Privacy Policy

1. Who is responsible for your data

ChoicePay Ltd., 753 Kettles Street, Pincher Creek, Alberta T0K 1W0, Canada (company number Corporate Access No. 2025573946) is the controller of the personal data described here.

2. Laws that apply

We handle personal data in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta's Personal Information Protection Act where it applies, and, where we process data about people in the United Kingdom or European Economic Area, the UK GDPR and EU GDPR. As an MSB we must also collect and keep certain data under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA).

3. Who this policy covers

• Merchants, and the owners, directors, employees and representatives of merchant businesses.
• Agents who refer merchants to us.
• Customers of our merchants who see the Greenlane button, pay through Greenlane checkout, use the Greenlane app or hold rewards with us.
• Visitors to our website.

Merchants also hold their own data about their customers and are responsible for their own privacy notices.

4. Data we collect

Merchants and agents

• Business details: legal name, registration number, addresses, website, licences, business model and transaction volumes.
• Owners, directors and representatives: name, date of birth, nationality, address, occupation, identity documents, ownership percentage, contact details, and results of identity, sanctions and politically-exposed-person checks.
• Account data: login email, password (stored hashed), two-factor settings, API key usage and audit logs.
• Financial data: payout wallet addresses, payout history, fees, reserves and commission.
• Communications with us.

Customers

• Identifiers received from merchants: a hashed (SHA-256) version of your email address, the merchant's customer ID, your country and IP address. We do not need your plain email address to check eligibility.
• Device and technical data: device and browser characteristics, IP address and approximate location, and app installation identifiers.
• Payment data: payment method details (card numbers are handled by PCI DSS-compliant partners and stored by us only in tokenised or masked form), amounts, currencies, merchants paid, outcomes, refunds and disputes.
• Account and reward data: rewards balance and history, and, if you create a Greenlane account or cash out rewards, your name, date of birth, address, contact details, identity verification results and crypto wallet address.

Website visitors

• Pages viewed, referring pages, device and browser data, IP address, and cookie identifiers (see Cookies), plus anything you send us through forms.

5. How we use it and why

Under Canadian law, we rely on your consent, which may be implied where the purpose is obvious, or on an exception the law allows, such as investigating fraud or complying with law. Where we rely on legitimate interests under the GDPR, we have balanced our interests against your rights. You can ask us for details.

6. Eligibility checks

When you reach a merchant's checkout, we decide automatically whether to show you an active Greenlane button. Our checks take into account your payment history with Greenlane across the merchants that use it, how long your email and device have been seen, any history of chargebacks or fraud, and other risk signals.

If the button is not shown, you can still pay the merchant with their other payment methods, so this decision does not stop you from completing a purchase. You can contact us at info@choicepay.ca to ask about a decision, give your view, and request a review by a person.

Signals from one merchant are used to protect payments at other merchants in our network. We do not give merchants your personal data from other merchants; they receive only the eligibility result.

7. Who we share it with

• Payment partners: acquiring banks, payment processors and orchestration providers, card networks and payment method providers.
• Merchants: the eligibility result and the status and details of payments you make to them.
• Verification and fraud-prevention providers: for identity, sanctions, document, device and fraud checks.
• Stablecoin and blockchain service providers: to make payouts and reward cash-outs, including originator and beneficiary details where the law requires them to travel with a transfer.
• Service providers: hosting, cloud, email, messaging, analytics and customer support, acting on our instructions under contract.
• Agents: limited information about the merchants they referred, needed to calculate commission.
• Professional advisers, auditors and insurers.
• Regulators, law enforcement and courts, including FINTRAC, where required by law or to protect rights, property or safety. We may be legally prohibited from telling you about a report to FINTRAC.
• A buyer or successor if our business is reorganised, sold or merged.

We do not sell personal data.

8. International transfers

We are based in Canada, and we and our service providers may store and process personal data in Canada, the United Kingdom, the European Economic Area, India, the United States and other countries. Data held in another country is subject to that country's laws and may be accessible to its courts and authorities. Where we transfer data from the UK or EEA, we use appropriate safeguards, such as Canada's EU adequacy decision for commercial organisations, standard contractual clauses or the UK International Data Transfer Agreement. You can ask us for a copy of the relevant safeguards.

9. How long we keep it

• Verification, transaction and reporting records: at least 5 years, as required by the PCMLTFA, or longer where other laws require.
• Eligibility and fraud-prevention data: for as long as it remains useful for preventing fraud, and no longer than 7 years after your last transaction.
• Account data: while your account is open, and afterwards for as long as needed for legal claims and record keeping.
• Marketing data: until you opt out or it is no longer relevant.
• Website and cookie data: as described in our cookie settings.

We delete or anonymise data when we no longer need it.

10. Security

We protect personal data with technical and organisational measures appropriate to its sensitivity, including encryption in transit and at rest, hashing of email identifiers, tokenisation of card data through PCI DSS-compliant partners, access controls, two-factor authentication and monitoring. If a breach of security creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada, and any other authority the law requires. No system is completely secure, so please keep your login details and devices safe and tell us immediately if you suspect misuse.

11. Blockchain data

Payouts and reward cash-outs are recorded on public blockchains. Wallet addresses and transaction details on a public blockchain are visible to anyone and cannot be changed or deleted by us or anyone else. Our own records linking those transactions to you are handled as described in this policy.

12. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and learn how it has been used and shared;
• correct inaccurate or incomplete data;
• withdraw consent, subject to legal or contractual restrictions and reasonable notice;
• ask us to delete data, or to restrict how we use it;
• object to our use of data based on legitimate interests, and to direct marketing at any time;
• receive data you gave us in a portable format; and
• not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you, and to ask for human review.

To use these rights, email info@choicepay.ca. We will reply within 30 days, and may need to verify your identity. Some rights are limited where we must keep data to meet legal obligations, such as anti-money-laundering rules.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca), or, if you live in the UK or EEA, your local data protection authority.

13. Cookies

Our website and checkout use cookies and similar technologies. Essential cookies keep the service secure and working, including fraud prevention and remembering your session. With your consent, we also use analytics cookies to understand how our website is used. You can change your choices at any time through our cookie settings or your browser.

14. Children

Greenlane is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

15. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new "last updated" date and, for significant changes, tell merchants, agents and account holders by email or in the dashboard or app.

16. Contact us

Privacy Officer, ChoicePay Ltd. (trading as Greenlane)
753 Kettles Street, Pincher Creek, Alberta T0K 1W0, Canada
Email: info@choicepay.ca