Privacy Policy

1. Who this policy covers

This Privacy Policy explains how 16886973 Canada Inc., operating as Thanos Link (“Thanos Link”, “we”, “us”) collects, uses, discloses and protects personal information when you use thanoslink.com, the Thanos Link mobile application and cardholder portal (together, the “App”), prepaid card programs, and any related services (together, the “Services”).

Thanos Link acts as a program manager and intermediary. Prepaid cards and the accounts behind them are issued by licensed financial institutions and regulated issuing partners (each an “Issuer”). The Issuer has its own privacy policy, which applies to the account it holds for you. Where we process personal information on behalf of an Issuer or of an employer or business that sponsors your card (a “Partner”), we do so under their instructions and this policy applies alongside theirs.

This policy is designed to comply with the Personal Information Protection and Electronic Documents Act (Canada), Quebec’s Act respecting the protection of personal information in the private sector (Law 25), and other applicable provincial privacy laws.

2. What personal information we collect

“Personal information” means information about an identifiable individual. Depending on how you use the Services, we may collect:

• Identity information — name, date of birth, nationality, gender, residential address, phone number, email address, and government-issued identification (for example a passport or driver’s licence) and the data on it.
• Verification information — proof of address documents, and the results of identity, sanctions and anti-money-laundering screening carried out by us, the Issuer or a verification provider.
• Account and card information — card number (masked where possible), expiry, balance, load history, transactions, merchant and ATM data, disputes and card status.
• Employment and program information — the Partner that sponsors your card, employee or contractor identifiers, payroll loads and the purpose of a program (for example payroll, payouts or expenses).
• Business information — for Partners: legal name, business number, address, directors and beneficial owners, and financial information needed to onboard and fund a program.
• Device and usage information — IP address, device identifiers, operating system, app version, log data, crash reports, pages viewed and actions taken in the App or on our website.
• Communications — messages, support requests, call recordings where you are notified, and feedback you send us.
• Location information — approximate location derived from IP address, and precise location only if you enable it in the App (for example to find an ATM).

We do not knowingly collect information from individuals under 18. Cards are only issued to adults who pass identity verification.

3. How we collect it

We collect personal information directly from you when you register, verify your identity, load or use a card, contact us or use the App; from the Partner that sponsors your card (for example your employer’s payroll file); from the Issuer and payment networks when transactions are processed; from identity-verification, fraud-prevention and sanctions-screening providers; and automatically through cookies and similar technologies on our website and App.

4. How we use it

We use personal information to:

• Verify your identity and eligibility, and meet our and the Issuer’s legal obligations, including anti-money-laundering and counter-terrorist-financing requirements.
• Open, operate, fund and manage card programs, accounts and cards, and process loads, payments, withdrawals, transfers and disputes.
• Provide the App and cardholder portal, including balances, transaction history, notifications, card freeze and replacement.
• Detect, investigate and prevent fraud, unauthorized use, security incidents and other illegal activity.
• Provide customer support and respond to your requests.
• Operate, secure, maintain and improve our website, App and Services, including analytics and troubleshooting.
• Send service communications (for example a load notification or a security alert). These are not marketing and you cannot opt out while you hold an active card.
• Send marketing about our services where you have consented or where permitted by law. You can withdraw consent at any time.
• Comply with law, regulation, payment-network rules, court orders and requests from regulators and law enforcement, and establish or defend legal claims.
• Any other purpose we identify at the time of collection, or to which you consent.

5. Who we share it with

We share personal information only as needed to provide the Services and as described here:

• Issuers and payment networks — to issue and operate cards and process transactions.
• Partners — the employer or business that sponsors your card receives the information needed to run its program (for example confirmation that a card is active and the amounts it loaded). Partners do not receive your purchase details.
• Service providers — identity verification, fraud and sanctions screening, card manufacturing and fulfilment, cloud hosting, analytics, customer-support tools and communications providers. They may only use your information to provide services to us and must protect it.
• Professional advisers — lawyers, auditors and accountants, under duties of confidentiality.
• Regulators, law enforcement and courts — where required by law, regulation, subpoena or court order, or to protect our rights, your safety or the safety of others.
• Business transfers — if we are involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction, subject to this policy.

We do not sell personal information.

6. Where it is stored and international transfers

Your information is stored on secure servers operated by us and our service providers. Some providers, including Issuers, verification providers and cloud hosts, are located outside Canada, including in the United States and the European Union. While in another country, information is subject to that country’s laws and may be accessible to its courts, law-enforcement and national-security authorities. We use contractual and organizational safeguards to require that providers protect your information to a standard comparable to this policy. You may contact us for more information about our transfer practices.

7. How long we keep it

We keep personal information for as long as needed for the purposes described in this policy and as required by law. Identity-verification records and transaction data are kept for at least five (5) years after the end of the relationship, as required by Canadian anti-money-laundering law and the Issuer. Account and support records are kept for the life of your relationship with us plus the applicable limitation period. When information is no longer needed, we securely delete or anonymize it.

8. How we protect it

We use physical, organizational, contractual and technological safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest, access controls and authentication, logging and monitoring, and staff training. Card data is processed on PCI-DSS-certified infrastructure operated by our Issuer and processing partners. Access is limited to personnel who need it to do their jobs. No system is completely secure; if a breach creates a real risk of serious harm, we will notify you and the relevant privacy regulator as required by law.

9. Your rights and choices

Subject to applicable law, you may:

• Access the personal information we hold about you and learn how it has been used and to whom it has been disclosed.
• Correct information that is inaccurate, incomplete or out of date. Where appropriate, we will pass corrections to third parties who received the information.
• Withdraw consent to uses that are not required to provide the Services or by law. Withdrawing consent may mean we can no longer provide a card or account.
• Request deletion of information we are not required to retain by law or contract.
• Opt out of marketing at any time using the link in any marketing email or by contacting us.
• Request portability of computerized personal information you provided to us, in a structured, commonly used format, where the law provides.
• Complain to us, and to the Office of the Privacy Commissioner of Canada or the Commission d’accès à l’information du Québec.

To exercise a right, contact us using the details in section 13. We may ask you to verify your identity first; that information is used only for verification. We respond within thirty (30) days and will tell you in writing if we need more time. Access is free; if a request involves significant cost we will give you an estimate before proceeding.

You can also view and update some account and verification details directly in the App. To delete your Thanos Link account, use the “Close account” option in the App or email us; any remaining balance is handled under your cardholder agreement with the Issuer.

10. Cookies and analytics

Our website uses strictly necessary cookies to operate, and analytics cookies to understand how the site is used. The App uses device identifiers and analytics and crash-reporting software for the same purposes. You can control cookies in your browser settings; disabling them may affect some features. Where required, we ask for your consent before setting non-essential cookies.

11. Information about Partners and their personnel

Where a business becomes a Partner, we collect business and personal information about its directors, officers, beneficial owners and authorized users to onboard the business, meet know-your-business obligations and administer the program. Partners are responsible for ensuring they have the authority and consents needed to provide their employees’ or contractors’ information to us, and for telling those individuals that a card is being issued through Thanos Link.

12. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top shows the current version. If a change is material we will notify you in the App or by email before it takes effect. Continued use of the Services after a change means you accept it; if you do not, you may close your account before the change takes effect.

13. Contact us

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).