Contact

Privacy Policy

Last updated on September 10, 2026

1. INTRODUCTION AND SCOPE

1.1. Corporate Commitment to Privacy 

HOLDEN TRANSFER INC., a corporation organized and existing under the laws of the Province of Alberta, Canada (Corporate Access Number: 2028406771), with its registered office and principal place of business at 700-602 12 AVENUE SW, Calgary, Alberta, T2R1J3, Canada (hereinafter – the “Company“), respects your right to privacy. The Company recognizes that in the virtual currency sector, data security and confidentiality are as critical as financial integrity. The Company is committed to protecting your personal information and ensuring that all data processing operations are lawful, fair, transparent, and proportionate. 

These commitments are given legal effect through the Personal Information Protection Act (Alberta), S.A. 2003, c. P-6.5 (hereinafter – the “PIPA“), which, as the Company is organized and operates from Alberta, is the primary private-sector privacy statute governing the Company’s collection, use, and disclosure of personal information. Where personal information crosses provincial or international borders, or relates to a federally regulated activity, the Company additionally observes the federal Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (hereinafter – the “PIPEDA“).

1.2. Scope of the Policy and Services 

This Privacy Policy (hereinafter – “Policy“) comprehensively governs the collection, use, disclosure, retention, cross-border transfer, and protection of personal information by the Company. It applies to all interactions you have with the Company in connection with the over-the-counter (hereinafter – “OTC”) virtual currency conversion services, the official website, client portals, API integrations, and all associated communication channels, including secure messaging applications and email.

1.3. Responsibility for Personal Information

HOLDEN TRANSFER INC. is responsible for personal information under its control and has designated an individual responsible for overseeing compliance with applicable privacy requirements and the Company’s privacy practices. 

1.4. Relationship with Other Company Documents

This Policy should be read together with the Company’s OTC Service Terms of Use, AML/ATF Notice and Cookies Policy, where applicable. This Policy explains how the Company collects, uses, discloses, retains and protects personal information in connection with the Website, onboarding, communications and the provision of Services.

2. THE INFORMATION WE COLLECT

2.1. Principle of Data Minimization and Definition 

To provide secure, reliable, and legally compliant OTC Services, the Company must collect specific categories of information from you. Because the Company’s operations are based and carried out in Alberta, “Personal Information” is defined, in accordance with section 1(1)(k) of PIPA, as information about an identifiable individual , a definition that PIPEDA mirrors at section 2(1) for personal information collected, used, or disclosed outside Alberta, or in the course of interprovincial or international commercial activity. The Company seeks to limit the collection of personal information to information that is reasonably necessary for identified operational, legal, regulatory, compliance and risk-management purposes. 

A. Identity and Onboarding Information

The Company does not permit Clients to access regulated OTC Services without completing the identification and verification procedures required under applicable law and the Company’s compliance framework. To satisfy statutory client identification mandates under applicable AML/ATF regulations, the following information is collected for natural persons:

  • Basic Identity: Full legal name, date of birth, and nationality.
  • Documentary Evidence: Valid, government-issued identity documents checking for validity and authenticity.
  • Address Verification: Verifiable proof of residential address.
  • Biometric Data: Automated biometric verification (Liveness checks) to ensure the physical presence of the applicant and prevent identity spoofing during remote onboarding.
  • Financial Information: Verifiable documentary evidence establishing the Source of Funds.

B. Corporate and Beneficial Ownership Information (B2B Clients) 

For corporate entities, trusts and institutional Clients, the Company conducts due diligence to identify and understand the entity’s ownership and control structure and, where required, its beneficial owners and persons exercising control. In this context, the Company collects personal information regarding:

  • Corporate Structure: Details of the corporate identity, including Certificate of Incorporation, Memorandum and Articles of Association (or operational bylaws), and documentary proof of the registered legal and operating address.
  • Authorized Representatives & Directors: Identity verification, including government-issued identification, Liveness checks, and proof of residential address, for all active directors, officers, and individuals authorized to execute transactions or bind the entity.
  • Ultimate Beneficial Owners: Full identification of all natural persons who ultimately own or control twenty-five percent (25%) or more of the shares, voting rights, or ownership interests in the entity, or who exercise effective control over the management of the entity. The personal data collected for each UBO includes government-issued identification, Liveness checks, and proof of residential address.
  • Financial Integrity: Comprehensive, verifiable documentary evidence establishing the entity’s Source of Funds and overall Source of Wealth.

C. Financial and Transactional Information 

To execute high-volume OTC conversion transactions, mitigate the risks of illicit finance, and satisfy Know Your Transaction obligations, the Company may collect and process, as applicable: 

  • Fiat Banking Profiles: Banking details (e.g., account numbers, SWIFT/BIC codes, institution names, and routing numbers). This data is reconciled to ensure fiat funds are deposited from and withdrawn strictly to accounts held in the exact registered legal name of the verified Client, actively preventing unauthorized third-party funding.
  • Virtual Currency Traces: Virtual currency wallet addresses, transaction hashes, and associated blockchain data where necessary for transaction monitoring, sanctions screening, blockchain analytics and other compliance purposes. 
  • Wealth Origination: Detailed documentation and declarations related to the specific Source of Funds for individual transactions and, where applicable for corporate entities, the overall Source of Wealth.
  • Conversion History: Comprehensive, auditable records of OTC requests, executed conversion transactions, conversion rates, fiat equivalents, and settlement history with the Company.

D. Communication Records and Audit Trails

To ensure the highest quality of service, prevent misunderstandings during complex OTC negotiations, and maintain auditable records for regulatory and dispute-resolution purposes, the following is securely collected and archived:

Transcripts and logs of all official communications with the Company. This encompasses interactions via email, secure messaging applications, and internal support ticketing channels. These records are treated with the highest level of confidentiality and are retained as a verifiable audit trail of client instructions, consent, and regulatory record-keeping.

3. PURPOSES OF DATA PROCESSING AND UTILIZATION

3.1. The Principle of Limited Use and Purpose Specification 

The Company adheres to the principles of purpose specification and limited use. There is no indiscriminate collection of data, nor is personal information sold, rented, or monetized to third parties. The collected data is utilized strictly to fulfill explicit, legitimate, and clearly defined purposes as outlined in the subsequent sections of this Policy.

3.2. Service Delivery and Operational Execution 

To provide premium OTC conversion services efficiently and securely, personal and financial information is required to:

Establish, administer, and maintain the individual or corporate account.

  • Assess initial and ongoing eligibility for the Services based on jurisdictional restrictions and internal risk appetite.
  • Process specific requests for OTC quotes, secure exchange rates, and execute high-volume virtual currency conversion transactions.
  • Facilitate the seamless and accurate settlement of fiat currency and virtual currencies strictly to verified, whitelisted banking institutions or external wallet addresses.

3.3. Strict Regulatory Compliance (AML/ATF) 

As an entity operating in compliance with Canadian national regulations, specifically the anti-money laundering and anti-terrorist financing framework set out in the PCMLTFA, S.C. 2000, c. 17 and PCMLTFR, SOR/2002-184 regulatory adherence is the mandatory foundation of the operations. Data is processed to:

  • Fulfill statutory Know Your Customer and Know Your Business identification mandates.
  • Conduct comprehensive, ongoing screening against global sanctions lists , as well as PEP and adverse media databases.
  • Monitor transactions and activities for compliance purposes and submit reports or disclosures to FINTRAC or other competent authorities where required by applicable law. 

3.4. Risk Management and Service Security

The Company may use technical and organizational measures, including identity verification tools, IP and device-related information, blockchain analytics and other fraud-prevention or compliance tools, where appropriate, to protect the Services, detect suspicious or unauthorized activity and manage operational, cybersecurity and financial-crime risks. 

3.5. Client Support, Communication, and Dispute Resolution 

To ensure a reliable client experience and maintain auditable corporate transparency, contact data and communication logs are used to:

  • Send critical operational notices, authentication codes, transaction settlement receipts, and updates regarding material changes to the Terms of Use.
  • Provide dedicated support, address complex compliance inquiries during the onboarding phase, and fairly resolve technical or transactional disputes.
  • Respond promptly, accurately, and lawfully to valid legal requests, subpoenas, or official inquiries from law enforcement agencies and competent regulatory authorities.

4. DISCLOSURE AND SHARING OF PERSONAL INFORMATION

4.1. Prohibition on Data Monetization 

The Company views personal information as a critical component of institutional trust. The Company does not sell, rent, trade, or otherwise monetize personal data to third parties, marketing agencies, or data brokers under any circumstances. Any disclosure of information is executed on a strictly “need-to-know” basis and is restricted to the specific operational and legal scenarios outlined below.

4.2. Authorized Third-Party Service Providers 

To operate secure and globally competitive OTC conversion services, the Company integrates with vetted, industry-leading technical and compliance vendors. Specific data points may be shared with these service providers to perform delegated functions on behalf of the Company. These include:

  • Identity and Compliance Partners: Specialized KYC/KYB orchestration agencies and biometric verification providers used to validate identity documents and corporate structures.
  • Blockchain Forensics Firms: Analytics providers utilized to monitor transaction hashes, verify the provenance of funds (KYT), and ensure compliance with global sanctions.
  • Infrastructure Providers: Enterprise-grade secure cloud hosting, database management, and encrypted communication infrastructure providers.
  • Safeguard: The Company requires service providers that process personal information on its behalf to be subject to appropriate contractual confidentiality, privacy, data-security and use restrictions, having regard to the nature of the services and information involved. 

4.3. Financial Institutions and Liquidity Partners 

To physically execute, clear, and settle requested high-volume OTC conversion transactions, the Company must interact with the traditional financial system. Necessary transactional and identity details are shared with regulated banking partners, payment processors, and liquidity providers. This disclosure is limited to the data required to facilitate fiat deposits and withdrawals, satisfy counterparties’ own AML/ATF clearing requirements, and comply with applicable electronic funds transfer regulations.

4.4. Mandatory Disclosures to Regulators and Law Enforcement 

As a regulated corporate entity, the Company is legally compelled to disclose personal information to competent authorities without prior consent when explicitly mandated by law. Such disclosures occur only in the following scenarios:

  • Statutory Reporting: Fulfilling mandatory reporting obligations to applicable national financial intelligence units or tax authorities regarding compliance and transactional thresholds.
  • Legal Compulsion: Responding to legally binding subpoenas, court orders, search warrants, or official demands from law enforcement agencies or equivalent international bodies through mutual legal assistance treaties.
  • Safeguard: The Company’s compliance and legal teams carefully review all such requests to verify their legal validity, jurisdiction, and scope before any data is disclosed, ensuring only the minimum required by the compelling authority is provided.

4.5. Service Providers Outside Canada

The Company may use service providers located outside Canada to collect, use, disclose, process or store personal information on its behalf. In such circumstances, personal information may be subject to the laws of the jurisdiction in which the relevant service provider operates and may be accessible to courts, law enforcement or regulatory authorities in that jurisdiction where required by law.

Individuals may obtain information about the Company’s policies and practices relating to service providers located outside Canada, including information regarding the countries in which such service providers may process personal information and the purposes for which they are authorized to process such information, by contacting the individual responsible for the Company’s privacy compliance using the contact details set out in Section 10 of this Policy.

4.6. Corporate Restructuring and Business Transfers

In the event that the Company undergoes a corporate transition – such as a merger, acquisition, restructuring, insolvency, or the sale of all or a portion of its assets – personal information may be transferred to the successor entity. Any such transfer will be subject to Non-Disclosure Agreements during the due diligence phase, and the receiving entity will remain bound by the material terms of this Privacy Policy.

5. SAFEGUARDING YOUR DATA

The Company implements reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the personal information under its control and the risks associated with its processing. Such safeguards may include encryption, access controls, authentication measures, logging and monitoring, personnel confidentiality obligations, staff training, vulnerability management and other information-security measures appropriate to the Company’s systems and operations.

Access to personal information is restricted to authorized personnel and service providers who require such access for legitimate business, compliance or operational purposes.

6. RETENTION OF PERSONAL INFORMATION

6.1. Principle of Storage Limitation 

The Company is committed to the principle of storage limitation. Personal information is retained only for the duration explicitly necessary to fulfill the operational and business purposes outlined in this Policy, to provide seamless OTC Services, and to resolve any prospective disputes. Client data is not indefinitely hoarded once the business relationship has concluded.

6.2. Statutory AML/ATF Retention Requirements

Following commencement of activities subject to Canadian MSB requirements, the Company will retain records required under applicable AML/ATF legislation for the applicable statutory retention periods. Depending on the category of record, these periods are generally at least five (5) years, calculated from the date or event prescribed by applicable law. Such records may include Client identification and verification information, beneficial ownership information, business relationship records, transaction records, compliance records and regulatory reporting documentation. 

6.3. Rejected Applications and Anti-Fraud Retention

Where an onboarding application is rejected, the Company may retain relevant information for a period reasonably necessary to document the decision, prevent fraud, manage legal or compliance risks and comply with applicable record-keeping obligations. The applicable retention period will depend on the nature of the information, the reason for rejection and any legal or regulatory requirements that apply. 

6.4. Legal Holds and Investigations 

In the event of an ongoing regulatory audit, law enforcement investigation, active civil litigation, or an unresolved financial dispute involving the account, the Company reserves the right to suspend standard data disposal schedules and mandate the preservation of all relevant information. Where a legal hold or preservation obligation applies, relevant personal information may be retained beyond the ordinary retention period for as long as reasonably necessary to satisfy the applicable legal, regulatory, investigative or dispute-resolution requirements. 

6.5. Secure Data Disposal and Anonymization

 Upon the expiration of all applicable legal, regulatory, and business retention periods, the Company executes irreversible data disposal protocols. Personal information will be either:

  • Securely and permanently destroyed from active servers and backup archives using industry-standard cryptographic wiping protocols; 
  • Irreversibly anonymized and aggregated, stripping it of any identifiable markers, so that the resulting dataset can no longer be linked to an identifiable individual and may be used safely for long-term statistical and analytical purposes.

7. YOUR PRIVACY RIGHTS UNDER CANADIAN LAW

7.1. Client Autonomy and Right to Access 

The Company respects individual autonomy over personal data. Individuals possess the right to formally request access to the personal information held by the Company. Upon the submission of a verified written request, individuals are entitled to know what data has been collected, how it is currently being used, and a list of third parties to whom it has been disclosed.

Exceptions: The Company reserves the right to deny access in limited circumstances permitted by law, such as when providing access would inherently reveal personal data about a third party, compromise proprietary anti-fraud security algorithms, or interfere with an ongoing, confidential law enforcement or national financial intelligence investigation.

7.2. Right to Rectification and Correction 

Maintaining the accuracy of a compliance profile is a shared responsibility. Individuals have the right to challenge the accuracy, completeness, and currency of their personal data. If it is demonstrated that the information held is materially inaccurate or outdated, the records will be promptly amended, corrected, or updated. Maintaining accurate identity data is a mandatory requirement for continued access to the OTC conversion services.

7.3. Right to Withdraw Consent 

Where the processing of personal information is based on active consent, the right to withdraw that consent at any time is retained.

Consequences of Withdrawal: Where personal information is necessary to provide the Services or comply with legal or regulatory obligations, withdrawal of consent may limit or prevent the Company from continuing to provide the relevant Services. Withdrawal of consent does not affect processing that is permitted or required without consent under applicable law and does not affect the lawfulness of processing undertaken before the withdrawal became effective. 

7.4. Limitations on the Right to Erasure (Deletion) 

It must be explicitly clarified that in the highly regulated financial and virtual currency sector, the right to demand the deletion or erasure of personal data is not absolute.

Statutory Locks: As detailed in Section 6, the Company is prohibited from deleting identity records, compliance files, or transaction histories that must be retained for AML/ATF purposes.

Blockchain Immutability: Due to the inherent cryptographic architecture of distributed ledger technology, any transactional data, wallet addresses, and execution hashes recorded directly onto public blockchains are mathematically immutable. The Company cannot alter, erase, or obscure public blockchain records under any circumstances.

7.5. Right to File a Regulatory Complaint 

If there is a belief that the Company has mishandled personal information or failed to respect statutory rights, it is strongly encouraged to contact the compliance team first to seek an immediate resolution. However, the legal right to lodge a formal complaint with the competent supervisory authorities, specifically the applicable federal or provincial privacy commissioners in Canada, is retained.

8. INTERNATIONAL USERS AND FOREIGN PRIVACY LAWS

8.1. International Users

The Company may receive inquiries or requests from individuals located outside Canada. The availability of the Company’s Services to any person remains subject to applicable financial-services, sanctions, AML/ATF and other legal or regulatory requirements.

8.2. Application of Foreign Privacy Laws

Where the Company’s processing of personal information falls within the territorial scope of a foreign privacy or data-protection law, including the General Data Protection Regulation (EU) 2016/679 (hereinafter – “GDPR”), the Company will comply with such requirements to the extent applicable.

The application of any foreign privacy or data-protection law is determined independently from whether the provision of a financial or crypto-asset service qualifies as reverse solicitation under applicable financial-services legislation.

9. CHANGES TO THIS PRIVACY POLICY

9.1. Unilateral Right to Update and Operational Drivers

The Company reserves the unilateral right to amend or update this Privacy Policy at any time. These modifications ensure continuous alignment with Canadian privacy and AML/ATF legislation, regulatory directives, or operational practices, including the introduction of new OTC conversion services or modifications to the underlying virtual currency infrastructure.

9.2. Notification of Material Changes 

In the event of material changes – specifically those altering the categories of personal data collected, processing purposes, or third-party disclosures – active Clients may be notified directly via registered email or a compliance alert. Minor administrative updates or typographical corrections will be enacted simply by updating the document.

9.3. Effective Date of Updates

The “Last Updated” date at the top of this Policy indicates when the current version became effective. Where required by applicable law, the Company will provide appropriate notice of material changes and obtain consent where consent is legally required. 

10. CONTACT INFORMATION AND PRIVACY INQUIRIES

To exercise any of your statutory privacy rights, to update your compliance profile, or to escalate a privacy-related inquiry or dispute, your requests must be directed to the individual responsible for the Company’s Privacy Officer using the contact details below:

Holden Transfer Inc.

Registered Office: 700-602 12 AVENUE SW, Calgary, Alberta, T2R1J3, Canada  

Company Registration Number: 2028406771

Email: holden.transfer@gmail.com