Privacy Policy
Date of Last Modified: 2026 – 10 – 16
This Privacy Policy explains how Acanis Major Corp., a corporation incorporated under the laws of the Province of Ontario, Canada ("Acanis", "we", "us" or "our"), collects, uses, discloses, protects and retains Personal Data inconnection with its Website, platform and Services. It should be readwith our General Terms and Conditions. Acanis is responsible for Personal Data under its control under the Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable privacy laws. "Personal Data" means information about an identifiable individual; information about a legal entity is coveredby this Policy to the extent that it identifies an individual.
Acanis Major Corp.’s registered office and postal contact address is 30 Wertheim Court, Unit 12, Suite 201, Richmond Hill, Ontario, L4B 1B9, Canada. We use Personal Data for the purposes explained in this Policy and apply safeguards appropriate to its sensitivity. Privacy questions, requests and complaints may be addressed to the person responsible for privacy compliance through the Contact section below.
Acanis Major Corp. processes Personal Data in connection with the provision of money services and payment services within the scope of the activities recorded in its FINTRAC registration and subject to applicable legal and regulatory requirements, and to maintain therelated compliance, security and transaction records (the"Services"). The particular Services made available to a client are described in the applicable agreements, terms and service information.
Please read this document carefully in order to understand our approach and policy regarding your Personal Data and how we will use your Personal Data.
This Policy explains our practices; publication of the Policy does not, by itself, constitute your consent to optional uses of Personal Data.
What Data We Collect About You
We process Personal Data about individuals connected with those clients or their payments, including directors, authorised representatives,beneficial owners, authorised users, senders and beneficiaries, as well as individuals who contact us or use our Website. An individual’s involvement in a payment, or status as an end user under applicable payment legislation, does not by itself make that individual an onboarded client. The categories below are collected only where reasonably necessary for identified purposes; not every category is collected from every person.
Information You Give to Us
You may provide information to us through forms on our Website, by phone, email, video conference or other communications. This includes Personal Data provided when registering for or using our Services, submitting payment instructions, completing identity verification, communicating with client support, or choosing to participate in a promotion or survey. If a communication is recorded, we explain the recording and its purpose and obtain any required consent before recording begins.
The Data That You Provide to Us As Legal Entity, May Include:
Registration number;
Date of registration;
Company name;
Type of entity;
Company email;
Company telephone;
Company website;
Country;
City;
Address line;
Building number;
Flat number;
Post code;
Tax ID;
Certificate of incorporation/registration;
Recent excerpt from a state company registry;
Director registry;
Power of attorney;
Shareholder registry;
Memorandum/articles of incorporation/association/registration;
Trust agreement;
Statement of information;
Other corporate or supporting documents reasonably required for the relevant Services or legal verification requirements;
Director name;
Director surname;
Director date of birth;;
Director nationality;
Director email;
Director phone number;
Director country;
Director city;
Director address line;
Director building number;
Director flat number;
Director post code;
Director TIN;
Director tax residence country;
UBO name;
UBO surname;
UBO date of birth;
UBO nationality;
UBO email;
UBO phone number;
UBO country;
UBO city;
UBO address liner;
UBO building number;
UBO flat number;
UBO post code;
UBO TIN;
UBO tax residence country;
UBO percentage of ownership;
Shareholder’s company name;
Shareholder’s company registration number;
Shareholder’s company date of registration;
Shareholder’s company type of entity;
Shareholder’s company country;
Shareholder’s company city;
Shareholder’s company address line;
Shareholder’s company building number;
Shareholder’s company flat number;
Shareholder’s company post code;
Shareholder’s company Tax ID;
Shareholder’s company percentage ownership;
Shareholder’s control scheme;
Company business activity and detail description;
Key partners/clients/suppliers and agreements/invoices;
Planned monthly turnover;
Source of funds;
Purpose of using the Services and relevant payment or bank accounts;
Government-issued identification documents of directors, representatives and ultimate beneficial owners (UBOs), such as a passport, identity card or residence permit, where necessary for identity verification;
The photos and videos that you may send to us for the verification purposes;
Financial statements for the previous years;
Company’s structure signed by director or representative;
Login information;
Location and log data generated through use of our Website, platform and Services, as described below;
Other information reasonably necessary to meet applicable anti-money laundering and counter-terrorist financing (AML/CTF), sanctions, fraud-prevention and client due diligence requirements. This may include occupation, source of funds or wealth, ownership and control information, and screening results, where relevant. Information about these compliance processes may be requested at aml@acanis.io, subject to legal restrictions on disclosure;
Personal Data About Individuals Connected With Clients or Payments May Include:
Name;
Surname;
Date of birth;
Nationality;
Email;
Phone number;
Country;
City;
Address line;
Building number;
Flat number;
Post code;
TIN;
Tax residence country;
Government-issued identification documents, such as a passport, identity card or residence permit, where necessary for identity verification;
The photos and videos that you may send to us for the verification purposes;
Login information;
Location and log data generated through use of our Website, platform and Services, as described below;
Other information reasonably necessary to meet applicable anti-money laundering and counter-terrorist financing (AML/CTF), sanctions, fraud-prevention and client due diligence requirements. This may include occupation, source of funds or wealth, ownership and control information, and screening results, where relevant. Information about these compliance processes may be requested at aml@acanis.io, subject to legal restrictions on disclosure;
Some Personal Data we handle is sensitive, including identity documents, financial information and certain verification or screening information. We limit its collection, use and disclosure to appropriate, identified purposes and apply safeguards proportionate to its sensitivity. We do not seek unrelated information about health, beliefs, sex life or other private matters. Where relevant information is received for a lawful compliance purpose, it is handled only as necessary for that purpose.We use SUMSUB to support remote identity verification and related screening under our Client Onboarding Procedure. This includes obtaining photographs of identity documents and selfies, checking document authenticity and validity, and comparing the document details and photograph with the person being verified. Verification results and relevant decision records are retained in the client file. PEP/HIO, sanctions and adverse-media checks may also be performed through SUMSUB and its relevant screening sources. We assess the results and remain responsible for our client decisions. The information requested depends on the individual’s role and the applicable legal requirements.
Where a verification process uses automated facial comparison, liveness technology or biometric templates, we provide specific information before that processing, including the information involved, purpose, provider’s role, retention, whether an alternative verification method is available and the consequences of declining the proposed method, and obtain express consent where required. The use of a document photograph and selfie does not, by itself, establish which biometric technologies are enabled. Biometric information is not used for advertising or unrelated identification.
If you provide another person’s Personal Data, you should have the authority to do so, provide them with this Policy and obtain any consent required by law. We remain responsible for establishing a lawful basis for our own collection, use and disclosure.
Information We Collect About You
Abouteach of your visits to our Website and use of our Services, we can collect, for example, the following information about you (including automatic collection):
Technical information, including IP address, account identifiers and authentication or security logs, browser type and version, time zone, browser plug-in types and versions, operating system and device information; we do not ask you to disclose passwords through ordinary email or support communications;
Website usage information, such as pages requested, access times, response times and technical errors, to the extent recorded in the technical logs used to operate, secure and troubleshoot the Website;
Location information, such as approximate location inferred from an IP address, where necessary for security, fraud prevention or provision of the Services. If a feature requires precise device location, we explain the purpose and obtain any required permission or consent before collection;
Financial and payment data relating to your use of our Services, including payment instructions, senders, beneficiaries, relevant bank or payment account details, transaction amounts, currencies, fees, status and transaction history;
Information We Receive from Other Sources Information We Receive from Other Sources
Where relevant to the purposes in this Policy and permitted by law, we receive Personal Data from banking and payment partners, identity-verification and screening providers, fraud-prevention providers, authorised representatives, public corporate registers and other lawful public sources. Credit-reference, analytics or marketing providers are used only where relevant to the particular activity and with any required consent. Information received may include:
Information about a bank or payment account used in connection with the Services;
Credit agencies’ confirmation of information that you have provided to us;
Information about identity, address, ownership, control, financial standing, sanctions or politically exposed person status, or relevant adverse media, to the extent necessary for the Services and lawful compliance checks.
If registration or identity verification is not completed, we may retain the information already provided only for a documented purpose, suchas handling the application, preventing fraud or satisfying a legal record-keeping obligation. An unfinished registration does not, byitself, justify indefinite retention or consent to marketing. Retention is governed by the Retention of Personal Data section.
Cookies
Acanis Major Corp. does not use cookies on its Website or platform. We therefore do not maintain a separate Cookie Policy. If this practice changes, we will update this Policy and provide information about the cookies, their purposes and available choices before they are introduced, and obtain any consent required by applicable law.
Why We Use Your Personal Data
We are going to use your personal data for the following purposes:
Provision of Our Services
To provide our Services, process your instructions and administer the relevant agreements and client relationship;
To ensure the security of our Website, our Services, and your account;
For administration of our Website and for internal operations, including troubleshooting, data analysis, testing, statistical data collection and for conducting surveys;
To give you access to the interactive features of the Website in case you wish to use them;
To support, respond and resolve your complaints and issues related to the use of our Services and the capabilities of our Website.
Informing You About Our Products and Services
To send permitted marketing communications about our Services, subject to the Marketing and Third Parties section;
To notify you about changes related to our Products and Services.
Helping Us Improve Our Products and Services
To improve our Website and to make sure that our content is most convenient for the operating system of your computer;
To assess promotional effectiveness only where the relevant use of Personal Data is permitted by law and any required consent has been obtained;
To ensure the most effective presentation of the content of our Website to you and the use of it on your computer.
Risk Management and Security
For risk management;
For security and control of our IT systems, crime prevention;
For measuring the use of our Services and Products for its further development;
For internal planning, service research and relevant client communications, using aggregated or de-identified information where appropriate;
For analysis using aggregated or de-identified information where appropriate. Pseudonymised information that can still be linked to an individual remains Personal Data. Any future use of tracking technologies will be explained before it begins and will require any consent prescribed by applicable law.
Assuring Legal Procedures
To respond to lawful and properly authorised requests from law enforcement, courts and regulators, subject to applicable limits;
To initiate and/or respond to legal claims;
To investigate and/or settle disputes with you.
Complying With Legal Regulations
To verify the identity of persons registering for or using our Services, and relevant representatives or beneficial owners, and to prevent fraud and other unlawful activity;
To conduct legally required client due diligence, ongoing monitoring, sanctions screening and AML/CTF reporting and record keeping, including disclosures to FINTRAC or other competent authorities where required or permitted by law; information about our compliance processes may be requested at aml@acanis.io, subject to applicable disclosure restrictions;
To notify users about relevant changes to this Policy, the General Terms and Conditions and the Services.
Marketing and Third Parties
If we send commercial electronic messages, we do so only with express consent, valid implied consent within its applicable scope and duration, or a specific lawful exemption under Canada’s Anti-Spam Legislation (CASL). An existing client relationship does not provide unlimited permission to send marketing. Where required, messages identify the sender, provide contact information and include a clear, free and readily usable unsubscribe mechanism. We action unsubscribe requests without delay and no later than 10 business days. You may also write to info@acanis.io or use account preferences where available. Necessary service, security and legal communications are handled separately from optional marketing.
We do not make optional marketing consent a condition of receiving the Services. Sharing identifiable information with another organisation for its own marketing requires separate, informed consent where required by law; a consent request identifies the relevant organisation and purpose. We keep appropriate consent and withdrawal records. Withdrawal does not invalidate earlier lawful use or preventretention of a minimal suppression record to respect your choice.
Disclosure of Your Personal Data
We may share Personal Data with relevant affiliates or group companiesonly for identified purposes described in this Policy, such as service administration, compliance or security, where permitted by law and subject to any required consent. Group membership does not give an entity unrestricted access to your information. Access is limited to those with a need to know and subject to appropriate confidentiality and security requirements.
Depending on the Services and processing involved, we may share necessary Personal Data with the following categories of recipients:
Banking and payment partners and institutions involved in carrying out your instructions; identity-verification, screening and fraud-prevention providers; and technical, hosting, communications, professional-advisory or other service providers supporting the relevant activity. We limit the information to what is needed for that role;
Marketing providers only within the scope of the separate choices described above; aggregated information is used where appropriate, but information is not treated as anonymous merely because direct identifiers have been removed;
Providers assisting with analysis and improvement of the Website or Services, where the particular processing is appropriate, lawful and subject to any required consent and data-use restrictions.
Service providers processing information on our behalf are subject to appropriate contractual or other safeguards covering confidentiality, security, permitted purposes, access to records, incident assistance and return or secure disposal when retention is no longer required. We assess relevant providers before engagement and regularly review their suitability and relevant safeguards, and maintain information about their role, processing locations, subcontracting and relevant risks. Provider arrangements require prompt notification of security breaches and cooperation with containment, investigation, recovery and lawful reporting. We remain accountable for information under our control. Banking or payment partners may also act independently for their own legal obligations; their separate notices explain that processing. Further information about relevant recipients and their role may be requested through the Contact section.
We may also disclose your Personal Data to third parties in the following cases:
In a proposed business sale, merger or other qualifying business transaction, only as permitted by applicable law, with confidentiality and security safeguards and limits on use and retention; if the transaction does not proceed, information is returned or destroyed as required;
On completion of a qualifying business transaction, subject to applicable requirements for continued protection, permitted purposes and notification to affected individuals;
Where disclosure is required or specifically permitted by law, including a valid court order, lawful regulatory reporting obligation or properly authorised request;
Where necessary to investigate or prevent fraud or protect rights, property or safety, but only within applicable consent requirements or a specific statutory exception. We do not interpret a general business interest as unlimited authority to disclose Personal Data.
Cross Border Transfers
The banking and payment arrangements used for the Services, and the location of relevant group companies or service providers, may require Personal Data to be processed or accessed outside Canada. The locations depend on the particular payment route and provider. Information about relevant processing locations and safeguards is available by contacting the person responsible for privacy complianceat info@acanis.io.
When information is transferred to a service provider for processing on our behalf, we remain accountable and use contractual or other means to provide a comparable level of protection. We assess the processing purpose, sensitivity, recipient and risks of the relevant jurisdiction, limit access and require appropriate safeguards. A transfer for a new independent purpose is assessed separately and requires any consent or other authority required by law.
Personal Data processed a broad may be accessible to courts, law enforcement, national security or other authorities under the laws of that jurisdiction. Contractual safeguards cannot override those laws. We provide relevant transparency and apply any additional assessment, notice or consent requirements imposed by applicable provincial or other privacy laws.
Basis for Personal Data Processing
We collect, use and disclose Personal Data for purposes that a reasonable person would consider appropriate in the circumstances. Under PIPEDA, we generally obtain meaningful consent unless a specific legal exception applies. We explain what information is involved, the purposes, relevant recipients and material consequences or risks in a form that is understandable. The following principles apply:
Consent: the form of consent depends on sensitivity, reasonable expectations and the circumstances. We generally seek express consent for sensitive information, unexpected uses or disclosures, or activities creating a meaningful residual risk of significant harm. Implied consent is relied upon only where appropriate and legally permitted;
Service-related processing: information needed to assess an application, verify relevant persons, provide the Services or administer an agreement is identified at collection. A contract is not treated as a general substitute for any consent required by Canadian privacy law;
Legal obligations and exceptions: we may collect, use, disclose or retain information without knowledge or consent where specifically required or permitted by law, including applicable AML/CTF reporting and record-keeping requirements. We rely on the relevant statutory conditions, rather than treating our internal policies as authority for processing;
Optional purposes: marketing and other non-essential uses are presented separately. We do not require consent to unnecessary processing as a condition of the Services, and a general legitimate business interest is not treated as an independent exemption from PIPEDA consent requirements;
Compliance with Applicable Regulatory Frameworks – where processing is required for the purpose of conducting Acanis Major UK Ltd’s business in line with statutory and regulatory requirements, including, without limitation, ensuring the quality of the Services provided, conducting internal controls, performing audits, compiling statistical reports, and identifying business needs.
Corporate Transactions – where the processing is necessary in the context of corporate restructuring or transactions, including, without limitation, mergers, acquisitions, reorganizations, transfers of undertakings, or the sale of shares, business units, or assets of Acanis Major UK Ltd, in accordance with applicable corporate and data protection laws.
You may withdraw consent by contacting info@acanis.io, subject to legal or contractual restrictions and reasonable notice. We explain the consequences: withdrawal may prevent a particular service where the information is necessary, but does not require us to delete legally required records. Refusing optional marketing does not by itself prevent provision of the core Services.
Your Rights
Subject to applicable law and lawful exceptions, you may contact us to exercise the following rights or make the following requests:
Request deletion of information that is no longer required for an identified lawful purpose. We assess the request against applicable retention and reporting duties; there is no unconditional right to erase legally required records;
Challenge the accuracy and completeness of Personal Data and have it amended where appropriate. Where a challenge is not resolved, we record its substance and take further steps required by law;
Withdraw consent, challenge a proposed use or disclosure, and raise a complaint about our privacy practices. Any additional right to object to or restrict processing is applied where the governing law provides it;
Be informed of the existence, use and disclosure of Personal Data about you and obtain access in an understandable form, subject to lawful exceptions. Any additional portability or format entitlement is applied where required by applicable law;
Refuse optional marketing and withdraw marketing consent through the methods described in the Marketing and Third Parties section. This does not affect necessary service or legal notices
We may request proportionate information to verify your identity or authority before acting. We do not request more identification than is reasonably needed. If a request cannot be fulfilled, we explain the reason and available recourse, except where the law restricts that explanation. Access may be restricted, for example, to protect another person’s information, legal privilege or protected regulatory reporting; we consider partial access where lawful.
Our Website may contain active links from/to the Websites of our partners, advertisers and affiliated companies. If you are following an active link, please note that other Websites have their own privacy policies, and we are not responsible for the provisions of these policies. Please review the privacy policies of these Websites before sharing your Personal Data with them.
Access to Personal Data
Send a written access request to info@acanis.io, marked for the attention of the person responsible for privacy compliance. We assist you inidentifying the information requested, verify identity proportionately, and explain the information we hold, its use and the parties to which it has been disclosed, subject to lawful exceptions. We respond as quickly as possible and within 30 days after receipt.Any extension is limited to grounds and periods permitted by PIPEDA; we notify you within the original 30 days of the extension, its reasons and your right to complain to the Office of the Privacy Commissioner of Canada (OPC).
Access is provided at minimal or no cost. If a lawful fee is proposed, we give an advance estimate and confirm that you wish to proceed. If access is refused in whole or in part, we provide written reasons, subject to legal restrictions, and information about recourse to the OPC or another competent privacy authority. We preserve information relevant to an access request for as long as required to allow applicable recourse.
Retention of Personal DataWe retain Personal Data only for as long as necessary for the purposes for which it was collected and to meet applicable legal obligations. Retention depends on the record type, the legal trigger for the period and any properly documented hold. It does not follow a single blanket period for every item of information.
AML/CTF and transaction records are retained under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and its regulations for the period applicable to the record. Many transaction records are retained for at least five years from creation; service agreement records are generally retained for at least five years after the last transaction. Copies of suspicious transaction reports are retained for at least five years after submission. The particular statutory trigger governs each category.
Client due diligence, identity and beneficial ownership records are classified according to their legal record type. Information records, corporate-existence records and specified beneficial ownership records are generally retained for at least five years after the last business transaction; other identity-verification and monitoring records follow their applicable statutory rule. Supporting identification images are retained only where necessary for the verification purpose or a specific record-keeping requirement. We do not automatically apply a relationship-end date to every record or retain all images merely because some verification information must be kept.
Records demonstrating compliance with the Retail Payment Activities Act andits regulations, including relevant operational risk, incident,review, testing and provider-assessment evidence, are retained until five years after the day they cease to demonstrate current compliance, subject to applicable conditions, undertakings and longer legal obligations. This is not automatically five years from creation or from the end of a client relationship. Personal Data is includedin these records only to the extent necessary for the relevant compliance evidence. Where more than one lawful retention requirement applies, we retain the relevant record for the period needed to meet those requirements, with access and use appropriately restricted.
Inomplete applications, support correspondence, technical and security logs, and optional analytics information are retained according to their specific purpose, sensitivity and any applicable legal requirement. We review whether they remain necessary; an incomplete application or a general possibility of future usefulness does not justify indefinite retention. Relevant information may be retained longer for a legal obligation, claim, official investigation or documented fraud-prevention need where lawful and proportionate. Any hold is limited to relevant information and reviewed when the reason ends.
If you unsubscribe from marketing, we retain only the identifiers and preference or consent records reasonably necessary to honour and demonstrate your choice, protected from ordinary marketing use. Once information is no longer required, we securely delete, destroy or irreversibly anonymise it, including through appropriate provider instructions. Where immediate removal from backups is not practicable, access and use remain restricted until the backup issecurely overwritten or deleted under its retention cycle.
Security of Personal Data
We apply physical, organisational and technical safeguards appropriate to the sensitivity, amount, format and location of Personal Data and the risks of the processing. These include role-based access restrictions, confidentiality requirements for Company Personnel and relevant providers, authentication and access monitoring, encryption where appropriate for transmission and storage, and secure disposal. Access is limited to authorised persons with a need to know, and safeguards are reviewed as risks and technology change.
For systems supporting payment activities, our operational risk frame workrequires individually attributable access, least privilege, prompt removal of access when no longer needed, strong authentication and multi-factor authentication for privileged, remote andpayment-release access where supported, and documented compensating controls for any limitation. Privileged and payment-release access is reviewed regularly and after role changes. We protect logs, backups and recovery records, control technical changes and verify the integrity of payment records before resuming affected processing.
No system or transmission method can be guaranteed completely secure. You should protect your credentials and promptly report suspected unauthorised account access or disclosure to info@acanis.io.
Personal Data Breaches
We assess suspected breaches, take steps to contain them and reduce harm, and keep records as required by law. Where a breach involving Personal Data under our control creates a real risk of significant harm, we report it to the OPC and notify affected individuals as soon as feasible after determining that it occurred, unless the law prohibits notification. We provide information about the breach, potential effects, mitigation and contact arrangements, and notify other organisations or authorities where required to reduce harm. Additional applicable privacy-law requirements are also observed.
The person responsible for privacy compliance coordinates with the Compliance Officer, incident coordinator and relevant technical oroperational personnel to contain the event and preserve evidence. An event affecting both Personal Data and payment activities is assessed separately under privacy law, the RPAA and any other applicable reporting duties. A Bank of Canada notification does not replace an OPC or individual notification, and an internal recovery target oranother reporting deadline does not postpone a privacy-law obligation. Any AML/CTF or sanctions assessment is referred to the MLRO through the applicable restricted channel. Notifications containonly information appropriate to the recipient and lawful purpose.
Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in applicable law, our Services or our data practices. The current version is made available on our Website or platform, with the date of the latest revision shown above. Editorial or clarifying changes that do not alter our data practices may be published without a separate notice. Where applicable law requires additional notice of a change, we provide it through an appropriate channel and within the required timeframe. Where a change requires new or renewed consent, we obtainit before carrying out the relevant processing, unless an applicable legal exception permits otherwise. Publication of an updated Policy or continued use of our Website or Services does not, by itself, replace any consent required by law.
Contact
For privacy questions, requests or complaints, contact the person responsible for privacy compliance at
info@acanis.io, using the subject line "Privacy". We acknowledge and investigate complaints, communicate the outcome and take appropriate corrective steps. Access requests follow the time limits explained above. Otherinquiries are handled promptly, taking account of their nature and complexity. You may also complain to the Office of the Privacy Commissioner of Canada at
www.priv.gc.ca , or the competent provincial privacy authority where applicable; we can assist with identifying the appropriate channel.
You can also write to: Acanis Major Corp., Attention: Privacy, 30 Wertheim Court, Unit 12, Suite 201, Richmond Hill, Ontario, L4B 1B9,Canada.