Privacy Policy
Version 1.0 — Effective date: October 20, 2026
1. About this policy
1.1 This policy explains how [Legal entity name to be confirmed], operating as Orion Payments ("Orion", "we"), collects, uses, discloses and protects personal information.
1.2 It is based on the data inventory of the software as built (see Appendix A). It will be updated before launch to reflect production providers, hosting and retention decisions.
1.3 Applicable law. Orion intends to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, provincial private-sector privacy laws (including those of Quebec, Alberta and British Columbia). Which laws apply to which activities has not yet been assessed by counsel.
1.4 Privacy Officer: [Privacy Officer contact to be confirmed].
2. Whose information we handle
2.1 Website visitors who browse or submit forms. 2.2 Account users: merchant team members and Orion staff. 2.3 Merchant applicants and their representatives, owners and controlling persons. 2.4 Customers of merchants who pay through Orion checkout. For this information, we generally act on the merchant's behalf (see the Data Processing Addendum), and the merchant's own privacy policy also applies.
3. What we collect and where it comes from
3.1 From you directly: name, email, company and message (contact and early-access forms); account details and team role; business identity and registration details; representative contact details; owner and controlling-person names, ownership percentages, roles and countries of residence; product, fulfilment and processing-history information; documents you provide; messages and support cases; settlement destination details; agreement acceptances.
3.2 Automatically: IP address and browser user-agent associated with sign-in sessions, agreement acceptance records and security/audit events; a session cookie (see the Cookie Notice). We do not use advertising or analytics cookies in the current build.
3.3 From merchants (about their customers): order references, items and amounts; the payment method chosen; payment status. We do not collect card numbers or security codes; card details, when live, are captured by the provider's hosted or tokenized components.
3.4 From payment providers: application decisions and references; payment, refund, dispute and settlement statuses.
3.5 From public blockchains: for stablecoin payments, transaction hashes, sending and receiving addresses, amounts and confirmation data.
3.6 From public and verification sources: business registry information and, where a provider requires, identity verification results through the provider's approved method.
4. Required and optional information
4.1 Information marked as required in onboarding is needed to assess an application and to meet provider and legal requirements. If it is not provided, we cannot proceed with the application.
4.2 Marketing communications are optional. Consent is requested separately, is never pre-selected and is not a condition of service.
5. Why we use it
5.1 To provide and secure the website, sandbox and portal (authentication, MFA, fraud and abuse prevention, audit logging). 5.2 To assess merchant applications, prepare provider submissions and manage approvals and connections. 5.3 To process, track and reconcile payments, refunds, disputes and provider-reported settlements. 5.4 To communicate about applications, accounts, security and service changes. 5.5 To meet legal, regulatory, provider and card-network obligations that apply to us (to be confirmed — see clause 11). 5.6 With consent, to send marketing messages, subject to Canada's anti-spam legislation (CASL).
6. Consent
6.1 We rely on consent appropriate to the sensitivity of the information and your reasonable expectations, and on other grounds permitted by law. Where information is sensitive (for example, identity information about owners), we seek express consent.
6.2 Merchants must have authority to provide information about their owners, representatives and team members, and must give those individuals appropriate notice.
6.3 Withdrawal. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may mean we cannot provide a service (for example, an application cannot proceed without verification information). Marketing consent can be withdrawn at any time without affecting the service.
7. Disclosure to providers and others
7.1 Payment providers. We disclose merchant application information, owner information, documents and Transaction data to the payment providers a merchant applies to or uses, for underwriting, risk, compliance and processing. Providers use it under their own privacy policies and legal obligations.
7.2 Service providers (for example, hosting, email, document storage and security tools) who process information for us under contract. These have not yet been selected.
7.3 Legal and safety: where required by law, to respond to lawful requests, or to protect rights, safety and the security of the service.
7.4 Business transfers: to a successor operator, subject to equivalent protections.
7.5 We do not sell personal information.
8. Cross-border processing
8.1 Hosting region: [Hosting region to be confirmed]. Payment providers and service providers may store or process information outside Canada, including in the United States, where it may be accessible to authorities under local law.
8.2 We do not promise Canadian-only hosting. We will identify the countries involved once providers are selected.
9. Retention
9.1 We keep personal information only as long as needed for the purposes above, or as required by law, provider agreements and card network rules.
9.2 Retention criteria include: the life of the account; the period during which transactions may be refunded or disputed; legal record-keeping obligations; and the resolution of complaints or legal claims.
9.3 Specific retention periods: [Retention periods to be set].
9.4 Sandbox data is synthetic and may be deleted at any time.
10. Public blockchain limitations
10.1 Transactions on public blockchains are recorded permanently and publicly by the network, not by Orion. We cannot delete or correct information recorded on a public blockchain. We can delete or correct the link between that information and you in our own records, subject to retention obligations.
11. Legal obligations — to be confirmed
11.1 If Orion's activities fall within the scope of anti-money-laundering legislation (for example, the Proceeds of Crime (Money Laundering) and Terrorist Financing Act) or the Retail Payment Activities Act, additional collection, verification, record-keeping and reporting obligations may apply. Status: FINTRAC — [FINTRAC MSB registration status not determined]; RPAA — [Bank of Canada RPAA registration status not determined]. This section will be completed after legal review.
12. Access and correction
12.1 You may request access to the personal information we hold about you and ask us to correct inaccurate information. Contact [Privacy Officer contact to be confirmed]. We will respond within the time required by applicable law and may need to verify your identity.
12.2 Some information may be withheld where the law permits or requires (for example, information about another person or information subject to legal privilege).
13. Security
13.1 Safeguards in the current build include: hashed passwords (Argon2id), optional TOTP multi-factor authentication, hashed session tokens, encryption of selected sensitive fields, role-based access with least privilege, masked display of sensitive identifiers, audit logging of sensitive access and exports, and rate limiting.
13.2 Some production safeguards (malware scanning, managed key storage, security monitoring, backups) are not yet implemented. Real sensitive documents are not collected until they are.
14. Privacy incidents
14.1 We will assess suspected breaches of security safeguards, contain them, and, where there is a real risk of significant harm, notify affected individuals and the Office of the Privacy Commissioner of Canada (and any provincial regulator that applies), and keep breach records, as required by law.
15. Complaints
15.1 Contact our Privacy Officer at [Privacy Officer contact to be confirmed]. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada or to the applicable provincial privacy regulator.
16. Changes
16.1 We will publish updated versions in the Legal Centre with a summary of changes and archive previous versions.
Appendix A — Data inventory (as built)
| Data | Source | Purpose | Stored as |
|---|---|---|---|
| Name, email, role | Account users | Accounts, communication | Database |
| Password | Account users | Authentication | Argon2id hash only |
| MFA secret | Account users | Authentication | Encrypted (AES-256-GCM) |
| Session IP, user agent | Automatic | Security | Database, until session expiry |
| Contact form submissions | Visitors | Responding to enquiries | Database (no email transport configured) |
| Business identity, registration, addresses | Applicants | Underwriting | Database |
| Owners: name, %, role, country | Applicants | Underwriting, provider requirements | Database |
| Documents | Applicants | Underwriting | Private storage; sandbox = fictional samples only |
| Settlement destination details | Merchants | Settlement setup | Encrypted; masked in display |
| Agreement acceptances (IP, user agent, time, version hash) | Merchants | Evidence of acceptance | Database |
| Marketing consent records | Users | CASL compliance | Database |
| Order items and amounts | Merchants | Checkout, reconciliation | Database |
| Wallet addresses, transaction hashes | Public blockchain | Stablecoin verification | Database (sandbox: simulated) |
| Internal notes, audit events | Staff, system | Review, accountability | Database |