OEX Canada Privacy Policy

OEX Canada Limited (“OEX”, “we” or “us”) is a corporation incorporated under the Canada Business Corporations Act ('OEX', 'we', 'us') with corporation number 1526293-3 and business address 21 Teagarden Ct, Whitby, Ontario, Canada, L1R 2H9. OEX is registered with the Financial Transactions and Reports Analysis Centre of Canada (“FINTRAC”) as a money services business (registration number M23760780).

We provide payment, conversion and digital asset services through the OEX website, OEX Enterprise platform, APIs and related support channels. This Privacy Policy explains how we collect, use, disclose and retain personal information about website visitors, applicants, customers, merchants, their personnel and beneficial owners, and individuals involved in transactions. It applies to personal information for which OEX is responsible. Banks, payment providers and other third parties may also handle information under their own privacy policies. This Privacy Policy is provided in compliance with Canada’s Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (“PIPEDA“) and, to the extent applicable, provincial privacy legislation in Canada.

When we refer to “you” or “your“, we mean separately and collectively any visitor or user of our website, OEX Enterprise platform, APIs and related support channels.

1 Who is responsible and how to contact us

OEX Canada Limited is responsible for personal information under its control. Contact us about this policy, access or correction requests, or a privacy complaint at support@oex.com, or at 111 2nd Avenue S, Unit 400, Saskatoon, SK S7K 1K6, Canada. Please say that your request concerns privacy so it can be directed appropriately.

2 Information we collect

Identity and verification: name, contact details, date of birth, nationality, address, government identification, photographs or verification results, and information about directors, authorized users, beneficial owners and other relevant individuals.
Business and financial information: occupation, business role, ownership and corporate records, banking and payment details, source-of-funds information and materials required for account opening or due diligence.
Account and transaction information: credentials and access logs; virtual account identifiers; payment instructions, counterparties, beneficiaries, amounts, currencies, quotes and settlement details; wallet addresses, transaction hashes and blockchain network data.
Compliance and risk information: screening results concerning sanctions or politically exposed persons, fraud signals, transaction monitoring alerts, records from public registers and other lawful sources, and investigations or communications with us.
Technical and communications information: device and browser details, IP address, approximate location inferred from IP, cookies and similar identifiers, API logs, support messages and feedback.

We obtain information from you, your organization or merchant, transaction counterparties, banks, payment and wallet providers, identity and screening providers, public registers, and other sources permitted by law. Where you submit someone else’s information, provide them with an appropriate notice and ensure you have authority to share it.

3 Why we use information

Assess applications, verify identity and business ownership, create accounts, authenticate users, provide customer support and manage the contractual relationship.
Process fiat receipts, virtual accounts, on-ramp and off-ramp transactions, spot conversions, FX, transfers, refunds and payouts; maintain records and reconcile transactions with providers.
Meet applicable anti-money-laundering, sanctions, tax, recordkeeping, reporting and other legal requirements; prevent fraud, misuse and security incidents; manage disputes and enforce rights.
Maintain and improve the platform, monitor service performance, troubleshoot APIs, and communicate service or policy updates.
Send marketing only in accordance with applicable law and your communication preferences. You can unsubscribe from marketing messages without stopping essential service or compliance notices.

We seek meaningful consent where required and otherwise collect, use or disclose information where permitted or required by applicable law. Certain verification and transaction information is necessary to provide regulated services. If you decline to provide it, we may be unable to open an account or complete a transaction. Withdrawal of consent is subject to legal and contractual limits, including recordkeeping duties.

4 Screening and decisions

We use automated tools and manual checks to verify identity, screen names and wallet addresses, and identify transactions that may require fraud or compliance review. An automated alert may be reviewed by our personnel and may result in a request for further information, a delay or a decision to decline a transaction or service. We may be legally restricted from disclosing certain investigations or reporting details.

5 Who receives information

We share personal information where necessary to provide the services described in this Policy. Recipients may include banks, acquiring and settlement providers, payment networks, liquidity providers, digital asset wallet or custody providers, identity verification and screening vendors, cloud and technology providers, professional advisers, and authorized OEX affiliates. Depending on their role, these parties may process information on OEX’s behalf or for their own legal and operational purposes.

We may also disclose personal information to FINTRAC, other regulators, courts, law enforcement agencies or government bodies where permitted or required by law. If OEX is involved in a proposed or completed corporate transaction, information may be disclosed subject to applicable legal protections.

6 Processing outside Canada

OEX and its service providers may store or process personal information outside your province or Canada in connection with the services described in this Policy. While information is in another jurisdiction, it may be subject to that jurisdiction’s laws, including lawful access by its authorities. OEX remains responsible for personal information under its control and takes appropriate steps to protect information handled by its service providers. You may contact our privacy officer for further information about our cross-border processing.

7 Cookies and similar technologies

The OEX website and platform use cookies and similar technologies that are necessary for functions such as sign-in, security and service operation. We may also use analytics or marketing technologies where enabled and permitted by applicable law. Where consent is required for optional technologies, we will provide information about their purposes and a way to manage your choices. You can also manage cookies through your browser settings, although blocking necessary cookies may affect the website or platform.

8 Security and retention

We use administrative, technical and physical safeguards appropriate to the sensitivity of the personal information we hold. These include access controls, monitoring and measures to protect information in transit and storage. We assess privacy incidents and notify affected individuals and regulators where required by law.

We generally retain KYC and transaction records for at least five years, calculated from the date applicable to each record under Canadian law. We may retain information longer where required for a legal obligation, investigation, audit or dispute. Other personal information is kept only as long as needed for the purposes described in this Policy, after which we securely delete or de-identify it where practicable. Records published on a blockchain may remain accessible on that network after OEX deletes its internal records.

9 Your choices and privacy rights

You may ask to access personal information under our control, understand how it has been used or disclosed, or correct inaccurate information. You may withdraw consent where permitted, opt out of marketing, and exercise additional rights available under applicable provincial law. Send requests to our support team. We may verify your identity and apply lawful limits, including where disclosure would reveal another person’s information or compromise a legally protected investigation. An access request will generally be answered within 30 days, subject to permitted extensions, and access is provided at minimal or no cost. If we cannot resolve a concern, you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or the applicable provincial privacy regulator.

10 Other sites, children and changes

Third-party websites, payment interfaces and wallet services may have separate privacy notices. Our services are not directed to minors; if we learn we collected a minor’s information contrary to applicable law, we will address it appropriately. We may update this policy and post the revised date. We will provide additional notice or seek consent where a material new use requires it.