Privacy Policy

To facilitate deposits, transfers, withdrawals, and currency exchanges, Korrency must share information with regulated financial institutions and payment partners. Such disclosures may include beneficiary details, account numbers, transaction amounts, and reference information required for execution and settlement. This may involve:

• Canadian and foreign correspondent banks;
• Payment processors and settlement agents;
• Mobile wallet operators and payout providers; and
• Payment networks (e.g., Interac, SEPA, FPS, CHAPS, BACS, SWIFT).

For client onboarding, ongoing monitoring, and compliance with AML/CTF obligations, Korrency engages third-party service providers to:

• Validate government-issued identification and biometric checks;
• Conduct politically exposed person (PEP), sanctions, and adverse media screening; and
• Provide fraud prevention and risk assessment services.

Information shared for these purposes is strictly limited to what is necessary for verification and compliance, and providers are contractually restricted from using it for any other purpose.

Korrency may disclose personal information to regulators, law enforcement agencies, or judicial authorities where legally required or permitted. Examples include:

• Reporting obligations to FINTRAC, such as Suspicious Transaction Reports (STRs), Large Cash Transaction Reports (LCTRs), and Electronic Funds Transfer Reports (EFTRs);
• Compliance with subpoenas, search warrants, or court orders; and
• Cooperation with domestic or foreign regulatory authorities in the context of supervision, audits, or investigations.

All such disclosures are reviewed to ensure they are lawful, properly authorised, and proportionate.

Korrency engages third-party vendors to provide operational and technical support. These include providers of:

• Cloud hosting and secure data storage;
• IT infrastructure and cybersecurity services;
• Customer support platforms and communication services; and
• Analytics and performance monitoring tools.

Vendors act as data processors on behalf of Korrency and are bound by contractual obligations to maintain confidentiality, implement appropriate safeguards, and process data only in accordance with Korrency’s instructions.

At present, Korrency does not share personal information with corporate affiliates for joint business purposes. Should such sharing occur in the future, it will be limited to clearly defined purposes consistent with this Policy, and subject to equivalent safeguards.

Where a client registers through a referral program or promotional campaign, Korrency may confirm limited information to the referring party, such as whether an account was successfully created or a referral reward earned. Such disclosures are made only with the client’s consent and do not include financial or sensitive personal information.

Korrency does not sell personal information to third parties. Personal information is not monetised through advertising networks, data brokers, or similar commercial arrangements.

Every disclosure of information by Korrency is subject to safeguards, including but not limited to:

• Data minimisation: limiting disclosures to the minimum information required for the stated purpose;
• Contractual protections: requiring third parties to comply with confidentiality, security, and data protection obligations;
• Technical safeguards: including encryption in transit and at rest;
• Due diligence and monitoring: assessing third parties for compliance with applicable laws and industry standards.

These measures ensure that information remains protected regardless of the recipient or jurisdiction.

You have the right to request confirmation of whether Korrency holds personal information about you and, if so, to obtain access to such information. Subject to limited exceptions prescribed by law (e.g., information that would reveal confidential commercial information or information relating to another individual), we will provide you with access within the timelines required by applicable law.

You have the right to request correction of personal information that is inaccurate, incomplete, or outdated. Korrency will update or amend records as appropriate and notify third parties to whom the information has been disclosed, where feasible.

In jurisdictions recognising this right (e.g., under the GDPR/UK GDPR), you may request deletion of your personal information where:

• The information is no longer necessary for the purposes for which it was collected;
• You withdraw consent and no other legal basis exists for the processing;
• You object to processing and no overriding legitimate grounds apply; or
• The information has been unlawfully processed.

This right is subject to statutory and regulatory retention obligations, including AML/CTF recordkeeping requirements.

You may request restriction of processing of your personal information where:

• You contest the accuracy of the information (pending verification);
• Processing is unlawful and you oppose erasure;
• Korrency no longer requires the information but you need it for legal claims; or
• You have objected to processing and verification of overriding legitimate grounds is pending.

Where processing is restricted, information will be retained but not further processed except as authorised by law.

Where recognised by law (e.g., GDPR/UK GDPR), you may request a copy of your personal information in a structured, commonly used, and machine-readable format, and you may request that we transmit this information to another service provider where technically feasible.

You may object, at any time, to:

• Direct marketing communications (including profiling related to marketing). Such objections will be respected without exception.
• Processing based on legitimate interests, where your rights and freedoms override our interests. Korrency will cease processing unless compelling legitimate grounds exist.

Where processing is based on your consent, you may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Certain withdrawals (e.g., for identity verification or AML/CTF purposes) may result in Korrency being unable to continue providing services.

Where decisions with legal or similarly significant effects are made solely through automated means, you have the right to request human intervention, express your point of view, and contest the decision. This right is particularly relevant to fraud detection and transaction monitoring systems.

• Canada: If you believe your rights under PIPEDA have been infringed, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPC).
• United Kingdom: Complaints may be lodged with the Information Commissioner’s Office (ICO).
• European Union: Complaints may be filed with the supervisory authority in the Member State of your residence, place of work, or where the alleged infringement occurred.
• Other jurisdictions: You may have equivalent rights to lodge complaints with your local data protection authority.

Korrency encourages clients to raise concerns directly with our Privacy Office in the first instance, and we will make reasonable efforts to resolve issues promptly and fairly.

• Encryption: Data is encrypted both in transit (e.g., TLS/SSL) and at rest using strong cryptographic protocols.
• Monitoring: Systems are continuously monitored for unauthorised access, suspicious activity, and vulnerabilities.
• Access controls: Role-based access is implemented, ensuring that only authorised personnel can access sensitive data.
• Secure hosting: Data is hosted in secure, audited data centres with redundancy and disaster recovery capabilities.

• Limited employee access: Access to personal data is restricted to personnel who require it for legitimate business purposes.
• Background checks: Employees and contractors with access to sensitive data are subject to appropriate vetting.
• Training: Staff receive mandatory training on privacy, data protection, and information security practices.

Korrency employs automated and manual controls to detect and prevent fraudulent or suspicious activity. These include transaction monitoring, behavioural analytics, and anomaly detection tools designed to safeguard both the platform and its users.

In the event of a security incident, Korrency follows documented response protocols, including:

• Immediate containment and mitigation of the incident;
• Investigation and remediation of the root cause;
• Notification of affected individuals and regulators, where required by law;
• Implementation of corrective measures to prevent recurrence.

While Korrency employs robust measures to secure information, no system of transmission or storage can be guaranteed to be entirely secure. Clients acknowledge this limitation, while Korrency remains committed to maintaining the highest practicable level of protection.