Privacy Policy — Nexus by Oneremit
Effective: October 12, 2025
Controller: Spark Tech Hub Ltd. (operating as Oneremit)
Applies to: nexus.oneremit.co and all Nexus features (quotes, magic-link, payment, tracking)
1) Overview
We respect your privacy. This Policy explains what we collect, why we collect it, how we use and share it, how long we keep it, and the choices you have—under Canadian law (PIPEDA) and, where applicable, other privacy laws (e.g., GDPR/UK GDPR, CCPA). This Policy forms part of Oneremit’s master privacy program.
2) What we collect
Identifiers & contact: email (for magic links), name, phone. Payment & transaction: institution and country, amount/invoice details, payment reference (e.g., NXS-259-102-7), transfer metadata, delivery status. KYC/Compliance (when required): date of birth, nationality, address, government-issued ID, proof of address, proof of funds/tuition purpose (invoice/offer letter), sanctions/PEP screening results. Device & security: IP, device/browser data, logs for fraud prevention (magic-link issuance/open, resend events). Support & comms: content of chats/emails and operational notes.
3) How we use data
• Provide the service: create quotes, send secure magic links (no password), process bank-transfer tuition payments, reconcile with institutions, generate receipts, and provide tracking. • Prevent abuse & comply with law: identity verification, sanctions/PEP screening, AML monitoring/reporting where required. • Improve & support: troubleshoot, measure performance, and respond to inquiries.
4) Cookies, analytics & marketing
We use necessary cookies (security, session, fraud-prevention) and measurement tools to understand site usage. Where we use third-party analytics/telemetry, those providers may receive pseudonymous usage data; you can control cookies in your browser. We do not sell personal information.
5) Legal bases (where required)
• Contract & legitimate interests: run Nexus, secure the service, fight fraud. • Legal obligation: AML/KYC, reporting, and record-keeping. • Consent: where local law requires consent (e.g., certain cookies/marketing).
6) Sharing
We share data only as needed to operate Nexus and meet legal requirements: payment partners and rails, ID verification vendors, anti-fraud/sanctions screening, hosting and support tools, and—where necessary—destination institutions to post funds. We also disclose where lawfully required (e.g., FINTRAC).
7) Retention
We retain records for the periods required by law and for our legitimate business needs. In particular, financial/AML records are typically kept at least five (5) years.
8) Your rights
Subject to law, you may request access, correction, deletion, and, where applicable, objection or restriction, and you may withdraw consent where processing is based on consent. We’ll verify your request and respond within statutory timelines.
9) Security
We employ administrative, technical, and organizational measures (single-use links, encryption in transit/at rest, access controls, monitoring). No system is perfect; we continuously improve our safeguards.
10) Children
Nexus is for users 18+. We don’t knowingly collect personal information from children.
11) Changes
We’ll post updates here and adjust the “Effective” date. Material changes will be highlighted.
12) Contact
• Privacy: privacy@oneremit.co • Support: support@oneremit.co • Compliance: compliance@oneremit.co Oneremit is a FINTRAC-registered MSB (Reg. No. C100000025).
