This Privacy Policy explains how ComplyFactor collects, uses, discloses and protects personal information through complyfactor.com, our live chat, marketing emails, enquiry and scoping process, and our Platforms (ComplyFactor OS, the FINTRAC reporting platform, the training platform and AI-enabled tools). It is written to meet Canada's PIPEDA, Quebec's Law 25, the UK GDPR and Data Protection Act 2018, and Canada's Anti-Spam Legislation (CASL).
1.1 The controller (or organization accountable) for your personal information is:
1.2 Our Privacy Officer is responsible for this policy and for our compliance with privacy law: Mehak Tariq, Privacy Officer, privacy@complyfactor.com.
1.3 Platform data is different. When our clients upload information to a Platform (for example their customers' identity documents or transaction data), the client is the controller and we process that information only on its instructions. Questions about it should go to that client first. Sections 2 to 4 describe information we control ourselves.
1.4 Regulatory reports. Our FINTRAC reporting platform processes personal information about individuals and entities who are the subjects of reports our clients make to FINTRAC, including suspicious transaction reports. That information belongs to, and is controlled by, the client that is the reporting entity. We process it only to prepare, validate, transmit and store reports on that client's instructions, and we never use it for our own purposes. We do not confirm or deny to anyone, other than FINTRAC or as required by law, whether a report about a person exists. If you think a report concerns you, contact the reporting entity directly. Access requests involving information disclosed to FINTRAC are subject to special rules under PIPEDA, which may require the reporting entity to consult FINTRAC and may result in the request being refused.
2.1 Information about other people. If you give us information about another person (for example a director or beneficial owner), you must make sure you are entitled to share it and that they know about this policy.
2.2 Information we don't want. Please do not send us sensitive personal information (such as health information) or suspicious transaction report content through the Website, chat or enquiry forms.
2.3 Public sources. We may obtain information from public registers (FINTRAC's MSB registry, the Bank of Canada PSP registry, corporate registries, Companies House), professional networking sites and adverse-media sources. We use it to verify prospective clients and to meet our own due diligence obligations.
2.4 Automated decisions. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Where AI tools support our work, a person reviews the result.
3.1 Where we rely on legitimate interests, those interests are: responding to and converting business enquiries; running and improving our business; securing our systems; meeting professional independence and conflict obligations; and defending legal claims. We balance these against your rights, and you can object at any time (section 9).
4.1 We do not sell personal information, and we do not share it for third parties' own marketing.
4.2 We share personal information only with:
5.1 We operate from Canada, the United Kingdom and the United Arab Emirates. Our Platforms are hosted in Canada and the United States, and our other service providers store and process information mainly in Canada, the United States, the UK and the European Union. Your information may therefore be processed outside your province or country, and may be accessible to courts and authorities there under local law.
5.2 Before transferring information outside Quebec, we assess whether it will be adequately protected, as Law 25 requires. For transfers from the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. You can ask for more detail by contacting our Privacy Officer.
6.1 We may keep information longer where needed to meet a legal obligation or to establish or defend a legal claim. At the end of the retention period, we securely delete or anonymize it.
7.1 We protect personal information with safeguards suited to its sensitivity. These include encryption in transit and at rest, access controls with multi-factor authentication, least-privilege access, logging, confidentiality agreements and staff training. No system is completely secure, and you share information at your own risk.
7.2 If a breach of security safeguards creates a real risk of significant harm (Canada), or a risk of serious injury (Quebec), or a risk to your rights and freedoms (UK), we will notify you and the relevant authority as the law requires. In the UK, that includes notifying the ICO within 72 hours where required.
8.1 We use strictly necessary cookies to run the Website. We use analytics and advertising cookies and pixels only with your consent, which you give or refuse through our cookie banner. You can change your choice at any time via the "Cookie settings" link in the footer, or by blocking cookies in your browser. Blocking some cookies may affect how the Website works.
9.1 Depending on where you live, you may have the right to:
9.2 To make a request, email privacy@complyfactor.com. We may need to verify your identity. We respond within 30 days (Canada) or one month (UK), and tell you if we need longer as the law allows. We may decline a request where the law permits, for example where disclosure would reveal another person's information, confidential commercial information, or information relating to a legal or regulatory matter.
9.3 If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or the UK Information Commissioner's Office. We'd appreciate the chance to resolve your concern first.
10.1 We send commercial electronic messages only with your consent. That means express consent (for example, when you subscribe) or implied consent where CASL allows it: within 6 months of an enquiry you made, or 2 years of a purchase or engagement. Every message identifies us and includes a working unsubscribe link, and we action unsubscribes within 10 business days.
11.1 Our Services are for businesses and professionals. They are not directed at anyone under 18, and we do not knowingly collect their personal information.
12.1 We may update this policy. We will post the new version with its effective date, and notify you by email or in-product where a change is material.
Mehak Tariq, Privacy Officer, privacy@complyfactor.com
ComplyFactor Limited, 320 Matheson Boulevard West, Suite 211, Mississauga, Ontario L5R 3R1, Canada (principal office and mailing address); registered office 1025 King Street East, Suite 107 #1596, Cambridge, Ontario N3H 3P5, Canada
ComplyFactor Ltd, 167–169 Great Portland Street, London W1W 5PF, United Kingdom