Privacy Policy

1. Introduction

This policy explains how Nyprel collects, uses, discloses and safeguards personal information. It is written to meet the Personal Information Protection and Electronic Documents Act (PIPEDA), the Act respecting the protection of personal information in the private sector in Quebec (commonly called Law 25), and the substantially similar provincial statutes in Alberta and British Columbia.

By using this website or opening an account you agree to the handling of your information as described here. If you do not agree, please do not submit your details.

2. Information we collect

Identifying information you give us: name, email address, telephone number, and the identity documents required for verification. Financial information: funding method, transaction history and account balances. Technical information collected automatically: IP address, browser and device type, pages visited, and referral source.

We do not collect more than we need for the purpose at hand, and we do not ask for sensitive categories of information that are irrelevant to operating an account.

3. Why we use it

To open and administer your account, verify your identity, process funding and withdrawals, provide client service in your preferred language, detect fraud and misuse, improve the platform, and meet our record-keeping obligations.

Where we use your information to send you commercial electronic messages, we do so in accordance with Canada\u2019s Anti-Spam Legislation (CASL). Every such message identifies us and carries a working unsubscribe mechanism that we action within ten business days.

4. Consent and legal basis

We rely on your consent, which you may give expressly or, for uses that are obvious in context, by implication. Under Quebec Law 25 we obtain express consent before using personal information for a purpose beyond the one for which it was collected, and before disclosing it outside the province where that requires it.

You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawing consent may mean we can no longer maintain your account.

5. How we protect it

Personal information is encrypted in transit using TLS 1.3 and encrypted at rest with 256-bit encryption. Access is restricted to staff who need it for their role and is logged. Two-factor authentication is mandatory on client accounts, and an independent security firm reviews our controls twice a year.

No system is perfectly secure. If a confidentiality incident presents a risk of serious injury, we will notify you and the appropriate regulator as required by PIPEDA and by Law 25.

6. Sharing with third parties

We share personal information with identity-verification providers, payment processors, cloud infrastructure providers and professional advisers, in each case only to the extent needed for them to perform their function, and under contract requiring equivalent protection.

We do not sell personal information. We disclose it to law enforcement or a regulator only where legally required, or where we believe in good faith that disclosure is necessary to prevent harm.

7. Transfers outside Canada

Some of our service providers process information outside Canada, including in the United States and the European Union. Information held in another country is subject to the laws of that country and may be accessible to its courts and authorities.

Before any such transfer we conduct a privacy impact assessment as required by Quebec Law 25, and we put contractual protections in place. You may write to us to ask where your information is held.

8. How long we keep it

We keep account records for the period required by financial record-keeping obligations, which is generally seven years after the account is closed. Marketing preferences are kept until you withdraw consent. Technical logs are kept for a rolling period of no more than twenty-four months.

When a retention period ends, information is destroyed or irreversibly anonymized.

9. Your rights

You may ask for access to the personal information we hold about you, ask us to correct anything inaccurate, ask for it to be deleted where no legal obligation requires us to keep it, and ask for a copy in a structured, commonly used electronic format.

Quebec residents additionally have the right to ask that a decision made solely by automated processing be reviewed by a person, and to be told what personal information was used to reach it. Write to [email protected] and we will respond within thirty days.

10. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in and to remember your language, and analytics cookies to understand how the site is used. The market ticker stores a cached price list in a cookie for twenty-four hours so that the page does not re-query the source on every visit.

You can refuse or delete cookies in your browser settings. Refusing strictly necessary cookies will prevent parts of the platform from working.

11. Children

The platform is not directed at anyone under the age of majority in their province or territory, and we do not knowingly collect their personal information. If you believe a minor has given us information, write to us and we will delete it.

12. Contact and complaints

Our Privacy Officer can be reached at [email protected]. We will acknowledge your enquiry and respond substantively within thirty days.

If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner of Canada, or, if you are a Quebec resident, to the Commission d\u2019acc\u00e8s \u00e0 l\u2019information du Qu\u00e9bec.