1. Introduction

 

BBA FinTech ("BBA," "we," "our," or "us") is committed to protecting the privacy and security of the personal information we process. This Privacy Policy outlines how we collect, store, use, disclose, and protect personal information when you visit our website, use our fraud prevention and reputation management SaaS platform (the "Platform"), or interact with us .

By using our Platform or interacting with us, you consent to the data practices described in this policy.

 

Scope
This Privacy Policy applies to all personal information collected, used, and disclosed by BBA in connection with our business, including:

• Personal information of customers, users, and prospective clients .

• Information provided through the use of our SaaS Platform.

• Information collected through our website and any affiliated tools or applications .

• Communications and interactions with our sales, marketing, and support teams .

• This policy does not apply to third-party websites or services that may be linked to or integrated with our Platform .

2. Definitions
"Personal Data" means any information relating to an identified or identifiable natural person .

"Sensitive Personal Data" means Personal Data specifying racial or ethnic origin, government identification, or financial account information as defined by applicable law .

"Platform" refers to BBA FinTech's fraud prevention and reputation management SaaS solution.

"Customer Content" means any information, files, or records your organization chooses to upload or connect to the Platform .

3. Personal Information We Collect
Information You Provide

• Account Information: Name, business email address, phone number, job title, company name, and role .

• Financial Information: Billing address, transaction history, and payment details .

• Customer Content: Any information you upload or connect to the Platform, including financial records, transaction evidence, fraud reports, complaints, internal policies, and supporting materials .

Information Collected Automatically

• Technical Information: IP address, device identifiers, browser type, operating system, and system usage logs .

• Usage Data: Information on how you interact with our Platform, including features used, access logs, and error reports .

• Cookies: We use cookies and similar tracking technologies to enhance user experience, analyze usage, and improve functionality . You can manage cookies through your browser settings.

Information from Third Parties
We may receive information from third-party services integrated with our Platform, such as authentication providers .

Sensitive Personal Data
We may collect or process Sensitive Personal Data, including government-issued identification or financial account details, where necessary for identity verification, fraud prevention, and compliance with KYC/AML regulations . We handle such data with heightened security and only process it when legally permitted .

4. How We Use Personal Information

We process Personal Data for the following purposes:

• Service Delivery and Security: Authenticate users, encrypt and store Customer Content, prevent fraud, and administer accounts.

• Fraud Prevention and Reputation Management: Detect, investigate, and prevent fraudulent activity; provide risk intelligence to protect your reputation.

• Customer Support and Communication: Respond to inquiries, troubleshoot issues, and send service updates.

• Platform Improvement: Analyze de-identified usage trends to improve features, performance, and reliability.

• Legal and Compliance: Maintain audit logs, comply with KYC/AML regulations, and fulfill tax or dispute obligations.

• Sales and Marketing: Respond to demo requests, send product updates, and share relevant marketing communications (subject to opt-out options).

We do not sell or rent your Personal Data to third parties for marketing purposes.

5. Legal Basis for Processing
We process your Personal Data based on one or more of the following legal grounds:

Contractual Necessity: To fulfill our obligations under a contract with you or your organization .

Compliance with Legal Obligations: To comply with applicable laws, including KYC, AML, and data protection regulations .

Legitimate Interests: To improve our services, ensure security, and pursue our business objectives, provided these interests do not override your rights and freedoms .

Consent: Where you have given explicit consent, which you may withdraw at any time .

6. Data Sharing and Disclosure
We may share Personal Data with the following parties:

Service Providers and Subprocessors: Third-party vendors who assist with business operations, including hosting, cloud services, analytics, and identity verification . These providers are contractually bound to keep your information confidential and secure.

Business Partners: In connection with joint services or co-marketing activities, where applicable .

Regulators and Law Enforcement: When required by law, legal process, or to protect the rights, property, or safety of BBA or others .

Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of our business, your information may be transferred as part of the transaction, subject to appropriate confidentiality and data protection obligations .

BBA does not share, sell, or rent your Personal Data to outside marketers who may want to offer their own products and services .

7. International Data Transfers
BBA operates globally, and your Personal Data may be transferred to and processed in countries outside your country of residence. Where we transfer data from the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on approved transfer mechanisms, such as the EU-US Data Privacy Framework, Standard Contractual Clauses, or equivalent safeguards . We ensure that all transfers are subject to appropriate data protection standards.

8. Data Retention

We retain your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.

• Account Data: Retained for the duration of the contract to fulfill contractual obligations.

• Customer Content (Fraud/Reputation Data): Retained for the duration of the contract plus any applicable regulatory period to support service delivery and compliance.

• Support Records: Retained for 24 months from the last activity to support quality assurance and knowledge reuse.

• Marketing Leads: Retained for 24 months from the last activity to support sales analytics.

• Audit and Compliance Records: Retained as required by law (e.g., 7 years) to meet legal and regulatory obligations.

Government-issued IDs are retained in accordance with KYC/AML compliance timelines. After the retention period, data is securely deleted or anonymized.

9. Data Security
We implement robust technical and organizational measures to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction . These include:

Encryption: TLS 1.2+ for data in transit and AES-256 for data at rest .

Access Controls: Strict access controls and authentication mechanisms to limit data access to authorized personnel only .

Regular Security Audits: Quarterly access reviews and annual third-party penetration testing .

Employee Training: Regular privacy and security training for all employees .

Incident Response: A documented data breach response plan to promptly address security incidents and notify affected individuals and regulators where required .

Despite our efforts, no data transmission over the internet or storage system can be guaranteed to be 100% secure. We encourage you to take steps to protect your own data, such as using strong passwords and logging out of your account after use.

10. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your Personal Data :

Right to Access: Request a copy of the Personal Data we hold about you .

Right to Rectification: Request correction of inaccurate or incomplete data .

Right to Erasure: Request deletion of your data ("right to be forgotten"), subject to legal retention requirements .

Right to Restrict Processing: Request restriction of processing under certain circumstances .

Right to Data Portability: Request a machine-readable copy of your data for transfer to another provider .

Right to Object: Object to processing based on legitimate interests, including direct marketing .

Right to Withdraw Consent: Withdraw consent at any time where we rely on it for processing .

To exercise these rights, please contact us at [Insert Privacy Email] . We will respond within the timeframe required by applicable law and may require you to verify your identity before processing your request .

11. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to enhance user experience, analyze usage, and provide personalized content . The cookies we use may include:

Essential Cookies: Necessary for core functionality, such as security and authentication .

Performance and Analytics Cookies: To measure and improve Platform performance (e.g., Google Analytics) .

Functional Cookies: To remember your preferences and provide enhanced features .

You can manage cookie preferences through your browser settings. However, disabling certain cookies may affect Platform functionality. At this time, we do not respond to "Do Not Track" (DNT) signals, as there is no consistent industry standard .

12. Third-Party Links
Our Platform may contain links to third-party websites or services that are not operated or controlled by us . We are not responsible for the privacy practices or content of these third-party sites. We encourage you to review their privacy policies before providing any Personal Data .

13. Children's Privacy
Our services are not directed at individuals under the age of 16, and we do not knowingly collect Personal Data from minors. If we become aware that we have collected Personal Data from a child without appropriate consent, we will take steps to delete it promptly .

14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with an updated effective date . We encourage you to review this policy periodically. In the event of material changes, we will notify you through the Platform or via email.

15. Contact Us
If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us at:

BBA FinTech

130 King St., Suite 1900

Toronto, M5X 1E3

Canada
Email: contact@bbafintech.com
 

If you are in the EU or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.