This Privacy Policy (the "Policy") explains how personal information is collected, used, disclosed and protected when you use the Ektico mobile application for iOS or Android (the "App"), its secure sign-in pages and the SEPA payment services accessible through it. It also explains which Ektico company is responsible for particular processing and the rights available to you.
This Policy applies to the services described in the Ektico Terms & Conditions and should be read together with those terms and any notice shown when information is collected.
The Ektico companies and who is responsible for your data
"Ektico" is a trading name used by companies in the Ektico Group. Ektico Ltd, Ektico Pay Limited and other affiliated entities form the Ektico Group. In this Policy, "Ektico", "we", "us" and "our" refer to the company responsible for the particular processing described below. Group membership alone does not make every Ektico company a controller of all personal information.
Ektico Pay Limited: Payment-service provider
Ektico Pay Limited is the Canadian company that provides the payment-account and SEPA transfer services available through the App. It is the principal controller of personal information used to open and operate your payment account, execute and monitor SEPA payments, verify identity, meet anti-money-laundering and financial-crime obligations, prevent fraud and provide payment-related support.
Legal name: EKTICO PAY LIMITED
Company registration: BC1462136
Registered office: 1021 West Hastings Street, Vancouver BC, V6E 0C3
FINTRAC reference: C100000125
Ektico Pay Limited is registered in Canada for the payment activities stated in its applicable Terms & Conditions and public regulatory records. Registration with FINTRAC as a money services business, and registration as a payment service provider under the Retail Payment Activities Act where applicable, are regulatory registrations; they are not a banking licence, deposit insurance or an endorsement by FINTRAC or the Bank of Canada.
Ektico Ltd: App owner and publisher
Ektico Ltd owns and publishes the App and operates its technical interface, security, release management, analytics and App support. It is a controller for personal data where it determines the purposes and means of those App functions. When Ektico Ltd handles payment-account or transaction information solely to operate the App or support Ektico Pay Limited, it acts as a processor or service provider on Ektico Pay Limited's documented instructions.
Legal name: EKTICO LTD
Company registration: C112220
Registered office: 23, Triq Nofs In-Nhar, Valletta, VLT 1102, Malta
Any separate regulatory authorisation held by Ektico Ltd for other services does not authorise payment services. Ektico Pay Limited remains responsible for the payment services described in this Policy.
If Ektico Pay Limited and Ektico Ltd jointly decide why and how a specific activity is carried out, they act as joint controllers for that activity and allocate their responsibilities by written arrangement. You may exercise your rights against either company for such processing. The company named in your account agreement or an in-product notice is the controller for any service not expressly allocated in this Policy.
Scope of this Policy
This Policy covers the App, the secure authentication pages used by it and the payment services accessible through it. The App is limited to payment-account functions: signing in, viewing balances and payment history, managing beneficiaries, initiating and monitoring SEPA credit transfers, receiving account or security messages and contacting support. The App does not provide payment cards, cash withdrawals, card acquiring, Apple Pay or Google Pay, lending, investments, crypto-asset services, crowdfunding, insurance, company formation or electronic invoicing. The Ektico website may have a separate privacy policy for website-only processing.
When we process your personal information
Payment account opening
To enter into and administer a payment-account agreement, Ektico Pay Limited may collect identity, contact, tax and business information, including the information listed below. Without information needed to identify you, assess eligibility, comply with law and perform the agreement, we may be unable to open or continue the payment account.
Identity and contact information: name, date of birth, address, nationality, citizenship, residence, email, telephone number and customer identifier.
Verification and compliance information: identity documents, photographs or video used for verification, tax information, occupation or business information, beneficial ownership and control information, source-of-funds information, screening results and information needed for anti-money-laundering, sanctions and fraud checks.
Account and SEPA payment information: account number or IBAN, BIC where relevant, balances, payer and beneficiary details, payment amount, currency, date and time, payment reference, status, rejection or return information, and transaction history.
Communications and preferences: support requests, complaints, call or message records, language, notification choices and marketing preferences.
Identity verification
Before opening an account and, where required, during the relationship, we verify the identity and authority of the customer, directors, representatives and beneficial owners. Verification may use government-issued identity documents, a selfie or liveness check, electronic verification, corporate register information and third-party identity-verification providers. We also perform sanctions, PEP, adverse-media, fraud and other checks required by applicable law and our risk controls.
Use of the payment account and SEPA transfers
When you view or use the payment account, we process account balances, IBANs, payer and beneficiary names, payment amount, currency, date and time, payment reference, transaction status and history, and information concerning rejected, returned or recalled payments. We use this information to authenticate instructions, execute and reconcile SEPA transfers, respond to payment enquiries, prevent fraud and meet recordkeeping and reporting duties.
Special categories of personal information
Payment references or counterparties can occasionally reveal sensitive facts, such as health, religion, political opinions or trade-union membership. We do not ask you to include such information in a payment reference. If it is revealed incidentally, we use it only as necessary to execute the payment, comply with law, establish or defend legal claims, or under another condition permitted by Article 9 GDPR where the GDPR applies.
When you use the App
Authentication and session information: user identifier, sign-in events, authentication status, session tokens, and the date and time of access.
Device and network information: IP address, device type, operating-system version, App version, language, time zone and security-related identifiers.
Usage and diagnostic information: App screens or features used, interaction events, performance data, crash reports, error logs and technical diagnostics.
Information submitted in the App: beneficiary details, SEPA payment instructions, references and information included in a message or support request.
The App does not access your contacts, camera, photo library, microphone or precise location and does not collect advertising identifiers. We do not use App information for third-party advertising or cross-app tracking. The native App does not use cookies. A secure authentication page opened in your system browser may use strictly necessary session technologies to complete sign-in and protect the service.
Signing in with Apple or Google
Where offered, you may sign in using Apple or Google. If you choose this option, we receive the identity information needed to authenticate you, normally your name, email address and a unique provider account identifier. We do not receive your Apple or Google password. The provider learns that you requested to sign in to Ektico and processes that event under its own privacy notice.
Data stored on your device
To operate correctly, the App stores limited information locally:
Authentication tokens and session information are held in secure operating-system storage and deleted when you sign out.
App preferences include language, display and security settings.
Saved payment beneficiaries include the beneficiary name and account number or IBAN associated with the account from which a payment was made. They remain on the device after sign-out so they are available when you next sign in.
The local copy is stored in the App's protected storage and is not transmitted merely because it is saved. Beneficiary details are sent to Ektico when you initiate a payment. Local data is not used for analytics, profiling or marketing. You can remove it by clearing the App's data using device controls or by uninstalling the App.
Biometric authentication and passkeys
Face ID, Touch ID or Android biometric unlock may be used as an optional local security feature. Verification is performed by the operating system; Ektico receives only confirmation that it succeeded or failed and does not receive, process or store your biometric template. You can disable this feature in App settings. If you use a passkey, your device or browser performs verification and sends a cryptographic confirmation—not your fingerprint or facial scan—to the sign-in service.
Analytics and crash reporting
The App uses Google Firebase Analytics and Firebase Crashlytics to understand feature use, detect errors and improve stability. Depending on configuration and device settings, Firebase may process an App-instance identifier, device and operating-system information, App version, interaction events, crash stack traces, performance data and related diagnostics. We configure these tools not to collect passwords, authentication credentials or full payment details. Amplitude and Microsoft Power BI are not embedded in the App.
Push notifications
If push notifications are enabled and you give device permission, we may send transaction confirmations, security alerts and service messages. A device push token and limited routing data are processed by Apple or Google to deliver the notification. You can withdraw device permission at any time. We avoid including full account numbers or other unnecessary confidential details in notification previews.
When you contact us
When you contact support, submit a complaint or respond to a compliance request, we may process your name, email address, telephone number, customer identifier, language, country, account status, relevant payment details and the content of your correspondence. Please do not send additional personal data or documents concerning yourself or another person unless we request them or they are necessary to explain the matter.
Why and on what legal grounds we use information
We process personal information only for identified purposes, including to:
create and administer the payment relationship, authenticate you and provide App features;
execute, reconcile, monitor and support payments and maintain transaction records;
verify identity and eligibility and comply with anti-money-laundering, sanctions, tax, accounting, regulatory reporting and other legal obligations;
prevent, detect and investigate fraud, misuse, security incidents and financial crime;
maintain, troubleshoot, secure, analyse and improve the App and our services;
communicate with you, respond to support requests and handle complaints or legal claims; and
send marketing only where permitted and in accordance with your preferences.
Canadian privacy law
Where Canadian privacy law applies, Ektico Pay Limited processes personal information with your express or implied consent, as appropriate to the sensitivity and context, for purposes that a reasonable person would consider appropriate. It may also process or disclose information without consent where legislation permits or requires this, including for fraud prevention, investigations, law enforcement and regulatory compliance. You may withdraw consent, subject to legal or contractual restrictions and reasonable notice; withdrawal may prevent us from providing the payment service.
GDPR legal bases
Where the GDPR applies, the relevant controller relies on:
Contract — Article 6(1)(b): to provide the payment account and App functions you request and take steps before entering into the account agreement.
Legal obligation — Article 6(1)(c): to meet anti-money-laundering, sanctions, accounting, reporting, security and other binding legal duties.
Legitimate interests — Article 6(1)(f): to secure and improve the App, prevent fraud, administer the business, provide relevant service communications and establish or defend legal claims, after balancing those interests against your rights.
Consent — Article 6(1)(a): for optional processing where consent is requested, such as certain notifications or marketing. You may withdraw it at any time without affecting earlier lawful processing.
Where Article 9 GDPR applies to information that reveals a special category, we process it only when an applicable Article 9 condition is met, such as explicit consent, legal claims or substantial public interest established by law.
SEPA payments, fraud monitoring and automated decisions
We use identity, account, transaction, device and behavioural information to authenticate SEPA payment instructions, route funds, reconcile accounts, screen transactions and comply with financial-crime requirements. Information is shared with the payer's and beneficiary's financial institutions, SEPA clearing and settlement participants, correspondent institutions where applicable, and other entities needed to execute, return, recall or investigate the transfer.
Automated rules and risk models may flag, delay, refuse or block a transaction or account activity where fraud, sanctions, money laundering or security risk is suspected. Trained staff review cases where appropriate. Where Article 22 GDPR applies to a solely automated decision producing legal or similarly significant effects, we use it only when permitted by law and provide applicable safeguards, including the right to request human intervention, express your view and contest the decision.
Marketing
We may send information about Ektico services where you have consented or where applicable law otherwise permits it. You may opt out at any time through the unsubscribe link, App settings where available, or by emailing support@ektico.com. Opting out does not stop essential payment, security, legal or account-service communications. We do not sell personal information or share App data for cross-context behavioural advertising.
Who receives your information
We disclose only what is reasonably necessary to:
Ektico Group companies, for App operation, customer support, security, compliance and administration, under intra-group confidentiality and data-protection arrangements.
payment and financial institutions, including SEPA clearing and settlement participants, banks, correspondent institutions where applicable, and beneficiary institutions involved in a transfer.
identity, compliance and fraud providers, including document-verification, sanctions-screening, anti-money-laundering and security vendors.
technology and operations providers, including cloud hosting, communications, customer support, software maintenance, Firebase Analytics and Crashlytics, and Apple or Google for App distribution, sign-in or notifications.
professional advisers and business counterparties, where necessary for audits, legal advice, insurance, financing, restructuring or a proposed corporate transaction, subject to appropriate protections.
public authorities, regulators, courts and law enforcement, where disclosure is required or permitted by law or necessary to protect rights, safety or the financial system.
A recipient may be our processor or service provider, a separate controller, or a joint controller, depending on whether it acts on instructions or decides its own purposes. Contracted processors may use information only for agreed services, subject to confidentiality, security and data-protection terms. Independent controllers, such as a beneficiary bank or identity provider, apply their own privacy notices to processing they control.
International transfers
Ektico Pay Limited operates in Canada and Ektico Ltd operates in Malta. Information may therefore be accessed or transferred between Canada and the European Economic Area and to countries where our service providers or payment participants operate. It may be subject to lawful access by courts, regulators or authorities in those countries.
Ektico remains accountable for information transferred to service providers under Canadian privacy law. Where the GDPR applies to a transfer outside the EEA, we use an adequacy decision where its scope covers the recipient—including the European Commission decision for qualifying Canadian commercial organisations subject to PIPEDA—or another lawful mechanism such as the European Commission's Standard Contractual Clauses, together with supplementary measures where needed. Contact dpo@ektico.com to request information about the relevant safeguard.
How long we keep information
We keep information only as long as necessary for the purposes in this Policy and applicable legal, regulatory, accounting, security and claims requirements. Retention is determined by record type, the account relationship and the law applying to the responsible company. In particular:
customer due-diligence, payment and prescribed anti-money-laundering records are generally kept for at least five years from the event specified by Canadian law, such as creation of the record, completion of the transaction or end of the business relationship;
tax and accounting records are normally kept for the statutory period, which may be six years or longer where law, an audit, investigation or dispute requires;
support, security and fraud records are kept for the period reasonably necessary to resolve the matter, protect the service and establish or defend claims;
Firebase Crashlytics reports are normally retained for up to 90 days, while analytics retention follows the configured Firebase period and is minimised where feasible; and
local tokens are removed at sign-out; preferences and saved beneficiaries remain until you clear App data or uninstall the App.
When retention is no longer required, information is securely deleted or irreversibly anonymised. Where deletion must be suspended for a legal hold, investigation or claim, use is restricted to that purpose.
Your privacy rights
Rights under Canadian privacy law
Subject to legal exceptions, you may ask Ektico Pay Limited for access to personal information it holds about you, an explanation of how it has been used and disclosed, and correction of inaccurate information. You may withdraw consent where processing depends on consent and challenge compliance with the applicable Canadian privacy principles. If we cannot resolve a concern, you may complain to the Office of the Privacy Commissioner of Canada or another competent provincial authority.
Rights under the GDPR
Where the GDPR applies, you may request access, rectification, erasure, restriction or portability; object to processing based on legitimate interests or to direct marketing; withdraw consent; and request the safeguards used for an international transfer. You also have rights concerning qualifying solely automated decisions. These rights may be limited where processing or retention is required by law, necessary for payment execution, or needed for legal claims.
You may complain to the Information and Data Protection Commissioner in Malta about processing controlled by Ektico Ltd, or to the supervisory authority in the EEA country of your habitual residence, workplace or the alleged infringement.
How to exercise a right
Email dpo@ektico.com and identify the account and request concerned. We may verify your identity and authority before disclosing or changing information. We generally respond within 30 days or one month, as applicable, and will explain any lawful extension, refusal or fee. Exercising a right is normally free.
Closing your payment account and deletion
You may submit a closure request in the App through Settings → Account & Security → Close account, or contact support@ektico.com. Closure is not immediate: our team reviews the request, any remaining balance and pending payments must be settled, and the account remains open until closure is confirmed.
Closing an account does not automatically erase all personal information. Ektico Pay Limited will retain records required for anti-money-laundering, tax, accounting, regulatory, fraud-prevention and legal-claims purposes for the periods described above. Data with no continuing lawful purpose will be deleted or anonymised. A separate erasure request can be made to dpo@ektico.com.
Security
We use administrative, physical and technical safeguards appropriate to the sensitivity of the information, including access controls, encryption in transit, protected device storage, monitoring, vendor assessment, staff confidentiality duties and incident response. No system is completely secure. Keep your device and credentials protected, use the latest App version and contact support@ektico.com immediately if you suspect unauthorised access.
Age requirement
The App and payment services are intended for persons aged 18 or older. We do not knowingly provide them to, or collect personal information directly from, a child. If you believe a person under 18 has provided information, contact dpo@ektico.com so we can investigate and take appropriate action.
Changes to this Policy
We may update this Policy when the App, our processing or applicable law changes. The current version will be available through the App and on Ektico's public legal page. If a change materially affects how we use information or your rights, we will provide an appropriate notice before it takes effect where required.
Contact us
For privacy rights, complaints or questions:
Data Protection Officer / Privacy Officer: dpo@ektico.com
Customer and account support: support@ektico.com