Cred-X Tech, Inc. (“CredX,” “we,” “us,” or “our”) builds financial technology for credit unions, merchants, payments, and closed-loop networks. Because our products touch money movement and regulated financial workflows, we take a fintech-grade approach to privacy: specific commitments, named safeguards, enumerated rights, and concrete retention periods. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have.
Please read Section 8 (Data Monetization and the CredX Marketplace) carefully. It describes the limited, opt-in circumstances in which CredX shares revenue from de-identified data and, with your separate express consent, places you as an identified lead in our marketplace where lenders and brokers may purchase that lead. We do none of this without the consent described in that Section.
1. Who We Are and How to Contact Us
1.1 Cred-X Tech, Inc. is a Canadian company headquartered in Calgary, Alberta. For personal information we collect through our own websites, marketing channels, and CredX-branded products, CredX is the organization accountable for that information (a “controller” or, under U.S. laws, a “business”). For services we deliver on behalf of a credit union, lender, or merchant partner, our role is described in Section 3.
1.2 Contact our Privacy Officer with any privacy question, request, or complaint. The Privacy Office also fulfills the roles of Grievance Officer under the DPDP Act 2023 of India, the EU/EEA Representative and Data Protection Officer (as appropriate) under the GDPR, and the UK Representative under the UK GDPR:
Privacy Officer, Cred-X Tech, Inc., Suite 159, #406, 917-85 ST SW Calgary, Alberta, T3H 5Z9 Canada[email protected]
2. Our Privacy Principles
2.1 Data minimization. We collect only personal information that is necessary for the specific purpose disclosed at collection. Optional fields are marked as optional.
2.2 Purpose limitation. We use personal information only for the purposes set out in this Policy or for compatible purposes permitted by law, and we will not use it for a new, materially different purpose without notice and, where required, your consent.
2.3 Meaningful consent. We obtain consent that is appropriate to the sensitivity of the information, and for sensitive purposes - including the sale of identifiable leads under Section 8 - we obtain express, opt-in consent that is separate from our general terms.
2.4 Accuracy, security, and accountability. We keep information accurate, protect it with the safeguards in Section 11, retain it only as described in Section 10, and assign accountability to a designated Privacy Officer.
3. Our Role: Controller, Service Provider, and Business
3.1 Depending on the product and workflow, CredX acts as: (a) a controller/business when we determine the purposes of processing for our own websites, products, and the CredX Marketplace; or (b) a service provider/processor when we process personal information on documented instructions from a Client (a credit union, lender, or merchant) under a written agreement. Where CredX acts as a service provider, the Client’s privacy notice governs that processing, and we will direct or forward your requests to the relevant Client as Section 13 describes.
4. Personal Information We Collect
4.1 Depending on the product and your interactions with us, we collect the following categories:
- (a)Account and profile information - name, email, phone, username, hashed password, preferences, and role.
- (b)Contact and communications - messages, support tickets, and call recordings where notice is given.
- (c)Financial and transaction information - bank account and card numbers, transit/routing numbers, balances, transaction history, merchant identifiers, interchange and settlement data, credit-application inputs, and loyalty and closed-loop network activity.
- (d)KYC and identity information - government identifiers (e.g., SIN/SSN where lawfully required), date of birth, address history, identity-document images, and beneficial-ownership information for business customers.
- (e)Credit-union and partner data - membership identifiers and partner-assigned customer numbers received under written data-sharing agreements.
- (f)Device, technical, and usage information - IP address, device and browser identifiers, operating system, logs, approximate geolocation derived from IP, pages viewed, and clickstream.
- (g)Inferences and analytics - derived from the above to detect fraud, manage risk, personalize the Services, and (where you consent under Section 8) generate marketplace leads.
4.2 For U.S. state-law purposes, this maps to the CCPA/CPRA categories of identifiers, customer records, commercial information, financial information, internet/network activity, geolocation, professional information, inferences, and sensitive personal information (e.g., account log-in credentials, government identifiers, and precise financial-account information). We collect sensitive personal information only as necessary to provide the Services, prevent fraud, comply with law, or with your consent.
5. How We Collect Personal Information
5.1 We collect personal information: directly from you (when you create an account, complete KYC, contact support, or use the Services); automatically (through cookies, SDKs, and server logs - see Section 6); from Clients (credit unions, lenders, and merchants who provide member or customer data under a written agreement); from service providers (identity-verification, fraud-prevention, payments, and analytics providers acting on our behalf); and from public and third-party sources (sanctions and politically-exposed-person lists, public registries, and credit-reporting agencies where lawful and necessary).
7. Purposes of Use and Lawful Bases
7.1 We process personal information to: provide, operate, secure, and improve the Services; authenticate users and prevent fraud; process payments, settle transactions, and operate the closed-loop network; perform KYC, sanctions screening, and risk management; match you with, and transmit your applications and instructions to, lenders, merchants, and other partners at your direction; meet legal, regulatory, tax, and recordkeeping obligations (including under the PCMLTFA/FINTRAC, the CRA, the IRS, and the Retail Payment Activities Act as and when in force); respond to support requests; conduct analytics and product development (in de-identified or aggregated form where feasible); and send marketing communications subject to your consent and right to opt out.
7.2 Lawful bases. In Canada we rely on your consent (express or implied as appropriate to sensitivity) and on the limited exceptions permitted under PIPEDA, Alberta PIPA, BC PIPA, and Quebec’s Law 25. For U.S. residents, we process personal information to provide the Services, for the business purposes described above, and - for any sale or sharing, and for the use of sensitive personal information beyond permitted purposes - only with your opt-in consent. Where we rely on consent, you may withdraw it at any time (Section 9); withdrawal does not affect processing carried out before withdrawal or processing we are legally required or operationally permitted to continue.
8. Data Monetization and the CredX Marketplace
This Section describes how CredX commercializes data. CredX uses a two-stage model and obtains a different level of consent for each stage. We have designed it to comply with PIPEDA and substantially similar provincial laws (including Quebec’s Law 25), and with the “sale”/“share” rules of the CCPA/CPRA and other U.S. state privacy laws.
Stage 1 - De-identified data and revenue share with the Client.
8.1 In the ordinary course, CredX de-identifies (anonymizes) transaction and behavioural data so that it is not reasonably capable of identifying any individual, and may use, license, and commercialize that de-identified or aggregated data for benchmarking, analytics, research, and market intelligence. CredX may share a portion of the resulting revenue with the Client (for example, a merchant) whose network activity contributed to the data set. CredX maintains technical and organizational measures designed to prevent re-identification and contractually prohibits recipients from re-identifying the data. Because Stage 1 data is de-identified, it does not identify you; we describe it here for transparency.
Stage 2 - Identified marketplace leads, sold only with your express opt-in consent.
8.2 Separately, and only after you have obtained a credit facility and we have collected further information, CredX may invite you - within the CredX Marketplace - to be matched with additional financial products (for example, a mortgage). If, and only if, you affirmatively say “yes” to a specific invitation, CredX will create a lead that includes information identifying you and list it in the CredX Marketplace, where licensed lenders and brokers may purchase it in order to contact you about the product you asked to be matched with.
8.3 Before you consent to a Stage 2 lead, we will present a separate, granular, affirmative opt-in (not bundled with these or any other terms) that clearly identifies, in plain language: the categories of personal information included in the lead; the type of recipients (e.g., licensed mortgage lenders and brokers) who may purchase it; the specific purpose (to contact you about the product you selected); the fact that this is a “sale” or “sharing” of your personal information under applicable law; any revenue arrangement; the consequences of declining (none for your existing Services); and how to withdraw consent.
8.4 Each Stage 2 consent is product-specific and time-limited. We do not pre-check the consent, we do not treat silence or inactivity as consent, and we do not condition your access to your existing CredX Services on giving it. You may withdraw a Stage 2 consent at any time (Section 9); withdrawal stops future listing and sale of new leads, but does not unwind a lawful disclosure already made to a purchaser who received the lead while your consent was in effect.
8.5 Minors. CredX does not knowingly create, list, or sell a marketplace lead, or otherwise sell or share the personal information, of any individual under the age applicable under the relevant law (Section 14).
9. Your Privacy Rights and Withdrawal of Consent
9.1 Subject to verification of identity and to exceptions permitted by law, you may: access the personal information we hold about you; request correction of inaccurate or incomplete information; request deletion, subject to legal holds (e.g., AML and tax retention); withdraw consent to optional uses and disclosures, including data monetization and marketing; and, for U.S. residents, exercise the additional rights in Section 14.2.
9.2 We provide two consent controls: (a) a privacy preference toggle in your account settings governing optional data uses and marketing; and (b) the separate, product-specific Stage 2 marketplace opt-in described in Section 8. Turning the toggle off, or withdrawing a Stage 2 consent, is as easy as giving consent and stops the relevant optional processing going forward, but does not affect processing needed to provide the Services you have requested, the use of de-identified or aggregated data, or disclosures already made in accordance with your prior consent.
9.3 To submit a request, email the Privacy Officer or use the form at [email protected]. We respond within 30 days under PIPEDA and Alberta/BC/Quebec law, and within 45 days (extendable once) under the CCPA/CPRA. If you are dissatisfied, you may escalate to our Privacy Officer and then complain to the Office of the Privacy Commissioner of Canada, a provincial regulator (Alberta OIPC, BC OIPC, or Quebec’s Commission d’accès à l’information), the California Privacy Protection Agency, or your state Attorney General.
10. Retention Schedule
10.1 We retain personal information only as long as needed for the purposes in this Policy and for legally required periods, then delete it or irreversibly de-identify it. Our baseline periods are:
| Data Category | Retention Period / Basis |
|---|---|
| Account and identity (KYC) records | Duration of relationship + 7 years (PCMLTFA/FINTRAC; equivalent U.S. obligations) |
| Transaction, settlement, and payment records | 7 years from the transaction date (PCMLTFA;tax) |
| Card data (PAN), where applicable | Not stored beyond authorization unless necessary (PCI DSS) |
| Tokenized card references | Life of merchant relationship (per Contract) |
| Backups containing personal information | Purged on rolling 35-day cycle from deletion request (per system Architecture) |
| Lending / adverse-action support records | 7 years after completion, denial, or closure, unless a Client contract requires longer |
| Marketplace-lead consent records and audit trail | Duration of consent + 7 years (to evidence consent) |
| Marketing data and cookie preferences | Until consent withdrawn or 24 months of inactivity |
| Support and correspondence | 3 years from last contact |
| Server, audit, and security logs | 12-24 months by log type |
| De-identified / aggregated data | While it remains de-identified and used for lawful purposes |
11. Security Safeguards
11.1 We implement administrative, technical, and physical controls appropriate to the sensitivity of the information, including: encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent); multi-factor authentication for personnel accessing production systems and for administrative accounts; least-privilege access reviewed regularly; logging and monitoring; vulnerability and patch management with periodic third-party penetration testing; vendor due diligence and contractual security requirements; secure development; workforce privacy and security training; and a documented incident-response plan. We maintain SOC 2 Type II and, for card data, PCI DSS compliance. No system is perfectly secure, and we continually review and improve our safeguards.
12. Security Incidents
12.1 If a breach of security safeguards creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as soon as feasible and keep a breach record, as required by PIPEDA (and report to international and provincial regulators where required; see “Regional Notices”, Section 17). We may delay notice if law enforcement determines it would impede an investigation.
12.2 We maintain a breach register compliant with the obligations under the GDPR and PIPEDA.
14. Children’s Privacy and U.S. State Rights
14.1 Children. The Services are not directed to children. We do not knowingly collect personal information from children under 13 (COPPA, PIPEDA) or otherwise sell or share the personal information of individuals under 16 without the authorization required by applicable law (GDPR) or 18 where applicable (DPDP Act 2023); in Canada we do not collect from minors below the age of meaningful consent without parental consent. If we learn we have collected a child’s information without required consent, we delete it promptly. We do not engage in tracking, behavioral monitoring, or targeted advertising directed at children, and do not engage in processing likely to cause detrimental effects to a child’s well-being. Parents and Guardians may contact the Privacy Officer at any time with requests relating to the above.
14.2 If you are a resident of California or another state with a comprehensive privacy law, you also have the rights to: know and access the categories and specific pieces of personal information we collect; delete and correct; opt out of the sale or sharing of personal information and of targeted advertising; limit the use of sensitive personal information to permitted purposes; and not be discriminated against for exercising a right. CredX does not sell or share personal information for cross-context behavioural advertising. CredX sells personal information only through the Stage 2 marketplace described in Section 8, and only with your opt-in consent. Submit requests via the Do Not Sell or Share My Personal Information and Limit the Use of My Sensitive Personal Information links in the footer or by e-mail to the Privacy Officer; we honour the Global Privacy Control.
15. Automated Decision-Making and Profiling
15.1 Where we use automated processing (including profiling) that produces legal or similarly significant effects - for example, fraud or transaction-risk scoring, or marketplace lead matching - you may request human review, contest the decision, provide additional information, and request an explanation of the principal factors involved. Contact the Privacy Officer with any requests.
16. International and Cross-Border Transfers
16.1 CredX is based in Canada and may process personal information in Canada, the United States, and other jurisdictions where our service providers operate. When we transfer personal information across borders, we use contractual and technical safeguards designed to provide a comparable level of protection, and for Quebec we complete a privacy impact assessment before transferring personal information outside the province where required by Law 25. We acknowledge that some destination jurisdictions may not offer the same legal protections as your home jurisdiction. A list of recipient countries is available on request.
17. Regional Notices
17.1 CredX will provide supplemental notices where required for specific jurisdictions, products, or processing activities.
17.2 For Canada, CredX is subject to PIPEDA and applicable provincial private-sector privacy laws where they apply. Individuals may contact CredX’s Privacy Officer and may have the right to complain to the Office of the Privacy Commissioner of Canada or an applicable provincial regulator.
17.3 For Alberta, British Columbia, and Quebec residents, provincial privacy laws may provide additional rights and organizational obligations where applicable.
17.4 For United States residents, applicable state privacy laws may provide rights regarding access, deletion, correction, portability, opt-out of sale or sharing, targeted advertising, and certain profiling.
17.5 For California residents, CredX will provide any required notices at collection, financial incentive notices, and Do Not Sell or Share mechanisms where applicable.
17.6 For EEA, UK, and Swiss residents, applicable data protection laws may provide rights to access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a supervisory authority.
17.7 For India residents, where the Digital Personal Data Protection Act applies, CredX will process personal data based on consent or recognized legitimate uses and will provide mechanisms for withdrawal, grievance handling, and other required rights where applicable.
18. Third-Party Services
18.1 The Services may link to or integrate with third-party websites and services (for example, your financial institution or a merchant site). We do not control those third parties, and their privacy practices are governed by their own notices. CredX is not responsible for the content, security, or privacy practices of third-party services.
19. Changes to This Policy
19.1 We will post any updated version at this URL with a revised effective date and keep prior versions in an archive. For material changes (new categories of data, new purposes, new sub-processor categories, or changes to your rights or to the monetization model in Section 8), we will give at least 30 days’ advance notice by in-product banner and email to account holders and, where required by law, obtain renewed consent.