1.Introduction and scope
This Privacy Notice (the “Notice”) describes the practices of Arc555 Limited, a corporation incorporated under the laws of the Province of Ontario, Canada, with its registered office at C6-80 Birmingham St, Toronto, Ontario, M8V 3W6, Canada (“Arc555”, “we”, “us” or “our”), with respect to the collection, use, disclosure, retention and protection of personal information obtained through this website (the “Website”) and in the course of our client onboarding, identity verification and due diligence processes, including through any online tools or other means that we make available for those purposes.
Arc555 is subject to, and this Notice is intended to comply with, the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”), including the ten fair information principles set out in Schedule 1 thereto.
For the purposes of PIPEDA, “personal information” means information about an identifiable individual. This Notice does not apply to information that has been irreversibly anonymised, nor to business contact information used solely for the purpose of communicating with an individual in relation to their employment, business or profession, to the extent exempted under PIPEDA.
2.Accountability
Arc555 is responsible for personal information under its control and has designated an individual responsible for overseeing compliance with this Notice and applicable privacy legislation (the “Privacy Officer”). The Privacy Officer may be contacted as set out in Section 10 below.
3.Personal information we collect
Information you provide. We collect personal information that you voluntarily submit through the Website or otherwise in connection with our services, including your name, business email address, organisation, telephone number (if provided) and the contents of any message or enquiry submitted through our contact form or by email. Where you apply to become, or act on behalf of, a client of Arc555, we also collect the identification and verification information required for client onboarding and due diligence, including your date of birth, residential address, nationality, occupation, government-issued identification documents and the information contained in them, images of such documents and of yourself used to verify your identity, and information regarding your organisation and its directors, officers, authorised signatories and beneficial owners. If you provide personal information about another individual, you confirm that you are authorised to do so and have made that individual aware of this Notice.
Information collected automatically. Our servers automatically record limited technical information when you visit the Website or use our online services, including your IP address, browser type and version, operating system, referring URLs, and the date, time and pages accessed. This information is used solely for the purposes described in Section 4.
We do not knowingly collect personal information from individuals under the age of majority, and the Website and our services are not directed at such individuals.
4.Purposes of collection, use and disclosure
We collect, use and disclose personal information only for the following identified purposes: (a) to respond to enquiries and correspond with you; (b) to assess, negotiate and administer prospective and existing business relationships, including client onboarding, identity verification and due diligence; (c) to comply with legal and regulatory obligations to which Arc555 is subject, including obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (Canada) (the “PCMLTFA”) and associated regulations administered by the Financial Transactions and Reports Analysis Centre of Canada (“FINTRAC”); (d) to maintain the security, integrity and performance of the Website, our online services and our systems; and (e) any other purpose to which you consent or which is otherwise permitted or required by law.
5.Consent
By submitting personal information through the Website or otherwise in connection with our services, you consent to its collection, use and disclosure in accordance with this Notice. Consent may be express or implied, as appropriate to the sensitivity of the information and your reasonable expectations. Where we collect sensitive personal information, including government-issued identification documents and images used to verify your identity, we will obtain your express consent. You may withdraw consent at any time, subject to legal, regulatory or contractual restrictions and reasonable notice, by contacting us as set out in Section 10; withdrawal of consent may affect our ability to respond to your enquiry, complete your onboarding or provide services.
We do not require consent where collection, use or disclosure without consent is permitted or required by law, including for the purposes of complying with the PCMLTFA, responding to lawful demands of regulators or law enforcement, or detecting and preventing fraud.
6.Limiting collection, disclosure and transfers
We limit the collection of personal information to that which is necessary for the purposes identified in this Notice, and we collect it by fair and lawful means.
We do not sell, rent or trade personal information. We disclose personal information only: (a) to service providers who process it on our behalf for the purposes described herein (including IT, hosting and security providers and identity verification, screening and due diligence providers), subject to contractual obligations of confidentiality and safeguarding consistent with this Notice; (b) to affiliates within our corporate group for the purposes described herein; (c) to regulators, law enforcement agencies, courts or other public authorities where required or permitted by law; and (d) in connection with a prospective or completed business transaction involving Arc555, subject to appropriate safeguards.
Personal information may be processed or stored outside the province or country in which it was collected, including outside Canada, and may be subject to access by authorities in those jurisdictions in accordance with local law. Where personal information is transferred to third-party service providers outside Canada, we use contractual and other means to ensure a comparable level of protection while the information is being processed.
7.Retention
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal, regulatory, tax, accounting or reporting requirements, or to establish, exercise or defend legal claims. Records collected or created in connection with obligations under the PCMLTFA are retained for a minimum of five (5) years, in accordance with that legislation. Personal information that is no longer required is securely destroyed, erased or anonymised.
8.Safeguards and accuracy
We protect personal information through physical, organisational and technological safeguards appropriate to its sensitivity, including access controls, encryption in transit and staff confidentiality obligations. In the event of a breach of security safeguards creating a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals, and maintain records of breaches, as required by PIPEDA.
We take reasonable steps to ensure that personal information is as accurate, complete and up to date as is necessary for the purposes for which it is used.
9.Your rights
Subject to applicable law, you have the right to: (a) request access to the personal information we hold about you and information about its use and disclosure; (b) request correction of inaccurate or incomplete personal information; and (c) withdraw consent as described in Section 5. We will respond to written requests within the time limits prescribed by applicable law. Certain exemptions may apply, in which case we will provide reasons for any refusal.
You have the right to challenge our compliance with this Notice by contacting the Privacy Officer, and to lodge a complaint with the Office of the Privacy Commissioner of Canada.
10.Contact and complaints
Questions, access or correction requests, complaints or other communications concerning this Notice or our handling of personal information should be directed to the Privacy Officer at: [email protected], or by post to Arc555 Limited, C6-80 Birmingham St, Toronto, Ontario, M8V 3W6, Canada.
11.Cookies
The Website uses only strictly necessary cookies that are required for its operation. Our online services, which may be hosted by service providers on our behalf, likewise use only cookies and similar technologies that are strictly necessary for their operation and security. We do not use analytics, advertising, profiling or other non-essential cookies, and, while we may use automated tools to assist in verifying identity documents, we do not make decisions producing legal or similarly significant effects based solely on automated processing.
12.Changes to this notice
We may amend this Notice from time to time to reflect changes in our practices or applicable law. The current version, together with its effective date, will be posted on the Website. Material changes will be communicated by prominent notice on the Website. Your continued use of the Website or our services following the posting of an amended Notice constitutes acknowledgement of the amended terms.