1. Data controller
Primer Financial, 789 Financial Boulevard, Suite 400, Toronto, ON M5H 2N2, Canada. Courriel : contact@primer-financial.com.
LPRPDE / PIPEDA · Quebec Law 25
Privacy Policy
Last updated: November 1, 2025
2. Data collected
- Identity data: legal name, date of birth, government ID (PDF/image)
- Financial data: income, bank statements, social insurance number (optional, AES-256 encrypted)
- Blockchain data: public wallet address, collateral balance (read-only)
- Connection data: anonymized IP address, session logs
- Essential cookies: PHP session, language preference — no third-party tracking cookies
3. Purposes of processing
- Analysis and processing of loan applications
- Identity verification (KYC) — FINTRAC legal obligation
- Client relationship management and contractual communications
- Accounting and tax obligations (retention 7 years)
- FINTRAC obligations (retention 5 years — s. 24 of the Act)
- Fraud prevention and system security
4. Data retention
| Category | Retention period | Legal basis |
|---|---|---|
| KYC data / loan file | 5 years after file closure | FINTRAC Act s. 24 |
| Accounting data | 7 years | Income Tax Act |
| Security logs | 5 years | FINTRAC + security |
| Session cookies | 1h (active session) | — |
5. Your rights
In accordance with PIPEDA and Quebec Law 25, you have the following rights:
- Right of access to your personal data
- Right to rectification of inaccurate data
- Right to data portability (Quebec Law 25)
- Right to erasure (subject to legal retention obligations)
- Right to withdraw consent for non-mandatory processing
To exercise these rights, contact our privacy officer: contact@primer-financial.com.
6. Security
- AES-256-CBC encryption for sensitive data (SIN, financial data)
- TLS 1.3 encrypted database connection
- Document storage off web root directory
- CSRF protection on all forms
- Rate-limiting: 5 requests / 60s / IP per endpoint
- Quarterly security audits by an independent firm