Outline for counsel: the headings and the points each section must cover. The final wording needs legal drafting.
1. Who we are and who is responsible
YYGROUP EXCHANGE LTD.British Columbia company, incorporation no. BC1450942Registered with FINTRAC as a money services business, registration no. M24028670Business address on the FINTRAC registry: Długa 29, 02-004 Warsaw, PolandCorrespondence address: 5577 153A St, Surrey, BC V3S 5K7, Canada
- Person in charge of the protection of personal information (Quebec Law 25): name or title, and email
2. What we collect
- Identity: name, date of birth, address, ID document and the results of identity checks.
- Contact: email address and phone number.
- Orders: amounts, bank account details, wallet addresses and transaction hashes.
- Device and usage data: essential cookies, and analytics only with your consent.
- If identity checks use facial biometrics: express consent, and advance notice to Quebec’s Commission d’accès à l’information. counsel
3. Why we use it
- To provide our services and support.
- To meet our duties under Canada’s Proceeds of Crime (Money Laundering) and Terrorist Financing Act: verifying identity, keeping records and reporting to FINTRAC.
- To prevent fraud.
- With your consent: analytics and product news.
4. Who we share it with
- Service providers that help us run the service: identity verification, payments, blockchain analytics, hosting, chat
- FINTRAC and other authorities when the law requires it.
- We don’t sell personal information.
5. Transfers outside Quebec or Canada
- Where our providers store data: countries
- Quebec Law 25: a privacy impact assessment before information leaves Quebec.
6. How long we keep it
- At least five years, as FINTRAC record-keeping rules require. exact periods
- Then we destroy or anonymise it.
7. How we protect it
- Security measures: summary
8. Your rights
- Access and correction.
- Withdrawing consent, within the limits the law sets.
- Data portability (Quebec).
- If a decision about you is made by automated processing, such as an automated identity check, you can learn the information used and ask a person to review it.
9. Confidentiality incidents
- We notify the Privacy Commissioner of Canada, the Commission d’accès à l’information and the people affected when an incident creates a risk of serious harm.
10. Cookies
- Tracking technology is off by default. See our Cookie Policy.
11. UK clients
- UK data protection law may apply to UK residents’ data. counsel, ICO registration
12. Questions and complaints
- Contact the person in charge of personal information first.
- You can also complain to the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec or, in the UK, the Information Commissioner’s Office.
13. Changes to this policy
- How we tell you about changes. notice