Privacy Policy

1. Purpose and Application

This Privacy Policy explains how Navara Group, Inc., operating as Naxcol, collects, uses, discloses, retains, and protects personal information when you use the Services, communicate with us, or otherwise interact with us.

Naxcol is a technology platform and is not a bank, deposit-taking institution, card issuer, lender, broker, investment adviser, or other financial institution under the Gramm-Leach-Bliley Act (“GLBA”) or under applicable Canadian federal or provincial financial-institution laws. Naxcol does not accept deposits or itself issue cards, loans, or investment products.

This Policy is intended to support compliance with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and applicable provincial legislation. It does not replace a card issuer’s, financial institution’s, payment network’s, payment processor’s, or connection provider’s privacy notice.

2. Accountability and Privacy Contact

Naxcol has designated a Privacy Officer responsible for overseeing compliance with this Policy, implementing privacy policies and practices, receiving and responding to access and correction requests and complaints, and providing information about Naxcol’s management of personal information. Questions, requests, and complaints may be submitted using the contact details below.

Privacy Officer Navara Group, Inc. / Naxcol — 276 Elgin Mills Rd W, Richmond Hill, ON L4C 4M2, Canada (Canadian users); 131 Continental Dr, Suite 305, Newark, DE 19713, USA (U.S. users) — privacy@naxcol.com

3. Information We Collect

Depending on the Services used, we may collect:

• account and identity information, including name, email address, telephone number, username, authentication information, date of birth where required, and business role;
• business information, including business name, address, contact details, tax or registration information, and authorized-user information;
• payment and billing information, including payment-method details, billing address, payment status, invoices, and processor tokens;
• Linked Account information, including account identifiers, account type, balances, transactions, merchants, subscriptions, recurring payments, and related information;
• virtual-card and card-program information, including eligibility, onboarding, card-use, authorization, settlement, dispute, fraud, and compliance information;
• device and usage information, including device identifiers, IP address, browser and operating-system information, app version, log data, interaction data, cookie data, and diagnostic information;
• communications and support information, including messages, inquiries, feedback, and call recordings where notice or consent is required; and
• security and fraud-prevention information, including authentication records, alerts, device or network signals, and information relevant to suspected fraud or misuse.

Naxcol does not intentionally store full payment-card numbers unless expressly stated at collection. Naxcol does not intentionally collect Linked Account passwords where credentials are entered directly with the applicable account-connection provider.

We do not knowingly collect personal information from children. The Services are not directed to individuals below the age of majority in their place of residence.

4. Purposes of Collection and Use

We collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances and as permitted or required by law. We may use personal information to:

• create, administer, authenticate, secure, and support accounts;
• provide, operate, maintain, and improve the Services;
• connect, refresh, display, categorize, and analyze Linked Account information at your direction;
• provide subscription intelligence and transaction insights;
• process subscriptions, payments, refunds, and related records;
• administer Business accounts and authorized users;
• administer and secure virtual-card and card-program features;
• detect, investigate, prevent, and respond to fraud, security incidents, illegal activity, and violations of our terms;
• communicate with you about the Services, transactions, security, support, and updates;
• send marketing communications where permitted, where required consent has been obtained, and subject to applicable opt-out rights;
• comply with legal, regulatory, tax, accounting, audit, recordkeeping, and enforcement obligations; and
• establish, exercise, or defend legal claims and manage our business operations.

We may use de-identified or aggregated information for analytics, product development, research, and business planning. We will not attempt to re-identify de-identified information except as permitted by law.

5. Consent and Choices

We obtain meaningful consent for the collection, use, and disclosure of personal information where required by applicable law. Consent requests will identify, as applicable, the personal information involved, the purposes of collection, use, or disclosure, relevant recipients or categories of recipients, and reasonably foreseeable material consequences or risks. The form of consent depends on the sensitivity of the information and the reasonable expectations of the individual; Naxcol seeks express consent for sensitive financial and Linked Account information where required or appropriate.

Before you connect a Linked Account, the authorization flow will identify, as applicable, the account-connection provider, account or account type, requested data categories, purposes, historical-data access, expected refresh frequency, duration, and how to disconnect or revoke access.

You may withdraw consent to non-essential uses or disclosures at any time, subject to legal or contractual restrictions and reasonable notice. You may disconnect a Linked Account, change account settings, unsubscribe from marketing communications, or contact the Privacy Officer.

Disconnection stops future retrieval by Naxcol subject to technical limitations, but does not automatically delete information previously collected, information required for legal or contractual purposes, backups, or information retained by a connection provider or another third party.

Naxcol does not sell personal information. Naxcol does not use personal information for targeted advertising, profiling producing legal or similarly significant effects, or comparable automated decision-making unless Naxcol specifically notifies you and obtains any consent required by law.

6. GLBA-Related Information and Service-Provider Processing

Naxcol is not a financial institution under the GLBA and does not independently provide a GLBA privacy notice as a covered financial institution. Banks, card issuers, payment providers, account-connection providers, and other covered financial institutions may provide their own privacy notices, including any applicable choices or opt-out rights, governing their collection, use, and disclosure of nonpublic personal information.

Naxcol may nevertheless receive or process nonpublic personal information on behalf of a covered financial institution as a service provider. In those circumstances, Naxcol will use the information only to perform specified services or functions; maintain its confidentiality; apply administrative, technical, physical, and contractual safeguards appropriate to the risk; restrict unauthorized use and redisclosure; oversee subcontractors; and comply with applicable contractual requirements concerning security, incident reporting, retention, deletion, audit, and cooperation.

Naxcol will not use information received from a covered financial institution for unrelated purposes or disclose it to another nonaffiliated third party except as authorized by the institution or as permitted or required by applicable law or contract. Naxcol will support the covered institution in implementing its privacy notice, consumer choices, and lawful opt-out instructions to the extent required by Naxcol’s contract and applicable law.

7. Disclosure of Information

We may disclose personal information only to the extent appropriate for an identified purpose and as authorized, permitted, or required by law, to:

• service providers providing hosting, infrastructure, analytics, customer support, communications, identity verification, payment processing, account connectivity, fraud prevention, security, professional, and related services;
• card issuers, program managers, processors, payment networks, and other virtual-card participants;
• Business Customers and authorized administrators or users, in accordance with configured permissions;
• financial institutions, account-connection providers, and other parties when you direct or authorize a connection, transfer, or disclosure;
• potential or actual purchasers, investors, lenders, affiliates, successors, or advisers in connection with a merger, acquisition, financing, reorganization, sale of assets, insolvency, or similar transaction; and
• regulators, government authorities, law enforcement, courts, insurers, professional advisers, or other parties where disclosure is permitted or required by law or reasonably necessary to protect rights, property, or safety.

We do not disclose personal information to third parties for their own direct-marketing purposes without consent where consent is required by law.

We require service providers to process personal information only for documented, authorized purposes; maintain confidentiality; implement safeguards appropriate to the sensitivity and risk; limit access and retention; notify Naxcol of security incidents without undue delay and within any period required by contract or law; assist with privacy requests and compliance obligations; and securely return or dispose of information when required. Service providers may use subcontractors only subject to appropriate authorization, due diligence, and protections no less protective than the applicable contractual requirements.

Cross-Border Processing

Naxcol and its service providers may process personal information in Canada, the United States, and other jurisdictions where Naxcol or its service providers operate.

Information processed outside your province or country may be subject to the laws of those jurisdictions and may be accessible to courts, law-enforcement authorities, or other authorities in accordance with those laws. Naxcol remains accountable for personal information processed on its behalf and uses contractual or other safeguards appropriate to the transfer and processing. You may contact the Privacy Officer for information about Naxcol’s use of service providers outside Canada or the policies and practices that apply to such processing.

9. Cookies and Similar Technologies

We use cookies, SDKs, pixels, local storage, and similar technologies to operate the Services, remember preferences, authenticate users, protect against fraud, understand performance and usage, and, where enabled with required consent, conduct analytics or marketing.

You may manage certain cookies through browser or device settings. Disabling some technologies may affect functionality. Where required by law, Naxcol will provide a consent mechanism for non-essential technologies and honor choices made through that mechanism.

10. Safeguards and Security Incidents

Naxcol uses administrative, technical, physical, and contractual safeguards appropriate to the sensitivity of personal information and the risks associated with processing it. These safeguards may include access controls, least-privilege permissions, authentication and multifactor controls, encryption in transit and at rest where appropriate, token protection, monitoring and logging, secure development, vulnerability management, personnel training, vendor due diligence, contractual controls, and documented incident-response procedures. Naxcol applies these safeguards to information it handles for covered financial institutions in a manner consistent with applicable service-provider obligations.

No method of transmission, storage, or security control is completely secure. You should use strong, unique credentials, protect your devices, and promptly notify us of suspected unauthorized access.

If a breach of security safeguards or confidentiality incident occurs, Naxcol will promptly investigate, contain and remediate the incident, assess the sensitivity of the information and the probability of misuse, take reasonable measures to reduce harm and prevent recurrence, and cooperate with affected institutional clients as required. Naxcol will maintain records of every breach of security safeguards as required by PIPEDA and will report a breach to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible where it is reasonable to believe the breach creates a real risk of significant harm. Naxcol will also notify other organizations or government institutions where required to reduce or mitigate that risk, and will provide contractual incident notices to covered financial institutions without undue delay.

11. Retention and Disposal

We retain personal information only as long as necessary to fulfill the purposes described in this policy, meet legal, regulatory, tax, accounting, card-program, dispute, security, and recordkeeping obligations, and resolve disputes.

Retention periods depend on the category, purpose, sensitivity, and applicable obligations. Our retention schedule is available on request at privacy@naxcol.com.

When information is no longer required, we will delete, securely destroy, anonymize, or de-identify it, subject to legal holds, contractual obligations, backup limitations, applicable law, and other lawful requirements.

12. Access, Correction, and Complaints

Subject to applicable law, you may request access to personal information we hold about you and information about its use and disclosure. You may also request correction of inaccurate, incomplete, or outdated information. Submit requests in writing to the Privacy Officer using the contact details in section 2. We may verify your identity and authority before responding. Subject to applicable law, we will respond at no cost or advise you of any permitted fee in advance, generally within 30 days under PIPEDA unless a lawful extension applies, and will give written notice of any extension and available complaint rights.

If we cannot grant a request in full, we will explain the reason and identify any available recourse, subject to legal restrictions. Where a correction is appropriate, we will amend the information and, where appropriate, transmit the amended information to third parties that received it; where a dispute remains, we will note the substance of the unresolved disagreement as required by law.

If you have a concern about our privacy practices, please contact the Privacy Officer first. Naxcol will investigate and respond to privacy complaints through an accessible process.

You may also have the right to complain to the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.

13. Québec-Specific Disclosures

For Québec users, this policy is intended to serve as Naxcol’s confidentiality policy for personal information collected through technological means.

When collecting personal information, Naxcol will make available information required by Québec law concerning purposes, collection methods, access and rectification rights, withdrawal of consent, communications outside Québec, and third-party recipients or recipient categories where required.

If Naxcol makes a decision based exclusively on automated processing that has a legal or similarly significant effect, Naxcol will provide the information and opportunity to make representations required by Québec law.

14. Marketing Communications

With valid consent where required, Naxcol may send commercial electronic messages about its products, services, offers, and events. Naxcol does not condition a Service on consent to marketing unless the marketing is integral to that Service and permitted by law, and does not share personal information for another party’s own direct marketing without required consent.

Commercial electronic messages will identify the sender, provide contact information, and include a clear, readily available unsubscribe mechanism where required by law. Naxcol will implement unsubscribe requests within the period required by applicable law and will honor applicable consumer choices and lawful opt-out instructions communicated by a covered financial institution for information processed on its behalf.

You may unsubscribe through the mechanism in the message or by contacting us. Unsubscribing does not affect service, transactional, security, or legally required communications.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our practices, Services, legal requirements, or operational needs. We will post the updated policy and revise the effective date.

For material changes, we will provide additional notice or obtain consent where required by law. Continued use of the Services will not constitute consent to materially new purposes or sensitive-information processing where affirmative consent is legally required.

16. Contact Us

Privacy Officer Navara Group, Inc. / Naxcol — 276 Elgin Mills Rd W, Richmond Hill, ON L4C 4M2, Canada (Canadian users); 131 Continental Dr, Suite 305, Newark, DE 19713, USA (U.S. users) — privacy@naxcol.com