Privacy Policy

1. Introduction

Virtual Pay Capital Ltd. ("VPC", "we", "our", or "us") is an Alberta corporation and a FINTRAC-registered Money Services Business. We are committed to protecting the privacy of our clients and the individuals whose personal information we handle in the course of providing our services.

This Privacy Policy describes how VPC collects, uses, discloses, and retains personal information in accordance with:

• The Personal Information Protection Act (Alberta) ("PIPA")
• The Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA")
• The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (Canada) ("PCMLTFA") and associated FINTRAC regulations

2. Scope of This Policy

This Policy applies to personal information collected by VPC during client onboarding and in connection with the execution and monitoring of financial transactions. VPC does not collect personal information through its website. This Policy does not apply to information that is aggregated or anonymized such that individuals cannot be identified.

3. Personal Information We Collect

VPC collects personal information solely for the purposes of client identification, transaction processing, and regulatory compliance. This may include:

• Full legal name, date of birth, and government-issued identification
• Residential and business address
• Contact information (email address, phone number)
• Financial account details necessary to process transactions
• Transaction records, including amounts, dates, currencies, and counterparties
• Source of funds documentation as required under KYC/AML obligations
• Beneficial ownership information for corporate clients

VPC does not collect sensitive personal information beyond what is required by applicable law and regulatory obligations.

4. Purposes of Collection and Use

Personal information is collected and used only for the following purposes:

• To verify the identity of clients in accordance with FINTRAC Know Your Client (KYC) requirements
• To process, settle, and record financial transactions
• To monitor transactions for suspicious activity in compliance with Anti-Money Laundering (AML) obligations
• To fulfill reporting obligations to FINTRAC and other regulatory authorities
• To comply with applicable laws, regulations, and court orders
• To communicate with clients regarding their accounts or transactions

VPC does not use personal information for marketing, profiling, or any purpose beyond those listed above without obtaining prior consent.

5. Disclosure of Personal Information

VPC does not sell, rent, or trade personal information. Personal information may be disclosed only in the following circumstances:

• As required by law, including mandatory reporting to FINTRAC under the PCMLTFA
• To financial institutions, payment networks, or correspondent parties necessary to complete a transaction
• To legal counsel or advisors bound by confidentiality obligations
• With the express consent of the individual

Where personal information is shared with third-party service providers, VPC takes reasonable contractual steps to ensure that such parties protect the information in a manner consistent with this Policy.

6. Retention of Personal Information

VPC retains personal information for a minimum of five (5) years following the date of the last transaction or the termination of the client relationship, as required under the PCMLTFA. Where a longer retention period is required by applicable law or regulatory obligation, VPC will retain the information for that extended period.

Personal information that is no longer required is securely destroyed or anonymized.

7. Security Safeguards

VPC implements physical, administrative, and technical safeguards appropriate to the sensitivity of the personal information held. These measures are designed to protect personal information from unauthorized access, disclosure, alteration, or destruction. Access to personal information is restricted to authorized personnel who require it to perform their duties.

In the event of a privacy breach that poses a real risk of significant harm, VPC will notify affected individuals and the Office of the Privacy Commissioner of Canada (OPC) and/or the Office of the Information and Privacy Commissioner of Alberta (OIPC) as required by law.

8. Individual Rights

Subject to applicable legal exceptions, individuals have the right to:

• Request access to their personal information held by VPC
• Request correction of inaccurate or incomplete personal information
• Withdraw consent to the collection, use, or disclosure of their personal information (where applicable and where not required by law)
• Request information about how their personal information has been used or disclosed

To exercise any of these rights, individuals may submit a written request to VPC's Privacy Officer using the contact information provided in Section 10. VPC will respond within 30 days of receiving a complete request.

9. Accountability and Privacy Officer

VPC has designated a Privacy Officer who is responsible for overseeing compliance with this Policy and applicable privacy legislation.

Privacy Officer:

Isaac Ru, Chief Compliance Officer
Virtual Pay Capital Ltd.
200-1001 1 ST SE, Calgary, Alberta T2G 5G3
Email: feedback@virtualpaycapital.com
Website: virtualpaycapital.com

10. Regulatory Recourse

If an individual is not satisfied with VPC's response to a privacy inquiry or complaint, they may contact the relevant regulatory authority:

• Office of the Privacy Commissioner of Canada (OPC): www.priv.gc.ca
• Office of the Information and Privacy Commissioner of Alberta (OIPC): www.oipc.ab.ca

11. Updates to This Policy

VPC may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, or business practices. The current version will always be available at virtualpaycapital.com. Material changes will be communicated to affected clients in writing.

Virtual Pay Capital Ltd. | Alberta Corporation | FINTRAC-Registered MSB