INTRODUCTION

Now Prepay is committed to keeping customers' personal information accurate, confidential, secure and private. The Now Prepay Group Privacy Code builds on this commitment.

This Code is based on the Federal Personal Information Protection and Electronic Documents Act ('PIPEDA'). It describes how Now Prepay subscribes to the principles of PIPEDA Privacy Principles throughout the company.

THE SCOPE OF THIS CODE & PRINCIPLES

Now Prepay encompasses all products, services, partners engaged in the following services to the public: purchase of prepaid products or services.

This Code describes the principles Now Prepay will use to protect the privacy of individual customers' personal information in the carrying out commercial activities throughout the company, no matter how the information is collected, used or disclosed.

This Code applies to Now Prepay as defined within this Code with respect to our operations company wide. Where Now Prepay is subject to laws or industry regulation or self-regulatory requirements which impose greater or additional obligations with respect to the protection of personal information, Now Prepay also complies with those additional obligations.

PRINCIPLE # 1 - ACCOUNTABILITY

Now Prepay is accountable for all personal information in its possession or custody, including any personal information disclosed to third parties for processing or other administrative functions. Now Prepay has established policies and procedures to comply with this Code, and has designated one or more persons to be accountable for compliance. 

1. Now Prepay’s senior management has accountability for protecting its customers' personal information. Senior management, however, delegates the day-to-day procedures of compliance to others.
2. Now Prepay will identify internally and to its customers the person or persons who are responsible for overall privacy protection and compliance.
3. Now Prepay is accountable for personal information in its possession or custody that is disclosed to a third party for processing or other administrative functions.
4. Now Prepay will safeguard this personal information through means such as a contract or other agreement with the relevant third party.
5. To put the principles of this Code into practice, Now Prepay:
   • Has policies and procedures to protect the privacy of personal information.
   • Has policies and procedures to receive and respond to customers' questions and complaints.
   • Informs customers and staff of Now Prepay's policies and procedures.
   • Trains staff to understand and follow Now Prepay’s policies and procedures.

Now Prepay also oversees compliance with these policies and procedures through normal risk-based review, and through ongoing compliance policies and procedures reviews.

PRINCIPLE # 2 - IDENTIFYING THE PURPOSES OF COLLECTING PERSONAL INFORMATION

Now Prepay will identify the purposes for which it collects the personal information, before or when the information is collected.

When a customer applies for a product or service provided by or through Now Prepay, Now Prepay will make sure the customer is made aware of:

• Why Now Prepay needs the personal information it is requesting;
• How the personal information may be used with customer consent for other purposes; and;
• The fact that the customer can refuse, at any time, permission for Now Prepay to use personal information for these other purposes.

In some cases Now Prepay may not explain or obtain customer consent for the other

purposes for which the information has been collected.

Now Prepay will collect and use personal information for the following purposes:

• To meet legal and regulatory requirements;
• To provide the services the customer has requested;
• To analyze the suitability of our products or services for the customer;
• To determine the customer's eligibility for our products and services;
• To set up, manage and offer products and services that meet the customer's needs; and/or;
• To provide ongoing service related to the offerings by and through Now Prepay.

Now Prepay will identify the purposes for which it intends to use the personal information, in writing, orally in person or over the telephone, electronically or by any other alternative format or means it uses to communicate with its customers. Now Prepay will use words that customers can easily understand when identifying these purposes.

Now Prepay will distinguish the purposes from other information so that customers will be

made aware of them. For instance, on an online application form, Now Prepay may identify the purposes using bolder type or a box, or a confirmation box. Over the telephone,

Now Prepay will identify the purposes as a distinct part of the conversation with respect to the personal information that is required as well as the purpose for gathering the information.

Now Prepay staff, its affiliates, partners and other related parties who collect personal information will be able to explain the purposes to customers. Customers will also be able to ask for information about the purposes when they email, phone or write to Now Prepay with respect to the use and collection of their personal information.

Now Prepay will explain all the purposes for which personal information is collected including any purposes which may not appear to be as obvious as others. The purposes for collecting a name or address are obvious and do not need to be explained.  For the purposes of collecting other information that may not be obvious Now Prepay will inform the customers that:

• Social Insurance Number is used to facilitate government tax payments;
• A valid government issued identification number and related information is used where legislation requires it for the customer's reporting and record keeping requirements;
• Credit information is requested from credit bureaus to maintain the integrity of the credit-granting process and identification purposes;
• Other services/utility bills is requested for identification purposes relating to legislative requirements;
• Personal information is required for the creation of a digital certificate, API Keys,and other private keys are required with online services to authenticate the customer to the web site and their account information;
• Bank account information is required for settlement and payment purposes; and/or;
• Personal information, including without limitation, telephone number, the customer's date of birth, occupation, source of funds, or other information as required for regulatory compliance.

PRINCIPLE # 3 - CUSTOMER CONSENT

Now Prepay will make all reasonable effort to make sure customers understand how their personal information will be used by Now Prepay. Now Prepay will obtain consent from its customers before, when it collects, or uses the personal information. Now Prepay will not attempt to deceive a customer into giving consent.

A customer's consent can be express, implied, or given through an authorized representative at Now Prepay, its affiliates, or partners.

A customer can withdraw consent at any time, with certain exceptions.

Now Prepay, however, may collect, use or disclose personal information without the customer's knowledge or consent in exceptional circumstances where such collection, use or disclosure is permitted or as required by law.

Generally, Now Prepay will seek consent to use and disclose personal information at the same time it is collected. Sometimes, however, Now Prepay may identify a new purpose and it will seek consent to use and disclose personal information for that purpose after the information has been collected.

Now Prepay will not obtain consent through deceptive practices. It will explain to customers how personal information will be used before they give their consent, except where applicable laws do not require consent.

Customers can give consent orally, in writing or electronically. They can imply consent through action or inaction. They can also give consent through an authorized representative. Express consent is the preferred form at Now Prepay.

Customers can grant consent:

• Orally, such as when information is collected over the telephone or at an affiliate or partner;
• In writing, such as when completing and signing an application; or
• Electronically, such as when applying through a computer or electronic communicating device.

Customers can grant implied consent by:

• Using a product or service offered by or through Now Prepay; and/or
• Not responding to Now Prepay’s offer to have their personal information removed from a direct marketing list. In this case, Now Prepay may assume that the customer consents to the use of personal information.

Customers can also give consent through an authorized representative, such as a legal guardian or a person with a power of attorney. This is necessary, for example, if Now Prepay cannot obtain express consent from a customer who is a minor, seriously ill, or mentally incapacitated.

Before deciding what form of consent is appropriate, Now Prepay will consider the type of personal information it needs, the reason for its use, and the type of customer contact that is involved.

Customers always have the option to withdraw consent to the use of personal information for marketing purposes.

Now Prepay can collect or use personal information without the knowledge and consent of the customer in exceptional circumstances where such collection or use is permitted or as required by law.

For example, Now Prepay will not ask for consent when personal information is collected used, or disclosed:

• In the clear best interests of the customer and consent cannot be obtained in a timely way;
• When asking for consent may compromise the information sought and collection relates to an investigation of a breach of an agreement or a contravention of Canadian laws, as for example to detect and prevent criminal activity and dealings in proceeds of crime;
• When the information is publicly available, as defined in applicable laws; or
• When Now Prepay obtains customer lists from another regulated organization, on the assumption that the organization providing the personal information has obtained each customer's consent before disclosing the information to Now Prepay.

Now Prepay can disclose personal information without the knowledge and consent of the customer in exceptional circumstances where such disclosure is permitted or required by law. For example Now Prepay will not ask for consent when personal information is:

• Given to affiliates or partners of Now Prepay who need it to carry out business-related functions, such as fulfilment (e.g. mailing follow-up information packages), data processing or the sending prepaid payment cards/vouchers/PINs, and/or gift cards;
• Given to its legal representatives;
• Disclosed for the purpose of collecting an overdue account; and/or
• Disclosed in order to:
• comply with a subpoena or warrant;
• respond to a governmental authority that has lawful authority to obtain the information;
• facilitate the activities of an investigative body or government institution in dealing with a past, potential or actual breach of an agreement or contravention of the laws of Canada or a province or a foreign jurisdiction; or
• comply with the law; and/or
• process or otherwise administer products or services and/or to transfer personal information to other companies that have acquired the rights to such offerings.

Subject to legal and contractual restrictions, customers can refuse or withdraw consent at any time as long as:

• Now Prepay is given reasonable notice of the withdrawal;
• Consent does not relate to a product or service where Now Prepay must collect and report information after the product or services has been used. This is to maintain the integrity of the payment system; or
• Consent does not relate to legal or regulatory requirements for reporting and record keeping; or
• Now Prepay will let the customer know the consequences of refusing or withdrawing consent when customers seek to do so. Refusing or withdrawing consent for Now Prepay to collect, use or disclose personal information could mean that Now Prepay cannot provide the customer with some product, service or information of value to the customer.

PRINCIPLE # 4 - LIMITING COLLECTION OF PERSONAL INFORMATION

Now Prepay limits the amount and type of personal information it collects. Now Prepay will collect personal information for the purposes it identifies to the customer at time of collection. Now Prepay will inform the customer if the information collected will be used for new purposes.

Now Prepay collects personal information using policies and procedures which are fair and lawful.

Although Now Prepay will collect personal information primarily from customers, it may

also collect personal information from external sources such as third party service providers, credit bureaus, government records, and partners as required by law or confirmation that the personal information collected is correct.

PRINCIPLE #5: LIMITING USE, DISCLOSURE AND RETENTION OF PERSONAL INFORMATION

Now Prepay will use or disclose personal information only for the reasons it was collected, unless consent is obtained from the customer to use or disclose the personal information for another reason, or is permitted/required by law.

Under certain exceptional circumstances, Now Prepay has a legal duty or right to disclose personal information without customer knowledge or consent, including to protect Now Prepay’s or the public interest.

Now Prepay will keep personal information only as long as necessary for the identified purposes for which it was collected.

Now Prepay may disclose personal information without consent where permitted/required by law. For example:

• subpoenas;
• production orders
• search warrants;
• other court and government orders; or
• demands from other parties who have a legal right to the personal information.

In these circumstances, Now Prepay will protect the interests of its customers by making reasonable efforts to ensure that:

• orders or demands comply with the laws under which they were issued;
• it discloses only the personal information that is legally required, and nothing more; and
• it does not comply with casual requests for personal information from government or law enforcement authorities.

Now Prepay may notify customers that an order has been received, if permitted by law.

Now Prepay may notify customers of such orders to the last know telephone, electronic mail, or letter.

Now Prepay may want to use personal information to market products and services to its customers, either directly or through Now Prepay or its affiliates. Now Prepay will obtain the consent of the customer before using personal information for such purposes.

When a customer uses a Now Prepay product or service and provides personal information, Now Prepay will:

• Tell the customer that this personal information may be used by it or other Now Prepay affiliates to market other products and services to the customer;
• Describe the types of Now Prepay affiliates who might market their products or services; and
• Ask the customer for consent, and advise them that this use of personal information is optional.

The first time a new type of Now Prepay affiliate provides promotional information about its product or service, the Now Prepay affiliate will:

• Explain the proposed use of the customer's personal information to the customer; and
• Give the customer an opportunity to withdraw consent for further use of their personal information.

Now Prepay specifies in its policies and procedures the periods of time it will keep personal information. Some of these time periods are determined by legislation. If personal information has been used to make a decision about a customer, Now Prepay will keep the personal information long enough for the customer to have access to it after the decision has been made, subject to any regulated record retention period.

Now Prepay will destroy or erase any personal information no longer needed for its identified purposes or for legal requirements.

Now Prepay’s policies and procedures explain how Now Prepay will destroy personal information so that unauthorized persons or organizations do not gain access to it.

PRINCIPLE #6: ACCURACY OF PERSONAL INFORMATION

Now Prepay will keep personal information as accurate, complete and current as necessary for the identified purposes for which it was collected.

Customers may, in writing, challenge the accuracy and completeness of their personal information and request that it be amended as appropriate.

Now Prepay will make reasonable efforts to minimize the possibility of using inaccurate, incomplete, or outdated personal information to make a decision about the customer.

Now Prepay will update personal information only if it is necessary for the purposes for which it was collected.

Now Prepay will make reasonable efforts to keep customers' personal information accurate and current if the information is used on an ongoing basis. This includes personal information disclosed to third parties for processing.

Now Prepay will also rely on customers to keep certain personal information (such as customer addresses) accurate, complete, and current. If a customer shows that personal information is inaccurate, incomplete, out of date, or irrelevant, Now Prepay will revise its records. If necessary, Now Prepay will disclose the revised personal information to third parties which were provided with the information to revise their records as well.

If Now Prepay does not agree to revise personal information as requested by the customer, the customer may challenge Now Prepay’s decision. Now Prepay will make a record of this challenge, and if necessary, disclose the challenge to the third parties who also possess the personal information, and advise the customer of the relevant complaint procedures.

PRINCIPLE #7: SAFEGUARDING PERSONAL INFORMATION

Now Prepay protects personal information with safeguards appropriate to the sensitivity of the information. These safeguards include protecting personal information from loss or theft, from unauthorized access, disclosure, duplication, use, or modification.

Now Prepay’s safeguards vary depending on the sensitivity, amount, distribution, format, and storage of the personal information. Now Prepay gives the highest level of protection to the most sensitive personal information.

Now Prepay safeguards personal information through security measures. For example:

• Physical security, such as secure locks on filing cabinets and restricted access to offices;
• Organizational security, such as controlled entry in data centres and limited access to relevant information; and
• Electronic security, such as passwords, personal identification numbers, and encryption.

Now Prepay informs its staff regularly about Now Prepay’s policies and procedures for

protecting customers' personal information, and emphasizes the importance of complying with them. As a condition of employment, employees are required to conform to Now Prepay’s policies and procedures.

Now Prepay may disclose personal information to third parties for fraud screening, credit worthiness, data processing services or administrative services, collection of debts, or for other goods and services. Now Prepay requires these third parties to safeguard all personal information in a way that is consistent with Now Prepay’s measures, or as regulated by law.

Now Prepay may, with the customer's consent, disclose personal information to businesses such as, credit bureaus, and third party payment providers, its partners and issuers of prepaid products or accounts, advisory organizations, and regulatory organizations. Now Prepay uses procedures and/or contracts to protect the privacy of that personal information.

As referred to in Principle 5, Now Prepay uses care when disposing of or destroying personal information, to prevent unauthorized access to the information.

PRINCIPLE #8: OPENNESS TO PERSONAL INFORMATION

Now Prepay is open about the policies and procedures it uses to manage personal information. Customers have access to information about these policies and procedures. The information will be made available in a manner that is generally easy to understand.

Now Prepay makes available to customers information about the policies and procedures it uses to manage personal information. Copies of this Code are available in printed format upon request.

Information about Now Prepay’s policies and procedures has been written so that it is generally easy to understand and it is readily available to customers. Through printed format or other related documents, customers will be able to find out:

• The title and mailing address of the representative of Now Prepay who is responsible for protecting the privacy of customers' personal information, so customers know where to address complaints and questions;
• How to access personal information held by Now Prepay;
• What type of personal information is held by Now Prepay and for what purpose it is used; and
• The personal information made available to Now Prepay or its affiliates.

Now Prepay makes information about its policies and procedures available in a variety of ways, depending on the nature of the service customers are using and the sensitivity of the personal information. For example, Now Prepay may make printed format or other information available upon request, mail information to its customers, establish a toll-free telephone service, use electronic mail, or provide online access.

If you have a question about Now Prepay's privacy policies, please contact us toll free at 1-844-241-2991. 

Alternatively, you may write to us at:

Now Prepay Inc.

c/o Chief Privacy Officer

365 Evans Avenue

Suite 301 Toronto

ON M8Z 1K2

PRINCIPLE #9: ACCESS TO PERSONAL INFORMATION

When customers make a request in writing, Now Prepay will, within a reasonable time, inform them of what personal information Now Prepay has, what it is being used for, and/or to whom it has been disclosed, depending on what details the customers have requested and that is not restricted by law, and/or from a contractual perspective.

When customers request it in writing, Now Prepay will give them access to their personal information. Now Prepay will respond to the written customer request within 30 days. In certain situations, however, Now Prepay may not be able to give customers access to all their personal information. Now Prepay will explain the reasons for this limitation on access and any recourse the customer may have, except where prohibited by law, and/or from a contractual perspective.

A customer has the right to know, by written request, what personal information is held by Now Prepay. Customers have a right, upon written request, to access personal information, and to know to which third parties the information has been disclosed, except where prohibited by law, and/or from a contractual perspective.

Now Prepay has policies and procedures for responding to customers' requests for access to personal information. When customers ask, Now Prepay will make these policies and procedures known to the customers. To respond to a customer's request certain information may be required, for example, customers have to be specific about the type of personal information that may be held by Now Prepay.

Now Prepay will attempt to be as specific as possible about the persons from whom it collected the personal information, to whom it has disclosed the personal information, and how and when the information was disclosed. Now Prepay will take this information from its records, and will provide it to the customer in a form that is generally easy to understand, providing explanations for abbreviations and codes. Now Prepay will provide the information to the customer within 30 days following a written request, and for a cost commensurate with the effort to retrieve the information, or at no cost.

Now Prepay will not charge the customer without first informing the customer of the cost of providing the requested information and giving the customer the option to withdraw the request.

Now Prepay will, on request, give a customer who has a sensory disability, access to personal information to which the customer is entitled, in an alternative format if a version of the information already exists in the alternative format, or if conversion into that format is reasonable and necessary in order for the customer to access the personal information.

Now Prepay will not provide the personal information that is in its control if:

• In so doing, it would reveal personal information about a third party and such personal information is not severable from the requesting individual's personal information;
• It is subject to solicitor-client or litigation privilege;
• It contains Now Prepay’s own confidential commercial information and such confidential commercial information is not severable from the requesting individual's personal information. For example, Now Prepay may use a scoring formula, form an assessment of risk, or make a collection recommendation that is confidential to Now Prepay;
• In so doing, it would reveal information that would reasonably be expected to threaten the life or security of another individual and such information is not severable from the requesting individual's personal information;
• It is information that was generated in the course of a formal dispute resolution process;
• It cannot be disclosed for legal reasons. For example, Now Prepay may not legally be able to provide the customer with information relating to disclosures to lawful authorities for law enforcement or crime prevention purposes. In some provinces Now Prepay cannot legally provide a customer's credit bureau report to that customer; and/or
• It is used for the detection and prevention of criminal activity and dealings in proceeds of crime.

Now Prepay will not record in customers' individual files when personal information was disclosed to third parties for routine purposes. For example:

• Reporting to tax authorities;
• Reporting to other authorities and/or related parties;
• Reporting to regulators;
• Regular updating of credit information to credit bureaus;
• Indicating to third parties when items are returned for NSF (not sufficient funds);
• Preparation and mailing of customer statements; or
• Record keeping for various regulated transactions.

If Now Prepay denies the customer's request for access to personal information, Now Prepay will explain the decision to the customer, except where prohibited by law. The customer may then challenge Now Prepay’s decision (See Principle 10).

A customer may challenge the reasonableness of the cost of providing personal information.

PRINCIPLE #10: CHALLENGING OUR PRIVACY POLICY

Customers may challenge Now Prepay’s compliance with this Privacy Policy. Now Prepay has policies and procedures to receive, investigate, and respond to customers' complaints and questions.

Now Prepay will inform customers of these policies and procedures, which are generally easy to understand and use. The complaint resolution process and the appropriate contact person are part of these policies and procedures.

Now Prepay will investigate all complaints received in writing and if it finds a complaint justified, Now Prepay will try to resolve it. If necessary, Now Prepay will take appropriate measures, including changing its policies or procedures, to ensure that other customers will not experience the same problem.

If a customer is not satisfied that Now Prepay is operating in compliance with the requirements of this Privacy Policy, the customers may file a complaint with the privacy regulator or data protection agency of their respective jurisdiction within Canada. Various privacy regulators or data protection agencies have different methods for filing customer complaints. Customers may also file a written complaint to the Office of the Privacy Commissioner of Canada.

Office of the Privacy Commissioner of Canada

30 Victoria Street
Gatineau, Quebec K1A 1H3
Toll-free: 1-800-282-1376
Phone: (819) 994-5444
Fax: (819) 994-5424
Internet: www.priv.gc.ca

The Interac logo and Interac e-Transfer are registered trade-marks of Interac Corp. Used under licence.