Privacy Policy

Version 1.0 · effective 5 August 2026 · Trivio Technologies Inc.

1. Who We Are | Qui nous sommes

Trivio Technologies Inc. ("Trivio", "we") is a Quebec-incorporated fintech company operating a charitable giving platform at trivio.tech, connecting Canadian donors with CRA-registered charities. Registered with FINTRAC as an MSB (N300000695). / Entreprise de technologie financière constituée au Québec, exploitant une plateforme de dons à trivio.tech; inscrite au CANAFE (N300000695).

Privacy Officer: Fahim Haque — CEO & Privacy Officer · fahim.haque@trivio.tech · 4565 rue Dutrisac, Laval, Québec, H7W 5M5, Canada.

2. Scope | Portée

Applies to all personal information collected/used/disclosed/stored by Trivio for: donor accounts + donation transactions; charity-partner onboarding; website visitor interactions; communications (email/phone/other); FINTRAC identity verification + AML/KYC. Applies to all Quebec residents and all individuals whose PI Trivio processes (Loi 25 territorial scope).

3. Personal Information We Collect | Renseignements collectés

3.1 Donor PI:

Identity: full legal name, date of birth, email, postal code, province — for account creation, KYC, CRA receipt.
Financial: payment-card details (processed by Stripe, not stored by Trivio), donation amounts, tip amounts, transaction history.
Compliance: PEP self-declaration, government-issued ID (transactions $10K+), source of funds (EDD) — FINTRAC/PCMLTFA.
Account: username, password hash, preferences, giving history, impact data.
Technical: IP address, browser type, device identifiers, session logs — security/fraud/performance.
Communications: email correspondence, support requests, preferences.
Payment-card notice: Trivio never stores card number/CVV/expiry — all via Stripe Payments Canada (FINTRAC MSB M22204455), PCI-DSS L1; Trivio receives only a transaction token.

3.2 Charity-Partner info: org legal name + CRA BN; authorized-rep identity; Stripe Connect account info; signed Receipting Agency Agreement; banking info (via Stripe, not stored); sanctions-screening records.

3.3 We do NOT collect: SIN; health/medical; biometric; racial/ethnic origin, religion, sexual orientation, or other sensitive categories; children's PI (not intended for under-18); full card numbers.

4. How We Use It | Utilisation

Only for the purposes collected (or compatible). Purpose → legal basis: processing donations + routing funds (contract/PCMLTFA); issuing CRA receipts (legal obligation CRA/PCMLTFA); AML/KYC + identity verification (PCMLTFA — name, DOB, address, PEP, gov ID + source of funds for EDD); FINTRAC reporting STR/LCTR/TPR (legal); sanctions screening OSFI/UN (legal); donor transparency dashboard (consent/contract); security + fraud (legitimate interest); transactional email (contract); marketing email (consent, CASL); analytics aggregated (legitimate interest); compliance record-keeping 5–7 yr (legal).

We never sell PI; use PI for advertising/targeted marketing without explicit consent; or make automated decisions with legal effects.

5. Consent | Consentement

5.1 Express consent at account creation (Privacy Policy + ToS); separate opt-in for marketing; implied consent for transactional data; legal-obligation collection (KYC/AML) regardless of consent (PCMLTFA).

5.2 Withdrawing: contact privacy@trivio.ca; withdrawal does not affect PCMLTFA-retained AML/KYC records (5 yr), CRA receipts (7 yr), or data processed before withdrawal. Withdrawing from core functions may deactivate the account.

6. Disclosure and Third Parties | Divulgation et tiers

6.1 Service providers (no data sold): Stripe Payments Canada (payment processing — name/email/card/amounts, Canada/Toronto); MongoDB Atlas (primary DB, all data encrypted at rest — Canada or US, PIA required if outside Quebec — region being confirmed by CTO); FINTRAC (mandatory STR/LCTR/TPR); CRA (charity-BN verification only, no donor PI); OSFI (sanctions name-matching only); email service provider TBD (transactional — name/email/donation ref, Canada preferred, PIA if outside QC).

6.2 Mandatory disclosure to FINTRAC / RCMP-law-enforcement / CAI / courts, no more than legally required; PCMLTFA tipping-off prohibits notifying you of an STR.

6.3 Cross-border transfers: Loi 25 requires a PIA before PI leaves Quebec. MongoDB Atlas region being confirmed; if any PI is outside Quebec, a formal PIA is completed + published before MVP launch.

7. Your Privacy Rights | Vos droits

Under Loi 25 + PIPEDA — exercise via info@trivio.tech (30-day timeline unless noted): right to be informed; access; rectification; erasure (subject to legal retention); de-identification; data portability (structured CSV/JSON, effective 2024-09-22 under Loi 25); withdraw consent (immediate prospective, see §5.2); lodge a complaint (CAI cai.gouv.qc.ca | OPC priv.gc.ca).

Limitation: erasure/de-identification cannot override mandatory retention — PCMLTFA (5 yr AML/KYC) + CRA (7 yr receipts).

8. Data Security | Sécurité

8.1 Loi 25 privacy-by-design: encryption at rest (AES-256, MongoDB Atlas); in transit (TLS 1.3); SHA-256 tamper-evidence hashing of transaction records; strict access controls; Stripe PCI-DSS L1 for cards; privacy by default; minimal collection.

8.2 Breach notification: if a confidentiality incident risks serious injury — notify the CAI within 72 hours; notify affected individuals without undue delay; maintain a breach log (all incidents); root-cause + remediation. Privacy Officer (Fahim Haque, privacy@trivio.ca) leads detection/assessment/notification; CTO (Roberto Calvi) leads technical investigation/remediation.

9. Data Retention and Destruction | Conservation

Retention → basis: donor identity/KYC 5 yr from end of relationship (PCMLTFA); transaction records 5 yr (PCMLTFA); CRA receipts 7 yr (CRA); AML/KYC EDD 5 yr; STR/LCTR/TPR 5 yr from filing; sanctions logs 5 yr; breach log 5 yr (Loi 25); active-donor account data relationship + 5 yr; marketing consent 3 yr (CASL); website analytics (anonymized) 24 months rolling (TTL); impact-dashboard data relationship + 5 yr. At end of period: secure deletion or anonymization; CTO enforces via MongoDB TTL indexes + archival workflows.

10. Cookies and Technical Data | Témoins

Strictly necessary (session/security/auth — no consent needed); functional (preferences/language/saved settings — opt-in); analytics (aggregated/anonymized — opt-in). Managed via browser settings or Trivio's cookie-consent banner (first visit); withdrawing non-essential cookies doesn't affect core donation functionality.

11. Automated Processing | Traitement automatisé

Loi 25 disclosure: the transaction-monitoring system flags transactions above thresholds (e.g., $10K) for human CCO review — it flags, it does not decide; sanctions screening auto-checks names, potential matches reviewed by the CCO before action; no automated decisions with legal/significant effects without human review.

12. Minors | Mineurs

Platform not intended for under-18; Trivio does not knowingly collect minors' PI; if discovered, deleted promptly. Report a minor's account: privacy@trivio.ca.

13. Email Communications (CASL) | Courriels (LCAP)

Transactional/relationship messages (confirmations, receipts, account notices) — no separate consent; commercial electronic messages (promotions/features/campaigns) — express opt-in + unsubscribe in every message. Unsubscribe via any marketing email or info@trivio.tech, processed within 10 business days.

14. Changes to This Policy | Modifications

Material changes: email registered donors ≥ 30 days before; post the updated policy on trivio.ca with the effective date; maintain version history. Continued use after the effective date = acceptance (to the extent permitted by law).

15. Contact Us and File a Complaint | Nous contacter

15.1 Privacy Officer: Fahim Haque — Co-Founder, CEO & Privacy Officer · info@trivio.tech · 4565 rue Dutrisac, Laval, Québec, H7W 5M5 · response within 30 days.

15.2 Regulators: CAI (Quebec) cai.gouv.qc.ca · 1 888 528-7741 · Quebec residents; OPC (Federal) priv.gc.ca · 1 800 282-1376 · federal matters.

16. Version History

v1.0 · Effective 2026-08-05 — initial publication (Loi 25, PIPEDA, PCMLTFA compliant). Owner: Fahim Haque, Privacy Officer. Next review June 2027. Classification: PUBLIC.