Privacy Policy

Last updated 01 December 2025

1. General information

1.1. The following Privacy Policy (Policy) is applicable to the platform, including any applicable websites and mobile applications used to access the same, collectively the “Platform” known as Bitsduck (“we, “us”, or “our”). (site) is owned and operated by MAYFAIR PAYMENTS INC., registration number 1001286260 (“Bitsduck”, “Company”, “We”, “Us” or “Our”). 

1.2. The Policy describes how we collect, use, and disclose Personal information that we obtain from current or prospective customers or users (“you” or “your”) of the Platform and any account services provided through the Platform. 

1.3. For the purpose of this Policy and associated Platform Terms of use at https://bitsduck.com/terms-of-service/ “Personal Information” refers to any information that relates to an identified or identifiable individual. We do not consider Personal Information to include information that has been anonymised, where it does not identify a specific user. 

1.4. Processing includes any handling of personal data, regardless of the means and procedures used, in particular the storage, disclosure, procurement, collection, deletion, storage, modification, destruction, and use of personal data.

1.5. By providing us with, or authorising us to collect, your personal information, you acknowledge that you have read and understood this policy and consent to the collection, use, and disclosure of your personal information in accordance with this policy and any other arrangements that apply between us.

2. Information Collected

2.1. We process the personal data that is necessary to be able to carry out our services in a permanent, user-friendly, secure, and reliable manner. Such personal data may in particular fall into the categories of inventory and contact data, browser and device data, content data, meta or edge data and usage data, location data, sales data, and contract and payment data.   

2.2. We may collect, hold, use, and disclose your personal information for the purposes of:

(a) Communicate with you and be able to provide you with our products and/or services you have requested. We use your Personal Information to provide you with the services you have requested, such as opening an account, making a transaction, or contacting customer support; 

(b) Protect ourselves and our users from fraud and other illegal activities. We use your personal information to protect our users and the platform from fraud and other illegal activities, such as screening for suspicious activity and enforcing our terms of service;

(c) Improve our service and the website. We use your personal information to improve our service and the website, such as developing new features, fixing bugs, and measuring the effectiveness of our marketing campaigns;

(d) Deliver direct marketing, service update notices, and promotional offers based on your communication preferences. We may use your personal information to deliver direct marketing, service update notices, and promotional offers to you. We will only do this where you have opted in to receive these communications; and

(e) Comply with applicable laws and regulations. We may use your personal information to comply with applicable laws and regulations, including but not limited to those related to anti-money laundering and KYC.

2.3. We process personal data for the period that is necessary for the respective purpose(s) or by law. Personal data that no longer needs to be processed will be anonymized or deleted.  

2.4. We may have personal data processed by third parties. We may process personal data together with third parties or transfer it to third parties. Such third parties are, in particular, specialized providers whose services we use. We also guarantee data protection for such third parties.

2.5. In principle, we only process personal data with the consent of the person concerned, unless the processing is permitted for other legal reasons, for example, to fulfill a contract with the person concerned and for corresponding pre-contractual measures in order to protect our overriding legitimate interests because the processing is apparent from the circumstances or based on prior information. 

2.6. In this context, we process information that a data subject voluntarily and personally provides to us when contacting us – for example by post, email, instant messaging, contact form, social media, or telephone – or when registering for service. We may store such information, for example, in an address book, in a customer relationship management system (CRM system) or using comparable tools. If we receive data about other persons, the persons transmitting the data are obliged to ensure data protection towards such persons and to ensure the accuracy of such personal data. 

2.7. We also process personal data that we receive from third parties, obtain from publicly available sources, or collect in the exercise of our activities and activities, if and to the extent that such processing is permitted for legal reasons. 

2.8. We collect these types of Personal Information: 

2.8.1. Non-Personally Identifiable Information. The first type is non-personally identifiable data and statistical information. Non-personally identifiable data that is being gathered consists of technical information and behavioral information that does not pertain to a specific individual (“Non-Personal Information”). This includes your device type, browser type and version, IP data, screen size and resolution, language and other technical data. While it is not specifically personally identifiable, it may be reverse-engineered to be identifiable and therefore is considered Personal Information. 

2.8.2 Personally Identifiable Information. The other type of information we collect is individually identifiable information. To put it simply, this information identifies an individual or is of a private and/or sensitive nature, such as your contact information and financial data, including: 

(a) Your contact details, which include your email address, phone number, full name, date of birth, gender, residential address, and postal address. 

(b) Your financial data, including the identity of cryptocurrency accounts you transferred sums to or from, and your bank details, tax identification number, income/next assets/wealth verification statements, as well as your transaction list.

(c) Your documents and data uploaded in our Know-Your-Customer (KYC) process, including a photocopy of your government issued ID, passport, driver’s licence, occupation and place of work, a video containing your image, your proof of address and utility bills, and other data filled in our forms such as your source of wealth and source of funds. 

To comply with identity verification requirements under the PCMLTFA and to prevent fraud, we may collect and process biometric information as part of our Know-Your-Customer (KYC) procedures. This includes:

• facial images extracted from identity documents;
• live video or selfie recordings;
• facial-matching results generated by automated systems;
• anti-spoofing or liveness-detection data.

Biometric information is processed solely for the purposes of identity verification, authentication, fraud prevention, sanctions and AML/ATF compliance, and to confirm that the person completing verification is the lawful holder of the identity document submitted.

We use trusted third-party KYC providers to perform these checks. These service providers may process your biometric information on our behalf and are contractually required to:

• protect the data using strong security measures;
• use it only for identity verification and compliance purposes;
• delete the biometric data after the verification process in accordance with applicable law and our instructions.

We do not use biometric data for automated decision-making unrelated to compliance, nor do we sell or share biometric identifiers for advertising, profiling, or unrelated commercial purposes.

If you do not consent to biometric verification, we are unable to complete mandatory identity verification and therefore cannot provide our services.

(d) Same-Name Verification. To protect against fraud and financial crime, we verify that any payment account, bank account, or other external funding method used with our platform is registered in the same legal name as the verified account holder. We may request documents or conduct automated checks to confirm ownership and may refuse transactions that do not meet same-name requirements.

(e) Self-Hosted Wallet Ownership Verification. Because our service is non-custodial, we require that all cryptocurrency used in transactions originates from, or is delivered to, a self-hosted wallet owned or controlled by you. We may request wallet-ownership declarations, on-chain signature proofs, or other verification methods. Wallets belonging to third parties or custodial exchanges are not accepted for settlement unless explicitly approved.

(f) Blockchain Analytics.  We use third-party blockchain analytics providers to assess the risk of wallet addresses and blockchain transactions. These service providers may receive hashed, pseudonymized, or transactional data for the purposes of risk scoring, sanctions screening, and AML/ATF compliance. This analysis forms part of our identity verification, transaction monitoring, and fraud-prevention processes.

2.9. We are committed to ensuring that the personal information we collect, use and disclose is relevant, accurate, complete and up-to-date.

2.10. We encourage you to contact us to update any personal information we hold about you. If we correct information that has previously been disclosed to another entity, we will notify the other entity within a reasonable period of the correction. Where we are satisfied that the information is inaccurate, we will take reasonable steps to correct the information within 30 days, unless you agree otherwise. We do not charge you for correcting the information.

2.11. AML / ATF Compliance Disclosure (PCMLTFA)

We collect, use, and retain certain personal information because we are legally required to do so as a Money Services Business (“MSB”) registered with FINTRAC under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). This includes information necessary to verify your identity, understand the nature and purpose of your transactions, monitor account activity, and maintain records as required by Canadian law.

Disclosure to FINTRAC. Where required by law, we may disclose personal information to FINTRAC, including for the purposes of filing Suspicious Transaction Reports (STRs), Large Virtual Currency Transaction Reports (LVCTRs), Terrorist Property Reports (TPRs), or other mandatory regulatory reports.

You acknowledge that we are prohibited by law from informing you whether a report has been filed.

Mandatory Collection. If you do not provide information required under the PCMLTFA, we cannot open an account for you or provide any services. AML/ATF-required information cannot be deleted or refused while you are using our services.

3. How Information Is Collected 

3.1. We collect your Personal Information:

3.1.1. When you visit our Platform, we collect information sent to us by your computer, mobile phone, or other access device. This information may include your IP address, browser type, operating system, and other device characteristics or identifiers. 

3.1.2. When you register for our services, we collect information such as your name, email address, phone number, date of birth, residential address, and postal address. We may also collect additional information such as your driver’s license and passport number or other information to verify your identity or address.

3.1.3. When you use our services, we collect information about your transactions and your other activities on our website. This information may include the amount of money you send or receive, the date and time of the transaction, and the recipient’s name and address. We may also collect information about your computer or other access device for fraud prevention purposes. 

3.1.4. We may collect information about your use and interaction with our Platform to help protect against fraud and misuse of your Personal Information. For example, we may evaluate your computer, mobile phone, or other access device to identify any malicious software or activity that may affect the availability of our services. 

3.1.5. Other ways. We may also collect additional information from or about you in other ways, such as interactions with our customer support team.

4. Communications

If you registered to our service, we may contact you with periodic updates and promotional emails relating to the service and the products or services we offer. You may opt out of these at any time, but not from transactional emails, such as updates on payments, withdrawals, or cryptocurrency purchase orders. Moreover, if you showed interest in one of our products or services, we may contact you in relation to such product or service either by email, phone, text or post.

5. Rights of Data Subjects

5.1. You can access, edit, update or delete your account or Personal Information we have collected at any time by accessing settings or contacting us via [email protected] . We will respond to your request within a reasonable period of time, but no later than the time period required by all applicable laws. 

5.2. Please note that notwithstanding the foregoing, there may be circumstances in which we are unable to accommodate a request to edit, update, access, or delete an account profile or Personal Information. This includes but is not limited to: 

5.2.1. any basis where such request can be denied under applicable law; or

5.2.2. where we need to retain the information to comply with federal, state, or local laws or for accounting or tax purposes; or

5.2.3. where we need to comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities; or 

5.2.4. where we need to cooperate with law enforcement agencies concerning conduct or activity that the business, service provider, or third party reasonably and in good faith believes may violate federal, state or local laws; or

5.2.5. where we need to retain information to exercise or defend legal claims; or

5.2.6. where the information contains legal privilege or proprietary information of another party; or 

5.2.7. where complying with the request would compromise others’ privacy or other legitimate rights.

5.3. If we determine that we cannot respond to any request in any particular instance, we will provide you with an explanation of why that determination has been made and a contact point for any further inquiries. To protect your privacy, we will take commercially reasonable steps to verify your identity before responding to any request under this provision, including complying with any applicable legal requirement for verifying your identity. 

5.4. To the extent permitted by applicable laws, we reserve the right to charge you a reasonable fee for the handling and processing of your requests to access your Personal Information, where applicable. If we so choose to charge, we will provide you with a written estimate of the fee we will be charging. Please note that in many jurisdictions, we are not required to respond to or deal with your access request unless you have agreed to pay the fee.

6. Sharing personal information with third parties

6.1. Your personal information may be disclosed to third parties for purposes described in this policy or described in any other specific and additional privacy provisions that apply to certain products and services provided by us. We may disclose your personal information to the following third parties:

6.1.1. third parties we use to help deliver our products and/or services to you (e.g. financial institutions, credit card schemes, and other payment scheme operators);

6.1.2. other third parties we use to help us run our business, e.g. marketing agencies or website hosts; 

6.1.3. our partners for the purpose of assisting us in the KYC process and providing any further support needed to use our services;

6.1.4. government agencies, law enforcement or regulatory agencies and bodies or other third parties as required by, and in accordance with, applicable law and regulations; 

6.1.5. organizations involved in facilitating payments on our behalf, including banks, third party payment processors who process your credit card and other payment information and other financial institutions; 

6.1.6. an agent, contractor or service provider we engage to carry out functions and activities, such as our bankers, lawyers, accountants, debt collectors and other advisers;

6.1.7. other companies in the case of a merger, divestiture or other corporate re-organisation. Usually, information will be anonymised, but this may not always be possible. The recipient of the information will be bound by confidentiality obligations;

6.1.8. any other third parties to whom you authorise us to disclose it or which is required by law; 

6.1.9. any other third party with your consent or where authorised or required by law.

6.2. Where necessary, such as when we transfer data to service providers, we put in place appropriate contractual arrangements and security mechanisms to protect the personal information shared and to comply with our data protection, confidentiality and security standards and obligations. We only allow our service providers to handle your personal information if we are satisfied, they take appropriate measures to protect your personal information. We also impose contractual obligations on service providers relating to ensuring they can only use your personal information to provide services to us and to you.

6.3. We will not share your personal information with any other third party.

7. Personal Data Abroad

The personal data collected from you, as detailed in this Privacy Policy, may be transferred to, and stored at, servers located in countries outside your jurisdiction and countries according to our third-party providers’ standard contractual obligations. It may also be processed by our suppliers, service providers, or partners’ staff operating outside your country. We are committed to protecting your Personal Data. We will take appropriate steps to ensure that your Personal Data is processed and stored securely and in accordance with applicable privacy laws, as detailed in this Privacy Policy. Such steps include putting in place data transfer agreements or ensuring our third-party service providers comply with our data transfer protection measures. By submitting your Personal Information through the Platform, you acknowledge, and agree, in a jurisdiction where such consent is required, to such transfer, storing and/or processing of Personal Information.

8. Security and Data Breach Notifications

8.1. We take reasonable steps to preserve the security of personal information it collects. Your personal information is held in an environment with reasonable security measures in writing or electronically, or both. We have implemented security procedures, controls, and protocols across all of our physical premises and electronic environments to minimise the risk of interference, loss, misuse, unauthorised access, modification, or disclosure of personal information. However, due to inherent risks in transmission of information over the Internet or other methods of electronic storage, we cannot guarantee that unauthorised access or use will never occur.

8.2. We will comply with applicable law in the event of any breach of the security, confidentiality, or integrity of your personal information and will inform you of such breach if required by applicable law. 

8.3. To the extent that we implement the required security measures under applicable law, we shall not be responsible or liable for unauthorized access, hacking, or other security intrusions or failure to store or the theft, deletion, corruption, destruction, damage, or loss of any data or information included in the personal information.

8.4. We comply with local authorities in data breach notifications. We have appropriate security measures to prevent personal information from being accidentally lost or used or accessed unlawfully. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

9. Data retention

We will retain the Personal Information as minimum for 5 years.  To determine the appropriate retention period for your personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal and regulatory requirements. Personal information that is no longer required for the purpose for which it was initially collected will be deleted unless we have a valid justification to retain it that is permitted under applicable law, such as to resolve disputes or comply with our legal obligations.

AML Record Retention

Notwithstanding any other retention period stated in this Policy, we are legally required under the PCMLTFA to retain certain records for a minimum of five (5) years, including:

• identity verification records;
• records of virtual currency exchanges or transfers;
• wallet declarations and ownership confirmations;
• transaction records and related documentation;
• records supporting STR, LVCTR, or other reports;
• correspondence and information used to assess or mitigate AML/ATF risks.

These records must be retained even if you close your account or request deletion of your personal information. After the retention period expires, the data will be securely destroyed unless further retention is required by law or for legitimate business purposes.

10. Cookies and Tracking Technologies

10.1. We use cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small data files stored on your device.

10.2. Types of Cookies We Use

Essential Cookies: Necessary for the operation of our website.

Performance Cookies: Collect information about how you use our website.

Functional Cookies: Remember your preferences and personalize your experience.

10.3. Managing Cookies

You can manage your cookie preferences through your browser settings. Disabling cookies may affect the functionality of our services.

10.4. Retention: Cookies are stored for a maximum of 13 months, after which consent must be renewed. A consent banner is displayed to manage cookie preferences upon your first visit.

11. Age of Consent

11.1 By using the Platform, you represent that you are at least the age of majority in your state or province of residence, or that you are the age of majority in your state or province of residence, and you have given us your consent to allow any of your minor dependents to use this site.

11.2. We do not knowingly collect any personal information from children under the age of 18. If you are under the age of 18, please do not submit any personal information through the Platform and Services. If you have reason to believe that a child under the age of 18 has provided personal information to us through the Platform and Services, please contact us to request that we delete that child’s personal information from our Services.

12. Jurisdiction-Specific Information

12.1. Canada

For users in Canada, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). This includes obtaining consent for data collection and ensuring data is protected and used appropriately.

We are a Canadian MSB regulated under PIPEDA and PCMLTFA. We do not target EU residents and do not provide services regulated under GDPR.

Transfers of Personal Information Outside Canada. We may transfer or store your personal information outside Canada, including in jurisdictions where our service providers, cloud infrastructure, compliance systems, or technical partners operate. When personal information is transferred outside Canada, it may be subject to the laws of the destination jurisdiction.

Under PIPEDA, we remain responsible for protecting your personal information and ensure that appropriate contractual, technical, and organizational safeguards are in place, regardless of where the information is processed. Our service providers are required to maintain privacy protections consistent with Canadian standards.

We do not rely on EU-style adequacy decisions or Standard Contractual Clauses. Instead, we apply the Accountability Principle, ensuring that privacy protections remain in place throughout the information-handling lifecycle.

13. How to contact us 

If you have questions, concerns, or complaints regarding this policy or the handling of your personal information, you may contact us at [email protected] . Please include your name, contact information, enough information to identify you and the nature of your concern/request, the right you want to exercise and the information to which your request relates so that we can appropriately respond to your communication. 

14. Update to this policy

This policy is current as of the last updated date set out above. We may change our policy from time to time, so please be sure to check periodically. To the extent required by all applicable laws, if we make any changes to this policy that materially affect our practices, we will endeavor to provide you with notice in advance of such change. This notice may be provided through email or other means. You are responsible for ensuring that your contact information is up-to-date so that we can effectively communicate with you. If you have any questions or concerns about this policy, please do not hesitate to contact us.