Privacy Policy

1. Introduction

Virtual Pay Capital Ltd. ("VPC", "we", "our", or "us") is an Alberta corporation and a FINTRAC-registered Money Services Business. We are committed to protecting the privacy of our clients and the individuals whose personal information we handle in the course of providing our services.

This Privacy Policy describes how VPC collects, uses, discloses, and retains personal information in accordance with:

• The Personal Information Protection Act (Alberta) ("PIPA")
• The Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA")
• The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (Canada) ("PCMLTFA") and associated FINTRAC regulations

2. Scope of This Policy

This Policy applies to personal information collected by VPC through its website, application intake workflow, client dashboard, client onboarding process, and in connection with the execution and monitoring of financial transactions. General browsing of the website does not require you to submit personal information, but application intake, dashboard access, communications with VPC, and approved services may require VPC to collect personal information. This Policy does not apply to information that is aggregated or anonymized such that individuals cannot be identified.

3. Personal Information We Collect

VPC collects personal information solely for the purposes of client identification, transaction processing, and regulatory compliance. This may include:

• Full legal name, date of birth, and government-issued identification
• Residential and business address
• Contact information (email address, phone number)
• Dashboard credentials, electronic acceptance records, application submissions, and related audit records
• Financial account details necessary to assess an application or process transactions
• Transaction records, including amounts, dates, currencies, and counterparties
• Source of funds and source of wealth documentation as required under KYC/AML obligations
• Beneficial ownership, control, director, officer, and authorized representative information for business applicants and clients

VPC does not collect sensitive personal information beyond what is required by applicable law and regulatory obligations.

4. Purposes of Collection and Use

Personal information is collected and used only for the following purposes:

• To verify the identity of applicants, clients, beneficial owners, directors, officers, and authorized representatives in accordance with FINTRAC Know Your Client (KYC) and Know Your Business (KYB) requirements
• To assess applications, conduct onboarding review, process, settle, and record financial transactions
• To conduct sanctions screening, fraud prevention, risk assessment, and transaction monitoring for suspicious activity in compliance with Anti-Money Laundering (AML) obligations
• To fulfill reporting obligations to FINTRAC and other regulatory authorities
• To comply with applicable laws, regulations, and court orders
• To communicate with applicants and clients regarding applications, dashboard access, accounts, transactions, records, notices, and service matters

VPC does not use personal information for marketing, profiling, or any purpose beyond those listed above without obtaining prior consent.

5. Disclosure of Personal Information

VPC does not sell, rent, or trade personal information. Personal information may be disclosed only in the following circumstances:

• As required by law, including mandatory reporting to FINTRAC under the PCMLTFA
• To financial institutions, payment networks, liquidity providers, processing partners, verification providers, fraud-prevention providers, technology vendors, or correspondent parties necessary to assess an application, support onboarding, complete a transaction, or provide and monitor services
• To legal counsel or advisors bound by confidentiality obligations
• With the express consent of the individual

Where personal information is shared with third-party service providers, VPC takes reasonable contractual steps to ensure that such parties protect the information in a manner consistent with this Policy.

6. Retention of Personal Information

VPC retains personal information for a minimum of five (5) years following the date of the last transaction, the termination of the client relationship, or the creation of records required to be retained under the PCMLTFA. Application and onboarding records may be retained even where an application is declined, discontinued, or withdrawn. Where a longer retention period is required by applicable law or regulatory obligation, VPC will retain the information for that extended period.

Personal information that is no longer required is securely destroyed or anonymized.

7. Security Safeguards

VPC implements physical, administrative, and technical safeguards appropriate to the sensitivity of the personal information held. These measures are designed to protect personal information from unauthorized access, disclosure, alteration, or destruction. Access to personal information is restricted to authorized personnel who require it to perform their duties.

In the event of a privacy breach that poses a real risk of significant harm, VPC will notify affected individuals and the Office of the Privacy Commissioner of Canada (OPC) and/or the Office of the Information and Privacy Commissioner of Alberta (OIPC) as required by law.

8. Individual Rights

Subject to applicable legal exceptions, individuals have the right to:

• Request access to their personal information held by VPC
• Request correction of inaccurate or incomplete personal information
• Withdraw consent to the collection, use, or disclosure of their personal information (where applicable and where not required by law)
• Request information about how their personal information has been used or disclosed

To exercise any of these rights, individuals may submit a written request to VPC's Privacy Officer using the contact information provided in Section 10. VPC will respond within 30 days of receiving a complete request.

9. Accountability and Privacy Officer

VPC has designated a Privacy Officer who is responsible for overseeing compliance with this Policy and applicable privacy legislation.

Privacy Officer:

Isaac Ru, Chief Compliance Officer
Virtual Pay Capital Ltd.
200-1001 1 ST SE, Calgary, Alberta T2G 5G3
Email: feedback@virtualpaycapital.com
Website: virtualpaycapital.com

10. Regulatory Recourse

If an individual is not satisfied with VPC's response to a privacy inquiry or complaint, they may contact the relevant regulatory authority:

• Office of the Privacy Commissioner of Canada (OPC): www.priv.gc.ca
• Office of the Information and Privacy Commissioner of Alberta (OIPC): www.oipc.ab.ca

11. Updates to This Policy

VPC may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, or business practices. The current version will always be available at virtualpaycapital.com. Material changes will be communicated to affected clients in writing.

Virtual Pay Capital Ltd. | Alberta Corporation | FINTRAC-Registered MSB