Privacy Policy

FX Wallet Inc. ("FX Wallet," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, platform, and services (collectively, the "Services").

We are a registered Money Services Business (MSB) with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), registration number C100000126, and we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and all applicable Canadian privacy legislation.

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please do not use our Services.

We use your personal information for the following purposes:

• Service Delivery: To process transactions, manage your account, execute currency conversions, and facilitate domestic and international transfers.
• Regulatory Compliance: To comply with FINTRAC reporting obligations, anti-money laundering (AML) requirements, sanctions screening, and other legal obligations under Canadian law.
• Identity Verification: To verify your identity and conduct due diligence as required by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA).
• Fraud Prevention: To detect, investigate, and prevent fraudulent transactions and unauthorized access to your account.
• Communication: To send transaction confirmations, security alerts, service updates, and respond to your inquiries.
• Improvement: To analyze usage patterns, improve our Services, develop new features, and enhance user experience.
• Legal Proceedings: To establish, exercise, or defend legal claims as necessary.

We process your personal information on the following legal grounds:

• Contractual Necessity: Processing required to perform our agreement with you and deliver the Services.
• Legal Obligation: Processing required to comply with FINTRAC regulations, PCMLTFA, tax reporting, and other applicable laws.
• Legitimate Interest: Processing for fraud prevention, security, service improvement, and business operations, balanced against your privacy rights.
• Consent: Where required, we obtain your explicit consent for specific processing activities, such as marketing communications.

We may share your personal information with the following categories of recipients:

• Financial Institutions: Banks, payment processors, and correspondent institutions involved in executing your transactions.
• Regulatory Authorities: FINTRAC, the Canada Revenue Agency (CRA), and other government bodies as required by law, including suspicious transaction reports (STRs) and large cash transaction reports (LCTRs).
• Service Providers: Third-party vendors who assist with identity verification, fraud detection, cloud hosting, analytics, and customer support, under strict contractual obligations.
• Legal and Compliance: Law enforcement agencies, courts, or other parties when required by law, subpoena, or court order.
• Corporate Transactions: In connection with a merger, acquisition, or sale of assets, your information may be transferred to the successor entity.

We do not sell your personal information to third parties for marketing purposes.

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account Data: Retained for the duration of your account and for 7 years after account closure, as required by FINTRAC record-keeping obligations.
• Transaction Records: Retained for a minimum of 5 years from the date of the transaction, in compliance with PCMLTFA requirements.
• Identity Verification Records: Retained for 5 years after the last transaction or account closure, whichever is later.
• Marketing Preferences: Retained until you withdraw consent or opt out.

We implement industry-standard security measures to protect your personal information, including:

• 256-bit AES encryption for data at rest and TLS 1.3 for data in transit.
• AWS-hosted infrastructure designed to meet Canadian regulatory requirements.
• Multi-factor authentication and role-based access controls for internal systems.
• Regular penetration testing and vulnerability assessments.
• Strict internal controls and regular third-party security audits.

While we take all reasonable precautions, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

Under PIPEDA and applicable Canadian privacy laws, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Withdrawal of Consent: Withdraw consent for processing where consent is the legal basis, subject to legal or contractual restrictions.
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

To exercise any of these rights, please contact our Privacy Officer at [email protected]. We will respond to your request within 30 days.

Please note that certain information may be exempt from such requests under applicable law, particularly where retention is required for regulatory compliance (e.g., FINTRAC record-keeping obligations).

Your personal information may be processed or stored in jurisdictions outside of Canada, including the United States, where our service providers operate. When we transfer data internationally, we ensure appropriate safeguards are in place, including contractual data protection agreements that meet Canadian privacy standards.

Our Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected information from a person under 18, we will take steps to delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on our website and updating the "Effective" date. Your continued use of the Services after any changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, please contact: