Privacy Policy | Frapex.Exchange

1. INTRODUCTION

This Privacy Policy (hereinafter – “Policy”) describes how Frapex Inc. (hereinafter – “Company”, “We”, “Our” or “Us”) collects, uses, discloses, transfers, retains and protects Personal Information in connection with the Website, the Services and other interactions with the Company.

The Company is registered with the Financial Transactions and Reports Analysis Centre of Canada (hereinafter – “FINTRAC”) as a money services business (hereinafter – “MSB”) under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (hereinafter –“PCMLTFA”), the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations (hereinafter –“PCMLTFR”).

Certain payment-related Services may be subject to the Retail Payment Activities Act (hereinafter – “RPAA”) and the related requirements applicable to payment service providers in Canada. The Company does not represent that any Service requiring registration with the Bank of Canada is available unless and until the applicable registration, legal, regulatory and operational requirements have been satisfied. Any payment-related Service is provided only to the extent legally permitted, registered, authorized or otherwise available to the Company.

This Policy applies to Personal Information relating to Users, prospective Customers, Customers, Business-Related Persons and other individuals whose Personal Information is provided to or obtained by the Company in connection with the Website, the Services, onboarding, verification, compliance checks, transaction processing, payment processing, settlement, reconciliation, communications or other interactions with the Company.

The Website is provided primarily for general informational and communication purposes. It does not itself enable Users to execute transactions, place orders, conclude trades, transfer funds or Virtual Currency, maintain balances or otherwise access regulated or transaction-related Services directly.

Where additional or different privacy or data protection requirements apply because of the location of an individual, the nature of the processing or the applicable legal framework, the Company may provide an additional or jurisdiction-specific privacy notice. Where and to the extent that the processing of Personal Information is subject to Regulation (EU) 2016/679 or other European Economic Area data protection requirements, a separate European Union / European Economic Area (hereinafter – “EU/EEA”) privacy notice may apply.

This Policy explains how We collect, use, disclose, transfer, retain and protect Personal Information and describes the choices and rights available to individuals in relation to their Personal Information.

We encourage You to read this Policy carefully to understand how Your Personal Information is handled when You interact with the Company.

2. TERMS AND DEFINITIONS

For the purposes of this Policy, unless the context requires otherwise, the following terms have the meanings set out below.

Applicable Law means any law, regulation, rule, regulatory requirement, order, directive, guidance or other legal or regulatory requirement applicable to the Company, the Website, the Services, the User, the Customer, the relevant transaction or the processing of Personal Information.

Business-Related Person means an individual whose Personal Information is processed in connection with a legal entity Customer or prospective Customer, including a director, officer, manager, shareholder, beneficial owner, person exercising control, authorized representative, authorized signatory, employee, contact person or other individual connected with that entity.

Company means Frapex Inc., a company incorporated under the laws of Alberta, Canada under company registration number 2027786017, with its registered office at 700-602 12 Ave SW, Calgary, Alberta, T2R 1J3, Canada.

Customer means a person or entity that has been accepted by the Company for onboarding, transaction discussions, provision of Services or another customer relationship, as applicable.

Electronic Funds Transfer means an electronic transfer of funds, where applicable to the relevant Service or transaction flow.

Fiat Currency means government-issued currency that is legal tender in the relevant jurisdiction.

Money Transfer Services means transaction-specific fiat transfer services made on a Customer’s instruction to an identified payee, recipient or beneficiary, subject to the Company’s approval, compliance procedures and operational requirements.

OTC Virtual Currency Exchange and Settlement Services means over-the-counter virtual currency exchange and related settlement services that may include fiat-to-virtual currency, virtual currency-to-fiat or virtual currency-to-virtual currency transactions, where supported by the Company.

Payroll Payment Services means services involving transaction-specific payment or payout instructions related to payroll or similar payment flows, subject to the Company’s approval, compliance procedures and operational requirements.

Personal Information means information about an identifiable individual, including information that identifies an individual or can reasonably be associated with or linked to an identifiable individual.

Services means the services that may be provided by the Company from time to time, including Money Transfer Services, OTC Virtual Currency Exchange and Settlement Services, Payroll Payment Services and other related services, in each case to the extent legally permitted, registered, authorized or otherwise available to the Company.

Third-Party Service Provider means a bank, payment service provider, exchange, liquidity provider, custodian, wallet provider, settlement provider, identity verification provider, compliance provider, blockchain analytics provider, technology provider or other third party used by the Company in connection with the Website, Services, onboarding, compliance, transaction execution, payment processing, settlement, reconciliation or record keeping.

User means any person who accesses, browses or uses the Website, submits an inquiry, sends a communication, uses a contact form or otherwise interacts with the Website before being accepted by the Company as a Customer.

Virtual Currency means a digital representation of value that may be used for payment or investment purposes and that is not Fiat Currency, including crypto-assets where they fall within the meaning of virtual currency under applicable Canadian AML/ATF requirements.

Website means the website available at https://frapex.exchange/ and any pages, content, communication tools, forms or functionality made available through that website.

You means the individual whose Personal Information is processed under this Policy, including a User, prospective Customer, Customer, Business-Related Person, payer, payee, recipient, beneficiary, payroll recipient, authorized representative or other relevant individual, as applicable. Your has a corresponding meaning.

3. SCOPE AND APPLICABLE LEGAL FRAMEWORK

This Policy applies to the collection, use, disclosure, transfer, retention and protection of Personal Information by the Company in connection with:

access to and use of the Website;
inquiries, contact forms, quote requests, messages or other communications submitted to the Company;
requests for, assessment of, or use of the Services;
Customer onboarding, identification, verification and risk assessment;
KYC/KYB, AML/ATF, sanctions, fraud-prevention, wallet screening, blockchain analytics and other compliance checks;
assessment of beneficial ownership, control, authority to act, source of funds, source of Virtual Currency, source of wealth, transaction purpose and expected activity;
processing, execution, settlement, reconciliation, monitoring, cancellation, refusal or return of transactions;
Money Transfer Services, OTC Virtual Currency Exchange and Settlement Services, Payroll Payment Services and related payment, payout, Electronic Funds Transfer, Virtual Currency, wallet, account or settlement flows;
communications with the Company;
regulatory reporting, record keeping, audit, dispute resolution, legal and contractual enforcement, security and risk-management activities; and
any other interaction with the Company in which Personal Information is collected or processed.

Where a Customer or prospective Customer is a legal entity, this Policy applies to Personal Information relating to individuals associated with that entity. Information relating solely to a legal entity is not Personal Information for the purposes of this Policy unless and to the extent that such information identifies, relates to or is otherwise linked with an identifiable individual.

The Company handles Personal Information in accordance with applicable Canadian privacy legislation, including:

the Personal Information Protection and Electronic Documents Act (hereinafter –“PIPEDA”), where applicable; and
the Personal Information Protection Act (Alberta) (hereinafter – “Alberta PIPA”), where applicable.

As a FINTRAC-registered MSB, the Company is also subject to the PCMLTFA, PCMLTFR, and other applicable AML/ATF, sanctions, recordkeeping and reporting requirements. These obligations may require the Company to collect, verify, use, disclose and retain certain Personal Information in order to comply with applicable legal and regulatory requirements.

Where payment-related Services are subject to the RPAA or related requirements applicable to payment service providers in Canada, the Company may collect, use, disclose and retain Personal Information as reasonably necessary to assess, document, perform, monitor and evidence compliance with such requirements, in each case to the extent applicable to the Company and the relevant Service.

Where the processing of Personal Information is subject to the GDPR or other EEA data protection requirements, the Company may provide a separate EU/EEA privacy notice. Such notice applies only to the extent required by applicable data protection law and does not, by itself, mean that any Service is offered, marketed, solicited or made available in the EU or EEA.

Where other federal, provincial or foreign privacy, data protection, financial crime, sanctions, payment, consumer protection, record-keeping or regulatory requirements apply to particular Personal Information, activities or individuals, such Personal Information will be handled in accordance with those requirements to the extent applicable.

4. PERSONAL INFORMATION WE COLLECT

The type and amount of Personal Information We collect depends on Your relationship with the Company, the nature of Your interaction with the Website, the Services requested or used, the relevant transaction or payment flow, the applicable compliance requirements and Applicable Law.

We may collect the following categories of Personal Information:

Contact and request information: such as Your name, email address, telephone number, preferred communication method, requested Service, requested transaction amount, requested currency, Virtual Currency, exchange pair or payment flow, and other information You provide when contacting the Company, submitting an inquiry, requesting information or communicating with Us.
Communication information: such as messages, transaction instructions, Payment Instructions, confirmations, enquiries, complaints, requests and other service-related communications exchanged with the Company through email, the Website or other communication channels, including relevant communication metadata where available.
Identity and verification information: such as full name, date of birth, nationality, citizenship, residential address, occupation, identification document details and copies, proof of address, photographs, selfie or liveness verification data and other information required to verify identity, authority, eligibility or compliance status.
Corporate and business information: where You interact with the Company in connection with a legal entity, including information concerning the entity, its business activities, place of incorporation or registration, registered and operating addresses, directors, officers, shareholders, beneficial owners, persons exercising control, authorized representatives, authorized signatories, employees, contact persons and other Business-Related Persons.
Authority and representation information: such as information and documents used to verify authority to act on behalf of a Customer, prospective Customer, legal entity, payer, payee, recipient, beneficiary or other relevant person.
Financial and source-of-funds information: such as information relating to bank accounts, payment accounts, payment instruments, payment methods, financial circumstances, business revenues or activities, source of funds, source of wealth, source of Virtual Currency, transaction purpose and supporting documentation where required for compliance, risk-assessment, transaction processing or settlement purposes.
Transaction and payment information: such as information concerning requested, proposed, reviewed, approved, rejected, delayed, cancelled, returned, executed or settled transactions, transaction amounts, currencies, exchange pairs, rates, fees, Payment Instructions, payment purpose, settlement information, payment account details, bank account details, counterparties, payers, payees, recipients, beneficiaries, payroll recipients, transaction status and related transaction records.
Virtual Currency and blockchain information: such as wallet addresses, blockchain transaction identifiers or hashes, Virtual Currency assets and networks used, wallet ownership or control information, transaction history associated with relevant wallet addresses, blockchain analytics results, KYT results, wallet-screening results and other information necessary for transaction processing, wallet screening, transaction monitoring, settlement or compliance purposes.
Compliance and risk information: such as information collected, generated or received in connection with KYC/KYB, AML/ATF, sanctions, politically exposed person / head of an international organization screening, adverse media screening, fraud prevention, risk scoring, Customer risk assessment, transaction monitoring, blockchain analytics, source-of-funds review, source-of-Virtual Currency review, source-of-wealth review, alerts, escalation decisions, internal compliance notes, regulatory inquiries, investigations and supporting documentation.
Jurisdictional and eligibility information: such as country of residence, physical location, nationality or citizenship, place of incorporation or business, declared jurisdiction, IP address, geolocation indicators, VPN or proxy indicators, access-control information, sanctions or regulatory indicators and other information used to assess jurisdictional eligibility, regulatory restrictions, fraud risk, cross-border restrictions or whether a Service may lawfully and appropriately be considered.
Website and technical Information: such as IP address, device type, browser information, operating system, access times, cookies or similar technology data and other technical information necessary to operate, protect, secure, maintain and improve the Website and related systems.
Information concerning third parties: where You provide information about another individual in connection with a Customer, prospective Customer, Business-Related Person, transaction, payment, payroll payout, beneficial ownership structure, authority to act, payee, recipient, beneficiary, counterparty or other legitimate business or compliance purpose. Where applicable, You should ensure that You are authorized or otherwise permitted to provide such information to the Company.

The Company may also collect other Personal Information where reasonably necessary to provide or assess the Services, conduct onboarding, verification or compliance procedures, process transactions, process payments, perform settlement, comply with Applicable Law, protect the Company and its systems, or for other purposes described in this Policy.

We may not collect every category of Personal Information described above in every case. The Personal Information collected will depend on the nature of Your interaction with the Company, the requested Service, the relevant jurisdiction, the type and risk profile of the proposed relationship or transaction, and applicable legal or regulatory requirements.

Information collected through cookies or similar technologies is described separately in the Company’s Cookie Policy.

5. SOURCES OF PERSONAL INFORMATION

We may collect Personal Information from different sources depending on Your interaction with the Company, the Services provided or requested, the relevant transaction or payment flow and Applicable Law.

We may collect Personal Information from the following sources:

You directly, including through the Website, email, contact forms, questionnaires, onboarding forms, documents, declarations, confirmations, Payment Instructions or other communications submitted to the Company;
the Customer or prospective Customer with which You are associated, where You act as, represent, own, control, work for, provide services to or are otherwise connected with that Customer or prospective Customer;
Business-Related Persons or other relevant individuals, including directors, officers, beneficial owners, authorized representatives, authorized signatories, employees, contact persons, payers, payees, recipients, beneficiaries, payroll recipients or counterparties, where their information is provided in connection with a legitimate business, payment, transaction or compliance purpose;
KYC/KYB, identity verification and onboarding providers, including providers supporting identity verification, business verification, beneficial ownership verification, liveness checks, document verification or related onboarding procedures;
AML/ATF, sanctions, politically exposed person / head of an international organization, adverse media, fraud-prevention, risk-screening, blockchain analytics, KYT, wallet-screening and transaction-monitoring providers;
banks, payment service providers, electronic funds transfer infrastructure providers, exchanges, custodians, liquidity providers, settlement providers, counterparties and other financial or operational service providers involved in a proposed or actual Service, transaction, payment, payout, wallet transfer, settlement or Customer relationship;
hosting, cloud, cybersecurity, communications, technical infrastructure, document-management, support and other technology or operational service providers used in connection with the Website, onboarding, communications, compliance, security or operation of the Services;
public records and lawful public sources, including corporate registries, regulatory databases, sanctions lists, court records, public websites, media sources and other publicly available information relevant to identity verification, due diligence, eligibility assessment, adverse media review, risk assessment or compliance procedures;
regulators, law enforcement agencies, courts, governmental or supervisory authorities, where information is lawfully provided or obtained in connection with regulatory, compliance, investigative, security, sanctions, legal or law-enforcement matters;
professional advisers, auditors, consultants, insurers or other third parties, where relevant to compliance, risk management, legal advice, dispute resolution, audit, insurance or protection of the rights and interests of the Company; and
other lawful sources, where collection is reasonably necessary for the purposes described in this Policy and permitted by Applicable Law.

Where Personal Information is obtained from a source other than You directly, We may combine such information with information received from You or from other lawful sources for the purposes described in this Policy.

6. HOW WE USE PERSONAL INFORMATION

We use Personal Information only for purposes reasonably necessary in connection with the Website, the Services, compliance with Applicable Law, protection of the Company’s rights and interests, and the operation, security and risk management of the Company’s business.

We may use Personal Information for the following purposes:

Purpose	How We Use Personal Information
Provision and administration of Services	To assess, prepare, communicate, provide, administer, process, execute, settle, reconcile, monitor, delay, cancel, reject, return or otherwise manage Services, including Money Transfer Services, OTC Virtual Currency Exchange and Settlement Services, Payroll Payment Services and related payment, payout, Electronic Funds Transfer, Virtual Currency, wallet, account or settlement flows.
Payment processing and settlement	To verify and administer payments, Payment Instructions, wallet transfers, bank account details, payment account details, payers, payees, recipients, beneficiaries, payroll recipients, settlement instructions, counterparties, transaction confirmations, settlement status, returns, recalls, reversals and related transaction information.
Customer onboarding and verification	To identify and verify Customers and relevant individuals, conduct KYC/KYB procedures, verify beneficial ownership, ownership structure, control, authority to act and representation rights, and obtain information concerning the purpose and intended nature of the proposed or existing relationship.
AML/ATF, sanctions and compliance check	To conduct AML/ATF, sanctions, politically exposed person / head of an international organization, adverse media, fraud-prevention, risk-based due diligence, enhanced due diligence, source-of-funds, source-of-Virtual Currency, source-of-wealth, wallet-screening, blockchain analytics, KYT and transaction-monitoring procedures.
Fraud prevention and security	To detect, prevent, investigate and respond to fraud, abuse, unauthorized activity, payment fraud, sanctions evasion, money laundering, terrorist financing, proliferation financing, cyber incidents, security incidents, misuse of the Website or Services, and other unlawful or harmful conduct.
Regulatory reporting and recordkeeping	To maintain records of inquiries, communications, onboarding procedures, eligibility assessments, compliance reviews, Customer relationships, transactions, Payment Instructions, settlement activities, decisions, reports, disclosures and other records required or permitted under Applicable Law.
Regulatory and law-enforcement cooperation	To cooperate with and respond to lawful requests, inquiries, examinations, investigations, notices, orders or other communications from FINTRAC, the Bank of Canada, privacy regulators, law enforcement agencies, courts, governmental authorities, supervisory authorities, banks, payment service providers or other competent persons.
Legal and regulatory compliance	To comply with AML/ATF, sanctions, record-keeping, reporting, tax, accounting, audit, privacy, data-security, payment, consumer protection and other legal or regulatory obligations applicable to the Company, the Website, the Services or the relevant transaction.
Retail payment activity compliance	Where payment-related Services are subject to the RPAA or related requirements applicable to payment service providers in Canada, to assess, document, perform, monitor and evidence compliance with such requirements, including in relation to payment flows, operational risk, incident handling, record keeping, reporting, safeguarding-related assessments where applicable, and regulatory inquiries.
Website operation and communication	To operate, maintain and secure and improve the Website; receive, review and respond to inquiries, contact forms, quote requests and other communications; and communicate with You regarding the Website, the Services, onboarding, compliance reviews, transactions, payment flows, settlement, complaints or other matters relating to Your interaction with the Company.
Eligibility and jurisdictional assessment	To assess whether a User, prospective Customer, Customer, Business-Related Person, transaction, payment flow, payee, recipient, beneficiary, jurisdiction or proposed relationship satisfies applicable legal, regulatory, compliance, operational, jurisdictional and risk-based eligibility requirements.
Dispute resolution and legal protection	To manage complaints, disputes, investigations, legal claims, regulatory inquiries and enforcement matters; establish, exercise, enforce or defend legal and contractual rights; and protect the rights, property, security, compliance position, regulatory status and legitimate interests of the Company, its Customers, personnel, Third-Party Service Providers and other relevant persons.
Risk management and internal controls	To maintain and improve information security, business continuity, operational resilience, internal controls, audit trails, compliance oversight, transaction monitoring, risk-management processes and fraud-prevention measures.
Other related purposes	To process Personal Information for other purposes reasonably related to those described above, where permitted by Applicable Law or with any additional notice or consent required by Applicable Law.

The Company will not use Personal Information for purposes that are materially different from those identified in this Policy unless permitted by Applicable Law or unless the Company provides additional notice or obtains consent where required.

7. CONSENT AND YOUR CHOICES

Where consent is required under Applicable Law, the Company obtains consent to the collection, use or disclosure of Personal Information. Depending on the circumstances and the sensitivity of the Personal Information involved, consent may be express or implied.

By using the Website, submitting an inquiry, communicating with the Company, requesting or using the Services, providing Personal Information, or allowing Personal Information to be provided to the Company on Your behalf, You acknowledge that Personal Information may be collected, used, disclosed, transferred, retained and otherwise processed in accordance with this Policy and Applicable Law.

You may withdraw consent to the collection, use or disclosure of Personal Information, subject to reasonable notice and applicable legal, regulatory, contractual and operational restrictions.

Where Personal Information is necessary for onboarding, verification, compliance checks, transaction processing, payment processing, settlement, reconciliation, record keeping, regulatory reporting, fraud prevention, sanctions screening, AML/ATF compliance or the provision of the Services, withdrawal of consent may prevent the Company from establishing or continuing a relationship, providing a Service, processing a transaction or maintaining a communication channel with You.

The Company may collect, use, disclose, transfer, retain or otherwise process Personal Information without consent where required or permitted by Applicable Law. This may include processing necessary to comply with AML/ATF and sanctions requirements, regulatory reporting and record-keeping obligations, court orders, lawful requests from competent authorities, fraud-prevention measures, security obligations, legal claims or other circumstances permitted by Applicable Law.

Where the Company intends to use or disclose Personal Information for a new purpose that was not previously identified and that requires consent under Applicable Law, the Company will obtain additional consent where required.

You may manage or limit certain cookies and similar technologies through Your browser settings and, where available, the relevant controls provided on the Website. More information about cookies and similar technologies may be provided in the Company’s Cookie Policy.

Where the processing of Personal Information is subject to the GDPR or other European Economic Area data protection requirements, additional rights, choices and legal bases may apply as described in the separate EU/EEA privacy notice.

8. HOW WE SHARE PERSONAL INFORMATION

The Company does not sell, rent or trade Personal Information to third parties for marketing, advertising or other commercial purposes.

We may disclose or share Personal Information where necessary or appropriate for the purposes described in this Policy and where permitted or required by Applicable Law.

Depending on the circumstances, Personal Information may be shared with the following categories of recipients:

Recipient	Purpose of Disclosure
Technology and operational service providers	Providers of hosting, cloud infrastructure, communications, cybersecurity, data storage, IT support and other technology or operational services used by the Company.
Verification and compliance providers	Identity verification and KYC/KYB providers, sanctions screening providers, politically exposed person / head of an international organization screening providers, adverse media screening providers, blockchain analytics providers, KYT providers, wallet-screening providers, transaction-monitoring providers, fraud-prevention providers and other compliance or risk-assessment providers.
Banks, financial institutions and payment service providers	Banks, financial institutions, payment service providers, electronic funds transfer infrastructure providers, payment processors, settlement providers, intermediaries and other financial or payment-related counterparties involved in receiving, processing, verifying, settling, returning, reconciling or otherwise administering payments, payouts, Electronic Funds Transfers or related transaction flows.
Virtual Currency and liquidity providers	Virtual Currency exchanges, OTC liquidity providers, custodians, wallet providers, settlement providers, blockchain infrastructure providers and other Virtual Currency infrastructure providers involved in the execution, settlement, monitoring or administration of a transaction.
Professional advisers and auditors	Lawyers, accountants, auditors, consultants and other professional advisers where access to Personal Information is reasonably necessary for the services they provide to Us.
Counterparties and transaction-related persons	Payers, payees, recipients, beneficiaries, payroll recipients, counterparties, authorized representatives and other persons where disclosure is reasonably necessary to process, verify, execute, settle, reconcile, return, investigate or document a Service, transaction, payment, payout or transfer.
Regulatory and public authorities	FINTRAC, the Bank of Canada, privacy regulators, tax authorities, law enforcement agencies, courts and other governmental or competent authorities where disclosure is required or permitted by Applicable Law, regulatory requirements, legal process, investigation, examination, reporting obligation or lawful request.
Corporate transaction parties	Prospective purchasers, investors, financing parties, transaction counterparties and their advisers in connection with a proposed or completed merger, acquisition, financing, restructuring, sale of assets, transfer of business or other corporate transaction, subject to appropriate confidentiality measures where applicable.
Other third parties	Where disclosure is reasonably necessary to comply with Applicable Law, respond to legal or regulatory process, protect legal rights, prevent or investigate fraud or misconduct, enforce contractual rights, protect the security or integrity of the Website or Services, or otherwise pursue the purposes described in this Policy.

Where the Company engages Third-Party Service Providers to process Personal Information on its behalf, the Company takes reasonable measures, where appropriate and subject to Applicable Law, to require such providers to process Personal Information only for authorized purposes and to apply appropriate confidentiality, security and data-protection safeguards.

Certain recipients, including banks, financial institutions, exchanges, payment service providers, regulators, public authorities or other regulated counterparties, may process Personal Information for their own purposes and under their own legal or regulatory obligations. In such cases, their processing may be governed by their own privacy notices, legal duties and regulatory requirements.

9. CROSS-BORDER PROCESSING AND TRANSFERS

Personal information may be transferred to, stored in, accessed from or otherwise processed in jurisdictions outside Canada where necessary for the purposes described in this Policy.

Such transfers may involve Third-Party Service Providers, banks, payment service providers, exchanges, custodians, liquidity providers, compliance providers, blockchain analytics providers, technology providers, cloud or infrastructure providers, professional advisers, regulators, public authorities or other recipients located in Canada, the EU, the EEA or other jurisdictions.

Where Personal Information is transferred outside Canada, it may be subject to the laws of the jurisdiction in which it is processed and may be accessible to courts, law enforcement agencies, regulators or governmental authorities in accordance with applicable local laws.

The Company remains responsible for Personal Information transferred to Third-Party Service Providers for processing on its behalf and uses contractual, organizational, technical or other appropriate measures to require such providers to provide a level of protection consistent with applicable Canadian privacy requirements.

Where required by Applicable Law, We will provide any additional notice or information required in connection with the processing of Personal Information outside Canada.

Individuals may obtain information about the Company’s policies and practices relating to service providers located outside Canada, including information regarding the countries in which such service providers may process Personal Information, by contacting the Company using the contact details set out in this Policy.

Where and to the extent that the processing of Personal Information is subject to the GDPR or other EEA data protection requirements, additional information regarding international transfers, transfer safeguards and related rights may be provided in the separate EU/EEA privacy notice.

10. RETENTION AND DISPOSAL OF PERSONAL INFORMATION

The Company retains Personal Information only for as long as reasonably necessary to fulfil the purposes for which it was collected, to provide or assess the Services, to maintain records, to comply with Applicable Law and to establish, exercise or defend legal or contractual rights.

Retention periods may vary depending on the category of Personal Information, the nature of Your relationship with the Company, the relevant Service, the relevant transaction or payment flow, the sensitivity of the information, the applicable legal or regulatory requirements and the need to maintain appropriate business, compliance, audit, security, dispute-resolution or legal records.

Personal Information may be retained for purposes including onboarding, KYC/KYB, AML/ATF compliance, sanctions screening, fraud prevention, transaction monitoring, blockchain analytics, regulatory reporting, payment processing, settlement, reconciliation, audit, tax, accounting, information security, dispute resolution, legal defence, enforcement of contractual rights and other legitimate business or regulatory purposes.

Different retention periods may apply to different categories of Personal Information, including:

Website and technical information, including access logs, security logs, cookies or similar technology data and technical records, retained for the period reasonably necessary for security, troubleshooting, fraud prevention, access control, system integrity and related operational purposes;
inquiry, contact form, quote request and communication information where no Customer relationship is established, retained for the period reasonably necessary to respond to the inquiry, prevent abuse or duplicate onboarding, document the circumstances of the request, apply jurisdictional restrictions and address applicable legal, compliance, dispute-related or regulatory requirements;
KYC/KYB, identity verification, beneficial ownership, authority to act, AML/ATF, sanctions, risk-assessment and other compliance records, retained for the period required or permitted under Applicable Law, including applicable PCMLTFA, PCMLTFR, FINTRAC and sanctions-related requirements;
transaction, payment, payout, Electronic Funds Transfer, wallet, blockchain, Virtual Currency, settlement and reconciliation records, retained for the applicable statutory or regulatory record-keeping period and, where permitted, for such additional period as may reasonably be necessary for reconciliation, audit, tax, legal, compliance, fraud-prevention or dispute-resolution purposes;
regulatory reports and related records, including records associated with suspicious transaction reporting, large virtual currency transaction reporting, sanctions-related reporting, regulatory inquiries or other mandatory regulatory filings, retained for the applicable period prescribed by the relevant regulatory framework;
records relating to payment-related Services, payment flows, operational risk, incident handling, provider arrangements, regulatory communications and related compliance matters, where retention is necessary or appropriate under Applicable Law or the Company’s regulatory obligations;
email and other service-related communications, retained where necessary or permitted for onboarding, transaction review, AML/ATF and sanctions compliance, record keeping, audit, dispute resolution, legal defence, fraud prevention, regulatory reporting or other purposes described in this Policy;
complaint, dispute, investigation, litigation and enforcement records, retained for the period reasonably necessary to manage the relevant matter, comply with applicable limitation periods and protect or enforce the rights and interests of the Company; and
security incident and cybersecurity records, retained for the period reasonably necessary to investigate and remediate incidents, protect systems and Personal Information, satisfy audit requirements and comply with applicable security or breach-notification obligations.

Certain Personal Information and records collected or generated in connection with the Company’s AML/ATF obligations are subject to mandatory retention periods under the PCMLTFA, the PCMLTFR and applicable FINTRAC requirements. Depending on the type of record, applicable records may be required to be retained for at least five years from the date or event specified by Applicable Law.

Personal Information may be retained for a longer period where required or permitted by Applicable Law, regulatory request, court order, legal hold, audit, investigation, dispute, enforcement proceeding, limitation period or other legitimate legal or compliance requirement.

When Personal Information is no longer required and there is no legal, regulatory, contractual or legitimate business reason requiring its continued retention, the Company will securely delete, destroy or anonymize it, as appropriate. Where Personal Information is held by Third-Party Service Providers on the Company’s behalf, the Company takes reasonable measures to require secure deletion, destruction or anonymization in accordance with applicable privacy requirements and contractual arrangements with such providers.

11. HOW WE PROTECT PERSONAL INFORMATION

The Company maintains reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the Personal Information in its possession or under its control.

Such safeguards may include, as appropriate:

administrative safeguards, including internal privacy and security procedures, confidentiality obligations, staff training, access controls and limiting access to Personal Information on a need-to-know basis;
technical safeguards, including authentication measures, password protection, system access controls, encryption of sensitive information, secure transmission channels, security logging and other measures designed to prevent unauthorized access to electronic information and systems; and
physical safeguards, including restricted access to premises, equipment and physical records containing Personal Information and secure storage of such records;
vendor and Third-Party Service Provider safeguards, including due diligence, contractual confidentiality, security and data-protection requirements, where appropriate and subject to Applicable Law;
operational safeguards, including incident-response procedures, fraud-prevention processes, business-continuity measures, access reviews and internal controls relating to onboarding, compliance, transaction and payment records; and
record-retention and disposal safeguards, including secure retention, archiving, deletion, destruction or anonymization procedures.

Where Third Party Service Providers process Personal Information on Our behalf, We take reasonable measures to require them to maintain appropriate safeguards for the Personal Information they process.

The Company reviews and updates its safeguards as appropriate to address changes in the sensitivity of Personal Information, technology, operational arrangements, regulatory requirements and security risks.

However, no method of electronic transmission, communication, processing or storage is completely secure. The Company cannot guarantee absolute security of Personal Information.

You are responsible for taking reasonable precautions when communicating with the Company, including protecting Your devices, accounts, authentication credentials and communication channels, and avoiding the transmission of unnecessary sensitive information through unsecured or unauthorized channels.

The Company will not request that You provide private keys, seed phrases, wallet recovery phrases, withdrawal credentials, passwords or other credentials that would enable unilateral access to Your wallet, account or digital assets.

12. ACCURACY AND UPDATING YOUR INFORMATION

We take reasonable steps to ensure that Personal Information used by the Company is accurate, complete and up to date to the extent necessary for the purposes for which it is used.

You are responsible for providing accurate and current Personal Information and for informing Us of any material changes to information previously provided. This includes changes relevant to identity, contact details, residence, citizenship, authority to act, beneficial ownership, ownership or control, business activity, source of funds, source of Virtual Currency, bank account details, payment account details, wallet details, Payee, Recipient or Beneficiary information, transaction purpose or any other information relevant to onboarding, compliance, transaction processing, payment processing, settlement or the Services.

The Company may request updated information, confirmations, explanations or supporting documentation where necessary to verify the accuracy of Personal Information, maintain records, complete onboarding, conduct ongoing monitoring, process a transaction, perform settlement, respond to a privacy request or comply with Applicable Law.

If Personal Information provided to the Company is inaccurate, incomplete, outdated, inconsistent or cannot be verified, the Company may be unable to complete onboarding, establish or continue a Customer relationship, provide a Service, process a transaction, process a payment, complete settlement or respond to a request.

13. YOUR PRIVACY RIGHTS AND REQUESTS

Subject to Applicable Law, You may have the right to:

request access to Personal Information about You held by the Company, subject to applicable legal limitations;
request information about the use and disclosure of Your Personal Information, where such right is available under Applicable Law;
challenge the accuracy or completeness of Your Personal Information and request that inaccurate or incomplete information be corrected or updated;
withdraw consent to the collection, use or disclosure of Personal Information where processing is based on consent, subject to Applicable Law and applicable legal, regulatory, contractual and operational restrictions;
raise a question, concern or complaint regarding the Company’s handling of Personal Information or its compliance with applicable privacy requirements; and
exercise any other privacy right available to You under Applicable Law.

These rights are subject to applicable legal exceptions, limitations and procedural requirements. In particular, the Company may be required or permitted to retain, use, disclose or restrict access to certain Personal Information where necessary or appropriate for purposes including:

AML/ATF, sanctions, fraud-prevention or other financial-crime compliance;
KYC/KYB, identity verification, beneficial ownership verification, source-of-funds review, source-of-Virtual Currency review or source-of-wealth review;
transaction processing, payment processing, settlement, reconciliation, returns, recalls, investigations or dispute resolution;
regulatory reporting, record keeping, audit, tax, accounting or legal obligations;
cybersecurity, fraud prevention, incident response or protection of the Website, Services, Customers, Third-Party Service Providers or other relevant persons;
compliance with court orders, regulatory requests, law-enforcement requests, legal holds or other lawful requirements;
establishment, exercise, enforcement or defence of legal or contractual rights; or
other purposes for which continued processing is required or permitted by Applicable Law.

The Company may request information reasonably necessary to verify Your identity and authority before responding to a privacy request.

Where a request concerns Personal Information processed in connection with a Customer, legal entity, transaction, payment, payout, settlement flow, Business-Related Person, payer, payee, recipient, beneficiary or other third party, the Company may take additional steps to verify the request, protect the rights and information of other persons and comply with Applicable Law.

Privacy requests will be reviewed and responded to within the time periods required by Applicable Law. Where access to Personal Information is refused or restricted, the Company will provide the reasons for such refusal or restriction and information regarding available recourse, where required by Applicable Law.

Where and to the extent that the processing of Personal Information is subject to the GDPR or other EEA data protection requirements, additional rights, limitations and procedures may apply as described in the separate EU/EEA privacy notice.

14. THIRD-PARTY WEBSITES AND SERVICES

The Website, communications from the Company or processes related to the Services may contain links to, integrate with or direct You to third-party websites, platforms, tools or services.

Such third-party websites, platforms, tools or services may include communication platforms, identity verification providers, KYC/KYB providers, payment service providers, banks, exchanges, custodians, liquidity providers, settlement providers, blockchain analytics providers, wallet-screening providers, compliance providers, document-management providers or other operational or compliance service providers.

Third-party websites, platforms and services operate independently and are generally governed by their own terms of use, privacy policies, security practices and other applicable policies.

Where You independently access a third-party website, platform or service, or provide Personal Information directly to an independent third party, the collection, use, disclosure, retention and protection of such information is governed by that third party’s own privacy practices and Applicable Law.

Where a third party processes Personal Information for its own purposes or under its own legal or regulatory obligations, such processing may be subject to that third party’s own privacy notice, legal duties and regulatory requirements.

Where a Third-Party Service Provider processes Personal Information on behalf of the Company, the Company takes reasonable measures, where appropriate and subject to Applicable Law, to require appropriate contractual, confidentiality, security and data-protection safeguards.

The Company is not responsible for the independent privacy, security or data-handling practices of third parties that are not acting on behalf of the Company or under the Company’s control, except to the extent responsibility cannot lawfully be excluded or arises under applicable contractual or legal obligations.

You should review the privacy policies, terms and other relevant notices of any third-party website, platform or service that You use or access in connection with the Website or the Services.

15. CHILDREN’S PRIVACY

The Website and the Services are not intended for persons under the age of 18.

The Company does not knowingly provide Services to, accept as Customers, or collect Personal Information for onboarding, verification, compliance, transaction, payment or settlement purposes from, individuals under the age of 18.

The Company may verify age as part of its identification and onboarding procedures. If the Company becomes aware that Personal Information relating to an individual under the age of 18 has been collected in circumstances inconsistent with this Policy or Applicable Law, the Company will take appropriate steps to restrict further processing and handle such Personal Information in accordance with applicable privacy, legal, regulatory and record-keeping requirements.

If You believe that an individual under the age of 18 has provided Personal Information through the Website or otherwise to the Company, please contact the Company so that the matter can be reviewed and appropriate action taken.

16. PRIVACY INCIDENTS AND BREACH MANAGEMENT

In the event of an actual or suspected breach of security safeguards involving Personal Information, We will assess the nature and circumstances of the incident and take appropriate measures to contain, investigate and address it.

Such measures may include restricting access, securing affected systems, preserving relevant records, assessing the categories and sensitivity of Personal Information involved, identifying affected individuals or systems, engaging relevant Third-Party Service Providers, implementing remedial measures and reviewing applicable legal, regulatory and contractual notification requirements.

Where a breach gives rise to a real risk of significant harm or otherwise meets an applicable statutory notification threshold, the Company will report the breach to the applicable privacy regulator and notify affected individuals as required by Applicable Law.

The determination of whether notification is required, and the timing, content and method of any notification, will depend on the nature and circumstances of the incident, the categories and sensitivity of the Personal Information involved, the actual or reasonably foreseeable risk arising from the incident, Applicable Law, law-enforcement considerations and remedial measures taken.

Where a privacy incident involves a Third-Party Service Provider processing Personal Information on behalf of the Company, the Company may require that provider to cooperate with the investigation, containment, remediation and notification process in accordance with applicable contractual and legal requirements.

We maintain records of breaches involving Personal Information in accordance with Applicable Law.

17. CHANGES TO THIS PRIVACY POLICY

The Company may update, amend, supplement or replace this Policy from time to time to reflect changes in Applicable Law, regulatory guidance, the Website, the Services, business activities, payment methods, settlement arrangements, technologies used, Third-Party Service Providers, privacy practices, security measures, risk-management practices or operational considerations.

Any updated version of this Policy will be made available through the Website and will indicate the date on which it was last updated.

Where appropriate or required by Applicable Law, the Company may provide notice of material changes, including by posting the updated Policy on the Website or through other communication channels used in connection with Your relationship with the Company.

Where a change involves the collection, use or disclosure of Personal Information for a new purpose not previously identified, the Company will obtain additional consent where required by Applicable Law.

Where a separate EU/EEA privacy notice applies to particular processing activities, such notice may be updated separately to reflect changes in applicable data protection requirements or the Company’s processing practices relating to such activities.

The Company encourages You to review this Policy periodically to remain informed about how Personal Information is collected, used, disclosed, transferred, retained and protected.

18. PRIVACY REQUESTS AND CONTACT INFORMATION

The Company has designated a person responsible for overseeing compliance with applicable privacy requirements and the Company’s handling and protection of Personal Information (hereinafter – “Privacy Contact”).

Requests to exercise privacy rights, as well as privacy-related questions, complaints, notices or other communications, may be submitted to the Company using the contact details provided below and will be handled under the oversight of the Privacy Contact.

The Company may request additional information where reasonably necessary to verify Your identity and authority, identify the relevant relationship, transaction, payment flow, Customer, Business-Related Person or record, and process Your request in accordance with Applicable Law.

Where Your request relates to Personal Information processed in connection with a specific Customer relationship, onboarding process, Service, transaction, payment, payout, settlement, Business-Related Person, payer, payee, recipient, beneficiary or other relevant matter, You should include sufficient information to allow the Company to identify the relevant matter.

Where and to the extent that the processing of Personal Information is subject to the GDPR or other EEA data protection requirements, additional rights, procedures and contact arrangements may apply as described in the separate EU/EEA privacy notice.

Privacy requests, questions and complaints may be submitted to:

Company name : Frapex Inc.

Registered address: 700-602 12 Ave SW Calgary, Alberta, T2R 1J3, Canada.

Website: https://frapex.exchange/

Email: officialfrapexinc@gmail.com

If You are not satisfied with the Company’s response to a privacy complaint, You may have the right to submit a complaint to the Office of the Information and Privacy Commissioner of Alberta, the Office of the Privacy Commissioner of Canada or another competent privacy or data protection authority, as applicable.