1. Our commitment to privacy
Xchange House ("we", "us", the "Firm") is committed to protecting the privacy and confidentiality of personal information we collect and hold. This Privacy Policy describes how we handle personal information in connection with our website and services, in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.
2. What we collect
Depending on the nature of your interaction with us, we may collect:
- Contact information — name, email address, telephone number, organization, and correspondence content.
- Identification information — government-issued identification, beneficial ownership information, and supporting documents required by our compliance programme.
- Transaction information — instructions, counterparty details, amounts, currencies, and supporting documentation for each transaction.
- Financial information — banking and payment details necessary to effect transactions.
- Technical information — IP address, browser type, pages visited, and similar data collected automatically when you use the Site.
3. Why we collect it
We collect and use personal information to:
- Respond to enquiries and provide information about our services;
- Onboard clients and conduct compliance checks required by law;
- Execute and document transactions on behalf of clients;
- Meet our regulatory obligations under the PCMLTFA, sanctions legislation, and tax reporting requirements;
- Manage the client relationship and improve our services;
- Maintain records required by law or prudent practice.
4. Consent
Where required, we obtain consent to the collection, use, and disclosure of personal information. In some circumstances, consent may be implied from the nature of the transaction or interaction. In other circumstances — particularly where collection is required by law — consent is not required.
You may withdraw consent to certain uses at any time, subject to legal and contractual restrictions. Note that withdrawal of consent may prevent us from providing services.
5. Disclosure
We disclose personal information only:
- to execute a transaction you have instructed (to counterparties, banks, and payment rails);
- to service providers bound by appropriate confidentiality and security obligations;
- to regulatory authorities (including FINTRAC) as required by law;
- with your consent; or
- as otherwise required or permitted by law.
We do not sell personal information.
6. International transfers
Cross-border transactions inherently involve the transfer of personal information across borders. Where such transfers occur, we take appropriate steps to ensure the information remains protected, though we note that information outside Canada may be subject to foreign legal process.
7. Safeguards
We apply physical, organizational, and technological safeguards to protect personal information. These include access controls, encryption in transit, secure storage, and staff training on confidentiality. No system is perfectly secure; we continuously review our safeguards against prevailing standards.
8. Retention
We retain personal information for as long as necessary to fulfil the purposes for which it was collected and to meet our legal and regulatory obligations — including the recordkeeping periods required under the PCMLTFA. Records are securely destroyed or de-identified when no longer required.
9. Your rights
Subject to applicable law, you may:
- request access to the personal information we hold about you;
- request correction of inaccurate or incomplete information;
- withdraw consent (subject to legal and contractual restrictions);
- lodge a complaint with our Privacy Officer (see below) or with the Office of the Privacy Commissioner of Canada.
We will respond to access requests within the timeframes required by law.
10. Cookies
The Site uses a minimal set of cookies necessary for its operation. We do not use third-party advertising cookies. Where we use any analytics, we do so in a manner that respects privacy and is described separately where applicable.
11. Children
Our services are not directed to individuals under the age of majority, and we do not knowingly collect personal information from such individuals.
12. Privacy Officer
Questions, requests, or complaints regarding this Privacy Policy or our handling of personal information should be directed to:
Privacy Officer
Xchange House
privacy@xchangehouse.ca
13. Updates to this Policy
We may update this Privacy Policy from time to time. The updated version will be posted on the Site with a revised "Last updated" date.