PRIVACY POLICY
PRIVACY POLICY
This Privacy Policy covers the following areas:
1. What personal data we collect.
2. How we may use your personal data and the lawful basis for doing so.
3. Who we may disclose your personal data to.
4. How we protect your personal data.
5. Your privacy rights.
6. How long we keep your personal data.
7. How changes to this Privacy Policy will be made.
8. Contacting us or the data protection authority.
PayDirect Billing Solutions Inc (“PayDirect”) is fully committed to protecting
your individual rights and keeping your personal data safe. This Policy
explains how we collect personal information about you when you use our
services, how we use that information and the conditions in which we may
disclose it to others, and how we keep it secure.
This Policy describes our obligations and your rights under applicable
Canadian privacy legislation as well as the General Data Protection
Regulation (the “GDPR”). For purposes of the GDPR, PayDirect is the data
controller that is processing your personal information. By using our services
and consenting to PayDirect processing your data, you are agreeing to this
Policy. If you have any questions, please email the following address:
1. What personal data we collect
Personal data is in most cases collected directly from you or generated as
part of the use of our services. Sometimes additional information is required
to keep information up to date or to verify information we collect.
The personal data we collect can be grouped into the following
categories:
-
Identification information including your full name, date of birth and
government issued identification such as passport, driver’s license,
national insurance or social security numbers.
-
Contact information including your home address, e-mail address and
phone numbers.
-
Financial information including your bank’s name, account number and
account type.
-
Payment transaction information including the name of the online
merchant you are using our services to pay and transaction history.
-
Information about you from third parties including credit bureaus and
identity verification services.
-
Information about your use of our systems.
-
Information related to legal requirements: customer due diligence and
anti-money laundering requirements.
Personal data we may collect from you:
We collect information you provide directly to us when you visit our website
or use any PayDirect service. For example, when you select one of our
payment services from a merchant’s payment page, we may collect personal
data, such as your name, address, government identification numbers, date
of birth, e-mail address, phone number and bank details to be able to provide
you with the payment service. We also collect information which you provide
us with, such as messages you have sent us, e.g. feedback or a request in
our digital channels. Calls and chat conversations with you may also be
recorded and logged for verification of transaction information,
documentation, and for quality and improvement purposes.
Personal data that we may collect from third parties:
-
Publicly available and other external sources; register held by
governmental agencies (such as company registration offices,
enforcement authorities, etc.), sanction lists (held by international
organizations such as the EU and UN as well as national organizations
such as Office of Foreign Assets Control (OFAC)), registers held by
credit-rating agencies and other commercial information providers
providing information on e.g. beneficial owners and politically exposed
persons.
-
In connection with payments, we collect information from remitters,
banks, payment service providers and others.
-
From other entities which we collaborate with.
2. How we may use your personal data and the lawful basis for doing so
We use your personal data to comply with legal and contractual obligations
as well as to provide you with services.
Performance of a contract
As a processor of payment transactions, we have entered into agreements
with online merchants to process online payment transactions on behalf of
their customers. The main purpose for using your personal data is to process
payments between you and these online merchants.
Examples of the performance of a contract:
-
Verify your identity and provide our services and process your
transactions.
-
Provide customer service, including troubleshooting service issues you
are having.
-
Reconcile payments, settle transaction disputes or address errors.
Legal obligation
In addition to the performance of contract, we process your personal data to
fulfil our obligations under law, other regulations or as required by regulatory
authorities.
Examples of processing due to legal obligations:
-
Preventing, detecting, and investigating money laundering, terrorist
financing, fraud or other potentially prohibited or illegal activities.
-
Reporting to police authorities, enforcements authorities or supervisory
authorities.
-
Payment service requirements and obligations.
Legitimate interest
Personal data is processed in the context of marketing, product and customer
analyses. This processing forms the basis for marketing, process, business
and system development, including testing.
We have a legitimate interest to prevent or remediate violations of policies or
applicable agreements, to manage and protect our information technology
infrastructure and to use profiling for example when conducting customer
analysis for monitoring transactions in order to detect fraud.
Consent
There are situations when we will ask for your consent to process your
personal data. Examples of such situations are processing of payment
transaction data for marketing purposes, or for some processing of special
categories of data. The consent will contain information on that specific
processing activity. If you have given consent to a processing of your
personal data you can always withdraw the consent.
3. Who we may disclose your personal data to
We may share your personal data with others such as authorities, affiliated
companies, suppliers, payment service providers and business partners.
Before sharing we will always ensure that we respect relevant financial
industry secrecy obligations.
Third parties and affiliated companies
We may pass your information to our third party service providers, agents,
subcontractors and affiliated companies for the purpose of completing tasks
and providing services to you on our behalf. However, when we use third
party service providers, we disclose only the personal information that is
necessary to deliver the service that you need, and we have contracts in
place that requires each third party provider to keep your information secure
and not to use it for their own direct marketing purposes or any other
purpose. We will not release your information to third parties beyond those
that we have such a contractual relationship with - unless you have
specifically requested us to do so, or we are required to do so by law, for
example, by a court order or for the purposes of prevention of fraud or other
crime. In such circumstances, we will take steps with the aim of ensuring that
your privacy rights continue to be protected.
For EU residents: Transferring your information outside of European Economic Area
As part of our services to you, the information which you provide to us may
be transferred to countries outside the European Economic Area (“EEA”). By
way of example, this may happen if any of our servers are from time to time
located in a country outside of the EU. These countries may not have
equivalent data protection laws. By submitting your personal data, you are
agreeing to this transfer, storing and/or processing. If we transfer your
information outside of the EEA in this way, we will take steps to ensure that
appropriate security measures are taken and we remain compliant with the
GDPR, with the aim of ensuring that your privacy rights continue to be
protected as outlined in this Policy.
If you use our services while you are outside the EU, your information may be
transferred outside the EEA in order to provide you with those services.
4. How we protect your personal data
Keeping your personal data safe and secure is at the centre of how we do
business. We use appropriate technical, organizational and administrative
security measures to protect any information we hold from loss, misuse, and
unauthorized access, disclosure, alteration and destruction.
5. Your privacy rights
You as a data subject have rights in respect of personal data we hold on you.
You have the following rights:
-
The right of access to your personal data. You have a right to access the
personal data we are keeping about you. Your right to access may, however, be restricted by legislation, protection of other persons’ privacy and consideration for PayDirect’s business concept and business practices. If there are exceptional circumstances that mean we can refuse to provide the information, we will explain them. If requests are frivolous or vexatious, we reserve the right to refuse them. If answering requests is likely to require additional time or occasions unreasonable expense (which you may have to meet), we will inform you.
-
The right of rectification to request correction of incorrect or
incomplete data. When you believe we hold inaccurate or incomplete
personal information about you, you may exercise your right to correct
or complete this data. This may be used with the right to restrict
processing to make sure that incorrect/incomplete information is not
processed until it is corrected.
-
The right to erasure (the ‘right to be forgotten’). Where no
overriding legal basis or legitimate reason continues to exist for
processing personal data, you may request that we delete the personal
data. This includes personal data that may have been unlawfully
processed. We will take all reasonable steps to ensure erasure.
-
The right to withdraw your consent. You have the right to withdraw
any consent you have previously given us to handle your information.
Examples include where-
-
you object to the processing and there is no justified reason for
continuing the processing,
-
you object to processing for direct marketing, or
-
processing is unlawful or
If you withdraw your consent, this will not affect the lawfulness of our
use of your information prior to the withdrawal of your consent.
Right to restrict processing of your personal data. You may ask us to stop
processing your personal data. We will still hold the data, but
will not process it any further. This right is an alternative to the right to
erasure. If one of the following conditions applies you may exercise the
right to restrict processing:
-
The accuracy of the personal data is contested.
-
Processing of the personal data is unlawful.
-
We no longer need the personal data for processing but the
personal data is required for part of a legal process.
-
The right to object has been exercised and processing is
restricted pending a decision on the status of the processing.
-
Right to object to processing of your personal data where we are relying on
a legitimate interest to process your data. You can always object to the processing of personal data about you for direct marketing and profiling in connection to such marketing.
-
The right to data portability. You have a right to ask for information you have
made available to us to be transferred to you or a third party in machine-readable formats. This right is only available if the original processing was on the basis of consent, the processing is by automated means and if the processing is based on the fulfilment of a contractual obligation.
These rights are not absolute: they do not always apply and exemptions
may be engaged. We may, in response to a request, ask you to verify your
identity and to provide information that helps us to understand your
request better. If we do not comply with your request, we will explain why.
6. How long we keep your personal data
We will hold your personal information on our systems for the longest of the
following periods:
-
a minimum of six years;
-
as long as is necessary for the relevant activity or as long as is set out
in any relevant agreement;
-
the length of time it is reasonable to keep records to demonstrate
compliance with professional or legal obligations;
-
any retention period that is required by law; or
-
the end of the period in which litigation or investigations might arise in
respect of the services that we provide to you.
7. How changes to this Privacy Policy will be made
We are constantly working on improving and developing our services,
products and websites, so we may change this Privacy Policy from time to
time. We will not diminish your rights under this Privacy Policy or under
applicable data protection laws in the jurisdictions we operate. Please review
this Privacy Policy from time to time to stay updated on any changes.
8. Contacting us or the data protection authority
If you have any questions or concerns regarding our Privacy Policy, you can
always contact PayDirect’s customer service at
You can also lodge a complaint or contact the data protection authority in any
of the countries, states or provinces where we provide services or products to
you.
Last Updated: January 2020