducting due diligence: including customer identification, know-your-customer procedures, and related verification activities.
- Detecting and preventing fraud: including investigating unauthorized activity, security incidents, and other potentially harmful conduct.
- Complying with legal and regulatory obligations: including anti-money laundering requirements, record-keeping obligations, and regulatory reporting.
- Communicating with customers: including responding to inquiries, resolving disputes, and providing customer support.
- Improving our Services: including enhancing service delivery, system performance, and operational resilience.
As permitted by law, OTT Pay may use aggregated, anonymized, or de-identified information for analytical, operational, or service improvement purposes.
We may use automated decision-making tools to assess eligibility for Services and prevent and detect fraud. If OTT Pay makes a decision based exclusively on automated processing, we may notify you of the automated nature of the decision and explain how you may request further information or a review by an OTT Pay representative, and provide the relevant contact details, in accordance with applicable laws.
4. When We Share Personal Information
OTT Pay may share Personal Information where reasonably necessary to provide the Services, operate our business, protect our systems, or comply with legal obligations, including with:
- Financial service providers: including sponsoring financial institutions, payment processors, clearing and settlement partners, and other providers involved in processing transactions.
- Service providers: including providers that support cloud hosting, infrastructure, fraud monitoring, identity verification and “Know Your Client” requirements, customer support, analytics, communications, or operational services.
- Regulators and government authorities: including courts, law enforcement agencies, and other parties where disclosure is required or authorized by law.
- Other parties at your direction: including where you ask us to share information or where disclosure is necessary to complete a transaction you have initiated.
- Parties involved in corporate transactions: including a merger, acquisition, reorganization, sale of assets, or similar transactions.
5. International Transfers and Processing Locations
OTT Pay’s primary data processing infrastructure is located in Canada. However, some Personal Information may be stored, transferred, or processed outside Canada, including outside Quebec, where OTT Pay, its affiliates, or its third-party service providers operate.
This may include processing in the United States or in other jurisdictions used by OTT Pay’s technology, infrastructure, payment, fraud prevention, identity verification, or customer support providers.
Where Personal Information is stored or processed in another jurisdiction, it may be subject to the laws of that jurisdiction. As a result, courts, law enforcement agencies, regulators, or other statutory authorities in that jurisdiction may be able to access the Personal Information in accordance with local law.
OTT Pay provides this disclosure for transparency. Separate consent is not required solely because Personal Information may be processed outside Canada.
Where cross-border processing occurs, OTT Pay implements contractual, technical, and organizational safeguards designed to provide a level of protection appropriate to the sensitivity of the information and consistent with applicable privacy laws.
If you have questions regarding our use of service providers outside of Canada, please contact our Chief Privacy Officer using the information provided below.
6. Security of Personal Information
OTT Pay maintains administrative, technical, and physical safeguards designed to protect Personal Information against loss, theft, unauthorized access, disclosure, copying, use, or modification, throughout its lifecycle.
We implement the following measures to protect your Personal Information:
- Internal policies and procedures that define the roles and responsibilities of our employees, representatives, and service providers throughout the life cycle of personal information and limit their access to that information on a “need-to-know” basis;
- Incident management and breach response procedures.
- Physical, electronic and procedural safeguards that comply with relevant standards to protect personal information;
- If the information is collected or stored electronically, technical safeguards such as encryption, firewalls, passwords, anti-virus software and similar measures;
- A designated Chief Privacy Officer to monitor our compliance with applicable privacy laws;
- Procedures for receiving, investigating, and responding to complaints or inquiries about our information handling practices; and
- Service provider due diligence and contractual protections to ensure that service providers with whom we share personal information maintain adequate protections and security standards.
7. Retention of Personal Information
OTT Pay retains Personal Information only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal, regulatory, operational, and audit requirements.
Retention periods may vary depending on the type of information, the service provided, and applicable legal obligations. For example, certain client identification, customer due diligence, and transaction-related records may need to be retained for at least five (5) years under applicable anti-money laundering or financial services record-keeping requirements.
When Personal Information is no longer required, OTT Pay takes reasonable steps to securely delete, destroy or anonymize the information.
8. Accuracy and Your Privacy Rights
OTT Pay takes reasonable steps to help ensure that Personal Information it holds is as accurate, complete, and up to date as necessary for the purposes for which it is used. Individuals should notify OTT Pay if their Personal Information changes or if they believe information held by OTT Pay is inaccurate.
Subject to applicable law, you may have the following rights:
- Right to information: You have the right to ask us about our processing of your Personal Information, including about the categories of persons who have access to your Personal Information within our organization and the applicable retention period.
- Right to access: You have the right to access the Personal Information we hold about you. Depending on the laws applicable in the province or territory in which you reside, you may also have the right to ask us to communicate your Personal Information to you in a structured, commonly used technological format, or to a third party upon your request.
- Right to rectification: You have the right to request that any incomplete, outdated, or inaccurate Personal Information that we process about you is corrected.
- Right to withdraw consent: If we rely on your consent to process your Personal Information, you have the right to withdraw consent at any time, to the extent permitted by law and our contractual obligations. However, if you withdraw consent, you may no longer be able to benefit from our Services.
Requests may be submitted using the contact details in Section 9. OTT Pay may need to verify identity before responding to a request. Subject to applicable law and any permitted exceptions, OTT Pay will respond within 30 days or within any other timeframe required by law.
9. Contacting the Privacy Officer and Privacy Complaints
OTT Pay has designated a Chief Privacy Officer who is responsible for overseeing OTT Pay’s privacy program and responding to privacy-related questions, requests, and complaints.
Questions, access requests, correction requests, deletion requests, consent withdrawal requests, or privacy complaints may be sent to:
Chief Privacy Officer
OTT Pay Inc.
1123 Leslie Street North York, ON M3C 2K5 Canada
privacy@ott.ca
1-800-688-9838
10. Changes to This Policy
OTT Pay may update this Privacy Policy from time to time to reflect changes in law, guidance, technology, service delivery, or business operations. Where material changes are made, OTT Pay will provide notice through appropriate channels and will update the “Last Updated” date shown at the beginning of the Policy.
Individuals are encouraged to review this Privacy Policy periodically to remain informed about how OTT Pay protects Personal Information.