Legal

Privacy Policy

For business customers, and individuals connected with them

Effective date: 2026

www.burqfx.com · compliance@burqfx.com

315-7 Westwinds Crescent NE, Calgary, Alberta, Canada, T3J 5H2

1. Introduction

BURQ FX LTD, operating as "BURQ FX" ("BURQ FX", "we", "us" or "our"), provides foreign exchange, cross-border payment, virtual currency and payment service provider (PSP) infrastructure to corporate and institutional clients. BURQ FX does not provide personal or individual consumer accounts.

Although our customers are businesses, we collect and use personal data about individuals connected with those businesses in order to provide our services, carry out customer due diligence, meet our legal and regulatory obligations, and prevent financial crime.

This Privacy Policy explains how we collect, use, store and share personal data relating to directors and officers, beneficial owners and controllers, authorised signatories and users, employees and representatives of our business customers, and individuals connected with payments and transactions we process (including senders, beneficiaries and counterparties), as well as individuals whose information arises through customer due diligence, sanctions screening, fraud prevention or financial-crime monitoring.

Being named in this Privacy Policy does not make an individual a customer of BURQ FX in their own right. Our contractual customer is the relevant business.

2. About BURQ FX

• Legal entity: BURQ FX LTD
• Incorporated in: Alberta, Canada — Incorporation Number 2026605531 (incorporated 2024-11-04)
• Registered with the Financial Transactions and Reports Analysis Centre of Canada ("FINTRAC") as a Money Services Business — Registration Number C100000771
• Registered office: 315-7 Westwinds Crescent NE, Calgary, Alberta, Canada, T3J 5H2

BURQ FX is not a bank. Registration with FINTRAC as an MSB is a registration for anti-money-laundering and counter-terrorist-financing supervision purposes only, and is not an endorsement, approval or certification of BURQ FX, its products or services. Certain banking, safeguarding, custody, settlement and payment infrastructure supporting our services may be provided by appropriately regulated third-party financial institutions and service providers.

3. Who this Policy applies to

We may process personal data about individuals connected with a business customer, including directors, officers, beneficial owners, controllers, shareholders, partners, trustees, authorised signatories, authorised users, account administrators, employees and other representatives. We may also process personal data about individuals connected with a payment or transaction, including payment senders and beneficiaries, counterparties, suppliers, and — in relation to our virtual currency services — the holders of virtual currency wallets and addresses involved in a transaction. These individuals are not necessarily BURQ FX customers in their own right.

4. What personal data we collect

4.1 Identity information

• Full name and any previous names
• Date of birth, nationality, country of residence and country of birth
• Government-issued identification and document details, including expiry dates
• Photographs or biometric data collected for identity verification
• Corporate registry information (e.g. Corporations Canada or a provincial registry) and professional registration information

4.2 Contact information

• Business and, where required for verification, residential address
• Email address and telephone number
• Correspondence and business contact details

4.3 Corporate, professional and role information

• Position and relationship to the business customer
• Director, officer, beneficial ownership and control information
• Authorisation and signing authority, and information required to establish who may operate or administer an account

4.4 Financial, payment and virtual currency information

• Bank account details, transit and institution numbers, IBANs or equivalent identifiers
• Payment instructions, amounts, currencies, dates, references and counterparty information
• Virtual currency wallet addresses, public blockchain transaction identifiers, and, where required under FINTRAC's "Travel Rule" for virtual currency transfers, originator and beneficiary information
• Source of funds and source of wealth information, and expected transaction activity

4.5 KYC, AML and financial-crime information

• Identity and beneficial-ownership verification results
• Sanctions, politically exposed person (PEP) and adverse-media screening results
• Transaction-monitoring alerts, fraud indicators and information obtained during enhanced due diligence

4.6 Technical and communications information

• IP address, device and browser information, login and authentication data, and security/activity logs from our website and platform
• Records of emails, calls, support requests, compliance correspondence and complaints

5. Where we obtain personal data from

We do not always collect personal data directly from the individual concerned. We may also receive it from the business customer and its authorised representatives; corporate registries (such as Corporations Canada or a provincial corporate registry); FINTRAC and other regulators; sanctions authorities and publicly available sanctions and PEP lists; identity-verification, screening and blockchain-analytics providers; banks, payment institutions and other MSBs or virtual asset service providers involved in a transaction; and publicly available sources.

6. How we use personal data

6.1 Providing and administering our services

Assessing and onboarding business customers; establishing and administering accounts and authorised users; processing foreign exchange, payment and virtual currency instructions; providing statements, confirmations and support; and reconciling transactions.

6.2 Identity verification and financial-crime prevention

Verifying identity and authority to act for a business customer; verifying beneficial ownership and control; screening for sanctions, PEP status and adverse media; detecting and preventing money laundering, terrorist financing and fraud; complying with FINTRAC's Travel Rule for virtual currency transfers; and monitoring transactions and investigating unusual activity.

6.3 Managing risk and meeting legal obligations

Assessing the risk associated with a business customer or transaction; applying account or transaction restrictions where necessary; complying with reporting obligations to FINTRAC and other authorities; and cooperating with law enforcement and regulators.

7. Our purposes and legal basis for processing

Canadian federal and provincial privacy law generally requires that personal data be collected, used and disclosed only for purposes a reasonable person would consider appropriate in the circumstances, and — outside specific legal exceptions — with the knowledge and consent of the individual. We process personal data on the following bases:

• Consent — express or implied consent, obtained directly or through the business customer, for the purposes described in this Policy
• Performance of a contract — processing necessary to establish and administer the account and services agreed with the business customer
• Legal and regulatory requirement — processing required under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act ("PCMLTFA"), FINTRAC guidance, sanctions law, tax law, and other applicable legislation, which may apply without or despite withdrawal of consent to the extent permitted by law
• Legitimate business interests — processing necessary to prevent fraud, maintain the security of our systems, manage risk and defend legal claims, balanced against the individual's privacy interests

8. Sensitive personal information

We do not generally seek to collect information such as health information, racial or ethnic origin, or information about sex life or sexual orientation. Financial information, government identification numbers and, where applicable, biometric identity-verification data are treated as sensitive and are subject to heightened security and access controls. Information connected with a compliance investigation may occasionally reveal sensitive information incidentally; where this occurs, we process it only to the extent necessary and permitted by law.

9. Automated screening tools

We use screening and monitoring tools to assist with identity verification, sanctions and PEP screening, fraud detection and transaction monitoring. These tools generate alerts that are reviewed by our compliance team; an alert does not by itself mean a relationship or transaction is unlawful. We do not make decisions producing legal or similarly significant effects based solely on automated processing without human review.

10. Who we share personal data with

• Banking, payment, custody and liquidity infrastructure providers that support our foreign exchange, payment and virtual currency services
• Identity-verification, sanctions/PEP screening and blockchain-analytics providers
• Other financial institutions, payment institutions and virtual asset service providers involved in processing or investigating a transaction, including Travel Rule counterparties
• FINTRAC, the Canada Revenue Agency, law enforcement, courts and other regulators or public authorities, where required or permitted by law
• Professional advisers, auditors and technology/cloud service providers who process personal data on our behalf under appropriate contractual and security safeguards
• A prospective purchaser or counterparty in connection with a merger, financing, restructuring or sale of all or part of our business

11. Virtual currency and blockchain data

Where we provide virtual currency or digital-asset settlement services, transaction information such as wallet addresses and transaction identifiers may be recorded on a public blockchain and is not private in the same way as traditional banking information. For virtual currency transfers meeting the applicable threshold, FINTRAC's Travel Rule requires us to obtain and, where we are the ordering institution, transmit prescribed originator and beneficiary information to the receiving virtual asset service provider or financial institution, and to retain records of that information.

12. Cross-border data transfers

We are based in Canada and aim to process personal data within Canada wherever reasonably practicable. Some of our service providers (including cloud, technology, screening and blockchain-analytics providers) may process or store personal data outside Canada, including in the United States. Where personal data is transferred outside Canada, it may be accessed by courts, law-enforcement or regulatory authorities of that jurisdiction in accordance with its laws. We take reasonable contractual and organisational steps to require an equivalent level of protection from providers who process personal data on our behalf.

13. Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including to provide our services, maintain business records, and meet legal and regulatory requirements. The PCMLTFA and its regulations generally require identification, transaction and record-keeping information to be retained for a minimum of five years from the date the relevant record is created or the business relationship ends. Longer retention periods may apply where required by other law, to resolve a dispute, or to establish or defend a legal claim. When no longer required, personal data is securely deleted, anonymised or destroyed.

14. Security

We use administrative, technical and physical safeguards designed to protect personal data against unauthorised access, disclosure, loss, misuse or alteration, including access controls, authentication, encryption where appropriate, monitoring, staff training and supplier due diligence. No system can be guaranteed completely secure, and we encourage business customers to maintain strong internal controls over their own users and credentials.

15. Your rights

Subject to applicable exceptions, you may have the right to: request access to personal data we hold about you; ask us to correct inaccurate or incomplete information; withdraw consent to processing that relies on consent (which may limit our ability to provide certain services); and ask questions about how your personal data has been collected, used or disclosed. These rights are not absolute — we may need to retain or continue processing information to meet legal, regulatory, financial-crime or record-keeping obligations, or where doing otherwise would reveal information about another individual.

16. How to exercise your rights

Requests can be sent to our Privacy Officer using the contact details in Section 20. We may need to verify your identity, and your relationship to the relevant business customer, before responding. We will respond within the timeframe required by applicable privacy law.

17. Complaints

If you have concerns about how we have handled your personal data, please contact us first so we can investigate. You also have the right to complain to the Office of the Privacy Commissioner of Canada and, in respect of matters governed by Alberta's Personal Information Protection Act, to the Office of the Information and Privacy Commissioner of Alberta. You can also use our Complaints Policy.

18. Cookies and online tracking

BURQ FX uses cookies and similar technologies on our website to operate core site functionality, keep the website secure, remember preferences, and understand how the website is used so we can improve it. Some cookies are essential and cannot be switched off. Others, such as analytics cookies, are used only where you have given the required consent, or as otherwise permitted by applicable law. You can manage or withdraw cookie preferences through your browser settings.

19. Changes to this Policy

We may update this Policy from time to time to reflect changes in our services, service providers, technology, or applicable law. The current version will be made available on our website, and we will take reasonable steps to notify business customers of material changes.

20. Contact us

BURQ FX LTD — Privacy Officer
315-7 Westwinds Crescent NE, Calgary, Alberta, Canada, T3J 5H2
Email: compliance@burqfx.com

Appendix — Categories of Recipients

• Banking, custody, settlement and liquidity infrastructure providers
• Identity-verification, screening and blockchain-analytics providers
• Other financial institutions, MSBs and virtual asset service providers involved in a transaction
• FINTRAC, law enforcement, courts, tribunals and other regulators or government authorities
• Professional advisers and auditors
• Technology, cloud and cybersecurity providers
• A prospective purchaser or counterparty in a corporate transaction, where lawful

Appendix — Key Definitions