1. Scope and accountability
This Privacy Policy explains how FinLinks Payment Inc. (“FinLinks”, “we”, “us”, or “our”) handles personal information in connection with its public website, business enquiries, and related support communications. It also describes the principles that apply to personal information handled for agreed services. Additional notices and contractual terms will identify any information required for production onboarding or provider services.
We are based at Suite 750, 2 Robert Speck Parkway, Mississauga, Ontario L4Z 1H8, Canada. Our compliance contact acts as the point of contact for privacy matters: compliance@finlinkspay.ca. We are responsible for personal information under our control and for establishing appropriate safeguards when a service provider processes it on our behalf.
We apply the Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies, together with other applicable privacy laws. Business contact information used solely to communicate with someone in relation to their employment, business, or profession may fall outside PIPEDA; other information in an enquiry may still be protected personal information.
2. Business and regulatory context
FinLinks Payment Inc. is developing non-custodial B2B payment orchestration services. FINTRAC MSB Registration No.: N300002252. FINTRAC registration does not constitute endorsement or licensing and is not a certification of privacy or security practices.
The proposed services operate on a non-custodial, in-transit basis. They do not provide deposits, stored value or reusable client balances. Underlying clearing, settlement, foreign exchange, and payment execution services are performed by appropriately licensed or otherwise authorized partner financial institutions or financial service providers identified in the relevant agreements. Those providers may collect and use information independently to meet their contractual and legal responsibilities. Their own privacy notices apply to that processing.
3. Information we collect
- Enquiries: name, work email address, company name, optional estimated monthly transaction volume, integration requirements, and confirmation of enquiry-related consent.
- Correspondence: messages, support requests, responses, and related business contact details that you choose to provide.
- Technical information: hosting, delivery, and security systems may process IP addresses, browser and device details, request times, requested resources, error information, and abuse-prevention signals.
- Agreed onboarding and services: where required and separately explained, business ownership and control information, identity verification information, authorized user details, and relevant transaction or reconciliation records. Sensitive onboarding information must be provided only through the designated secure process.
The public contact form does not request bank credentials, account numbers, identification documents, or confidential payment instructions. Do not include those details in the Integration Needs field. Collect and share another person’s information only when you have appropriate authority.
4. Why we use information
We use information for identified, reasonable purposes: responding to enquiries; assessing business and integration requirements; providing agreed support and services; maintaining communication records; protecting systems and investigating abuse; administering contractual relationships; and meeting applicable legal, regulatory, reporting, recordkeeping, and lawful request obligations.
We limit collection to information reasonably necessary for those purposes. We do not use the public contact form to subscribe you to marketing. Any separate marketing communications must have an applicable lawful basis under Canadian anti-spam requirements and an appropriate unsubscribe mechanism. We do not sell enquiry information or use this form to build advertising audiences.
5. Consent and your choices
The form asks for express confirmation that FinLinks may use the supplied details to respond to your enquiry. Required fields support that response; monthly volume is optional and includes “Prefer not to say”. You may instead contact us directly by email or postal mail.
Where required, we seek meaningful consent before collecting, using, or disclosing personal information for a new purpose. We explain the relevant information, purposes, parties involved, and material consequences in an understandable manner. We may act without consent only where permitted or required by law.
You may withdraw consent by contacting compliance@finlinkspay.ca, subject to legal or contractual restrictions and reasonable notice. We will explain relevant consequences, including when we can no longer respond to or provide a requested service. Withdrawal does not invalidate lawful processing already completed or require destruction of records that must be retained by law.
6. Contact form, Resend, and email fallback
The contact form submits JSON to FinLinks’ own same-origin /api/contact endpoint. Our backend email workflow uses Resend to send the enquiry to support@finlinkspay.ca. Resend and the relevant hosting and email providers may process the message content, sender and recipient details, technical metadata, and delivery or security logs to provide their services.
No Resend secret API key is embedded in the browser. A successful form confirmation indicates backend acceptance for sending, not guaranteed inbox delivery. If a response is lost or delayed, the server may still have received the submission.
If submission cannot be confirmed, the page offers an email-address copy button and a mailto draft link. Clicking the draft link passes the draft content to your email application; you decide whether to send it. Your chosen email provider’s terms and privacy practices then apply. This frontend does not intentionally persist form entries in cookies, localStorage, or sessionStorage. Entries remain in the current page until cleared, reset after confirmed submission, or the page is closed; your browser may separately offer autofill or recovery features.
8. Processing outside Canada
Service providers, infrastructure, or support personnel may be located in Canada or other countries. Personal information processed outside Canada may be subject to the laws of the jurisdiction in which it is processed, including lawful access by courts, law enforcement, or government authorities.
FinLinks remains accountable for personal information transferred for processing on its behalf and uses contractual or other appropriate means to support a comparable level of protection, as required by applicable law. This website does not promise Canadian-only data residency. Contact our privacy contact for information about relevant processing arrangements.
10. Retention, accuracy, and safeguards
We retain information only as long as reasonably necessary for its identified purpose, legal or regulatory requirements, dispute resolution, and legitimate recordkeeping. Retention depends on the record type and context; ordinary enquiries are not automatically treated as regulated transaction records. Information used to make a decision about an individual is retained long enough to support applicable access rights. When no longer needed, information is securely deleted, destroyed, or de-identified, subject to appropriate backup lifecycles.
We use administrative, technical, and physical safeguards appropriate to sensitivity and risk, including access restrictions and secure handling procedures. No internet transmission or storage system is entirely risk-free. Do not email credentials or sensitive financial documents. Please tell us when information needs correction.
Where PIPEDA requires, we assess and record breaches of security safeguards, report qualifying breaches to the Office of the Privacy Commissioner of Canada, notify affected individuals of breaches creating a real risk of significant harm, and take required mitigation steps. Records of breaches are retained for the legally required period.
11. Access, correction, and complaints
You may request information about the personal information we hold about you, its use and disclosures, access to it, or correction of inaccurate or incomplete information. You may also ask about withdrawal of consent or deletion of information no longer required. These requests are subject to applicable exceptions, retention obligations, and identity verification proportionate to the request.
Where PIPEDA applies, we normally respond to access requests within 30 days, subject to legally permitted extensions and required notice. We will explain a refusal or restriction where required, provide severable information where appropriate, and identify available complaint options. If a correction is disputed, we will record the unresolved challenge as required by law. We will not require you to send unnecessary sensitive identification through an insecure channel.
Contact compliance@finlinkspay.ca with a description of your request or concern. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada or another competent privacy authority. Nothing in our Terms limits these rights.
12. Children, updates, and governing framework
Our services and website are directed to business users and are not intended for children. If you believe a child has supplied personal information, contact us so that we can assess appropriate steps.
We may update this Policy as practices or legal requirements change. The revision date identifies the current version. Material changes will be communicated as required by law, and fresh consent will be sought where required. Ontario law and applicable federal Canadian law provide the general framework, without displacing mandatory privacy rights or the jurisdiction of competent regulators.
13. Privacy contact and official resources
Privacy contact — FinLinks Payment Inc.
Suite 750, 2 Robert Speck Parkway
Mississauga, Ontario L4Z 1H8, Canada
Email: compliance@finlinkspay.ca
General support: support@finlinkspay.ca
Official resources: PIPEDA; the Office of the Privacy Commissioner’s meaningful consent guidance and cross-border processing guidance.