Introduction.

The Katarun Technologies Ltd (the “Katarun”) Privacy Policy (the “Privacy Policy”) explains how Katarun manages the personal information it collects, uses and discloses. Personal information means information about an identifiable individual. Personal information does not include aggregate information that cannot be associated with a specific individual, and in certain jurisdictions, it may also exclude business contact information.

This Privacy Policy outlines the principles and the detailed practices we follow in protecting and managing your personal information. This includes personal information we collect from customers or prospective customers of Katarun (“Customers”). This includes the personal information we collect when you sign up for the Katarun payment platform; access or use our website, product, and services (collectively, the “Katarun Solution”); or when you otherwise interact with us. This Privacy Policy does not apply to information that is not personal information.

In this Privacy Policy, “you” and “your” shall refer to Katarun Customers who may provide personal information to Katarun and “we”, “us”, “our” and “ourselves” shall refer to Katarun.

Accountability.

Principle – Katarun takes steps to maintain and protect personal information under its control in accordance with the applicable legislation. Katarun has designated a Privacy Officer to oversee Katarun compliance with this Privacy Policy and the applicable legislation and may be contacted at [email protected] adding FAO: Privacy Officer in the email subject.

Identifying purposes.

Principle.

This Privacy Policy outlines certain purposes for which Katarun requires the collection, use and disclosure of personal information from Katarun Customers in order to provide its requested services. Katarun will identify any additional purposes for which personal information is collected, used or disclosed before or at the time the information is collected.

Generally, we collect, use and disclose personal information to:

1. Administer and service the business relationship with Katarun Customers and to provide Katarun Customers with the requested services, information and support;
2. Process payment transactions and facilitate billing for Katarun Customers;
3. Improve and personalize Katarun Solution;
4. Determine a Katarun Customer’s financial status by collecting financial information from credit agencies, strategic partners or other financial institutions;
5. Comply with any required reporting (i.e.: FINTRAC, Visa, MasterCard etc.);
6. Track and analyse trends and usage in connection with Katarun Solution;
7. Safeguard your or our interests such as to verify your identity; to investigate and prevent suspicious activities or fraud, and to protect our rights or property;
8. Enable features of Katarun Solution such as sending transaction receipts to Consumers through e-mail or SMS;
9. Identify insights, trends and analytics of activities of Consumers; and
10. Send other information about Katarun and its products and services.

Consent.

Principle.

Katarun will obtain your consent for the collection, use or disclosure of your personal information, including when Katarun wishes to use the collected information for any other purpose.

We obtain most of your personal information, and your express consent for its collection, during the account registration process when you complete the registration form online to receive Katarun Solution. Your provision of personal information to us implies that: (a) you agree and consent that we may collect, use and disclose your personal information in accordance with this policy; (b) you or your representatives are authorized to provide us with your personal information.

We may obtain some information when you change the nature of services you receive, when you call our Support Centre or when you contact us otherwise. With your consent, we may obtain information about you from third parties, including credit-reporting agencies. We may collect your personal information in person, over the telephone or through e-mail, regular mail or facsimile correspondence.

The choice to provide us with personal information is always yours. You may not grant, or withdraw, consent to use your personal information at any time (subject to legal or contractual restrictions and reasonable notice). However, your decision to withhold particular details may limit our ability to provide you with our services.

Commercial Electronic Messages and Opt-Out.

Katarun may send you “commercial electronic messages” about Katarun and Katarun’s products, services, promotions and events. Katarun may seek your express consent or, in some cases, rely on an existing agreement or prior transaction with you to imply your consent to receiver these messages. You may withdraw this consent at any time by contacting [email protected] indicating in the email’s subject FAO: Privacy Officer. Please note that for some types of messages, such as transaction notifications and important information about a Katarun Customer’s account, it may not be possible to unsubscribe and continue to use the Katarun Services.

Recording of Calls.

Katarun may record incoming phone calls to our Support Centre for quality monitoring and coaching purposes and, as necessary, to record the fact that verbal consent was obtained to use your personal information for an identified purpose (for example, obtaining a credit report from a credit-reporting agency or credit bureau).

Limiting collection.

Principle.

Katarun shall limit the collection of personal information to that which is necessary for the purposes identified by Katarun. Katarun shall collect personal information by fair and lawful means.

The type of information we collect to provide you with the services includes the following:

1. We collect the information you provide such as when you sign up for a payment account; during our identity verification process; or in the course of a transaction. This may include, but is not limited to, basic information such as your name, e-mail address, mailing address, phone number, birth date and social insurance number (optional); financial information including bank account, business details and other historical, contact, and demographic information.
2. We collect transaction information when you use Katarun Solution to accept payments. This includes transaction details like date-time, geo-location, description, the payment amounts, and information about the devices and payment methods used to complete the transaction.
3. We collect device information when you access Katarun Solution, including the hardware model, operating system and version, unique device identifiers, mobile network information, browser types and language, and Internet Protocol (‘IP’) addresses.
4. We collect information through technologies like cookies. Cookies are small data files that may be stored on the device memory or hard drive when you visit our website. We use cookies to support the integrity of the payment session and to retain your language preferences and account settings to create a customized experience.
5. We collect information about you from third parties, including but not limited to third-party verification services, credit bureaus, and publicly available sources.
6. We collect Consumer information from transactions through Katarun Solution, including products sold and customer financial transaction data.

Under the age of 13.

The Katarun website and Katarun products and services are not intended for individuals under the age of 13. Katarun does not collect, use or disclose personal information of individuals under the age of 13. If you suspect Katarun has inadvertently collected personal information of someone under the age of 13 you may contact Katarun’s Privacy Officer.

Third-Party Links.

The Katarun website may contain links to other websites for the convenience of visitors. Visitors should be aware that this Privacy Policy does not apply beyond the Katarun website and as such Katarun is not responsible for the personal information practices of those websites. Visitors are encouraged to read the privacy and cookie policies of any respective website they visit.

Limiting use, Disclosure & Retention.

Principle.

Katarun will use or disclose your personal information only for the purposes for which it was collected, except with your consent or as required or permitted by law. Katarun will retain your personal information as long as necessary for the fulfilment of those purposes, subject to statutory or regulatory retention requirements and legitimate business reasons.

In the course of daily operations, access to personal and other sensitive information is restricted to authorized employees who have legitimate business purposes for accessing it.

We do not license, sell, rent or trade your personal information to third parties unless it is necessary to provide you with requested services and you authorize or consent to the disclosure, or when such disclosure is otherwise described in this Privacy Policy or permitted or required by law.

Disclosure to Third Parties.

We may disclose or share your personal information with third parties in situations where:

1. We have your consent;
2. The third parties are (a) our suppliers or partners who assist us in providing, maintaining, and improving Katarun Solution; and (b) financial institutions, processors, payment card associations, and other entities that are part of the payment process;
3. We are required or permitted to do so by law or applicable regulators and self-regulatory organizations; and
4. Merger, sale of company stock or assets, financing, acquisition, divestiture, or dissolution of all or a portion of our business is involved.

In such situations, Katarun only shares the personal information with third parties for appropriate purposes in providing the requested products and services to Katarun Customers. Additionally, Katarun uses contractual means to ensure that personal information shared with third parties is provided with comparable levels of protection and management as provided under this Privacy Policy. It is possible such third parties are outside of Canada and subject to their own respective jurisdictions.

Retention.

We retain your personal information as long as necessary for the fulfilment of the identified purpose(s). We make reasonable efforts to ensure that personal information, which is no longer required to be retained, is disposed of or destroyed in a secure manner.

Accuracy.

Principle.

Katarun will use reasonable efforts to maintain your personal information in the as accurate, complete and up-to-date form as is necessary for the purposes for which it is to be used, in compliance with applicable legislation.

Safeguarding personal information.

Principle.

Katarun will put in place security safeguards appropriate to the sensitivity of the personal information in order to protect your personal information from unauthorized access, improper use and accidental destruction or loss.

We take reasonable measures, including administrative, technical, and physical safeguards, to help protect personal information from loss, theft, misuse, and unauthorized access, disclosure, alteration, and destruction. Personal information, in both electronic and paper-based form, is stored in a highly secured environment with restricted access. Katarun Solution uses encryption for protecting and maintaining the security of message transmissions over the Internet.

Katarun’s employees, as a condition of their employment, are required to comply with confidentiality, merchant privacy and security obligations. Katarun’s employees are also trained on the importance of privacy and maintaining the confidentiality of personal information.

From time to time, Katarun reviews and updates its security policies and measures in an effort to protect the information in the most effective manner possible.

Openness.

Principle.

Katarun shall make available to you, upon request, specific information about our policies and practices that apply to the management of your personal information.

You can check our Privacy Policy on our website or contact us to obtain a current copy of our Privacy Policy.

Katarun customer access.

Principle.

Upon request, Katarun shall inform you of the existence, use and disclosure of your personal information. You may verify the accuracy and completeness of your personal information and may request that it be amended, if appropriate, as provided by applicable legislation.

Subject to applicable legislation, our merchants may access, verify and update their personal information by logging into their account on the merchant portal or by calling our Support Centre If there is any error, we will promptly amend and correct the information in our possession.

Contact us.

You may direct any questions, concerns or complaints regarding Katarun’s privacy policy and practices outlined above by contacting:

Katarun Technologies Ltd.

422 Richards St #170 Vancouver,

British Columbia, V6B 2Z4, Canada

Phone: +1 (604) 757-4645

E-mail: [email protected]

Annex I – Privacy Notice to Customers from EU/EEA.

We respect your privacy, protect and process your Personal data in accordance with the rules of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter – “GDPR”) and other applicable regulatory enactments.

This notice explains how and why we use your personal information when you open an account and use our Katarun Solution and services for account holders.

Information Katarun collects and holds about you and how this information is used.

Information you provide us via the Katarun payment platform:

1. Information you provide when applying for an account with Katarun (your name, surname, address, contact information, place and date of birth, tax residency, identification document, information on source of income, etc.).
2. A short video of yourself and your selfie, which you provide as part of the on-boarding process.
3. The log in credentials and settings you choose for your account.
4. Information you give us through the Katarun payment platform when you contact us.
5. Answers you give to surveys so we can improve our services.

Information Katarun collects if you get in touch.

If you use other ways to get in touch than the Katarun payment platform, we collect the following information so we can answer your questions or take action:

1. The phone number you’re calling from and the information you give us during the call.
2. The email address you use and the contents of your email (and any attachments).
3. Public details from your social media profile (like LinkedIn) if you reach out to us via these platforms and the contents of your messages or posts to us.

Information we collect when you use the Katarun payment platform and our services.

We collect this information to give you services in a safe and lawful way, and to keep improving them. This includes:

1. details about payments to and from your payment account;
2. details about how you use our payment platform;
3. all the countries you’re a tax resident in and your Tax Identification Number for each one.

Information we collect from your phone and PC:

1. The mobile network and operating system you use, so we can analyse how our app works and fix any issues.
2. Your IP address and device ID for security reasons (we’ll link your mobile phone number with your device).

Information we obtain from external sources.

When you apply for our services, we search your records at fraud prevention agencies and KYC (Know Your Customer) and AML (Anti Money Laundering) service providers to fulfil our legal obligations.

We may also collect information about you from public sources for AML reasons or market research. This includes:

1. official public records, like Company registers;
2. information published by the press or on social media.

Legal basis for collecting and processing your information.

We collect and process your information only for legitimate purposes in accordance with the rules of data protection and processing established by GDPR and other applicable rules as well as with data processing principles, which means that your personal information will be:

1. Used lawfully, fairly and in a transparent way;
2. Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
3. Relevant to the purposes we have informed you about and limited only to those purposes;
4. Accurate and kept up to date;
5. Maintained only for as long as necessary for the purposes we have informed you about;
6. Kept securely and protected against unauthorized or unlawful processing and against loss or destruction using appropriate technical and organizational measures.

When Katarun using your personal data, at least one of the following applies: contractual or legal obligation, legitimate interest, public interest, vital individual interest or consent.

We need to use your data for a contract we have with you, or to enter into a contract with you. We use details about you to:

1. consider your application;
2. give you the services we agreed to in line with our terms and conditions;
3. send you messages about your account and other services you use if you get in touch, or we need to tell you about something;
4. exercise our rights under contracts we’ve entered into with you;
5. investigate and resolve complaints and other issues.

We need to use your data to comply with the law. We:

1. confirm your identity when you sign up or get in touch;
2. check your record at immigration and fraud prevention agencies;
3. prevent illegal activities like money laundering, tax evasion and fraud;
4. keep records of information we hold about you in line with legal requirements;
5. adhere to applicable laws and regulations (according to which we sometimes need to share customer details with regulators, tax authorities, law enforcement or other third parties);
6. compare the information we hold about your account with your tax residency information to make sure we don’t have a reason to doubt it.

When it’s in our “legitimate interest”. We need to use your data for our legitimate interests, or those of a third party. This means using data in a way that you might expect us to, for a reason which is in your and/or our (or a third party’s) interest and which doesn’t involve overriding your privacy rights. We:

1. tell you about products and services through the payment platform, website or other channels, like social media companies, based on how you use our products and services and other information we hold about you. We do this so we can make sure our marketing is useful. That includes instructing platforms to show or not show Katarun adverts to existing customers. We don’t share any identifying information with social media companies other than your mobile advertising ID. You can disable or reset your mobile advertising ID in your device’s operating system;
2. provide you with transaction reports;
3. track, analyse and improve the services we provide to you and other customers and how you respond to ads we show. We may ask for feedback if you’ve shown interest in a service. We do this so that we can make our products better and understand how to market them;
4. protect the rights, property or safety of us, our customers or others;
5. carry out security and maintenance checks to make sure our app and other services run smoothly for you;
6. manage Katarun’s business risk and financial affairs and protect our customers and staff.

Consent. We’ll ask for your consent to share information about you with companies we work with when we need your permission (see “Who we share your data with” below).

You don’t have to share information about yourself if you don’t want to. But if you don’t, you may not be able to use some (or any) of our services.

We share your information with.

Companies that provide services to us.

Here we mean companies, that help us provide services you use and need to process details about you for this reason:

1. companies that provide payment software to Katarun;
2. Know Your Customer (KYC) and Anti-Money Laundering (AML) service providers that help us with identity verification or fraud checks like Troolio, LexisNexis;
3. cloud computing power and storage providers like Amazon Web Services (AWS) and Google Cloud;
4. companies that help us with technical support;
5. companies that help us with marketing (but we won’t share identifiable personal data with third parties for their own direct marketing unless you give us permission, and you can opt out any time);
6. software companies that we use for emailing you;
7. companies that offer benefits or rewards through special programmes you sign up to.

Anyone you give us permission to share it with.

We tell you in the payment platform, when we need your consent to share your data with:

1. other banks and payment service providers;
2. people you’ve asked to represent you, like solicitors.

Law enforcement and other external parties.

We may share your details with:

1. authorities that spot and stop financial crime, money laundering, terrorism and tax evasion if the law says we have to, or if it’s necessary for other reasons;
2. the police, courts or dispute resolution bodies if we have to;
3. other banks or payment service providers to help trace money if you’re a victim of fraud or other crimes or if there’s a dispute about a payment;
4. any other third parties where necessary to meet our legal obligations.

We may also share your details with people or companies if there’s a corporate restructuring, merger, acquisition or takeover.

Information retention.

Katarun will hold your personal information for no longer than reasonably necessary – not more than 6 years from the moment we establish a business relationship with you, except in cases where there is a legal reason to hold it longer (e.g., due to AML reasons, claims, initiated court proceedings).

To establish how long we keep different categories of data, we consider why we hold it, how sensitive it is, how long the law says we need to keep it for, and what the risks are.

Your rights.

You have a right to:

1. access the personal data we hold about you, or to get a copy of it;
2. ask for a copy of your personal data in a portable (machine-readable) format or make us send it to someone else;
3. make us correct inaccurate data;
4. ask us to delete, ‘block’ or suppress your data, though for legal reasons we might not always be able to do it;
5. say no to us using your data for direct marketing and in certain other ‘legitimate interest’ circumstances;
6. withdraw any consent you’ve given us;
7. ask a member of staff to review a computer-made (automated) decision.

To do any of these things, please contact us by emailing  [email protected] indicating FAO: Privacy Officer. As per European data protection laws, we will respond you in a months’ time.

Where Katarun stores and sends your data.

We may transfer and store the data we collect from you to organisations outside the European Economic Area (EEA) and Canada. When we do this, we make sure that your data is protected and that:

1. the European Commission says the country or organisation has adequate data protection, or
2. we’ve agreed to standard data protection clauses approved by the European Commission with the organisation.

How Katarun protects your personal data

Katarun complies with its obligations under the applicable data protection laws by:

1. keeping personal data up to date;
2. storing and destroying it securely;
3. not collecting or retaining excessive amounts of data;
4. protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical and organizational measures are in place to protect personal data.

This Privacy Policy was last amended on 01/02/2023.