Privacy policy

1.1 About Monitiva

Paytex Solutions Ltd. (Monitiva) is a corporation incorporated in the Province of Ontario (Ontario Corporation Registration Number: 1000801222), registered as a Money Services Business (MSB) with FINTRAC (#C100000118) and as a Payment Service Provider (PSP) with the Bank of Canada under RPAA (REG-3961, registered February 2, 2026).

Monitiva is building cross-border domestic payment infrastructure through which, once payment services launch, users will maintain a safeguarded Local Balance — held in trust by Paytex, in Canadian dollars, in a trust account at a prudentially regulated Canadian financial institution or trust company — and execute domestic payments in Destination countries through a Just-in-Time (JIT) FX mechanism. When a confirmed payment instruction is executed, Paytex converts the required CAD amount and executes the domestic payment in the Destination country (at launch, Local Payment via SPEI in Mexico; Bill Pay and Cardless Withdrawal as they are offered; additional Destination rails as they become available), from the prefunded balance that Paytex will hold with its payment provider in the Destination. No foreign client balance is created at any point. Client funds never leave Canada; once a User-instructed payment is debited from the Local Balance, the amount debited is no longer client funds. Some processing occurs on infrastructure operated by affiliated entities and by service providers. The written data-processing and intercompany agreements governing that processing are being put in place and will be in force before payment services launch. In all cases Monitiva remains the controller of your personal information and determines the purposes and means of its processing.

Data Controller Declaration: Paytex Solutions Ltd. dba Monitiva acts as the data controller for all personal data collected through the Platform, waitlist, and associated services.

1.2 Two Operational Phases Covered by This Policy

CURRENT STATUS — PRE-LAUNCH: Monitiva is currently in a pre-launch phase. The only service available today is waitlist registration. Monitiva does not currently open accounts, accept or hold client funds, or process payments. Accordingly, the Phase 2 processing described below — identity verification, biometric verification, risk assessment, location data, and transaction monitoring — does not occur today. It describes the processing that will apply when payment services launch and you open a Monitiva Account. Only the Phase 1 processing described below applies to you at present.

Phase 1 — Waitlist and Pre-Launch: Collection of interest registration information (name, email, city, user profile, urgency indicator, payment frequency, and monthly spend estimate) through landing pages and waitlist forms, including campaign and marketing analytics.

Phase 2 — Full Platform: Processing of personal and financial information necessary to provide payment services, including identity verification (KYC), risk assessment, transaction processing, regulatory reporting, and AML/CTF compliance.

1.3 Privacy Contact

1.4 Acceptance

By accessing our website, submitting your information for our waitlist, or using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal information as described herein, subject to the legal bases set out in Section 4.

2.1 Jurisdictional Scope

3.1 Waitlist and Pre-Launch Registration Data

3.2 Technical and Analytics Data (Automatically Collected)

We automatically collect: IP address (anonymized where feasible); browser type, version, and operating system; device type and screen resolution; referring URL and landing page URL; UTM parameters for campaign attribution; pages visited, time spent, and navigation patterns; cookie identifiers; and A/B test variant exposure.

3.3 Personal Identification Information (Platform Users — KYC)

3.4 Financial and Transactional Information

We collect: details of the Canadian bank account you link to your Monitiva Account in order to fund your Local Balance by pre-authorized debit (account number, institution, and the name of the account holder of record); your pre-authorized debit authorization and the record of it; your Local Balance and transaction history; source of funds documentation; purpose of transactions; and Beneficiary name and domestic payment identifier (CLABE or equivalent).

Account ownership verification. When you link a Canadian bank account, we verify that the account belongs to you by comparing the name of the account holder of record against your verified legal name. We do this to prevent third-party funding, which we do not permit, and to meet our obligations under PCMLTFA and the requirements of our banking partner. If the names do not match, the account cannot be linked and you will not be able to fund your Local Balance from it. You may ask us to review this outcome (see Section 13).

3.5 Risk Assessment and Suitability Information (KYC)

To meet our risk-based obligations under PCMLTFA and to assign appropriate transaction limits, we collect the following at onboarding and, where applicable, at Enhanced Due Diligence (EDD):

How we use employer and business information. Where you provide the name of an employer or business, we use it to assess the risk profile associated with your declared occupation and industry, and it may be screened against adverse media sources as part of our AML/CTF due diligence. This screening is directed at the named organization in the context of your risk assessment.

Data minimization by design. Consistent with PIPEDA and Quebec Act 25 minimality requirements, we limit what we collect:

• We do not collect your Social Insurance Number (SIN) or your country of birth. These are not necessary for our MSB/PSP scope and are excluded by design.
• We do not receive or store your online banking credentials. When your bank account is verified, you authenticate with your bank inside an environment hosted by our verification provider; your banking credentials are never transmitted to or held by Monitiva.

3.6 Biometric Verification Information

We collect biometric information — facial images for liveness verification, and biometric data compared against your identity document — through our identity verification and compliance provider Sumsub. Biometric verification occurs at two points:

• At onboarding, as part of the identity verification process required before we can provide you with any financial service.
• On an ongoing basis, at each Cardless Withdrawal request. We re-verify your identity biometrically in the application each time you request a Cardless Withdrawal, before the voucher is issued, to confirm that the person making the request is you. This is a recurring verification for as long as you use Cardless Withdrawal, not a one-time check.

Before identity verification, and before each Cardless Withdrawal request, we ask for your express consent to collect and use your biometric information for identity verification only. You give it by an affirmative action within the verification flow; starting the verification or the request does not by itself constitute consent. If you do not consent, we cannot verify your identity or issue the Cardless Withdrawal voucher. We do not use biometric data for any other purpose, and we do not use it to identify you in any context other than verifying your own identity to your own account.

3.7 Location Information

When you use the payment services, we collect information about where you are located. This is distinct from the website analytics described in Section 3.2 and is used for compliance and fraud-prevention purposes.

Cardless Withdrawal location gating. Cardless Withdrawal requires you to be physically present in the Destination country. We verify this using a combination of the signals above; if we cannot confirm your presence, the Cardless Withdrawal request is declined. You may ask us to review this outcome (see Section 13).

What we do not do with location data. We do not use location information for advertising, marketing, or profiling unrelated to compliance and fraud prevention. We do not sell or share it with marketing platforms. We do not use it to determine your tax residency or your immigration status, and we do not report it to tax or immigration authorities except where we are legally compelled to respond to a valid order or regulatory request. Our use of location data is for AML/CTF compliance, fraud prevention, and risk assessment only.

4.1 Overview

4.1.1 Legal Basis by Activity — Waitlist and Pre-Launch Phase

4.2 CASL Compliance

Monitiva fully complies with CASL. We will only send you commercial electronic messages if you have provided express consent through our waitlist form or platform registration. Every commercial message identifies Monitiva as the sender, provides our complete contact information, and includes a clear, functioning unsubscribe mechanism honored within 10 business days. We maintain records of how and when consent was obtained. Withdrawal of consent does not affect transactional or service messages.

4.3 Quebec Act 25 — Specific Requirements

Although the payment Services are not offered to residents of Quebec at this time (see the Terms of Use), a Quebec resident’s personal information may still be processed — for example, through waitlist registration or an application that is declined. Where we process the personal information of a Quebec resident, the protections of Quebec Act 25 apply. For Quebec residents, we apply: the principle of minimality (we collect only the minimum personal information necessary); clear, specific information about each purpose before collection; express consent before using information for purposes not identified at collection; Privacy Impact Assessments (PIAs) before implementing new technologies; data portability in structured, machine-readable format; and the ability to request de-indexation of information. The privacy assessment that Quebec law requires before the personal information of a Quebec resident is communicated outside Quebec — including to the hosting described in Section 7 — is pending. Either that assessment will be completed before any such information is communicated outside Quebec, or that information will not be collected.

5.1 Waitlist and Pre-Launch Activities

• Sending waitlist confirmation, position updates, and launch notifications
• Communicating product developments, beta access invitations, and early adopter offers (with CASL-compliant consent)
• Analyzing demand by geography and user profile
• Running A/B tests on messaging to optimize the product before launch
• Prioritizing beta access based on urgency, profile, and geographic alignment
• Sending newsletter content and marketing communications of potential interest to the User — including cross-border payment tips, product updates, and corridor-specific information — exclusively to Users who have provided separate express opt-in consent in accordance with CASL at the time of waitlist registration. Each communication will identify Monitiva as the sender, include complete contact information, and provide a clear unsubscribe mechanism honored within 10 business days.

5.2 Platform Service Delivery

• Verifying ownership of the Canadian bank account you link, and processing Local Balance funding by pre-authorized debit (PAD) against that account
• Executing JIT FX conversions and domestic payment instructions in the Destination country
• Maintaining RPAA-compliant Trust Account sub-ledgers for each client
• Providing customer support and resolving service issues

5.3 Regulatory Compliance

• Complying with PCMLTFA, including filing Suspicious Transaction Reports (STRs), Electronic Funds Transfer Reports (EFTRs), and Listed Person or Entity Property Reports (LPEPRs) with FINTRAC
• Complying with RPAA operational and incident reporting requirements to the Bank of Canada
• Conducting sanctions screening against applicable Canadian, US, UN, and EU lists
• Implementing and maintaining our AML/CTF program, including transaction monitoring and risk classification

5.4 Travel Rule Compliance

Where required by law, we include information identifying you and the beneficiary with the payment instruction and share it with the institutions involved in executing the transfer. This is a mandatory legal requirement under PCMLTFA and does not require additional consent.

5.5 Fraud Prevention, Security, and Business Improvement

We use your information to detect and prevent fraudulent activity and account takeover; maintain audit trails for security and compliance; analyze service usage to improve our product; and personalize the user experience based on your profile and preferences.

6.1 Service Providers

We share personal information with service providers strictly as necessary to deliver and safeguard the service. With the exception of Sumsub (named below given its role in identity verification and compliance), providers are described by function rather than by name; where they relate to cookies and analytics, the specific vendors are listed in our Cookie Policy.

6.2 Regulatory Authorities

6.3 What We Do NOT Do

Monitiva does not, and will not: sell, rent, or trade your personal information to third parties for marketing purposes; share your information with advertisers or ad networks for behavioral targeting on other platforms; or use your financial transaction data or Local Balance information for purposes other than providing and improving our services and complying with legal obligations.

9.1 Safeguards

Monitiva is implementing safeguards appropriate to the sensitivity of personal information, designed to include encryption of data in transit and at rest, role-based access control with multi-factor authentication for privileged access, network and application security controls, monitoring and audit logging, and backup and recovery arrangements. These safeguards will be in operation before payment services launch. Today we hold only waitlist and website data (Section 1.2). Access to personal information is to be granted on a least-privilege basis and reviewed periodically.

9.2 Fund Segregation Security

Once payment services launch, client funds (Local Balances) will be held in trust in the Trust Account and segregated from Paytex’s own corporate funds. Client funds are not Paytex’s property, are not used to fund Paytex’s operations, and are not available to Paytex’s creditors. This segregation protects client funds and is a non-negotiable operational requirement under RPAA safeguarding obligations.

11.1 Rights Under PIPEDA (All Canadian Residents)

You have the right to: access the personal information we hold about you; request correction of inaccurate or incomplete information; withdraw consent for processing activities based on consent (subject to mandatory legal retention obligations); and file a complaint with the Office of the Privacy Commissioner of Canada (OPC).

11.2 Additional Rights Under Quebec Act 25

Quebec residents have additional rights including: data portability in structured, machine-readable format; de-indexation requests; information about automated decisions significantly affecting you; and human review of automated decisions.

11.3 Additional Rights Under GDPR (EU/EEA Residents)

EU/EEA residents have additional rights including: data portability; restriction of processing; right to object; erasure (“right to be forgotten”, subject to mandatory PCMLTFA retention obligations); and the right not to be subject to solely automated decisions with legal effects.

11.4 CASL Unsubscribe Rights

You may withdraw consent to receive commercial electronic messages at any time by clicking the unsubscribe link in any commercial email, emailing privacy@monitiva.com, or updating your communication preferences in your account settings. We will honor unsubscribe requests within 10 business days.

17.1 Contact Monitiva

17.2 Supervisory Authorities