How we collect, use, and protect your personal data, including your rights under GDPR.
This Privacy Policy explains how PayConnect Ltd ("PayConnect", "we", "us", or "our") collects, uses, discloses, and protects personal data, and describes the rights available to individuals whose personal data we handle. PayConnect is established in Laval, Québec, Canada. This Policy applies to personal data collected through our website and in connection with our sales, support, and account-administration activities. It does not apply to Customer Data processed through the PayConnect software itself, which is addressed separately below.
PayConnect Ltd, with its registered place of business in Laval, Québec, Canada, is the data controller responsible for the personal data described in this Policy, unless stated otherwise.
We collect personal data that you provide directly to us, such as when you request a demo, contact us, subscribe to our newsletter, or become an Authorized User of the Software. This may include:
| Category | Examples | Source |
|---|---|---|
| Contact information | Name, business email address, phone number, job title, company name | Demo requests, contact forms, newsletter sign-up, business cards exchanged at events |
| Account information | Login credentials, role, permissions | Provided by Customer when provisioning Authorized Users |
| Communications | Messages, support tickets, meeting notes | Correspondence with our sales and support teams |
| Technical information | IP address, browser type, device information, pages visited | Automatically collected when you visit our website, subject to your cookie preferences - see our Cookie Policy |
The PayConnect Software is deployed within Customer's own network infrastructure. As a result, the financial, transactional, and SAP or ERP data that Customer and its Authorized Users process through the Software ("Platform Data") remains within Customer's own environment and is generally not accessed, collected, or stored by PayConnect. Where Customer's personal data protection obligations apply to Platform Data - for example, personal data about Customer's own customers contained within transaction records - Customer remains the data controller for that Platform Data, and PayConnect acts only as a software provider, not as a data controller or processor of it, except to the limited extent PayConnect personnel access Platform Data at Customer's request to provide support (in which case PayConnect acts as Customer's processor/service provider and will only use that data to deliver the requested support).
We use personal data to: respond to demo and information requests; provide, maintain, and support the Software; administer accounts and manage our contractual relationship with Customer; send product updates, security notices, and - where you have opted in - marketing communications; improve our website and offerings; and comply with our legal obligations.
Where applicable data protection law requires a legal basis, we rely on: performance of a contract (for example, administering an Authorized User's access); our legitimate interests (for example, responding to inquiries, improving our website, and maintaining security), balanced against your interests and rights; your consent (for example, for marketing emails or non-essential cookies, which you may withdraw at any time); and compliance with a legal obligation.
Our website uses cookies and similar technologies as described in our Cookie Policy, which explains the categories of cookies we use and how you can manage your preferences.
We do not sell personal data. We may share personal data with: service providers who support our business operations (such as email delivery, customer relationship management, and analytics providers), under contractual confidentiality and data protection obligations; professional advisors (such as legal or accounting advisors); and regulators, law enforcement, or other parties where required by law or to protect our rights, property, or safety, or that of others. If PayConnect is involved in a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction, subject to appropriate confidentiality protections.
We are established in Canada, and personal data we collect is generally processed in Canada. Where we use service providers located outside Canada - including, where applicable, in the European Economic Area, the United Kingdom, or elsewhere - we take steps to ensure an adequate level of protection for that data, such as entering into standard contractual clauses or relying on other legally recognized transfer mechanisms, and by selecting providers with appropriate security and confidentiality commitments.
We retain personal data for as long as necessary to fulfil the purposes described in this Policy, including to provide our Services, maintain business records, meet legal, accounting, or regulatory requirements, and resolve disputes. Retention periods vary depending on the type of data and the purpose for which it was collected; for example, we generally retain sales and account-contact information for the duration of our relationship with Customer and for a reasonable period afterward for legal and record-keeping purposes.
We use administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, loss, misuse, or alteration, including access controls and encryption of data in transit. Further detail on our security practices is available on our Security page.
Depending on your location, applicable law - including Québec's Act respecting the protection of personal information in the private sector - may give you the right to: request access to the personal data we hold about you; request correction of inaccurate or incomplete personal data; request that we cease using or disclosing your personal data, or request its deletion, subject to applicable legal exceptions; withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and be informed about, and in some cases request the de-indexing of, personal data made public by us where its dissemination is inconsistent with the purposes for which it was collected. To exercise any of these rights, please contact us as described in Section 15 below. If you are not satisfied with our response, you may contact Québec's Commission d'accès à l'information.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) or equivalent local law may give you additional rights with respect to your personal data, including the right to: request access to, rectification, or erasure of your personal data; restrict or object to our processing of your personal data; receive your personal data in a portable format, where technically feasible; not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects concerning you; and lodge a complaint with your local data protection supervisory authority. To exercise any of these rights, please contact us as described in Section 15 below.
Our website and Software are intended for business use and are not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will post the updated Policy on this page with a revised effective date.
If you have questions about this Privacy Policy or wish to exercise any of the rights described above, please reach out via our Contact page.