Privacy policy

Commercial Payment Network Inc. (CPN) is a Canadian payments infrastructure company based in Quebec. CPN is a registered Payment Service Provider under the Retail Payment Activities Act, supervised by the Bank of Canada, and a FINTRAC-registered Money Services Business. This policy covers the cpn.global website. Personal information handled inside CPN's payment services is governed by the agreements and notices that apply to those services.

• Analytics cookies only if you accept them, and none until you do. No advertising cookies, ever.
• No sale of personal information, and no sharing for advertising.
• We collect only what you choose to give us, plus the minimal technical logs any web server produces.
• You can ask what we hold about you, have it corrected, or have it deleted.

• Information you submit. If you contact us through the site or by email, we receive what you send: typically your name, work email address, organization, and message.
• Technical logs. Our hosting infrastructure records standard server logs, including IP address, browser type, pages requested, and timestamps. We use them to operate and secure the site, and they are kept only as long as operationally necessary.

Analytics, if you accept it, is described in the next section. Nothing else is collected. The site runs no advertising trackers and no social media pixels, so browsing cpn.global does not build an advertising profile of you anywhere.

The site uses Google Analytics 4, loaded through Google Tag Manager, to understand which pages are read and which paths lead to an inquiry. It runs only after you accept it in the banner shown on your first visit. Until you choose, and if you decline, no analytics cookie is set and no analytics request leaves your browser.

• What it collects: pages viewed, the language you are reading in, the rough region your connection comes from, the type of device and browser, and the actions you take on the site such as submitting the contact form or requesting a value report. IP addresses are truncated by Google before storage.
• What it does not collect: your name, your email address, the contents of anything you type into a form, or any identifier that follows you to other sites. Nothing you enter in a form is sent to analytics.
• Consent basis: your explicit choice in the banner. Under Quebec's Law 25 this is the consent that authorizes the analytics cookie, and it is recorded in your browser only, not on our servers.
• Changing your mind: select Cookie preferences in the footer of any page to reopen the banner and change your choice. Declining removes the analytics cookie the next time the page loads.
• Retention: analytics data is kept by Google for 14 months, after which it is deleted automatically.

Declining costs you nothing. Every page, form, and report on the site works the same way whether or not you accept analytics.

• To respond to your inquiry and provide the materials you ask for.
• To operate, secure, and troubleshoot the website.
• To meet legal and regulatory obligations that apply to CPN.

We use your information for the purpose you gave it to us, and for nothing else without asking first. You may withdraw your consent at any time. If you no longer want us to hold your information, tell us and we will delete it, unless a legal obligation requires us to keep it.

CPN is based in Quebec. Some providers that support the website, such as hosting and email infrastructure, may store or process information outside Quebec and outside Canada. Before communicating personal information outside Quebec, CPN assesses the protection it will receive, as Law 25 requires, and proceeds only where that protection is adequate.

We keep personal information only as long as the purpose it was collected for requires, or as long as law requires, whichever is longer. After that it is destroyed or anonymized.

We apply security measures proportional to the sensitivity of the information: encryption in transit, access controls, and monitoring. CPN maintains a register of confidentiality incidents. If an incident presents a risk of serious injury, we notify the Commission d'accès à l'information du Québec and the affected individuals, as Law 25 requires.

• Access: ask what personal information we hold about you and receive a copy.
• Rectification: have inaccurate or incomplete information corrected.
• Withdrawal: withdraw consent to uses that depend on it.
• Cessation of dissemination and de-indexing, where the legal conditions are met.
• Portability: receive computerized personal information you provided in a structured, commonly used technological format.

To exercise any of these rights, contact the person in charge of the protection of personal information, below. If you are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec.

Law 25 requires a designated person in charge of the protection of personal information. At CPN that responsibility sits with the privacy office, reachable at privacy@cpn.global or through the contact page.

If this policy changes, the new version is posted here with a new effective date. If a change materially affects how your information is handled, we say so plainly at the top of the policy.