Privacy Policy

1Who We Are

This Privacy Policy explains how Movaratech Inc., operating as ConaPay ("ConaPay", "we", "us"), with its head office at 94 Lakeshore Road East, Unit 203, Mississauga, Ontario L5G 1E3, Canada, collects, uses, discloses and protects your personal information when you use the ConaPay app, website, card and related services (the "Services").

Although the Services are not offered to residents of Canada, Movaratech Inc. is a Canadian organization and handles personal information in accordance with the Personal Information Protection and Electronic Documents Act (Canada) (PIPEDA). Movaratech Inc. is responsible for personal information under its control and has designated a Privacy Officer who is accountable for our compliance with this Policy (see Section 13).

This Policy should be read together with our Terms and Conditions. Capitalized terms used but not defined in this Policy (such as Account, Card, Card Issuer, Card Network, Digital Assets and Transaction) have the meanings given to them in the Terms and Conditions.

2Personal Information We Collect

(a) Information you provide

• Identity information: full name, date of birth, nationality, gender (if shown on ID), government-issued ID type, number, images and expiry date.
• Biometric information: selfie images and facial geometry used for liveness checks and face matching during identity verification.
• Contact information: residential and delivery address, email address, mobile phone number.
• Financial and compliance information: occupation, source of funds and wealth, purpose of account, expected activity, tax residence, politically exposed person (PEP) status.
• Communications: messages and documents you send to customer support.
• Referral information: referral codes you use or share.

(b) Information generated by your use of the Services

• Account and card information: account identifiers, card number (stored by the Card Issuer and its processor in a PCI DSS-compliant environment), card status, limits.
• Transaction information: purchases, merchant name and category, amount, currency, exchange rate, location of the transaction, ATM withdrawals, refunds, disputes, top-ups, transfers and withdrawals, wallet addresses and blockchain transaction hashes.
• Mobile wallet information: device and token information when you add your Card to Apple Pay or Google Pay.

(c) Information collected automatically

• Device and technical information: device model, operating system, app version, device identifiers, IP address, language and time-zone settings.
• Location information: approximate location derived from your IP address and, with your permission, precise device location for fraud prevention.
• Usage information: login times, pages and features used, crash reports, and cookies and similar technologies (Section 10).

(d) Information from third parties

• Identity verification, sanctions, PEP, adverse-media and fraud-prevention providers.
• Blockchain analytics providers (for example, risk scores of wallet addresses).
• The Card Issuer, the Card Network and other card network participants.
• Couriers (delivery status).
• People who refer you to ConaPay.

3How We Use Your Personal Information

We use your personal information for the following purposes:

We will not use your personal information for a purpose not described in this Policy without first obtaining your consent, unless permitted or required by law.

4Consent

By creating an Account and using the Services, you consent to the collection, use and disclosure of your personal information as described in this Policy. We obtain express consent for sensitive information, including biometric information and precise location, and for marketing communications.

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. However, because identity verification and transaction monitoring are required by law, withdrawing consent to these uses means we will be unable to provide or continue the Services.

5Biometric Information

Facial images and facial geometry collected during identity verification are used only to verify your identity and prevent fraud. They may be processed on our behalf by our identity verification service provider, which acts only on our instructions, does not use your information for any other purpose, and retains it only for as long as required under Section 8.

6Who We Share Your Personal Information With

We do not sell your personal information. We share it only as described below:

• Card Issuer and Card Network: the Card Issuer, the Card Network and their processors, to issue and operate your Card and process Transactions and disputes.
• Service providers acting on our behalf: identity verification, sanctions screening, blockchain analytics, fraud prevention, digital-asset custody, cloud hosting, customer-support tools, communications, analytics and card manufacturing and delivery (courier) providers. They may use your information only to provide services to us and must protect it.
• Mobile wallet providers: Apple or Google, when you choose to add your Card to their wallet.
• Other ConaPay users: limited information (such as your display name) when you send or receive an in-app transfer; your referrer may see that you joined using their code.
• Other virtual asset service providers: originator and beneficiary information required under travel rule obligations when you withdraw or receive Digital Assets.
• Regulators, law enforcement and authorities: including the Bank of Canada, FINTRAC, tax authorities and courts, where required or permitted by law.
• Professional advisors: lawyers, auditors and insurers, under confidentiality obligations.
• Corporate transactions: a prospective or actual buyer or successor in the event of a merger, acquisition, financing or sale of all or part of our business, subject to confidentiality obligations.

7International Transfers

We are based in Canada, and our service providers and the Card Issuer may store and process your personal information in countries outside Canada. Personal information processed in another country is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities.

We use contractual and other measures to ensure that personal information transferred outside Canada receives a comparable level of protection.

8Retention

We retain personal information only for as long as necessary for the purposes described in this Policy, including to meet legal, regulatory, accounting and reporting requirements.

• Identification, account and transaction records required under Canadian anti-money laundering law are retained for at least five (5) years after the record is created or the business relationship ends, as applicable.
• Records relating to disputes or legal claims are retained until the matter is resolved and any limitation period has expired.
• Marketing preferences are retained until you withdraw consent.
• Biometric information (selfie images and facial geometry) is retained only for as long as necessary for identity verification, fraud prevention and our record-keeping obligations under applicable anti-money laundering laws, after which it is permanently deleted.

When personal information is no longer required, we securely destroy or anonymize it.

9How We Protect Your Information

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest, access controls on a need-to-know basis, multi-factor authentication, logging and monitoring, and staff confidentiality and training. Card numbers are handled in a PCI DSS-compliant environment and displayed in the App through a secure component.

No method of transmission or storage is completely secure. If a breach of security safeguards involving your personal information creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required by law.

10Cookies and Similar Technologies

Our website uses cookies and similar technologies that are strictly necessary for it to function, and, with your consent, analytics and marketing cookies. You can manage your preferences through the cookie banner or your browser settings. Blocking strictly necessary cookies may affect how the website works. Our App uses software development kits for analytics and crash reporting.

11Your Rights

Subject to applicable law, you have the right to:

• access the personal information we hold about you and receive information about how it is used and disclosed;
• correct inaccurate or incomplete personal information;
• withdraw consent as described in Section 4;
• request deletion of personal information that we are no longer required to keep;
• challenge our compliance with this Policy.

You can make a request by contacting our Privacy Officer (Section 13). We will respond within 30 days, or tell you if we need an extension as permitted by law. We may need to verify your identity before responding. We may decline a request where permitted by law (for example, where the information must be retained under anti-money laundering law or would reveal information about another person), and we will tell you why.

12Children

The Services are not intended for anyone under 18 years of age (or the age of majority in their place of residence). We do not knowingly collect personal information from minors. If we learn that we have done so, we will delete it, unless retention is required by law.

13Contact Us and Complaints

If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or the data protection authority in your place of residence.

14Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy on our website and in the App and, where changes are significant, notify you through the App or by email before they take effect.

15Language

This Policy is prepared in English. Translations are provided for convenience; in the event of any inconsistency, the English version prevails, unless local law requires otherwise.