Privacy Policy

Emanita Payments Limited is a Money Services Business (MSB) registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), offering domestic and cross-border payment and money transfer services.

This Privacy Policy explains what personal information Emanita collects, why we collect it, how we use and protect it, and what rights you have. It applies to all customers, website visitors, and anyone whose personal information we handle in connection with our services.

1. Who We Are

We are Emanita Payments Limited ("Emanita", "eMANITA", "EMANITA", "eManita", "we", "our", or "us"), a Money Services Business (MSB) registered with FINTRAC, Canada's financial intelligence regulator. We offer domestic and cross-border money transfer and payment services to business clients across Canada and internationally.

We take your privacy seriously. This Privacy Policy explains in straightforward language how we handle your personal information - what we collect, why we need it, how we use it, who we share it with, and what choices you have.

This Policy applies Canada-wide and is designed to meet the requirements of the Personal Information Protection and Electronic Documents Act (PIPEDA), as well as provincial privacy laws in Quebec (Act Respecting the Protection of Personal Information in the Private Sector, also known as Law 25), Alberta, and British Columbia (each of which has legislation that is substantially similar to PIPEDA). Where Quebec's Law 25 is stricter, we follow that stricter standard for Quebec residents.

2. What Personal Information We Collect

Personal information means any information about an identifiable individual. The specific information we collect depends on who you are and how you use our services.

2.1 Information You Give Us

If you are an individual associated with a business client (for example, a director, officer, beneficial owner, or authorised representative):

• Full legal name
• Date of birth
• Home address
• Email address and phone number
• Government-issued photo identification (such as a passport, driver’s licence, or provincial ID card)
• Occupation
• Payment details (bank account information, debit or credit card details)
• Information about the source of your funds, when required for transactions above certain thresholds

If you are a business customer:

• Business name, registration number, certificate of incorporation, registered address and other required information
• Names, dates of birth, and identification for directors, officers, and anyone who owns or controls 25% or more of the business (its "beneficial owners")
• Business purpose and the nature of the transactions you expect to make
• Financial statements or other documents confirming the legitimacy of your business, where required

If you contact us or apply through our website:

• Contact form: your name, company, email address, and the content of your message;
• Merchant application form: your business details (registered and operating names, addresses, and the names of your ultimate beneficial owners), your company email address, and your company phone number. We verify your email address and phone number by sending a one-time code to each, with the phone code delivered by SMS; and
• Your IP address, recorded when you submit either form, for security and fraud prevention purposes.

2.2 Information We Generate or Collect Automatically

When you use our services or visit our website, we may also collect:

• Details of the transactions you make with us (amounts, dates, currencies, sender and recipient information)
• Records of communications between you and our team (emails, chat logs, phone call records)
• Device and browser information when you visit our website or complete our forms (see Section 8 on cookies)
• IP address and approximate location derived from your IP address
• Information collected by Cloudflare Turnstile, our human-verification tool, when you use forms such as "Contact Us" or "Open Merchant Account" (see Section 8.4)

2.3 Information from Third Parties

In limited circumstances, we may receive information about you from third parties, including:

• Identity verification and fraud prevention providers that help us confirm your identity documents are genuine
• Publicly available records (such as corporate registries or published sources) to confirm business information
• Our banking partners, where they provide information relevant to a transaction or a regulatory requirement

3. Why We Collect Your Information

We only collect personal information for specific, clear purposes. Here is a plain-language summary of why we need it:

3.1 Automated Screening and Decision-Making

We use automated tools to screen applications, accounts, and transactions against sanctions lists, politically exposed person (PEP) databases, and our own risk indicators, and to generate risk scores that help prioritise review. This processing is necessary for compliance with our legal obligations under the PCMLTFA and for fraud prevention. We do not make decisions about your eligibility for our services (such as approving, declining, or closing an account) based solely on automated processing: automated results are always reviewed by our compliance personnel, who make the final decision. If you are a Quebec resident and have questions about how automated processing is used in relation to your information, you may contact our Privacy Officer (see Section 11).

4. Our Legal Basis for Collecting Your Information

Under Canadian privacy law, we need a reason (called a "legal basis") to collect and use your personal information. Here are the bases we rely on:

4.1 Your Consent

For most of our services, we ask for your consent when you sign up. This consent covers the collection and use of your information to provide our services, verify your identity, and communicate with you about your account. You can withdraw your consent at any time - but please note that if you withdraw consent for information we are legally required to collect, we may not be able to continue providing services to you.

We also rely on your consent for optional activities like sending you marketing emails or newsletters. You can opt out of these at any time by clicking "unsubscribe" in any email or by contacting us (see Section 11).

4.2 Legal Obligation

Some of our data collection is not optional for us - it is required by law. The PCMLTFA and FINTRAC's regulations require us to:

• Verify the identity of every customer before providing services;
• Keep records of customer identity and transactions for a minimum of five years;
• Report certain types of transactions and suspicious activity to FINTRAC; and
• Screen customers against Canadian and international sanctions lists.

For these activities, the law - not your consent - is our authority to collect and use your information. Withdrawing consent does not remove these legal obligations from us or from you.

4.3 Legitimate Interests

In some situations, we collect and use personal information based on our legitimate business interests, where those interests are not outweighed by your privacy rights. For example, we use your transaction information to detect and prevent fraud, and we use website data (in aggregate) to improve our website. We do not use your personal information in ways that would surprise you or that you would reasonably object to.

5. Who We Share Your Information With

We do not sell your personal information. We share it only where necessary to provide our services, to comply with the law, or where you have given us your permission.

5.1 FINTRAC and Canadian Regulators

As a regulated business, we are required by law to share certain information with FINTRAC. This can include reports of large cash transactions, certain electronic funds transfers, and transactions that give us reason to suspect money laundering or terrorist financing. We do not notify you when we make a regulatory report, as the law prohibits us from doing so.

5.2 Law Enforcement and Government Authorities

We may share your information with the Royal Canadian Mounted Police (RCMP), the Canada Border Services Agency (CBSA), or other government authorities where we are required to do so by a court order, warrant, subpoena, or other lawful request. We review all such requests carefully before responding.

5.3 Banking Partners and Payment Networks

To process your transfers and payments, we work with banking partners and payment networks. Sharing your information with them is necessary to complete your transaction. These partners are subject to their own privacy and security obligations.

5.4 Service Providers Who Help Us Run Our Business

We use trusted third-party service providers to help us operate, including:

• Identity verification providers that confirm your documents are genuine;
• Compliance screening providers that help us meet our legal obligations to screen for sanctions and financial crime risk;
• Cloud and technology providers that host our systems and data securely;
• Customer support platforms that help our team assist you;
• Email delivery providers (Resend and AhaSend) that send verification codes and account-related emails on our behalf (see Section 8.4);
• SMS delivery providers (Twilio and Bird) that deliver verification codes to your mobile phone; and
• Cloudflare, which provides our website security and human-verification (Turnstile) technology (see Section 8.4).

We only share what is necessary, and we require all service providers to protect your information with appropriate security measures. They are not permitted to use your information for their own purposes.

5.5 Recipients of Your Transfers

When you send a money transfer, we share the necessary transaction information (such as your name and the transfer amount) with the institution or individual receiving the funds. This is required to complete your transaction.

5.6 International Data Transfers

Some of our service providers are located outside Canada. When your information is transferred internationally, we ensure it is protected by contractual safeguards that require the receiving party to treat it with a standard of care equivalent to Canadian privacy law. If you are a Quebec resident, please note that we conduct a privacy impact assessment before transferring your personal information outside Quebec, as required by Law 25.

6. How We Protect Your Information

We take the security of your personal information seriously and maintain a range of technical and organisational safeguards, including:

• Encryption of personal and financial data in transit and at rest;
• Access controls that limit who within Emanita can access your information, based on their role and need;
• Secure storage on password-protected and access-monitored systems;
• Staff training on privacy and data security obligations;
• Vendor due diligence to ensure third-party service providers maintain equivalent security standards; and
• Incident response procedures to detect, contain, and address security breaches promptly.

No method of electronic transmission or storage is 100% secure. While we work hard to protect your information, we cannot guarantee absolute security. If you believe your account or personal information has been compromised, please contact us immediately at info@emanitaglobal.com.

6.1 What Happens If There Is a Data Breach?

If a security incident occurs that involves your personal information and creates a real risk of significant harm, we are required under PIPEDA to notify the Office of the Privacy Commissioner of Canada (OPC) and to notify you directly as soon as feasible. We will tell you what happened, what information was involved, and what steps we are taking. Quebec residents have additional protections under Law 25, including mandatory notification timelines.

7. How Long We Keep Your Information

We only keep your personal information for as long as we need it. Our retention periods are determined by the purpose for which the information was collected and by our legal obligations.

When retention periods expire, we securely delete or anonymise your personal information so it can no longer be linked to you.

8. Cookies and Our Website

When you visit www.emanitaglobal.com (our website), we use cookies and similar technologies. This section explains what they are, what we use them for, and how you can control them.

8.1 What Are Cookies?

Cookies are small text files that websites place on your device. They help websites remember your preferences, understand how you use the site, and work properly. Some cookies are essential for the website to function; others are optional and help us improve your experience or measure how well our site is performing.

8.2 The Cookies We Use

8.3 Your Cookie Choices

When you first visit our website, a short cookie notice explains that we use only essential and security cookies. You can dismiss the notice with the "Got it" button, and your choice is remembered on your device. Because we do not use any optional cookies, the notice does not offer accept/decline options; if we add optional cookies in the future (for example, analytics), we will ask for your consent through a banner with accept/decline choices before they are set, as required by Quebec's Law 25 and other applicable laws.

Browser settings: You can also control or delete cookies through your browser settings. Instructions vary by browser; look for a "privacy" or "cookies" section in your browser's settings menu. Please note that blocking security cookies may prevent our forms from working.

8.4 Cloudflare Turnstile and Data Transfers

Turnstile is operated by Cloudflare, which may process the information it collects in the United States and other countries. It uses that information solely to determine whether a form submission comes from a real person rather than an automated bot. We never receive or store your browsing data from Cloudflare - only a pass/fail result for each form submission. For more information, see Cloudflare's Privacy Policy at www.cloudflare.com/privacypolicy/.

Our email and SMS delivery providers (Resend, AhaSend, Twilio, and Bird - see Section 5.4) may also process your email address, phone number, and message content outside Canada in order to deliver verification codes and account-related messages. We require these providers to protect your information with appropriate contractual safeguards, consistent with Section 5.6.

9. Your Privacy Rights

Canadian privacy law gives you rights over your personal information. Here is what you can do:

We try to respond to all access and correction requests within 30 days. If we need more time, we will let you know. There is no charge for most requests, but we may charge a reasonable fee for large or complex requests after notifying you in advance.

9.1 Limits on Access

In some circumstances, we may not be able to give you access to all of your information. For example, we may not be able to share information that could reveal confidential information about another person, information that is subject to legal privilege, or information related to a regulatory investigation or report filed with FINTRAC. Where we cannot provide access, we will tell you why (unless doing so would itself compromise an investigation).

10. Children and Our Services

Our services are intended for adults. We do not knowingly collect personal information from anyone under the age of 18. If you believe we have inadvertently collected information about a minor, please contact us immediately at info@emanitaglobal.com and we will delete it promptly.

11. How to Contact Our Privacy Officer

Our Privacy Officer is the person responsible for our compliance with this Privacy Policy and Canadian privacy law. The Privacy Officer role at Emanita is currently held by our Money Laundering Reporting Officer (MLRO).

If you have any questions, concerns, or requests relating to your personal information or this Privacy Policy, please get in touch:

We aim to acknowledge all privacy enquiries within 10 business days and resolve them within 30 days. For complex requests, we may take up to 60 days, and we will let you know if this applies to your request.

12. Making a Complaint

12.1 Start With Us

If you are unhappy with how we have handled your personal information, we encourage you to contact our Privacy Officer first (see Section 11). We take all complaints seriously and will investigate promptly. We will respond in writing with our findings and any steps we will take to resolve the matter.

12.2 Escalate to the OPC

If you are not satisfied with our response, or if you prefer to contact a regulator directly, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC):

• Website: www.priv.gc.ca
• Toll-free: 1-800-282-1376
• Mailing address: 30 Victoria Street, Gatineau, Quebec, K1A 1H3

The OPC can investigate complaints, recommend corrective action, and, where necessary, take Emanita to Federal Court if we fail to act on its findings.

12.3 Quebec Residents

Quebec residents may also file a complaint with the Commission d'accès à l'information (CAI), Quebec's provincial privacy authority:

• Website: www.cai.gouv.qc.ca
• Phone: 1-888-528-7741

Under Quebec's Law 25, you also have a private right of action - meaning you can sue Emanita directly in court for breaches of Quebec privacy law, without first going through the CAI. Minimum damages start at CAD $1,000 per individual affected.

12.4 Alberta and British Columbia Residents

Residents of Alberta and British Columbia may also contact the privacy commissioners for those provinces:

• Alberta: Office of the Information and Privacy Commissioner of Alberta - www.oipc.ab.ca
• British Columbia: Office of the Information and Privacy Commissioner for BC - www.oipc.bc.ca

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or privacy practices. When we make material changes, we will:

• Post the updated Policy on our website at www.emanitaglobal.com;
• Update the "Effective Date" at the top of the Policy; and
• Where required, notify you directly by email if the changes significantly affect how we use your personal information.

We encourage you to review this Policy periodically. Your continued use of our services after we post changes means you accept the updated Policy. If you do not agree with the changes, please stop using our services and contact us to close your account.

Glossary of Key Terms

We have tried to write this Policy in plain language, but here are definitions for a few terms we use: