Privacy Policy

Definitions

In this policy, "Nuvaultance", "we", and "us" mean Nuvaultance Digital Assets Ltd., operating the platform under the trading name Nuvaultance. "Personal data" means information relating to an identified or identifiable individual. "You" means a visitor, registrant, or client of the platform.

Personal data

We collect at minimum your first name, last name, telephone number, and email address when you register or contact us. Identity verification adds the document data described in the AML/KYC policy. Content you provide in messages, complaints, or support conversations is also personal data.

Usage data

When you use the site, we collect technical usage data: pages visited, approximate location derived from your IP address, browser and device type, referrer, and timestamps. This data keeps the service secure, stable, and understandable in the aggregate. It is not used to build advertising profiles.

Cookies

The platform uses strictly necessary cookies for session integrity and security, and functional cookies that remember interface choices. Analytics cookies may be used in aggregate to understand which pages help users and which confuse them. You can refuse non-essential cookies in your browser; the site remains fully usable.

Operator and processors

Nuvaultance is the operator responsible for the personal data it collects. Service providers process data on our behalf under written agreements: hosting and infrastructure operators, KYC verification providers, email delivery services, and analytics tools. They may act only on our documented instructions.

Collection and use

We use personal data to answer your requests, to set up and operate your account, to verify identity and prevent fraud, to execute and document transactions, to meet legal obligations, to secure the platform, and to improve the service. Marketing messages are sent only where you consented, and every message carries a working unsubscribe link.

Legal bases

Processing rests on contract for running the account you asked for, on legal obligation for verification and record-keeping, on legitimate interest for security and fraud prevention, and on consent for marketing and for optional cookies. Canadian privacy law, including PIPEDA where it applies, shapes how these bases are applied and how you can challenge a use you disagree with.

Data retention

Registration and contact data are kept while the relationship lasts and for a reasonable period after. KYC and transaction records are kept for the retention periods Canadian law requires, measured in years after the end of the relationship. Usage data in aggregate form may be kept longer because it no longer identifies you. When retention ends, data is deleted or irreversibly anonymized.

Data transfer

Some providers operate outside Canada. Where personal data is transferred internationally, we use providers offering comparable protection, rely on appropriate transfer mechanisms, and limit what is transferred to what the purpose needs.

Disclosure

We do not sell personal data. We share it with execution and custody partners to the extent needed to operate your account, with service providers under the agreements above, with affiliates involved in providing the service, and with regulators, courts, or law enforcement where the law requires or a valid order compels disclosure.

Security

Data is protected with encryption in transit and at rest, access controls, and logging, as described on the Security page. No system is perfectly secure, so we also maintain an incident process that includes notifying affected individuals and the relevant authorities where required.

Your rights

You can request access to the personal data we hold about you, correction of inaccurate data, deletion where no legal obligation requires retention, restriction of processing while a dispute is resolved, and objection to processing based on legitimate interest. Withdrawing marketing consent is possible at any time. Requests are answered within the timelines Canadian law prescribes, via [email protected].

Service providers

Current categories of providers include hosting, KYC verification, email delivery, analytics, and payment processing. Each receives only the data needed for its function, and the list of categories is updated as the service evolves.

Analytics

We use analytics to count visits, understand navigation, and find broken journeys. Where Google Analytics is enabled, its GA4 identifier is set in the site configuration by the operator, and you can block it with standard browser tools. Analytics never gates access to content or features.

Advertising and retargeting

The platform does not run advertising trackers of its own. If marketing partners are used later, their cookies will be disclosed here and will honor your consent choices before loading.

Third-party links

Pages may link to third-party sites, such as regulators' public pages or payment providers. Once you follow a link, this policy no longer applies; read the destination's own policy before sharing data there.

Children

The platform is intended for adults. Accounts are not offered to anyone under 18, and verification exists partly to enforce this. If we learn that data was collected from a minor, it is deleted promptly.

Changes and contact

This policy can change as the service or the law changes. The current version is always this page, and material changes are announced in the account. Questions and requests go to Client Support and Compliance at [email protected], or by post to 45 O'Connor Street, Suite 300, Ottawa, ON K1P 1A4, Canada.