This is the privacy policy ("Policy") for Paays Financial Technologies Inc. ("Paays", "we", "us" or "our"). It outlines what personal information is collected by Paays from individuals who interact with or use the services available through the ID Verifier or Income Verifier by Paays applications, or other applications that link to this Policy (the "Apps"), or the Paays website at www.paays.com, or other websites that link to this Policy (collectively, the "Websites") (the Apps and Websites referred to collectively as the "Platform"), how that information may be used, and with whom it may be shared.
By visiting the Platform, using the services available through the Platform (the "Services"), or providing us with personal information you consent to Paays collecting, storing, using and disclosing your personal information in accordance with the terms of this Policy. Updates to the Policy will be posted on the Platform.
The Platform and Services are made available for, and intended for use by, Canadian residents only. If you are not a resident of Canada, you may not visit or use the Platform or apply for or use the Services.
If you do not agree with the terms of this Policy, do not access or use the Platform, apply for or use the Services, or provide us with personal information. If you are under the age of majority in the province where you reside, you may not access or use the Platform or our services or submit personal information to Paays.
1. About Paays
Paays provides digital finance and authentication Services to Automotive retail and finance businesses in Canada (collectively, "Clients"). Paays collects personal information relating to current, prospective and former Clients and their authorized employees, representatives and agents (collectively, "Representatives") in order to manage our relationship with Clients, and to promote, offer, provide and administer our Platform and Services. We refer to this personal information as Client Personal Information. Paays is accountable for and in control of Client Personal Information under applicable privacy laws.
In providing Services to Clients, Paays may collect and otherwise process personal information relating to our Clients' customers ("End Users"). When Paays collects personal information about End Users (referred to as "End User Personal Information") we do so as a service provider to the Client. The Client remains accountable for and in control of their End User Personal Information.
2. Personal Information: Collection, Retention and Use
The type of Personal Information that Paays collects depends on the nature of your interaction and relationship with us.
With respect to Clients and their Representatives, we may collect name, title, and business contact information, such as business address, telephone number and email address.
With respect to End Users, the End User Personal Information we or our service providers collect will depend on the nature of the Services that our Client has requested from us, but may include:
-
your name and contact information, including residential address, email address home and/or mobile phone number, and country of residence
-
A digital copy of your (Canadian or international) government issued photo ID (passport, driver's license, provincial ID card, or, where voluntarily provided by you, a provincial or territorial health card, including a Régie de l'assurance maladie du Québec (RAMQ) card, etc.), and information extracted from it, including name, date of birth, health insurance number and ID number, and a selfie photo. Note that this only applies to ID Verifier by Paays ("IDV"). Use of IDV is through integrations with our verification partner Yoti. The collection and use of this information by Yoti is subject to Yoti's privacy policy available at https://www.yoti.com/privacy/.
-
We also collect information from our fraud detection and identity verification vendors (see section 4 below).
-
Digital copies of bank statements, pay stubs or tax statements, and the information extracted from these documents for Income Verifier by Paays ("Income Verifier"). Verification partners used in Income Verifier include: Zum Rails (https://zumrails.com/privacy-policy/), Argyle (https://argyle.com/legal/consumers/how-it-works/) and Resistant.ai (https://resistant.ai/privacy-policy).
We use Client Personal Information to manage our Client relationships and for marketing purposes. Representatives may opt-out of email-based marketing communications at any time by using the unsubscribe link in the email message or sending an email with "Unsubscribe" to the email address provided in the marketing communication.
We use End User Personal Information only for the purposes of providing and improving our Services to our Client. End User Personal Information that we process is under the relevant Client's control. If you have any questions about how a Client handles End User Personal Information you must contact the Client directly.
For IDV, Paays has partnered with Yoti to provide this service. When you submit your ID document, Yoti will extract data from it and share it with us. You will also be asked to submit a selfie and Yoti uses biometric technology to check that the selfie is of a real person and that your selfie matches the photo on the ID document. Yoti sends us the results of the checks. We share the data extracted from your ID document, and the results of these checks with the Client. Where you have applied for auto financing through a Client that uses any of the DealerTrack, RouteOne, Propel, or CreditApp financing portals (each a "Finance Portal"), and the Client has instructed us to do so, we will, on behalf of our Client, also share the data extracted from your ID document, and the results of these checks with the Client's lender partners chosen to receive the auto financing application. For more information about how Yoti handles your information, see the Yoti privacy policy at https://www.yoti.com/privacy/.
For Income Verifier, Paays has partnered with verification partners to provide this service. If you choose to connect to your bank account, the verification partner will extract data from it and share it with us (and we share it with the Client). Paays and its verification partners do not access or store bank connection log-in details. If you choose to connect to your payroll account, the verification partner will extract data from it, and share it with us (and we share it with the Client). Payroll log-in credentials are never accessed or stored by Paays or our verification partners. If you choose to manually upload documents, you are able to submit PDF, PNG and JPEG files into a portal presented by Paays, on behalf of a Client. These documents are then reviewed and analyzed for authenticity by Paays, before passing them to a Client for further review and decisioning. Where you have applied for financing through a Client, and the Client has instructed us to do so, we will, on behalf of our Client, also share the data and documents referred to above with the Client's lender partners who have received your loan application. For more information about how these verification partners handle your information, see the following Privacy Policies: https://resistant.ai/privacy-policy, https://argyle.com/legal/consumers/how-it-works/, https://zumrails.com/privacy-policy/.
We retain Client Personal Information only for as long as necessary to fulfill the purposes for which it was collected, to meet our legitimate business requirements, and as otherwise permitted or required by law.
We retain End User Personal Information only for as long as necessary to perform our Services for Clients.
3. Information Collected Automatically
When you visit or interact with the Platform certain information is collected automatically through cookies or similarly purposed technologies, including technical and statistical information such as your IP address, your geolocation and location based on your IP address, mobile device identifiers, operating system, and page views and duration.
The primary use of this information by Paays is to verify and authenticate you. The information collected may also be used by Paays to improve the Service(s) provided to its Clients, including the operation and improvements to the Platform, debugging, product research, evaluation, and development.
4. Disclosure of your Information
Our Clients control the End User Personal Information that we process when performing Services on their behalf. End User Personal Information will be shared with and made accessible to the applicable Client. Where you have applied for auto financing through a Client that uses a Finance Portal, and the Client has instructed us to do so, we will also, on behalf of our Client, share information with the Client's lender partners that use the Finance Portal as outlined in section 3 above. Please note that for the purposes of detecting and preventing fraud, your information will be shared with any lender partner that receives a credit application from you through the applicable Finance Portal within 30 days of your initial credit application.
Fraud detection. We share information with vendors that provide fraud detection services. The information shared with these vendors includes home and/or mobile phone number, email address, device ID, IP address and geolocation information. Using this information, these vendors will generate and share with Paays a risk score or flag. These vendors process your information in accordance with their own privacy policies (see: https://risk.lexisnexis.com/group/processing-notices/emailage and https://www.maxmind.com/en/privacy-policy).
Identity verification. We share information with TransUnion to verify End User identity. TransUnion will let us know if the information that we share about an End User matches the information that they have about that individual in their records. For IDV, we do not obtain credit reports or scores from Transunion. For information about TransUnion's personal information practices, see https://www.transunion.ca/legal/privacy-policy.
Income verification. We share information with income verification partners including Zum Rails, Argyle and Resistant Ai to verify, confirm, and calculate banking or payroll information. With Zum Rails and Argyle, End User data is extracted from a bank account (Zum Rails) or payroll account (Argyle) and provided to Clients for their review. With Resistant Ai, End User documents uploaded are scanned for fraud signals, which are provided to Clients, along with the documents themselves for their review. Privacy Policies: https://resistant.ai/privacy-policy, https://argyle.com/legal/consumers/how-it-works/, https://zumrails.com/privacy-policy/.
Anti-money laundering (AML). Certain Clients for IDV may request Paays to check an End User's information against AML databases (Watchlists, Politically Exposed Persons (PEP) lists, UN Sanctions lists, and Adverse Media lists). To perform these checks, we may share your information with Minerva Ai ("Minerva"). Minerva will let us know if the information we share about an End User matches that on any of the above-mentioned lists, and this information will be shared with our Clients. For information about Minerva's personal information practices, see https://www.gominerva.com/legal/privacy.
IDV: If you complete the IDV process, a verification report is sent to the Client who initiated the IDV request, confirming the authenticity of your identity document(s) submitted. This report may contain a digital copy of your government-issued photo ID, along with other text-based identity information, extracted and verified by IDV. This information is passed to the Client who initiated the request.
Income Verifier: If you complete the Income Verifier process, a verification report is sent to the Client who initiated the Income Verifier request, confirming the authenticity of your document(s) submitted. This report may contain a digital copy of any of the statements provided, along with other text-based identity information, extracted and verified by Income Verifier. This information is passed to the Client who initiated the request.
Certain Paays employees, representatives and agents will have access to your Personal Information as necessary in connection with their responsibilities. This includes employees in our Customer Support, Quality Assurance and Developer Operations teams.
In connection with providing the Service, Paays may share your Personal Information with companies providing related services to Paays, such as data hosting and processing, analytics, marketing, fraud detection and prevention, identity verification. Some of these service providers may be located outside of Canada, including the United States.
Paays may share with any third party that we deem appropriate, aggregate anonymized information regarding the Platform and users of the Platform, such as demographic information about, and geographic territory of, end users (as a group), customer preferences (as a group), technical performance and usage statistics. These third parties may include, for example, business partners or companies who assist Paays in providing or supporting the Paays platform.
Paays may share Personal Information where permitted or required by law (including as required by foreign laws applicable to Paays service providers), if we believe we are required to do so in order to comply with an order of a court of competent jurisdiction or other legal requirements of any governmental authority, if we believe doing so would potentially mitigate our liability in an actual or potential lawsuit, if we believe it is necessary to protect our rights or property, or if Paays sells all or part of its assets, or enters into a similar business transaction to a third party.
5. Your Consent under this Policy
We will not collect, hold, use or disclose your Personal Information without your consent unless authorized or required by applicable law. By using our Services, accessing the Platform, or otherwise submitting your Personal Information to us, you acknowledge and agree that your Personal Information may be collected, used, disclosed, processed and retained in accordance with this Policy and as otherwise permitted or required by applicable law. Your consent may be express (for example, where you affirmatively agree to the collection of specific categories of information) or implied (for example, where you voluntarily provide information for an obvious purpose), depending on the nature and sensitivity of the Personal Information involved.
If you provide Personal Information concerning another individual to us, you represent that, prior to submitting such Personal Information, you have obtained all necessary consents or authority to permit us to collect, use and disclose such Personal Information for the purposes described in this Policy, or that such collection, use and disclosure are otherwise permitted by applicable law.
You may vary or withdraw your consent to the use and disclosure of your Personal Information, or opt out of certain uses and disclosures, subject to legal or contractual restrictions and reasonable notice. Please note that withdrawing your consent may prevent us from providing, or continuing to provide, certain Services or access to the Platform.
Health Card. Where you voluntarily choose to use a provincial or territorial health card (including a Régie de l'assurance maladie du Québec (RAMQ) card) for ID Verifier by Paays ("IDV"), you expressly consent to Paays and its verification partners collecting, using and disclosing the information contained on the health card solely to verify your identity for the Services requested by the applicable Client. Paays does not require the use of a health card for identity verification, and you may choose another accepted form of government-issued photo identification at any time.
If you require any assistance in understanding the scope of the consent being sought or to vary or withdraw your consent, please contact Paays' Chief Privacy Officer using the contact information in Section 11.
6. Data Protection and Security
Paays takes your privacy and the protection of your Personal Information seriously and takes commercially reasonably measures to ensure its security. Despite these measures, no transmission of Personal Information over the Internet can be guaranteed to be uninterrupted or completely secure, and accordingly Paays cannot, and does not, guarantee that your Personal Information will not be unlawfully accessed by a third party. PAAYS DOES NOT WARRANT THE SECURITY OF ANY INFORMATION YOU TRANSMIT ELECTRONICALLY, AND YOU DO SO AT YOUR OWN RISK.
7. Governing Law and Jurisdiction
Paays is domiciled in and provides its services from the Province of Ontario. Consumers from countries and jurisdictions outside of Canada are advised that this Policy, and the collection, retention, and use of your Personal Information, shall be construed in accordance with and governed by the laws of the Province of Ontario and the federal laws of Canada as applicable.
You are also advised that Personal Information is retained in cloud-based servers which may be located in Canada, the U.S.A. and other jurisdictions. The laws of these jurisdictions may offer less stringent privacy and consumer rights than the jurisdiction in which you reside.
IDV transactions are processed and stored exclusively in Canada.
8. Changes to this Policy
Paays may revise this Policy from time to time. The updated Policy will be published on the Platform and identified by the publication date. Please review the Policy frequently during your use of the Platform and Paays Services to ensure that you are aware of the most up to date Policy. Your continued use of the Platform or the Services following the publication of an update to this Policy confirms your acceptance of the then updated Policy terms.
9. Opting out of Marketing Communications
Client Representatives can opt-out of marketing communications by using the unsubscribe link in the email or by sending an email with "Unsubscribe" in the subject line to the email address provided in the communication.
10. Your rights
Representatives have the right to request access to or correction of their Personal Information in our custody or control, to request information about how their Personal Information has been processed, to request that certain Personal Information be transferred to the Representative or a third party in a commonly used machine readable format, to withdraw their consent to our collection, use and disclosure of their Personal Information, and in certain circumstances, to request deletion of their Client Personal Information. These rights are subject to contractual and legal restrictions. We will take appropriate steps to verify a Representatives identity before honoring any request. Please also note that if a Representative withdraws their consent, we may no longer be able to provide our Services.
End Users may also have similar rights with respect to their End User Personal Information. However, since End User Personal Information is under the control of the applicable Client, End Users must contact the relevant Client in order to exercise these rights.
11. Contact Paays
Should you have any questions regarding this Policy or the processing of Client Personal Information, please contact Paays' Chief Privacy Officer at Paays Financial Technologies Inc., 140 Yonge Street, Suite 209, Toronto, ON, M5C 1X6 or privacy@paays.com.
Questions related to the security of the Paays website, or any solutions provided by Paays? Contact security@paays.com.
Should you have any questions regarding the processing of End User Personal Information please contact the Client directly.