Bidali Privacy Policy

Last updated on January 26th, 2021

Bidali Inc., a Canadian privately controlled corporation, its affiliates, and subsidiaries ("Bidali", "we", "us" and "our") provide products and services that enable individuals and businesses (individually a "Customer", "you", "your" and collectively "Customers") to purchase gift cards, vouchers and other prepaid products, earn rewards or receive exclusive offers ("Products"), and to share these Products with other Customers as well as enable business Customers to offer such Products and distribute these Products to other Bidali Customers, their customers and employees (collectively such services will be known as, the "Services").

Bidali respects and protects the privacy of visitors to our Sites and Customers who use our Services and, as such, we have developed this privacy policy (the "Privacy Policy").

Please take a moment to read this Privacy Policy carefully. If you have any questions about this Privacy Policy, please contact us at legal@bidali.com.

1. Scope

Bidali has developed this Privacy Policy to describe the ways Bidali collects, stores, uses and protect Personal Information. The purpose of this Privacy Policy is to ensure that Bidali complies with applicable Canadian federal and provincial regulations such as Canada’s Anti-Spam Law ("CASL") and the Personal Information Protection and Electronic Documents Act ("PIPEDA"), applicable United States (US) federal and state regulations, and European Union (hereinafter, "EU") data protection laws such as the General Data Protection Regulation ("GDPR").

To ensure transparency, this Privacy Policy describes our information handling practices when you create a user account ("Bidali Account") or access content we own or operate in any of our products and services (collectively the "Services"):

  • Our website(s) located at bidali.com, any subdomains of bidali.com, and any other associated websites (individually a "Site" and collectively the "Sites");
  • Our mobile applications (individually a "Mobile App" and collectively the "Mobile Apps")
  • Our software, including routines, data structures, object classes, protocols, programs, templates, libraries and interfaces, application programming interfaces ("APIs"), software development kits ("SDKs"), e-commerce plugins ("Plugins"), developer tools, technical documentation, and other related materials provided to you.
  • Our "Money Services" and "Additional Services" as described in the Bidali User Agreement & Terms of Use.

There are four types of data subjects whose personal data we may process:

  • Visitors to our Sites;
  • Customers that use our Services;
  • Partners of Bidali as defined in the Bidali Partner Program;
  • Employees, contractors and affiliates of Bidali

2. Agreement

By accessing and using our Services, you agree to the terms of this Privacy Policy as well as the Bidali User Agreement & Terms of Use. Where we require your consent to process your Personal Information, we will ask for your consent to the collection, use, and disclosure of your Personal Information as described further below. Bidali may provide additional "just-in-time" disclosures or additional information about the data collection, use and sharing practices of specific Services. These notices may supplement or clarify Bidali’s privacy practices or may provide you with additional choices about how Bidali processes your Personal Information.

If you do not agree with or you are not comfortable with any aspect of this Privacy Policy, you should immediately discontinue access or use of our Services.

3. Personal Information We Collect

Personally Identifiable Information or Personal Data ("Personal Information") is any information that can be used to identify you directly or indirectly, or to contact you. Our Privacy Policy covers all Personal Information that you voluntarily submit to us and that we obtain from our partners. This Privacy Policy does not apply to anonymized data, as it cannot be used to identify you.

You may be asked to provide Personal Information anytime you are in contact with Bidali. Bidali may use your information to provide and improve our products, services, and content as described in this Privacy Policy.

Except as described in this Privacy Policy, Bidali will not give, sell, rent or loan any Personal Information to any third party.

We collect Personal Information to provide you with our Services. When we require certain Personal Information from users it is because we are required by law to collect this information or it is relevant for specified purposes. Any information you provide to us that is not required is voluntary. You are free to choose whether to provide us with the types of Personal Information requested, but we may not be able to serve you as effectively or offer you all of our Services when you do choose not to share certain information with us.

For example, we collect Personal Information which is required under the law to open a Bidali Account, add a payment method, sell products and/or services, or execute a transaction. Please refer to our AML Policy for more information.

We also collect Personal Information when you use or request information about our Services, subscribe to marketing communications, request support, complete surveys, contact members of our team, or sign up for a Bidali event. We may also collect Personal Information from you offline, such as when you attend one of our events, or when you contact customer support. We may use this information in combination with other information we collect about you as set forth in this Policy.

The Personal Information we collect depends on how you interact with our Services. In order to protect your privacy and reduce our liability wherever possible we aim to capture and retain as little personally identifiable information as possible, but broadly, we may collect the following types of information:

  • Personal Information: Full name, email address, phone number, home address, date of birth, gender, government identification number and/or signature.
  • Formal Identification Information: Utility bills, financial statements, passport details, driver’s license details, national identity card details, photograph identification cards, and/or visa information.
  • Financial Information: Bank account, debit card and/or credit card information, public blockchain addresses, and/or transaction history.
  • Transaction Information: Information about the transactions you make on our Services, such as the types of Products, amounts, information about the counter-parties, Financial Information used to process and verify the transaction, and/or timestamp.
  • Employment & Career Information: You may provide Personal Information such as, office location, job title, description of role, career history and/or educational background when applying for a specific job on our Sites, or having your identity formally verified in accordance with our AML Policy.
  • Online Identifiers: Geo location/tracking details, device identifiers, browser fingerprint, OS, browser name and version, and/or IP addresses used to access our Services.
  • Usage Data: Survey responses, information provided to our support team, public social networking posts, authentication data, security questions, user ID, click-stream data and other data collected via cookies and similar technologies. Please read our Cookie Policy for more information.

Bidali does not process any sensitive Personal Information, such as religion, race, sexual preference, ethnicity, medical information, and/or political views.

4. How Your Personal Information is Used

Our primary purpose in collecting Personal Information is to provide you with a secure, smooth, efficient, and customized experience. In general, we use Personal Information to create, develop, operate, deliver, and improve our Services, content and advertising, and for loss prevention and crime prevention purposes.

We will not use your Personal Information for purposes other than those purposes we have disclosed to you below, without your permission. From time to time we may request your permission to allow us to share your Personal Information with third parties. You may opt out of having your Personal Information shared with third parties, or allowing us to use your Personal Information for any purpose that is incompatible with the purposes for which we originally collected it or subsequently obtained your authorization. If you choose to so limit the use of your Personal Information, certain features or the Bidali Services may not be available to you.

We may use your Personal Information in the following ways:

Some of our core Services are subject to laws and regulations requiring us to collect and use your personal identification information, formal identification information, financial information, transaction information, employment information, online identifiers, and/or usage data in certain ways. For example, Bidali must identify and verify customers using our Services in order to comply with anti-money laundering and terrorist financing laws across jurisdictions. In addition, we use third parties to verify your identity by comparing the Personal Information you provided against third-party databases and public records. When you seek permissions to make purchases with Bidali's Services, we may require you to provide additional information which we may use in collaboration with service providers acting on our behalf to verify your identity or address, and/or to manage risk as required under applicable law. The consequences of not processing your Personal Information for such purposes is the termination of your Bidali Account as we cannot perform the Services in accordance with legal and regulatory requirements.

EEA Residents: For individuals who reside in the European Economic Area (including the United Kingdom) or Switzerland (collectively "EEA Residents"), pursuant to Article 6 of the EU General Data Protection Regulation (GDPR) or any equivalent legislation (collectively "EEA Data Protection Law"), we process this Personal Information to comply with our legal obligations.

4.2 To enforce our terms in our user agreement and other agreements

Bidali handles very sensitive information, such as your identification and financial data, so it is very important for us and our Customers that we are actively monitoring, investigating, preventing and mitigating any potentially prohibited or illegal activities, enforcing our agreements with third parties, and/or violations of our posted user agreement or agreement for other Services. In addition, we may need to collect fees based on your use of our Services. We collect information about your Bidali Account usage and closely monitor your interactions with our Services. We may use any of your Personal Information collected on our Services for these purposes. The consequences of not processing your Personal Information for such purposes is the termination of your Bidali Account as we cannot perform our Services in accordance with our terms.

EEA Residents: Pursuant to EEA Data Protection Law, we process this Personal Information based on our contract with you.

4.3 To provide Bidali’s Services

We process your Personal Information in order to provide the Services to you. For example, when you want to make purchases or for Bidali to sell your goods and services, we may require certain information such as your identification, contact information, and payment information. We cannot provide you with Services without such information.

EEA Residents: Pursuant to EEA Data Protection Law, we process this Personal Information based on our contract with you.

4.4 To provide Service communications

We send administrative or account-related information to you to keep you updated about our Services, inform you of relevant security issues or updates, or provide other transaction-related information. Without such communications, you may not be aware of important developments relating to your Bidali Account that may affect how you can use our Services.

EEA Residents: Pursuant to EEA Data Protection Law, we process this Personal Information based on our contract with you.

4.5 To provide customer service

We process your Personal Information when you contact us to resolve any questions, disputes, collect fees, or to troubleshoot problems. We may process your information in response to another customer’s request, as relevant. Without processing your Personal Information for such purposes, we cannot respond to your requests and ensure your uninterrupted use of the Services.

EEA Residents: Pursuant to EEA Data Protection Law, we process this Personal Information based on our contract with you.

4.6 To ensure quality control

We process your Personal Information for quality control and staff training to make sure we continue to provide you with accurate information. If we do not process Personal Information for quality control purposes, you may experience issues on the Services such as inaccurate transaction records or other interruptions. Our basis for such processing is based on the necessity of performing our contractual obligations with you.

EEA Residents: Pursuant to EEA Data Protection Law, we process this Personal Information based on our contract with you.

4.7 To ensure network and information security

We process your Personal Information in order to enhance security, monitor and verify identity or service access, combat spam or other malware or security risks, and to comply with applicable security laws and regulations. The threat landscape on the Internet is constantly evolving, which makes it more important than ever that we have accurate and up-to-date information about your use of our Services. Without processing your Personal Information, we may not be able to ensure the security of our Services.

EEA Residents: Pursuant to EEA Data Protection Law, we process this Personal Information to satisfy our legal obligations.

4.8 For research and development purposes

We process your Personal Information to better understand the way you use and interact with Bidali's Services. In addition, we use such information to customize, measure, and improve Bidali's Services and the content and layout of our website and applications, and to develop new services. Without such processing, we cannot ensure your continued enjoyment of our Services. Our basis for such processing is based on legitimate interest.

EEA Residents: Pursuant to EEA Data Protection Law, we process this Personal Information to satisfy our legitimate interests as described above.

4.9 To enhance your usage experience

We process your Personal Information to provide a personalized experience, and implement the preferences you request. For example, you may choose to provide us with access to certain Personal Information stored by third parties. Without such processing, we may not be able to ensure your continued enjoyment of part or all of our Services.

EEA Residents: Pursuant to EEA Data Protection Law, we process this Personal Information to satisfy our legitimate interests as described above.

4.10 To facilitate corporate acquisitions, mergers, or transactions

We may process any information regarding your Bidali Account and use of our Services as is necessary in the context of corporate acquisitions, mergers, or other corporate transactions. You have the option of closing your Bidali Account if you do not wish to have your Personal Information processed for such purposes.

EEA Residents: Pursuant to EEA Data Protection Law, we process this Personal Information to satisfy our legitimate interests as described above.

4.11 To engage in marketing activities

Based on your communication preferences, we may send you marketing communications to inform you about our events or our partner events; to deliver targeted marketing; and to provide you with promotional offers based on your communication preferences. We use information about your usage of our Services and your contact information to provide marketing communications. You can opt-out of our marketing communications at any time.

EEA Residents: Pursuant to EEA Data Protection Law, we process this Personal Information to satisfy our legitimate interests based on your consent.

5. How We Protect and Store Your Personal Information

We understand how important your privacy is, which is why Bidali maintains (and requires its service providers to maintain) appropriate physical, technical and administrative safeguards to protect the security and confidentiality of the Personal Information you entrust to us.

We may store and process all or part of your personal and transactional information, including certain payment information, such as your encrypted bank account and/or routing numbers, public blockchain addresses, and debit and credit card information, in Canada and elsewhere in the world where our facilities or our service providers are located. We protect your Personal Information by maintaining physical, electronic, and procedural safeguards in compliance with the applicable laws and regulations.

You can learn more about how we keep your information secure by reviewing our Security Policy.

However, we cannot guarantee that loss, misuse, unauthorized acquisition, or alteration of your data will not occur. Please recognize that you play a vital role in protecting your own Personal Information. When registering with our Services, it is important to choose a password of sufficient length and complexity, do not reveal this password to any third-parties, and to immediately notify us if you become aware of any unauthorized access to or use of your Bidali Account.

Furthermore, while we use secure connections for all our Services, we cannot ensure or warrant the security or confidentiality of information you transmit to us or receive from us by Internet or wireless connection, including email, phone, or SMS, since we have no way of protecting that information over unencrypted channels once it leaves your posession and until it reaches us. If you have reason to believe that your data is no longer secure, please contact us at the email address, mailing address or telephone number listed at the end of this Privacy Policy.

6. Retention of Personal Information

We store your Personal Information securely throughout the life of your Bidali Account. We will only retain your Personal Information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting obligations or to resolve disputes.

As a registered Money Services Business ("MSB") with FINTRAC, in order to comply with applicable legislation Bidali is required to retain Personal Information that has been obtained as a part of our AML Policy for a period of 5 years, regardless of whether an Bidali Account has been closed or become inactive.

7. Information Collected Automatically

We receive and store certain types of information automatically, such as whenever you interact with the Sites or use the Services. This information does not necessarily reveal your identity directly but may include information about the specific device you are using, such as the hardware model, device ID, operating system version, web-browser software, and your Internet Protocol (IP) address/MAC address/device identifier.

For example, we automatically receive and record information on our server logs from your web-browser, including how you came to and used the Services; your IP address; device type and unique device identification numbers, device event information (such as crashes, system activity and hardware settings, browser type, browser language, the date and time of your request and referral URL), broad geographic location (e.g. country or city-level location) and other technical data collected through cookies, pixel tags and other similar technologies that uniquely identify your browser. We may also collect information about how your device has interacted with our website, including pages accessed and links clicked. In general, this data is anonymous and not associated with your Personal Information.

However, we may use identifiers to recognize you when you arrive at the Site via an external link, such as a link appearing on a third party site, to prevent criminal activity, comply with applicable law, to credit affiliate rewards, or for debugging purposes.

Please refer to the Bidali Cookie Policy for more information about our use of cookies.

8. Accessing Personal Information from Third Parties

From time to time, we may obtain information about you from third party sources as required or permitted by applicable law, such as public databases, credit bureaus, ID verification partners, resellers and channel partners, joint marketing partners, and social media platforms.

8.1 Public Databases, Credit Bureaus and ID Verification Partners

We obtain information about you from public databases and ID verification partners for purposes of verifying your identity. ID verification partners use a combination of government records and publicly available information about you to verify your identity. Such information includes your name, address, job role, public employment profile, credit history, status on any sanctions lists maintained by public authorities, and other relevant data. We obtain such information to comply with our legal obligations, such as anti-money laundering and counter-terrorism laws.

EEA Residents: Pursuant to EEA Data Protection Law, our lawful basis for processing such data is compliance with legal obligations. In some cases, we may process additional data about you to ensure our Services are not used fraudulently or for other illicit activities. In such instances, processing is necessary for us to continue to perform our contract with you and others.

9. Sharing Personal Information with Third Parties

Bidali does not sell, trade, rent, or license your Personal Information to third parties.

9.1 How Your Personal Information is Shared with Third Parties

We take care to only share your Personal Information with those who really need to in order to perform their tasks and duties, and to share with third parties who have a legitimate purpose for accessing it. We will only share your information in the following circumstances:

  • When required by law, we share your information with third party identity verification services in order to prevent fraud and comply with our our legal obligations. This allows Bidali to confirm your identity by comparing the information you provide us to public records and other third party databases. These service providers may create derivative data based on your Personal Information that can be used solely in connection with provision of identity verification and fraud prevention services.
  • We may share your information with service providers under contract who help with parts of our business operations such as bill collection, marketing, and technology services. However, we strictly limit access to non-anonymized data. Furthermore, our contracts require these service providers to only use your information in connection with the services they perform for us, and prohibit them from selling your information to anyone else and retaining your information after our contacts have expired or been terminated.
  • We may share your information with financial institutions with which we partner in order to process payments you have authorized.
  • We may share your information with companies or other entities that we plan to merge with or be acquired by. Should such a combination occur, we will request that the new combined entity follow this Privacy Policy with respect to your Personal Information. You will receive prior notice of any change in applicable policies.
  • We may share your information with law enforcement, officials, or other third parties when we are compelled to do so by a subpoena, court order, or similar legal procedure, or when we believe in good faith that the disclosure of Personal Information is necessary to prevent physical harm or financial loss, to report suspected illegal activity or to investigate violations of our User Agreement or any other applicable policies.
  • We may share information with other Customers you are purchasing goods or services from via Bidali in order to help complete your transaction with the other party.

If you establish a Bidali Account indirectly on a third party website or via a third party application as a result of interacting with our Services, namely our APIs or SDKs, any information that you enter on that website or application (and not directly on a Bidali website) will be shared with the owner of the third party website or application and your information will be subject to their privacy policies.

9.2 How Your Personal Information is Shared During Transactions

If you use your Bidali Account to purchase or redeem Products, we may also provide the seller and our third-party financial service providers with your shipping address, name, and/or email to help complete your transaction with the seller. The seller and the third-party financial service providers are not allowed to use this information to market their services to you outside of the Bidali Services unless you have agreed to it. If an attempt to purchase a Product is later invalidated, we may also provide the seller and our third-party financial service providers with details of the unsuccessful transaction. To facilitate dispute resolutions, when applicable, we may provide a Customer with the seller's direct support information and address so that Products can be returned to the seller.

In connection with a transaction between you and a third party, including other Customers, a third party may share information about you with us, such as your email address, mobile phone number or unique Bidali identifier which may be used to inform you that a transaction has been attempted or completed with the third party. We may use this information in connection with such transactions to confirm that you are a Bidali Customer, that a transaction has occurred, and/or to notify you of the status of a transaction. If you request that we validate your status as a Bidali Customer with a third party, we will do so. You may also choose to transact by simply providing an email address, a phone number, unique Bidali identifier or social media handle. In such cases, your name, email, unique Bidali identifier, phone number and/or social media handle may be displayed in a message notifying the intended message recipient(s) of the designated email address, phone number, unique Bidali identifier, and/or social media handle of your action.

Please note that third parties you interact with may have their own privacy policies, and Bidali is not responsible for their operations, including, but not limited to, their information practices. Information collected by third parties, which may include such things as contact details or location data, is governed by their privacy practices. We encourage you to learn about the privacy practices of those third parties.

If you authorize one or more third party applications to access your Bidali Account, then information you have provided to Bidali may be shared with those third parties. Unless you provide further authorization, these third parties are not allowed to use this information for any purpose other than to facilitate your transactions using Bidali Services.

10. Accessing or Managing Your Personal Information

You are entitled to review, correct, or amend your Personal Information, or to delete that information where it is inaccurate. You may do this at any time by logging in to your Bidali Account and navigating to the "Profile" or "My Account" section.

If you close your Bidali Account, we will mark your Bidali Account in our database as "Inactive", but will keep your Bidali Account information in our database for a period of time as described above. This is necessary in order to deter fraud and comply with applicable law, by ensuring that persons who try to commit fraud will not be able to avoid detection simply by closing their Bidali Account and opening a new Bidali Account. However, if you close your Bidali Account, your Personal Information will not be used by us for any further purposes, nor sold or shared with third parties, except as necessary to prevent fraud and assist law enforcement, as required by law, or in accordance with this Privacy Policy.

11. Rights in Relation to the Use of Your Personal Information

11.1 Rights of Access, Correction and Deletion

You have a right to access the Personal Information that we hold about you under EU data protection legislation, and to some related information. You can also require any inaccurate Personal Information to be corrected or deleted.

11.2 Right to Object

You can object to our use of your Personal Information for direct marketing purposes at any time and you may have the right to object to our processing of some or all of your Personal Information (and require them to be deleted) in some other circumstances.

If you wish to exercise any of these rights, please contact us as set out below.

If you are located in, or a resident of, Singapore, you specifically and voluntarily consent to the transfer of your Personal Information to our related entity and service providers in Canada, for the specific purposes of performing identity verification or checking, to enable us to prevent fraud and comply with our legal obligations.

Canada may not have protections in place for personal data as extensive as those within Singapore. However, we require our service providers, including Bidali, to treat your Personal Information in strict confidence and use appropriate security measures to protect it. We also require them to uphold all of our other obligations under this Privacy Policy.

You may revoke your consent to this section at any time by emailing legal@bidali.com.

11.4 Notice to California Residents

To the extent any California data privacy law applies, we will provide California residents with certain information upon request ("Data Subject Request"). This Privacy Policy outlines how California residents can receive the information and what you can receive.

11.4.1 Data Subject Requests

If you would like to submit a Data Subject Request at any time by emailing legal@bidali.com.

If you choose to submit a Data Subject Request, you must provide us with enough Information to identify you and enough specificity on the requested data. We will only use the Information we receive for verification. We will not be able to disclose Information if it cannot verify that the person making the Data Subject Request is the person about whom we collected Information, or someone authorized to act on such person’s behalf.

If you are a California resident, you may submit a Data Subject Request to receive information about our data collection practices as it relates to your data. By submitting this request, you are declaring that you are a California resident availing yourself of the rights afforded to you under the California Consumer Privacy Act (CCPA).

You may request information on the categories of Personal Information (as defined by California law) we have collected about you; the categories of data collection sources; any business or commercial purpose for collecting or selling Personal Information; the categories of third parties with whom we share Personal Information, if any; and the specific pieces of Personal Information we have collected about you. If you would like to also receive information about our data disclosure for business purposes, then please include that in the Data Subject Request. We will clarify whether the Information was collected and disclosed or simply collected and kept internally.

11.4.2 The "Sale" of Personal Information under the California Consumer Protection Act

The California Consumer Protection Act gives California residents the right to stop the "sale" of their Personal Information through a mechanism called "Do Not Sell My Personal Information" button or hyperlink.

While there are many positive impacts of this requirement, California’s definition of "sale" also captures the transfer of data between corporate affiliates (that is, companies that share common ownership) and other transfers that ordinarily may not be thought of as a "sale" in the traditional sense of the word. At Bidali, we may share your Personal Information with our partners to provide you with the rewards, coupons and benefits that are a core mission of our Services. Because the CCPA has defined some of these transfers as "sales" we are unable to offer all of our services to our Users that ask us not to "sell" their Personal Data.

California residents may utilize the "Do Not Sell My Personal Information" hyperlink located on our Services to facilitate their opt-out of the sale of certain Personal Information. However, if you opt to request that we do not "sell" your Personal Information you may not be able to use Services we offer that requires our continued use of your email address. Accordingly, users who direct us to stop "selling" their Personal Information may be asked to delete their Bidali Account and their associated Personal Information. Users who make this request will still be able to access our website and explore our Services that are available to non-account holders.

Please note that we will attempt to verify your identity via the email address and/or telephone number associated with your request prior to fulfilling it. If you authorize another person to make this request on your behalf, in addition to verifying your identity we will also require proof that the person is authorized to act on your behalf.

Please note that the categories of Personal Information and sources will not exceed what is contained in this Privacy Policy. Additionally, we are not required to retain any Information about you if it is only used for a one-time transaction, unless required by law, and would not be maintained in the ordinary course of business. Unless required by law, we are also not required to re-identify Personal Information if it is not stored in that manner already, nor is it required to provide the Personal Information to you more than twice in a twelve-month period.

You may request that we delete your Personal Information. Your deletion request should be submitted through a Data Subject Request. Subject to certain exceptions set out below we will, on receipt of a verifiable Data Subject Request, delete your Personal Information from our records and direct any service providers to do the same.

Please note that we may not delete your Personal Information if it is necessary to:

  • complete the transaction for which the Personal Information was collected;
  • provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us;
  • detect security incidents, protect against malicious, deceptive activity, and take all necessary and appropriate steps to mitigate current and future risk;
  • debug and repair internal information technology as necessary;
  • undertake internal research for technological development and demonstration;
  • exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law;
  • comply with the California Electronic Communications Privacy Act;
  • engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the Information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent;
  • enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us; comply with an existing legal obligation; or
  • otherwise use your Personal Information, internally, in a lawful manner that is compatible with the context in which you provided the Information.

We may not, and will not, treat you differently because you of your Data Subject Request activity. As a result of your Data Subject Request activity, we may not and will not deny goods or services to you, charge different rates for goods or services, provide a different level quality of goods or services, or suggest any of the preceding will occur. However, we can and may charge you a different rate, or provide a different level of quality, if the difference is reasonably related to the value provided by your Personal Information.

In addition, if you are a California resident under the age of 18 and are a registered user, you may request us to remove content or Information posted on our Sites, Mobile Apps or stored on our servers by (a) submitting a request in writing to insert email, and (b) clearly identifying the content or Information you wish to have removed and providing sufficient information to allow us to locate the content or Information to be removed. However, please note that we are not required to erase or otherwise eliminate content or Information if (i) other state or federal laws require us or a third party to maintain the content or Information; (ii) the content or Information was posted, stored, or republished by another user; (iii) the content or Information is anonymized so that the minor cannot be individually identified; (iv) the minor does not follow the instructions posted in this Policy on how to request removal of such content or Information; and (v) the minor has received compensation or other consideration for providing the content. Further, nothing in this provision shall be construed to limit the authority of a law enforcement agency to obtain such content or Information.

12. Children's Personal Information

We do not knowingly request to collect Personal Information from any person under the age of 18. If a user submitting Personal Information is suspected of being younger than 18 years of age and we do not have explicit parental consent, Bidali will require the user to close his or her Bidali Account and will not allow the user to continue to use the Services. We will also take reasonable steps to delete the Personal Information as soon as possible. Please notify via email support@bidali.com us if you know of any individuals under the age of 18 using our Services so we can take action to prevent access to our Services.

If you wish to authorize a Bidali Account as a legal guardian for a user that is under the age of 18, please email support@bidali.com and include their Bidali username. We may ask for additional details to verify that you are the user's legal guardian.

13. International Transfers of Personal Information

While we aim to comply with EEA Data Protection Law, Bidali Inc. is based in Canada and does not materially have a presence in the EU as of yet. As a result we are not required to be compliant with EEA Data Protection Law.

With that said, our service providers may store, transfer, and otherwise process your Personal Information in countries outside of your country of residence, including Canada, the United States, and possibly other countries.

  • E.U.-U.S. Privacy Shield: To comply with EEA Data Protection Law, we require that any third party located in the U.S. receiving your Personal Information is certified under the E.U.-U.S. and/or the Swiss-U.S. Privacy Shield Frameworks and require that the third party agree to at least the same level of privacy safeguards as required under applicable data protection laws. These frameworks were developed to enable companies to comply with data protection requirements when transferring Personal Information from the European Union and Switzerland to the United States. For more information about the Privacy Shield Program, please visit https://www.privacyshield.gov/welcome.
  • EU Model Clauses: We use approved Model Contractual Clauses, also known as Standard Contractual Clauses, for the international transfer of Personal Information collected in the EEA to countries outside of the USA.

14. Specific Terms for EEA Residents

If you are a resident of the EEA, Bidali Inc. is a controller with respect to your Personal Information. As a controller, Bidali determines the means and purposes of processing data in relation to using our Services.

Our legal bases for processing under EEA Data Protection Law are described above in the sections 4 and 9. We may process your Personal Information if you consent to the processing, to satisfy our legal obligations, if it is necessary to carry out our obligations arising from any contracts we entered with you, or to take steps at your request prior to entering into a contract with you, or for our legitimate interests to protect our property, rights or safety of Bidali, our customers, directors, employees, shareholders, affiliates or others.

14.2 Direct Marketing

If you are a current Customer residing in the EEA, we will only contact you by electronic means (email or SMS) with information about our Services that are similar to those which were the subject of a previous sale or negotiations of a sale to you.

If you are a new Customer and located in the EEA, we will contact you by electronic means for marketing purposes only if you have consented to such communication. If you do not want us to use your Personal Information in this way, or to pass your Personal Information on to third parties for marketing purposes, please go to your "Profile" or "My Account" section to opt-out or contact us at support@bidali.com. You may raise such objection with regard to initial or further processing for purposes of direct marketing, at any time and free of charge. Direct marketing includes any communications to you that are only based on advertising or promoting products and services.

14.3 Individual Rights

EEA Residents have the following rights, which can be exercised by going to your "Profile" or "My Account" section or contacting us at support@bidali.com so that we may consider your request under applicable law.

Your "Profile" or "My Account" section on our Services allows you to set your communication preferences and make individual rights requests relating to your Personal Information. We encourage you to make any individual rights requests through our Services because it ensures that you have been authenticated already. Otherwise, when we receive an individual rights request via email we may take steps to verify your identity before complying with the request to protect your privacy and security.

You have the right to withdraw your consent to the processing of your Personal Information collected on the basis of your consent at any time. Your withdrawal will not affect the lawfulness of Bidali's processing based on consent before your withdrawal.

14.3.2 Right to access or rectification of your Personal Information

You have a right to request that we provide you a copy of your Personal Information held by us. This information will be provided without undue delay subject to some fee associated with gathering of the information (as permitted by law), unless such provision adversely affects the rights and freedoms of others. You may also request that we rectify or update any of your Personal Information held by Bidali that is inaccurate. Your right to access and rectification shall only be limited where the burden or expense of providing access would be disproportionate to the risks to your privacy in the case in question, where the rights of persons other than you would be violated, or where we are required to by applicable law.

14.3.3 Right to erasure

You have the right to request erasure of your Personal Information that:

  • (a) is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
  • (b) was collected in relation to processing that you previously consented, but later withdraw such consent; or
  • (c) was collected in relation to processing activities to which you object, and there are no overriding legitimate grounds for our processing.

If we have made your Personal Information public and are obliged to erase the Personal Information, we will, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other parties that are processing your Personal Information that you have requested the erasure of any links to, or copy or replication of your Personal Information. The above is subject to limitations by relevant data protection and financial regulation laws.

14.3.4 Right to data portability

If we process your Personal Information based on a contract with you or based on your consent, or the processing is carried out by automated means, you may request to receive your Personal Information in a structured, commonly used and machine-readable format, and to have us transfer your Personal Information directly to another "controller", where technically feasible, unless exercise of this right adversely affects the rights and freedoms of others. A "controller" is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of your Personal Information.

14.3.5 Right to restriction or objection of processing

You have the right to restrict or object to us processing your Personal Information where one of the following applies:

  • (a) You contest the accuracy of your Personal Information that we processed. In such instances, we will restrict processing during the period necessary for us to verify the accuracy of your Personal Information.
  • (b) The processing is unlawful and you oppose the erasure of your Personal Information and request the restriction of its use instead.
  • (c) We no longer need your Personal Information for the purposes of the processing, but it is required by you to establish, exercise or defense of legal claims.
  • (d) You have objected to processing, pending the verification whether the legitimate grounds of Bidali's processing override your rights.

14.3.6 Rights for restricted information

Restricted Personal Information shall only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest. We will inform you if the restriction is lifted.

  • Notification of erasure, rectification and restriction. We will communicate any rectification or erasure of your Personal Information or restriction of processing to each recipient to whom your Personal Information have been disclosed, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients if you request this information.
  • Right to object to processing. Where the processing of your Personal Information is based on consent, contract or legitimate interests you may restrict or object, at any time, to the processing of your Personal Information as permitted by applicable law. We can continue to process your Personal Information if it is necessary for the defense of legal claims, or for any other exceptions permitted by applicable law.
  • Automated individual decision-making, including profiling. You have the right not to be subject to a decision based solely on automated processing of your Personal Information, including profiling, which produces legal or similarly significant effects on you, save for the exceptions applicable under relevant data protection laws.
  • Right to lodge a complaint. If you believe that we have infringed your rights, we encourage you to contact us first at legal@bidali.com so that we can try to resolve the issue or dispute informally. Refer to Section 18 of this policy for more information.
  • Storage of your Personal Information. Bidali will try to limit the storage of your Personal Information to the extent that storage is necessary to serve the purpose(s) for which the Personal Information was processed, to resolve disputes, enforce our agreements, and as required or permitted by law.

14.3.7 Restrictions on your rights

Your rights to your Personal Information are not absolute. Access may be denied when:

  • Denial of access is required or authorized by law;
  • Granting access would have a negative impact on other's privacy;
  • To protect our rights and properties; and
  • Where the request is frivolous or vexatious.

15. Changes to this Privacy Policy

You agree to Bidali’s E-Sign Consent. We have the right, in our sole discretion, to add to, remove, modify or otherwise change any part of Privacy Policy, in whole or in part, at any time.

If we do so, we will publish the modified Privacy Policy to our Site(s), and if any material changes have been made will notify you by providing you with a notice in an manner we deem reasonable including in-app notifications within the Bidali Services, and through other communications as required by applicable law. Such changes shall be effective immediately as per the "last updated" date.

It’s important that you review the Privacy Policy whenever we modify it because your continued usage of Bidali Services after any such changes to this Privacy Policy will constitute acceptance of those changes. If any change to Privacy Policy is not acceptable to you, you must discontinue your usage of the Bidali Services immediately.

16. Owner and Data Controller Contact

If you have questions or concerns regarding this Privacy Policy, or if you have a complaint, you should first contact us at legal@bidali.com, our support page, or by writing to us at:

Bidali Inc.
#300 - 1550 5 St SW
Calgary, AB, Canada
T2R 1K3

17. Third Party Data Sub-Processors

To support Bidali in delivering its Services, Bidali may engage third party service providers to assist Bidali with its data processing activities. When we work with these service providers in our capacity as a data processor, the third-party service provider is a sub-processor of Bidali ("Sub-processor").

This page identifies the Sub-processor, describes where they are located, and what services they provide to us. Before engaging any Sub-processor, we perform extensive due diligence, including detailed security and legal analysis. We do not engage a Sub-processor unless our quality standards are met. Our Sub-processors are all subject to contract terms that enforce compliance with applicable data protection laws.

Bidali currently uses the following Sub-processors:

Sub-Processor Service Provided Location of Sub-Processor
Google Email, File Storage, Cloud Services, Analytics United States, Ireland
Pipedrive Customer Relationship Management Estonia
Pandadoc Legal Agreements/Signed Contracts United States
HelpScout Customer Support/Chat United States
Bugsnag Error Reporting United States
Sendgrid Email messaging United States
Twilio SMS messaging United States
IP Data IP Address Lookup United States

Our business needs may change from time to time. For example, we may deprecate a Sub-processor to consolidate and minimize our use of Sub-processors. Similarly, we may add a Sub-processor if we believe that doing so will enhance our ability to deliver our Services. We will periodically update this page to reflect additions and removals to our list of Sub-processors.

18. Complaints

If you have a complaint about our processing of your Personal Information you can make a complaint to the relevant data protection authority. You can complain in the EU member state where you live or work, or in the place where the alleged breach of data protection law has taken place. In the Canada, the relevant data protection authority is the Office of the Privacy Commissioner of Canada.

Office of the Privacy Commissioner of Canada
30, Victoria Street
Gatineau, Quebec, Canada
K1A 1H3

Report a concern online