Privacy Policy

This Privacy Policy explains how NEO FINTECH LTD ("NEO", "we", "us") collects, uses, shares and protects personal data when you visit neofin.tech, contact us, apply for or use NEO Collect, or are an end customer, director, beneficial owner or payer connected to one of our clients. We are the controller of the personal data described in this policy unless stated otherwise.

1. Who we are

NEO FINTECH LTD is incorporated in Ontario, Canada (Incorporation No. 1001341675, Licence No. N300001101) with its registered office at 210 - 2020 Winston Park Drive, Oakville, Ontario, Canada, L6H 6X7. Our Data Protection Officer can be reached at privacy@neofin.tech.

2. Personal data we collect

Website visitors and enquirers

• Contact details you submit through our forms: name, work email, company, website, country, role and message.
• Technical data: IP address, browser and device information, pages visited and referring site, collected through server logs and privacy-first analytics that do not use cookies.

Client representatives, directors and beneficial owners

• Identity data: name, date of birth, nationality, residential address, identity document images and data, and a live image where liveness verification is used.
• Role and ownership data: position, shareholding, control and relationships to the client.
• Screening data: results of sanctions, politically exposed person and adverse-media checks, including any matches and our assessment of them.
• Credential and usage data: console logins, actions, API requests, IP addresses and device identifiers.

Account holders and payers

• Account holder data submitted by our clients: legal name, identifiers, verification status and references.
• Payment data: payer name, account number, bank, country, amount, currency, remittance information and timestamps received with each credit, and the results of name matching and screening.
• Recall and dispute data: communications and evidence exchanged in connection with a recall or investigation.

3. Why we use personal data and the legal basis

Where PIPEDA applies, we rely on your consent, which may be implied where the purpose is obvious and reasonable, or on exceptions permitted by law, including for the detection and prevention of fraud and compliance with legal requirements.

4. Who we share personal data with

• Our banking partner, which holds the pooled accounts and executes payments, to the extent required for it to provide its services and meet its own regulatory obligations. Requests for end-customer information are met with anonymised reporting, an attestation from our MLRO or review under NDA wherever the law allows.
• Verification and screening providers that perform identity verification, registry checks, sanctions and PEP screening, device intelligence and blockchain analytics on our behalf.
• Infrastructure and service providers that host, secure, monitor and support the Services, under contracts that restrict their use of data.
• Our clients, who receive data about credits to their virtual accounts, including payer details, in order to reconcile payments.
• Banks, payment schemes and counterparties in connection with payments, returns and recalls.
• Regulators, law enforcement and courts where required by law or to protect our rights.
• Professional advisers and auditors, including the independent reviewer of our compliance programme.
• A successor in the event of a merger, acquisition or sale of assets, subject to this policy.

We do not sell personal data.

5. International transfers

Production data is hosted in the European Union with encrypted backups in Canada. Where personal data is transferred outside the EEA, the United Kingdom or Canada, we rely on adequacy decisions, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or equivalent safeguards, together with technical measures such as encryption.

6. Retention

• KYB, screening, transaction and recall records: at least five years after the end of the client relationship or the transaction, as required by anti-money laundering law, and up to seven years where required for audit or tax purposes.
• Enquiries that do not lead to a client relationship: 24 months.
• Audit logs: seven years.
• Analytics and server logs: 13 months.

7. Security

We protect personal data with encryption in transit and at rest, access controls, two-factor authentication, audit logging, network segregation, regular penetration testing and staff training. See our security overview.

8. Your rights

Depending on where you are, you may have the right to access, correct, delete or port your personal data, to restrict or object to processing, to withdraw consent, and to lodge a complaint with a supervisory authority, including the Office of the Privacy Commissioner of Canada, the UK Information Commissioner's Office or your EU data protection authority. Some rights are limited where we must retain data by law. To exercise a right, write to privacy@neofin.tech. We respond within one month, or 30 days under PIPEDA, and may ask you to verify your identity.

9. Automated decisions

Shield makes automated decisions to accept, hold or return inbound credits based on name matching, screening and rules. These decisions concern business payments and are reviewed by analysts where a credit is held. Account holders and payers affected by a return may ask for human review through the client that issued the account or by writing to us.

10. Cookies

We use strictly necessary cookies only. See our Cookie Policy.

11. Changes

We will post changes to this policy on this page and, where the change is material, notify clients by email at least 30 days before it takes effect.