1. Introduction

Sparroz Group Ltd. (“Sparroz,” “we,” “our,” or “us“) is committed to protecting your privacy and handling your personal information responsibly, transparently, and securely.

This Privacy Policy explains how we collect, use, disclose, store, transfer, and protect personal information when you:

• visit our website;
• create an account;
• use our financial products or services;
• communicate with us;
• participate in promotions or surveys;
• interact with our customer support team;
• otherwise engage with Sparroz.

This Privacy Policy applies to all users of our Services unless a separate privacy notice is expressly provided.

2. Who We Are

Sparroz Group Ltd. is a corporation incorporated under the laws of Canada.

We provide financial technology and payment-related services to customers in multiple jurisdictions.

Depending on the Services you use and your location, Sparroz may process personal information directly or together with regulated financial institutions, payment partners, banking partners, card issuers, identity verification providers, and other authorized service providers.

3. Our Privacy Principles

We are committed to:

• processing personal information lawfully;
• collecting only information reasonably necessary for our Services;
• maintaining transparency regarding our data practices;
• protecting personal information through appropriate security measures;
• limiting access to authorized personnel;
• retaining information only as long as necessary or required by law;
• respecting applicable privacy rights.

4. Information We Collect

Depending on the Services you use, we may collect the following categories of information.

Personal Identification Information

• Full name
• Date of birth
• Nationality
• Residential address
• Email address
• Telephone number
• Government-issued identification
• Passport details
• Driver’s licence information
• National identity numbers where permitted by law

Account Information

• Username
• Account preferences
• Authentication credentials
• Security settings
• Customer reference numbers

Passwords are encrypted and are never stored in plain text.

Financial Information

Where applicable, we may collect:

• Bank account details
• Payment card information
• Wallet identifiers
• Transaction history
• Currency preferences
• Payment instructions
• Account balances
• Payment recipients
• Funding sources

Sensitive payment information may be processed by regulated payment partners rather than directly by Sparroz where appropriate.

Identity Verification Information

To comply with legal and regulatory obligations, we may collect:

• Identity documents
• Selfies or biometric verification data where legally permitted
• Proof of address
• Corporate documentation
• Beneficial ownership information
• Source of funds information
• Source of wealth information
• Tax identification numbers
• Politically Exposed Person (PEP) information
• Sanctions screening information

Business Information

For business customers we may collect:

• Company registration details
• Registered office address
• Business activities
• Ownership structure
• Directors and officers
• Authorized representatives
• Tax registrations
• Regulatory licences

Technical Information

When you use our website or platform, we may automatically collect:

• IP address
• Browser type
• Operating system
• Device identifiers
• Language settings
• Time zone
• Website usage information
• Log files
• Cookies and similar technologies

Communications

We may collect information contained in:

• emails;
• support requests;
• live chat;
• telephone calls where legally permitted;
• complaints;
• feedback;
• survey responses.

5. Information We Receive From Third Parties

We may receive information from:

• identity verification providers;
• payment processors;
• financial institutions;
• banking partners;
• fraud prevention providers;
• sanctions screening providers;
• publicly available sources;
• regulatory authorities;
• law enforcement agencies where legally permitted;
• credit reference or business verification providers where applicable.

6. How We Use Your Information

We use personal information to:

• provide our Services;
• create and manage your account;
• verify your identity;
• process transactions;
• provide customer support;
• communicate with you;
• prevent fraud;
• detect financial crime;
• comply with AML and KYC obligations;
• comply with legal and regulatory requirements;
• improve our products and Services;
• maintain platform security;
• conduct internal audits;
• manage business operations;
• resolve disputes;
• enforce our Terms of Service.

We do not sell your personal information to third parties.

7. Legal Bases for Processing

Where applicable, including under the General Data Protection Regulation (GDPR), Sparroz processes personal information on one or more of the following legal bases:

• performance of a contract;
• compliance with legal obligations;
• legitimate business interests;
• protection against fraud and financial crime;
• protection of vital interests where applicable;
• your consent, where consent is required by law.

Where processing is based on consent, you may withdraw that consent at any time, subject to legal or contractual restrictions.


8. Sharing Your Personal Information

Sparroz treats your personal information as confidential. We do not sell your personal information to third parties.

We may share your personal information only where necessary to provide our Services, comply with legal obligations, protect our legitimate interests, or where you have authorized us to do so.

Depending on the Services you use, your personal information may be shared with:

• regulated financial institutions;
• banking partners;
• payment processors;
• card issuers;
• identity verification providers;
• fraud prevention providers;
• sanctions screening providers;
• anti-money laundering service providers;
• cloud hosting and technology providers;
• customer support providers;
• auditors and professional advisers;
• regulators and supervisory authorities;
• law enforcement agencies where required by law;
• courts or government authorities;
• companies within the Sparroz corporate group;
• business partners involved in providing a requested Service.

Each recipient receives only the information reasonably necessary to perform its function.

9. International Data Transfers

As an international financial services provider, Sparroz may transfer personal information between countries in order to provide the Services.

Your personal information may be processed in Canada and in other jurisdictions where Sparroz, its affiliates, banking partners, payment providers, or service providers operate.

These jurisdictions may include, without limitation:

• Canada;
• Member States of the European Union;
• the United Kingdom;
• Australia;
• the United States; and
• other countries where our approved service providers maintain operations.

Where personal information is transferred internationally, Sparroz implements appropriate contractual, technical, and organizational safeguards designed to protect your information in accordance with applicable privacy laws.

For transfers subject to the GDPR or UK GDPR, Sparroz will use legally recognized transfer mechanisms where required, including Standard Contractual Clauses or other approved safeguards.

10. Regulatory Compliance

Because Sparroz operates within the financial services sector, we are legally required to collect and process certain personal information to comply with applicable regulatory obligations.

These obligations may include:

• Anti-Money Laundering (AML);
• Know Your Customer (KYC);
• Customer Due Diligence (CDD);
• sanctions compliance;
• fraud prevention;
• terrorist financing prevention;
• financial crime investigations;
• regulatory reporting;
• tax reporting where required by law.

Where required by law, Sparroz may disclose information to competent authorities without prior notice to the customer.

Nothing in this Privacy Policy limits our ability to comply with legal or regulatory obligations.

11. Data Retention

We retain personal information only for as long as necessary to:

• provide our Services;
• comply with legal obligations;
• satisfy regulatory recordkeeping requirements;
• resolve disputes;
• enforce agreements;
• protect our legal rights;
• prevent fraud and financial crime.

The applicable retention period depends upon:

• the type of information;
• the Services provided;
• applicable legislation;
• regulatory requirements;
• ongoing investigations;
• legal proceedings.

Where retention is no longer required, personal information will be securely deleted, anonymized, or otherwise disposed of in accordance with our internal policies and applicable law.

Additional information regarding retention periods is available in our Data Retention Policy.

12. Information Security

Protecting personal information is one of Sparroz’s highest priorities.

We maintain administrative, technical, and physical safeguards designed to protect information against:

• unauthorized access;
• accidental disclosure;
• alteration;
• misuse;
• destruction;
• loss.

Our security measures may include:

• encryption of sensitive information in transit and at rest;
• multi-factor authentication;
• access controls;
• network monitoring;
• vulnerability management;
• logging and audit trails;
• employee security training;
• incident response procedures;
• regular security assessments.

While we implement appropriate safeguards, no method of electronic transmission or storage can be guaranteed to be completely secure.

13. Your Privacy Rights

Depending on your jurisdiction, you may have certain privacy rights under applicable law.

These rights may include the right to:

• access your personal information;
• request correction of inaccurate information;
• request deletion of information where legally permitted;
• request restriction of processing;
• object to certain processing activities;
• withdraw consent where processing is based on consent;
• request data portability;
• receive information regarding how your data is processed;
• lodge a complaint with an applicable supervisory authority.

Certain rights may be limited where processing is necessary to comply with legal obligations, including anti-money laundering and financial crime prevention laws.

14. Marketing Communications

Where permitted by applicable law, Sparroz may send information regarding:

• new products;
• service updates;
• educational materials;
• newsletters;
• promotional campaigns;
• events.

You may unsubscribe from marketing communications at any time using the unsubscribe link provided in the communication or by contacting us directly.

Even if you opt out of marketing communications, we may continue sending important service-related, legal, security, and compliance communications.

15. Cookies and Similar Technologies

Sparroz uses cookies and similar technologies to:

• operate our website;
• remember user preferences;
• authenticate users;
• improve website performance;
• analyze website usage;
• maintain security;
• prevent fraud.

Additional information regarding cookies, including available choices and controls, is available in our Cookie Policy.

16. Children’s Privacy

Our Services are not intended for individuals under the age of 18, or the legal age required to use financial services in the applicable jurisdiction.

We do not knowingly collect personal information from children.

If we become aware that personal information has been collected from a child in violation of applicable law, we will take reasonable steps to delete that information.

17. Automated Decision-Making

Certain aspects of our Services may involve automated systems designed to:

• detect fraud;
• assess transaction risk;
• identify suspicious activity;
• comply with sanctions requirements;
• enhance platform security.

Where required by applicable law, customers may have the right to request human review of certain decisions.

Not all automated decisions produce legal or similarly significant effects.

18. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes in applicable laws;
• regulatory guidance;
• new technologies;
• changes to our Services;
• operational improvements.

The updated version will be published on our website together with the revised “Last Updated” date.

Where required by law, we will notify users of material changes before they become effective.

19. Contact Us

If you have questions regarding this Privacy Policy or the manner in which Sparroz processes personal information, please contact us:

Sparroz Group Ltd.

Registered Office:
11th Floor, 20 Bay Street
Toronto, Ontario M5J 2N8
Canada

Company Registration Number: 1001425871

MSB Registration Number: N300000953

Email: privacy@sparroz.io

Website: www.sparroz.io

20. Supervisory Authorities

If you believe that Sparroz has not handled your personal information in accordance with applicable privacy laws, you may have the right to submit a complaint to the competent privacy regulator or supervisory authority in your jurisdiction.

We encourage you to contact Sparroz first so that we have the opportunity to address your concerns promptly and fairly.