Privacy Policy

Last updated: 20 October 2026

This Privacy Policy describes what personal information LUMEN PAYMENTS LIMITED collects, why we need it, who we share it with and how long we keep it. It also explains the choices and rights available to you. Please read it together with our Cookie Policy and our Terms of Use.

1. Who We Are and What This Policy Covers

LUMEN PAYMENTS LIMITED ("Lumen Payments", "we", "us" or "our") is a company incorporated in British Columbia, Canada, under registration number BC1582665. Our registered office is at 5307 Victoria Drive #1277, Vancouver BC V5P 3V6, Canada. We are registered as a Money Services Business (MSB) with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) under MSB registration number N300001690. Lumen Payments is not a bank. FINTRAC registration is not a licence, is not prudential supervision and does not mean endorsement by FINTRAC or the Government of Canada.

This Policy applies to personal information we handle through the website at lumenpayments.io (the "Website"), through our other digital channels and in the course of providing money services to corporate clients that have passed our verification process.

In this Policy, "personal information" means information about an identifiable individual. That individual might be a Website visitor, a person who sends us an enquiry, a director, officer, authorized signatory or beneficial owner of a client, or a counterparty to a payment. Lumen Payments decides why and how this information is processed and is accountable for it while it remains under our control. We treat it as confidential and take steps to keep it accurate and secure for as long as we have it.

2. Legal and Regulatory Framework

The main Canadian laws that shape how we handle personal information are the Personal Information Protection and Electronic Documents Act (PIPEDA) and the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), along with the PCMLTFA regulations and FINTRAC guidance. Where it applies, we also observe the British Columbia Personal Information Protection Act (PIPA).

The PCMLTFA obliges us to verify who our clients are, to keep specific records and to file certain reports. Processing carried out to meet those obligations is a condition of receiving our services, so it cannot be refused by anyone who wishes to become or remain a client.

If we handle personal information of people located in the European Economic Area or the United Kingdom, we also have regard to the General Data Protection Regulation and the UK version of that regulation, including the rights they give to individuals.

3. Personal Information We Collect

We only collect what we need to provide our services and to comply with the law. The categories below describe what that usually involves.

Website enquiries. When you use the contact form on the Website, we receive your full name, company, work email, country of incorporation and the message you write. Our server stores this submission in a PostgreSQL database hosted for us by a service provider, together with your IP address, your browser's user-agent string and the time of submission. Each enquiry is given a reference number so that we can track it. Please do not send identity documents or payment details through the contact form.

Cookie choices. When you record a cookie choice, we store that choice, the version of the cookie notice you saw, an anonymous visitor identifier, your IP address, your user-agent string and the time, so that we can demonstrate which choice was made. Further detail is in our Cookie Policy.

Identification information. For clients and their related persons, this typically covers full legal name, date of birth, residential address, nationality, contact details and the type, number and expiry date of government-issued identity documents. For a corporate client we also collect details about the entity itself and about its directors, authorized signatories and ultimate beneficial owners.

Transaction information. When we process payments, we record amounts, currencies, payment methods, details of the sender and the recipient (including their account details), the stated purpose of the payment and the relevant dates and times.

Client relationship information. This can include business email addresses, telephone numbers, credentials used to access our systems, details of bank accounts held in the client's own name that the client nominates for payments, and documents the client uploads to us.

Compliance and verification information. This can include copies of identity documents, facial images taken during biometric or liveness checks, proof of address, corporate registry extracts, ownership charts, and evidence of source of funds or source of wealth.

Technical and communication records. When you browse the Website, we automatically receive technical data such as your IP address, browser type, device and operating system. We also keep records of our correspondence with you, including enquiries, support requests, complaints and onboarding communications.

4. Why We Use Personal Information and Our Legal Grounds

We use personal information for the following purposes:

answering enquiries sent through the Website or by email;
setting up and managing client relationships;
confirming the identity and eligibility of clients and of the individuals connected to them;
carrying out payment, remittance and foreign exchange instructions;
performing anti-money laundering, counter-terrorist financing and sanctions checks;
detecting and preventing fraud;
keeping complete and accurate business records;
protecting the Website and its forms against spam and misuse, and improving the security and performance of our systems;
measuring how the Website is used, where you have allowed analytics cookies.

Our primary basis under PIPEDA is your meaningful and informed consent. You can withdraw consent at any time, although legal or contractual restrictions may limit the effect of a withdrawal, and withdrawing may mean we can no longer provide services. Much of our processing is also needed to perform the agreement we have with you or your organization, or to comply with our obligations under anti-money laundering, know-your-client, sanctions, tax and record-keeping laws. Some processing relies on our legitimate business needs, such as securing our systems, preventing fraud, managing risk and maintaining the quality of our service, provided those needs do not override your rights.

5. When We Disclose Personal Information

We never sell, rent or trade personal information. We share it only in specific situations and only as far as is necessary. Depending on the circumstances, recipients may include:

regulated payment processors, correspondent and acquiring banks and card scheme operators that take part in executing a transaction;
providers of identity verification, sanctions screening and anti-money laundering services;
fraud prevention organizations and credit reporting agencies;
technology providers that host the Website and its database, and that deliver our email (Resend, our email delivery provider, sends our enquiry notifications and acknowledgements);
professional advisers, including auditors and legal counsel.

We will also disclose personal information to FINTRAC, law enforcement, courts and other public bodies where a law, regulation, subpoena or court order requires us to. Each service provider we use is bound by contract to keep the information confidential and secure, and may use it only to provide services to us.

6. International Transfers

Some of our service providers, banking partners and hosting facilities operate outside Canada. As a result, personal information may be transferred to, stored in or accessed from other countries, for example to process a transaction, to run our technology (including email delivery) or to carry out a compliance review. Information held in another country is subject to that country's laws and may be accessed by its authorities where those laws permit. We use contractual, organizational and technical measures designed to give transferred information a level of protection comparable to what Canadian privacy law requires.

7. How We Protect Personal Information

The protection we apply is proportionate to how sensitive the information is. Our measures include encrypted connections (HTTPS) and encryption of stored data, multi-factor authentication, access limited by role to staff who need the information for their work, logging and monitoring of access to our systems, regular vulnerability testing and secure procedures for destroying data.

If payment card data is involved, it is processed by partners certified under the Payment Card Industry Data Security Standard (PCI DSS), and full card numbers are not stored on Lumen Payments systems.

Should a breach of our security measures create a real risk of significant harm to anyone, we will notify the affected individuals and the Office of the Privacy Commissioner of Canada, as PIPEDA requires.

8. How Long We Keep Information

FINTRAC record-keeping rules require us to keep identification and transaction records for at least five years, counted from the later of the last transaction or the end of the business relationship. Other information is kept only for as long as the purpose for which we collected it requires, or for longer if the law demands it. In particular:

enquiries that do not lead to a client relationship are kept for up to 24 months after our last exchange with you;
cookie choice records are kept for up to 12 months, after which we ask for your choice again.

When a retention period ends, we securely delete, destroy or anonymize the information.

9. Your Privacy Rights

PIPEDA gives you the right to ask for access to the personal information we hold about you, to request correction of anything inaccurate or incomplete, and to challenge whether we are complying with our privacy obligations. We reply to written access requests within 30 days and may first need to confirm your identity. In some cases the law requires or allows us to refuse access, for instance where giving access would reveal that a report has been filed with FINTRAC. If we refuse, we will give our reasons to the extent the law permits.

If you are in the European Economic Area or the United Kingdom, you may also have rights to erasure, restriction, portability and objection under Articles 15 to 22 of the GDPR. These rights are subject to the retention duties that the law imposes on us.

To exercise any of these rights, write to our Privacy Officer at compliance@lumenpayments.io. If our answer does not resolve your concern, you can complain to the Office of the Privacy Commissioner of Canada or, where relevant, to the data protection authority in your country. More information on raising a concern with us is on our Complaints page.

10. Cookies

The Website uses a small number of cookies. Strictly necessary cookies record your cookie choice and are always active. Analytics cookies from Google Analytics 4 are only set after you agree to them in our cookie banner. You can change your choice at any time using the "Cookie settings" link in the footer. Our Cookie Policy lists each cookie and explains what it does.

11. Minors

Our services are offered only to businesses. They are not aimed at anyone below the age of majority in their province or country of residence, and we do not knowingly collect personal information from minors. If we discover that we have received such information by mistake, we will delete it.

12. Updates to This Policy and How to Contact Us

We may revise this Privacy Policy when the law, regulatory expectations or our internal procedures change. The current version, with its "last updated" date, will always be published on the Website. Before a material change takes effect, we will give notice on the Website or by email.

Please send questions, access requests and privacy complaints to our Privacy Officer at compliance@lumenpayments.io, or by post to LUMEN PAYMENTS LIMITED, Attention: Privacy Officer, 5307 Victoria Drive #1277, Vancouver BC V5P 3V6, Canada. Our team replies Monday to Friday, 9:00 to 17:00 Pacific Time, except British Columbia statutory holidays.

LUMEN PAYMENTS LIMITED, registration number BC1582665, British Columbia, Canada. FINTRAC MSB registration number N300001690. Website: lumenpayments.io.