Privacy Policy
1. Who is responsible for your information
This Privacy Policy explains how FINYARD PAYMENTS LTD, trading as KYX Pay (“KYX Pay”, “we”, “us” or “our”), collects, uses, discloses, stores and protects personal information when you visit kyx-pay.io, contact us, apply for or use our business accounts, payment, foreign exchange or digital asset-related services, or act on behalf of a business customer.
FINYARD PAYMENTS LTD is incorporated in British Columbia, Canada (company number BC1573940). Its registered address is 373-901 3rd Street West, North Vancouver, BC V7P 3P9, Canada. FINTRAC MSB registration number: N300000885. These registration particulars must be checked against current official records before publication.
We generally provide services to businesses, but we process personal information about their directors, shareholders, beneficial owners, employees, authorised users, counterparties and other individuals. This policy applies to that personal information. A business’s non-personal corporate information may also be subject to confidentiality and contractual protections.
2. Information provided through this website
We may collect: (a) identity and contact information, including name, date of birth, nationality, residential or business address, telephone number, email, government-issued identity document details and photographs; (b) business and due-diligence information, including job title, ownership and control, beneficial ownership, tax residency, professional background, source of funds, source of wealth, business activity, licensing and regulatory status; (c) account and transaction information, including account identifiers, balances, transaction amounts, currencies, beneficiaries, counterparties, payment references, invoices and supporting documentation; (d) digital asset information where relevant, including public wallet addresses, blockchain transaction identifiers, blockchain analytics results, wallet ownership evidence and screening flags; (e) technical and usage information, including IP address, device identifiers, browser and operating-system details, access logs, approximate location derived from IP address, security events and cookie preferences; (f) communications, including enquiries, complaints, support correspondence and call recordings where lawful and notified; and (g) fraud, sanctions, adverse media, politically exposed person and other risk- screening results. We may obtain information directly from you, from your employer or the business you represent, from payment and banking partners, identity verification vendors, fraud prevention and blockchain analytics providers, public registers, credit or business information agencies, counterparties and lawful government or regulatory sources.
3. Why we use information
We use personal information to: assess applications and establish customer relationships; verify identity, beneficial ownership and authority; conduct know-your-customer, know-your-business, anti-money laundering, counter-terrorist financing, sanctions and fraud checks; provide and administer accounts, payments, FX and eligible digital asset-related services; process, trace, reconcile and investigate transactions; manage account access, cybersecurity and service continuity; respond to enquiries and complaints; maintain records, perform audits and comply with reporting, regulatory, tax and legal obligations; assess credit, operational and financial-crime risks; enforce contractual rights and protect customers, our business and the financial system; improve service quality and understand website performance; and send business marketing where permitted by law and your communication preferences.
We use information only for identified purposes, compatible purposes or other purposes permitted or required by applicable law. Where consent is required, we will seek it and explain available choices. We do not sell personal information.
4. Legal grounds and consent
Our processing is governed principally by applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, British Columbia’s Personal Information Protection Act. Specific activities may also be required by anti-money laundering, payment, sanctions and other financial-services laws. Depending on the law that applies to you, our grounds for processing may include your consent, performance of a contract, compliance with a legal obligation and legitimate interests that are not overridden by applicable individual rights. Where the EU or UK data protection rules apply to a particular activity, we will rely on an appropriate lawful basis and provide any additional required disclosures. You may withdraw consent where permitted, but withdrawal may prevent us from providing services or retaining an account and does not override mandatory recordkeeping obligations.
5. Identity verification and higher-risk businesses
We may apply enhanced due diligence to customers operating in sectors such as cryptocurrency, digital assets, gaming and gambling. This may involve collecting evidence of licences, ownership, source of wealth, source of funds, customer due diligence controls, transaction purposes, geographic exposure, payment flows and wallet provenance.
We may use sanctions, fraud, adverse-media and blockchain screening tools, including automated risk indicators, to flag activity for additional review. Material decisions about onboarding, restrictions or termination are subject to our risk and compliance processes, as applicable. No approval is guaranteed solely because an industry is within our commercial risk appetite.
6. When we share information
We may disclose relevant personal information to: banks, payment service providers, account infrastructure partners, correspondent banks, settlement and FX providers, digital asset or custody partners where applicable; identity verification, screening, fraud prevention, blockchain analytics, hosting, cybersecurity, communications and customer-support providers; auditors, insurers, professional advisers and prospective purchasers or successors in a business transaction subject to appropriate safeguards; counterparties and their financial institutions to execute or investigate payments; and FINTRAC, the Bank of Canada, law enforcement, tax authorities, courts and other regulators or authorities when required or permitted by law. We share only information reasonably necessary for the purpose and use contractual, organisational or other appropriate safeguards. Third-party providers may also act as independent controllers or organisations responsible for personal information under their own privacy notices, depending on the service and legal arrangements.
7. International transfers
Because KYX Pay operates in cross-border financial services, information may be processed or accessed in Canada and other jurisdictions where we or our providers operate. Foreign laws may permit courts, regulators or law enforcement to access information in those jurisdictions. We apply reasonable contractual and technical protections to international transfers and any additional transfer mechanism required by applicable law.
8. How long we keep information
We retain personal information for as long as reasonably necessary for the purposes described here, including the customer relationship, disputes, fraud prevention, legal claims and statutory recordkeeping. Certain identity and transaction records must be retained for periods prescribed by applicable anti-money laundering and other laws; those periods may extend beyond account closure. We securely delete, anonymise or otherwise dispose of information when no longer required, subject to legal holds and lawful exceptions. Specific retention schedules depend on the record category and applicable legal requirement.
9. Security
We use risk-appropriate administrative, technical and physical safeguards designed to protect information against loss, theft, unauthorised access, disclosure, alteration and misuse. Measures may include access controls, authentication, encryption where appropriate, monitoring, vendor due diligence, staff confidentiality obligations and incident-response procedures. No internet transmission or system is completely secure. Please notify us promptly if you suspect account compromise or misuse of personal information
10. Cookies and analytics
Our website may use strictly necessary cookies and similar technologies to operate the site, maintain security and remember preferences. We may also use analytics or marketing technologies, but only where implemented and subject to the notice and consent requirements applicable to those technologies and visitors. Details of actual cookies, providers, purposes, duration and available controls should be set out in a separate Cookie Policy or cookie settings panel before deployment. You may also manage cookies through your browser, although disabling essential cookies may affect site functionality.
11. Marketing
Where permitted, we may send information about KYX Pay products, services and business developments. We will obtain consent where required, including under applicable Canadian anti-spam legislation, and provide a clear unsubscribe mechanism for electronic marketing. Operational, security and legally required messages are not marketing and may continue while relevant.
12. Your privacy choices and rights
Subject to applicable law, you may request access to personal information we hold about you, ask us to correct inaccurate information, withdraw consent where consent is the basis for processing, or raise a concern about our practices. Depending on your jurisdiction, additional rights may include erasure, restriction, portability, objection and rights relating to certain automated decisions. These rights are not absolute: we may need to retain or withhold information to comply with financial-crime laws, protect others, preserve legal privilege or satisfy other legal obligations.
To exercise a right, contact our Privacy Officer using the details below. We may need to verify your identity and authority before acting. We will respond within the time required by applicable law and explain any lawful refusal.
13. Children
KYX Pay provides business services and does not knowingly target children or solicit personal information from them through the website. If we become aware that we have collected information from a child without a lawful basis, we will take appropriate steps to address it.
14. External websites and public blockchains
Our website may link to third-party sites governed by their own privacy practices. We are not responsible for those sites. Public blockchain records may be visible to anyone and can be persistent or practically irreversible. Information linked to a public wallet address or transaction may therefore remain publicly accessible independently of KYX Pay’s systems. We cannot generally erase data from a public blockchain.
15. Changes to this policy
We may update this Privacy Policy to reflect changes in law, services, technology or processing practices. We will publish the revised version and its effective date on kyx-pay.io and provide additional notice or seek consent where required by applicable law.
16. Contact and complaints
Privacy Officer — FINYARD PAYMENTS LTD (trading as KYX Pay)
Registered address: 373-901 3rd Street West, North Vancouver, BC V7P 3P9, Canada
Website: https://kyx-pay.io
Privacy email: info@kyx-pay.io
You may contact us to ask questions, exercise privacy rights or complain about our handling of personal information. If unresolved, you may be entitled to complain to the Office of the Privacy Commissioner of Canada or the applicable provincial privacy commissioner or other competent data protection authority.