Privacy

Who we are

Wibeex operates a spot cryptocurrency exchange. For Canadian users, we handle personal information to open accounts, verify identity, process trades, deposits and withdrawals, meet anti-money laundering duties, and provide support.

Questions about this policy go to our Privacy Officer at privacy@wibeex.com, or through support with the topic “Privacy request”.

Laws that apply

Depending on where you live and how we deal with you, the following may apply:

• The federal Personal Information Protection and Electronic Documents Act (PIPEDA), which governs personal information collected, used, or disclosed in the course of commercial activity in Canada.
• Provincial private-sector laws that are substantially similar to PIPEDA, including Alberta’s and British Columbia’s Personal Information Protection Act, and Quebec’s Act respecting the protection of personal information in the private sector (including Law 25 updates).
• The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and FINTRAC rules for dealing in virtual currency, including identity verification, record keeping, and reporting.
• Canada’s Anti-Spam Legislation (CASL) for commercial electronic messages.

Where a provincial law gives you stronger rights, we honour those rights for residents of that province.

Personal information we collect

We collect only what we need for the purposes below. That typically includes:

• Account details: name, email, password hash, two-factor authentication status, and device or session identifiers.
• Identity information required by Canadian AML rules: legal name, date of birth, residential address, occupation, government-issued ID, and liveness or selfie checks.
• Financial and source-of-funds information when risk, thresholds, or law require it.
• Exchange activity: orders, fills, balances, deposit and withdrawal addresses, network transaction IDs, and related timestamps.
• Support records: tickets, attachments you send, and email or chat threads.
• Technical logs: IP address, browser type, approximate location derived from IP, cookie identifiers, and security events.

We do not collect Social Insurance Numbers unless a legal obligation specifically requires it.

Consent

Under PIPEDA we identify purposes and obtain meaningful consent where required. Opening an account, completing KYC, and using the exchange is your consent to the collection, use, and disclosure described here that is necessary to provide the service and to comply with Canadian law.

You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. If you withdraw consent for identity verification or transaction monitoring, we may have to freeze or close the account because we cannot operate a Canadian crypto desk without those measures. Optional items (for example, marketing emails) can be turned off without affecting trading, as long as CASL unsubscribe rules are followed.

How we use it

We use personal information to:

• Create and administer your account, authenticate you, and operate the matching engine and wallets.
• Verify identity, assess risk, detect fraud and account takeover, and meet FINTRAC and other legal duties.
• Process deposits, withdrawals, and support requests.
• Keep records, improve reliability and security, and communicate about the service.
• Send service messages (security alerts, order and transfer status). Marketing mail is sent only with CASL-compliant consent, and every marketing message includes an unsubscribe.

We do not sell personal information. We do not use it for a new purpose without consent, unless the law allows or requires it.

FINTRAC and reporting

Dealers in virtual currency in Canada must identify clients, keep prescribed records, and file reports with FINTRAC. That includes large virtual-currency transaction reports, suspicious transaction reports, and other reports the PCMLTFA requires. We may also share information with law enforcement, securities regulators, or other authorities when Canadian law requires or permits it. We cannot always tell you when a report has been filed.

Sharing and service providers

We share personal information only as needed with:

• Identity-verification, sanctions-screening, and blockchain-analytics vendors.
• Cloud, hosting, email, and security providers under contract.
• Professional advisers (legal, audit, compliance) bound to confidentiality.
• Regulators, FINTRAC, courts, or law enforcement when required or permitted by law.

Crypto transfers you initiate are broadcast on a public network. Wallet addresses and transaction IDs are visible on the relevant blockchain and are outside our control once sent.

We remain accountable under PIPEDA for personal information transferred to a service provider. Providers must protect it with safeguards comparable to those we would use ourselves.

Transfers outside Canada

Some vendors store or access personal information in other countries, including the United States. While it is in another jurisdiction, it may be subject to the laws of that country, including lawful access by foreign authorities. If you are in Quebec, we take reasonable steps required by Quebec law before communicating personal information outside Quebec, including assessing privacy risks and using contractual protections.

Cookies

We use cookies and similar tools that are needed to keep you signed in, protect the session, and remember basic preferences. We do not use them to sell advertising profiles. You can block cookies in your browser; some features of the exchange may then stop working.

Retention

We keep personal information only as long as necessary for the purposes above, then securely destroy or anonymize it. FINTRAC record-keeping rules generally require us to retain certain identification, account, and transaction records for at least five years. Support tickets are kept while they remain relevant to your account and any legal hold. Closing an account does not always allow immediate deletion of AML or ledger records.

Safeguards

We use safeguards appropriate to the sensitivity of the information: encryption in transit, hashed credentials, two-factor authentication, withdrawal allowlists, access limits, and segmented wallet infrastructure. No exchange can promise zero risk. Enable 2FA and treat API keys as cash.

If a breach in Canada creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as PIPEDA requires. Quebec residents may also receive notice under Quebec law, including to the Commission d’accès à l’information du Québec where that law applies.

Your rights

Subject to limited exceptions in PIPEDA and provincial law, you may:

• Ask whether we hold personal information about you, and request access to it.
• Request a correction if it is inaccurate or incomplete.
• Withdraw consent for optional uses, such as marketing.
• Challenge our compliance with this policy.

Access may be refused or limited where the law allows — for example, if it would reveal another person’s information, privileged advice, or information related to a FINTRAC report or an investigation. We will tell you the reason if we cannot provide access, unless the law prohibits that explanation.

Quebec residents may have additional rights, including to request cessation of dissemination or de-indexation in the cases Quebec law sets out, and data portability in a structured, commonly used technological format when that right is in force and technically feasible. Identity and AML records we must keep cannot always be erased.

To exercise these rights, use support with topic “Privacy request”, or email privacy@wibeex.com. We may need to verify your identity before responding. We aim to reply within the time limits set by the applicable Canadian law (generally 30 days under PIPEDA, unless we notify you of an extension).

Complaints

Start with our Privacy Officer. If you are not satisfied, you may complain to:

• The Office of the Privacy Commissioner of Canada (priv.gc.ca), for PIPEDA matters.
• The Commission d’accès à l’information du Québec, if you are in Quebec.
• The Office of the Information and Privacy Commissioner of Alberta or of British Columbia, if their provincial private-sector law applies to you.

Changes

If we change this policy in a material way, we will post the updated version on this page. Continued use of the exchange after a material change, where the law allows, means you accept the revised policy. For new purposes that require consent, we will ask again.