Privacy Policy

Scadox (“Scadox”, “we”, “us”, or “our”) is committed to protecting the privacy of the personal information entrusted to us. This Privacy Policy explains what personal information we collect, how we use and protect it, and the choices you have. We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, substantially similar provincial privacy laws.

01 Who this policy applies to

This policy applies to personal information we collect through our website at scadox.com, our contact and enquiry forms, and our software platform and related services. It covers visitors to our website, prospective customers who contact us, and individuals whose information we process on behalf of our business clients (see Section 07).

Under PIPEDA, personal information means any information about an identifiable individual. It does not include the business contact information of an employee used solely to communicate with them in relation to their employment.

02 Information we collect

Information you give us directly

When you complete a form on our website (for example, to book a call), we collect:

• Your name;
• Your company name;
• Your email address;
• Your phone number (optional); and
• Any other information you choose to include in your message or in correspondence with us.

Information collected automatically

When you visit our website, we and our service providers may automatically collect limited technical information such as your IP address, browser and device type, pages viewed, and the date and time of your visit. This is used to operate, secure, and improve the website.

03 How we use your information

We use personal information only for purposes a reasonable person would consider appropriate, including to:

• respond to your enquiry and schedule and conduct a requested call or demonstration;
• provide, operate, maintain, and improve our website and platform;
• communicate with you about your enquiry, our services, and relevant updates (you can opt out of marketing messages at any time);
• protect the security and integrity of our website and services, and detect and prevent fraud or misuse; and
• comply with applicable laws and regulatory or legal obligations.

We will not use your personal information for a new purpose without obtaining your consent, unless permitted or required by law.

04 Consent

We collect, use, and disclose your personal information with your consent, except where otherwise permitted or required by law. By submitting a form and checking the consent box, you consent to us contacting you and processing the details you provide for the purposes described in this policy.

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting us using the details in Section 15. Withdrawing consent may affect our ability to provide you with certain services or respond to your enquiry.

05 When we disclose information

We do not sell your personal information. We may disclose it in the following limited circumstances:

• Service providers. To trusted third parties who perform services on our behalf (such as hosting, form processing, and communications), bound by confidentiality and data-protection obligations (see Section 06).
• Professional advisers. To our legal, accounting, and compliance advisers — including Approved MSB Services, our Canadian AML/ATF advisory partner — where reasonably necessary.
• Legal and regulatory requirements. Where required to comply with applicable law, a subpoena, court order, or lawful request by a public authority or regulator.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

06 Service providers & hosting

We rely on a small number of service providers to operate our website and services. These currently include:

• Hosting. Our platform and client data are hosted in Canadian data centres certified to SOC 2 and ISO 27001 standards.
• Form processing. Website enquiry forms are processed by a third-party form service that delivers your submission to us by email.
• Identity verification (KYC). Where used as part of the platform, integrations with KYC providers (such as SumSub) help maintain accurate customer and location data.

Where a service provider is located outside Canada, your personal information may be processed in another jurisdiction and could be subject to the laws of that jurisdiction. We take reasonable steps to ensure any such provider offers a comparable level of protection.

07 Data we process on behalf of our clients

Scadox provides FINTRAC reporting software to reporting entities. When we provide these services, we act as a service provider processing transaction and customer data on behalf of, and under the instructions of, our business clients (the “controlling” organizations). Those clients are responsible for the personal information in their accounts and for their own privacy obligations toward the individuals concerned.

We process this data only to deliver the contracted services — detecting reportable activity, generating, validating, and submitting reports to FINTRAC, and maintaining the associated records and audit trail. If you are an individual whose information has been provided to us by one of our clients and you have a question or request, please contact that organization directly; we will assist them as required.

08 How long we keep information

We retain personal information only as long as necessary to fulfil the purposes for which it was collected, or as required by law. Enquiry and contact information is kept for as long as needed to respond and for a reasonable period afterward for our records.

Reporting and transaction records processed through the platform may be retained to meet recordkeeping obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), under which reporting entities are generally required to retain records for at least five years. When information is no longer required, we securely delete or anonymize it.

09 How we protect information

We maintain physical, organizational, and technological safeguards appropriate to the sensitivity of the information, including:

• encryption of data in transit (TLS 1.3) and at rest (AES-256);
• hosting in Canadian data centres with SOC 2 and ISO 27001 certification;
• role-based access controls, so only authorized personnel can access data;
• comprehensive, timestamped audit logs; and
• regular security assessments and penetration testing.

No method of transmission or storage is completely secure, but we work continuously to protect your information against unauthorized access, use, or disclosure.

10 Your rights and choices

Subject to applicable law, you have the right to:

• Access the personal information we hold about you, and receive an account of how it has been used and to whom it has been disclosed;
• Correct information that is inaccurate or incomplete;
• Withdraw consent to our continued collection, use, or disclosure of your information;
• Opt out of marketing communications; and
• Challenge our compliance with this policy and PIPEDA.

To exercise any of these rights, contact our Privacy Officer (see Section 15). We will respond within 30 days or tell you if we need more time. There is generally no cost to make a request, and we may need to verify your identity before responding.

11 Cookies and analytics

Our website may use cookies and similar technologies to keep the site functioning, remember your preferences, and understand how the site is used. You can control or disable cookies through your browser settings; some features may not work properly if cookies are disabled. Where we use analytics that involve personal information, we do so in line with this policy and applicable law.

12 Data breaches

We maintain procedures to detect, assess, and respond to security incidents. If a breach of security safeguards creates a real risk of significant harm to affected individuals, we will notify those individuals and the Office of the Privacy Commissioner of Canada as required by law, and keep records of breaches in accordance with PIPEDA.

13 Children’s privacy

Our website and services are intended for businesses and are not directed to children. We do not knowingly collect personal information from individuals under the age of majority. If you believe a minor has provided us with personal information, please contact us so we can delete it.

14 Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated version on this page and revise the “Last updated” date above. Material changes will be communicated where appropriate. Your continued use of our website or services after an update constitutes acceptance of the revised policy.

15 How to contact us

If you have questions, requests, or concerns about this policy or your personal information, please contact our Privacy Officer:

If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC):