Introduction
This Privacy Policy explains how BFG Toronto Ltd. ("BFG", "we", "us", or "our") collects, uses, discloses and protects personal information in connection with your use of our website, digital asset trading platform and/or over-the-counter trading services (together, the "Platform" and "Services"), wherever you are located.
This Privacy Policy applies to all users of the Platform worldwide. We handle your personal information in accordance with the national and international privacy and data protection laws and industry standards in the jurisdictions where we operate and where you are located.
This Privacy Policy should be read together with the Terms and Conditions for use of the BFG Platform and the OTC Terms of Services.
If you do not agree with this Privacy Policy, you should not access or use the Platform or Services.
Application of this Policy
This Privacy Policy applies to BFG Toronto Ltd.'s handling of personal information in the course of providing the Platform and Services worldwide. Depending on where you live, local privacy laws may grant you additional rights, which we will respect to the extent they apply to our processing of your information.
Definitions
Unless the context otherwise requires:
- (a)"Personal Information" means information about an identifiable individual, including information that can be used on its own or together with other information to identify a person, as defined under applicable privacy and data protection laws.
- (b)"Digital Assets" has the meaning given to that term in the Terms and Conditions.
- (c)"OTC Services" has the meaning given to that term in the OTC Terms of Services.
- (d)"Platform" means the BFG platform, website, user interfaces, communication channels and related services made available by BFG Toronto Ltd. in connection with Digital Asset trading and OTC Services.
Personal Information Collected
Personal Information may be collected directly from users, automatically through use of the Platform, and from third parties where permitted by law or reasonably necessary for the provision of the Services, including compliance, fraud prevention and security purposes.
The categories of Personal Information that may be collected include:
- (a)Identification and contact information, such as full legal name, date of birth, nationality, residential address, email address, telephone number, government-issued identification information, photographs and other identity verification information.
- (b)Corporate and beneficial ownership information, where the user is acting for or through an entity, including incorporation documents, constitutional documents, ownership and control information, board resolutions, authorisations, and information relating to directors, officers and beneficial owners.
- (c)Financial and transaction information, such as bank account details, payment instructions, wallet addresses, trade records, account balances, deposit and withdrawal information, transaction confirmations and settlement information.
- (d)OTC communications and operational information, including Requests for Quote, quotes, quote acceptances, confirmation messages, account activity records, support correspondence and communications through supported communication channels such as web interface, email, instant messaging or telephone where used for the Service.
- (e)Technical and usage information, such as IP address, login information, device identifiers, browser type, operating system, pages viewed, timestamps, cookies, analytics information and security logs.
- (f)Compliance and screening information, such as sanctions screening results, politically exposed person checks, adverse media results, fraud indicators and information obtained from compliance databases or verification providers.
- (g)Public source and third-party information, including information from financial institutions, payment providers, fraud prevention providers, blockchain analytics providers, public registries and publicly available sources, where permitted by law.
If required Personal Information is not provided, BFG may be unable to open or maintain an account, process a transaction, respond to a Request for Quote, or provide some or all of the Services.
Personal Information About Others
If Personal Information about another individual is provided to BFG, including information about a director, officer, shareholder, beneficial owner, authorised signatory, representative or related party, the person providing that information must have authority to do so and must ensure that the individual has been informed of the collection, use and disclosure of that information as described in this Privacy Policy.
Purposes of Collection, Use and Disclosure
Personal Information may be collected, used and disclosed for the following purposes:
- (a)Providing and operating the Platform and Services, including account opening, account administration, customer support, access management, transaction processing, OTC quoting, trade execution, settlement, custody-related operations and service communications.
- (b)Identity verification and compliance, including know-your-customer, know-your-business, beneficial ownership verification, anti-money laundering, anti-terrorist financing, sanctions screening, fraud prevention, suspicious activity detection and market abuse monitoring.
- (c)Risk management and security, including authentication, cybersecurity, fraud detection, investigation of suspicious or unauthorised activity, protection of users and the Platform, and maintenance of business continuity and incident response procedures.
- (d)Legal and regulatory compliance, including compliance with applicable laws, regulations, court orders, lawful requests from regulators, tax authorities and law enforcement agencies, and maintenance of required books and records.
- (e)Business operations and improvement, including internal reporting, analytics, auditing, governance, testing, product improvement, service enhancement and development of new features or services.
- (f)Communications and marketing, where permitted by applicable law, including sending updates, service announcements, product information, educational materials, events and promotional communications relating to the Platform and Services.
- (g)Protection of legal rights, including enforcing contractual rights, investigating breaches of terms, pursuing or defending claims, collecting amounts owing and participating in legal, regulatory, administrative or investigative proceedings.
Personal Information will not be used for purposes other than those for which it was collected, except with consent or where otherwise permitted or required by applicable law.
Disclosure of Personal Information
Within BFG Toronto Ltd., access to your Personal Information is limited to employees, contractors and representatives who reasonably need it to perform their duties and who are subject to confidentiality obligations.
Personal Information may be disclosed to the following categories of recipients where reasonably necessary for the purposes described in this Privacy Policy:
- (a)Service providers and professional advisers, including providers of cloud hosting, information technology, cybersecurity, identity verification, AML screening, blockchain analytics, communications, customer support, payment processing, banking, auditing, legal and consulting services.
- (b)Affiliates and group entities providing operational support, where an entity within the Bond Financial Group supports BFG Toronto Ltd. in connection with technology, risk, compliance, administration, customer support, marketing, finance, legal, or other internal functions related to the Platform and Services.
- (c)Liquidity providers, counterparties and financial institutions, where disclosure is required to facilitate a transaction, settlement, custody-related operation, payment or related compliance process.
- (d)Regulators, law enforcement, courts and governmental authorities, including FINTRAC and other competent authorities, where disclosure is required or permitted under applicable law, regulation, court order or lawful request.
- (e)Prospective purchasers, assignees or successors, and their advisers, in connection with a merger, financing, restructuring, acquisition, disposal, insolvency proceeding or other corporate transaction involving BFG, subject to appropriate confidentiality measures.
- (f)Other persons with consent or direction, where the user has requested or authorised the disclosure, or where the disclosure is otherwise authorised by law.
Personal Information is not sold to third parties for their own independent marketing purposes.
International Transfers
Personal Information may be transferred to, stored in and processed in Canada and other countries where BFG's affiliates, service providers, infrastructure providers or counterparties are located.
Those jurisdictions may have data protection laws that differ from the laws of the user's home jurisdiction. BFG will take reasonable steps to ensure that Personal Information transferred across borders is protected by appropriate contractual, organisational and technical safeguards, in accordance with applicable law.
Cookies and Similar Technologies
BFG may use cookies, web beacons, analytics tools, server logs and similar technologies to operate the Platform, remember preferences, improve functionality, analyse usage patterns, maintain security and support user experience.
Users may manage cookies through their browser or device settings, but disabling some cookies may affect the availability or functionality of parts of the Platform.
Retention
Personal Information will be retained only for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, including to provide the Services, comply with legal and regulatory requirements, resolve disputes, enforce agreements and protect legal rights.
Certain records, including identification and transaction records, may be retained for at least five years or for such longer period as may be required under applicable anti-money laundering, tax, audit or other legal requirements.
When Personal Information is no longer required, BFG will take reasonable steps to securely delete, destroy or anonymise it in accordance with applicable law and internal retention practices.
Security
BFG uses administrative, technical and physical safeguards designed to protect Personal Information against loss, theft, unauthorised access, disclosure, alteration and destruction.
These safeguards may include access controls, user authentication, monitoring, encryption in transit and at rest where appropriate, secure infrastructure, segregation of customer records and other security procedures appropriate to the sensitivity of the information and the nature of the Services.
No method of transmission over the Internet or method of storage is completely secure and we cannot guarantee absolute security of your Personal Information. Users are also responsible for maintaining the confidentiality of their account credentials, devices and communication channels used to access the Platform and Services.
User Rights
Subject to applicable law and any legal or regulatory exceptions, users may have the right to:
- (a)request access to Personal Information held by BFG;
- (b)request correction of inaccurate or incomplete Personal Information;
- (c)request withdrawal of consent where processing is based on consent;
- (d)request deletion, restriction or objection in circumstances where such rights are available under applicable law; and
- (e)complain to an applicable privacy or data protection regulator where permitted by law.
These rights may vary depending on the user's jurisdiction. Users located in certain jurisdictions may have additional rights under local privacy laws, and BFG will address such requests in accordance with applicable law.
BFG may request information necessary to verify identity before responding to a privacy request, and may decline requests to the extent permitted or required by law, including where retention is required for legal or regulatory reasons.
Marketing Communications
Where permitted by applicable law, BFG may use contact information and account-related information to send updates about products, services, platform features, events or other marketing communications relevant to the Platform and Services.
Users may opt out of non-essential marketing communications at any time by using the unsubscribe mechanism in the relevant communication or by contacting BFG. Service-related, transactional, security or legally required communications may still be sent where necessary.
BFG will not disclose Personal Information to third parties for their own independent direct marketing purposes without consent where such consent is required by law.
Third-Party Services and Links
The Platform may contain links to or integrations with third-party websites, services, tools or applications. BFG is not responsible for the privacy practices of those third parties, and this Privacy Policy does not apply to information collected by them outside the Platform.
Users should review the privacy policies of any third-party services they access or use in connection with the Platform.
Minors
The Platform and Services are not intended for individuals who have not reached the age of majority in their jurisdiction of residence, and BFG does not knowingly provide Services to such individuals.
If BFG becomes aware that Personal Information has been collected from an individual who is not legally permitted to use the Services, BFG may take steps to delete that information, subject to applicable legal retention requirements.
Changes to this Privacy Policy
BFG may amend this Privacy Policy from time to time to reflect changes in business practices, technology, legal requirements or the Platform and Services.
The updated version will be posted on the relevant website or platform interface with a revised "Last Updated" date. Continued use of the Platform or Services after the effective date of an updated Privacy Policy constitutes acceptance of the revised Policy, to the extent permitted by applicable law.
Contact
Questions, requests or complaints relating to this Privacy Policy or BFG's handling of Personal Information may submitted to enquiries@bondfinancial.co or otherwise notified to users from time to time.
BFG may require sufficient information to verify the identity of the requesting individual before responding to a privacy-related request.