Plain-language summary. We collect the information we need to open and verify your account, to operate listings, investments, escrow and settlement on the platform, and to meet our record-keeping obligations. We store it in Google Firebase / Firestore. We share it only with the service providers and counterparties needed to deliver those functions, or where we are legally required to. You can ask us for a copy of your information, ask us to correct it, or ask us to delete it.
This summary is for convenience only. The sections below govern.
1. Who we are
TradExim ("TradExim", "e-TradeFTZ", "we", "us", "our") is a Canadian company operating the e-TradeFTZ trade-finance platform at tradexim.ca. Our registered address is 270 George St. N, Peterborough, Ontario, K9J 3H1, Canada.
For the purposes of this policy, we act as the party that determines why and how your information is handled on the platform. Where we process information on behalf of a business customer — for example, documents an organization uploads about its own staff — that organization remains responsible for the lawfulness of the information it provides to us.
2. Scope of this policy
This policy applies to the tradexim.ca website, the e-TradeFTZ web application (including the exporter, importer, investor, guarantor and ECA/G2G portals), and any communication you have with us through those channels.
It does not apply to third-party websites, wallets, banks, or services that you reach through a link or integration from our platform. Those services operate under their own privacy terms, and we encourage you to read them before providing information.
The platform is built for business users acting in a commercial capacity. It is not intended for personal or household use.
3. Information we collect
We collect the following categories of information. Not every category applies to every user — what we hold depends on your role on the platform and how far you progress through onboarding.
3.1 Account and identity information
- Name, email address, telephone number, and the password credential used to sign in (passwords are handled by our authentication provider and are not visible to us in readable form).
- The role you register under (exporter, importer, investor, guarantor, ECA/government partner) and your account approval status.
- Email verification status and sign-in activity such as timestamps and the fact of a successful or failed sign-in.
3.2 KYC and business verification information
- Identity documents and the details drawn from them, which may include government-issued identification, date of birth, and residential or business address.
- Business registration and incorporation records, tax or business numbers, trade licences, export or import permits, and evidence of authority to act for the organization.
- Beneficial ownership and directorship details where required to verify who controls the organization.
- Screening results returned by verification providers, including sanctions, politically-exposed-person and adverse-media checks, and the outcome of our review of them.
- Correspondence and file notes relating to your verification, including reasons an application was approved, held, or declined.
3.3 Equipment listing and transaction content
- Listings you upload, including equipment descriptions, specifications, condition statements, serial or asset numbers, location, stated valuation, photographs and supporting documents.
- Shipping, customs, inspection and title documentation attached to a transaction.
- Tokenization records, including the on-chain identifiers associated with a listing, token issuance and transfer records, and wallet addresses linked to your account.
- Investment activity, including subscriptions, fractional holdings, and instructions you submit.
3.4 Payment and settlement records
- Escrow instructions, wire and remittance details, banking coordinates you supply for settlement, payment references, amounts, currencies and dates.
- Confirmations, receipts and reconciliation records generated by us or by a payment or banking partner.
- Invoices, fee records and related accounting entries.
We do not store full payment card numbers on our systems. Where card payments are supported, they are handled by a payment processor and we retain only a reference and the transaction outcome.
3.5 Usage and technical information
- Pages viewed, features used, actions taken in the application, and the time and sequence of those actions.
- IP address, approximate location derived from it, browser and device type, operating system, and language settings.
- Diagnostic and error logs, and aggregated analytics about how the platform is used.
3.6 Communications
- Inquiries submitted through our contact forms, support requests, and the messages exchanged with our team.
- Notices and confirmations we send you about your account or a transaction.
We ask that you do not send us sensitive personal information — such as health information — through the platform. If you upload a document that contains information we do not need, we may redact or remove it.
4. How we use information
| Purpose | What this involves |
|---|---|
| Creating and administering accounts | Registering you, authenticating sign-in, applying your role and permissions, and managing the admin approval decision described in our Terms of Use. |
| Verifying identity and business standing | Reviewing KYC and business documents, running or commissioning screening checks, and recording the result. |
| Operating the marketplace | Publishing listings, running tokenization, recording fractional ownership, and presenting holdings and activity to the relevant parties. |
| Processing payments and settlement | Executing escrow instructions, arranging cross-border settlement, reconciling funds, and issuing invoices and receipts. |
| Risk, fraud and compliance | Detecting suspicious activity, meeting anti-money-laundering and sanctions obligations that apply to us, and maintaining records we are required to keep. |
| Support and communication | Responding to inquiries, sending service notices, and notifying you about changes to your account or a transaction. |
| Improving the platform | Understanding usage patterns, diagnosing faults, testing changes, and planning new functionality. |
| Legal and dispute handling | Establishing, exercising or defending legal claims, and responding to lawful requests from regulators or authorities. |
We do not sell your personal information. We do not use your KYC documents, listing content, or transaction records to train third-party advertising or marketing systems.
5. Why we are permitted to use it
Depending on the information and the circumstance, we rely on one or more of the following: your consent, the need to perform a contract with you or take steps at your request before entering one, compliance with a legal obligation that applies to us, and our legitimate business interest in operating, securing and improving the platform where that interest is not overridden by your interests.
Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect anything we did before you withdrew it, and in some cases it will mean we can no longer provide part or all of the service to you.
6. Where and how we store it
Our primary data store is Google Firebase, and specifically Cloud Firestore for structured records and Firebase Cloud Storage for uploaded documents and images. Authentication credentials are managed by Firebase Authentication. Server-side logic runs on Firebase Cloud Functions, and product analytics may be collected through Firebase Analytics.
Google, as the operator of Firebase, processes this information on our instructions under its own terms and security commitments. Firebase infrastructure is operated across Google data centres, which may include locations outside Canada. See section 8.
Certain records are also written to a permissioned blockchain network used by the platform for tokenization and asset registry purposes. Information written to that ledger — such as token identifiers, wallet addresses and transfer records — is designed to be tamper-evident and, once written, generally cannot be altered or erased. We therefore keep personal identifying details off-chain in Firestore wherever possible, and record only the minimum reference data on-chain. Please review our Risk & Disclosures before submitting anything to the ledger.
8. Cross-border transfers
The platform supports cross-border trade, and by its nature some information will move between countries. Our cloud infrastructure, our verification and payment providers, and the counterparties to a transaction may be located outside Canada — including in the United States, the European Union, and the jurisdictions of the exporters, importers and agencies involved in a given deal.
When information is held in another country it is subject to that country's laws, and may be accessible to courts, regulators and law-enforcement authorities there under those laws. Where we transfer information internationally, we use contractual protections with the receiving party and limit the transfer to what the purpose requires.
9. How long we keep it
We keep information for as long as we need it for the purpose it was collected, and then for any further period we are required or permitted to retain it.
- Account records are kept for the life of the account and for a period afterwards to handle disputes, reinstatement requests and audit needs.
- KYC, verification and screening records are kept for the period required by the anti-money-laundering and record-keeping rules applicable to us, which is typically several years after the end of the business relationship.
- Transaction, escrow, settlement and fee records are kept for the period required by tax, accounting and commercial-law obligations.
- Listing content is retained while the listing is active and for a period afterwards to preserve the record of what was represented to buyers and investors.
- Usage and diagnostic logs are kept for a shorter period, generally measured in months, unless retained longer for a security investigation.
When a retention period ends, we delete the information or render it anonymous so it can no longer be linked to you. Records written to the blockchain ledger cannot be deleted; see section 6.
10. Your rights and choices
Subject to the limits described below, you may ask us to:
- Access the personal information we hold about you and be told how it has been used and disclosed.
- Correct information that is inaccurate, incomplete or out of date.
- Delete information we no longer have a lawful or business reason to retain.
- Restrict or object to a particular use, including withdrawing a consent you previously gave.
- Receive a copy of information you provided to us, in a commonly used machine-readable format.
- Opt out of non-essential messages. You can unsubscribe from product and marketing email at any time. We will still send you service and security notices while you hold an account.
To make a request, contact us using the details in section 15. We will ask you to verify your identity before we act, and we will respond within a reasonable period.
We may decline all or part of a request where the law requires or permits us to — for example where the information must be retained for anti-money-laundering purposes, where it forms part of a transaction record another party is entitled to rely on, where releasing it would reveal another person's information or confidential business information, or where it is subject to legal privilege or an ongoing investigation. If we decline, we will tell you why and, where applicable, how to escalate.
Deleting your account does not automatically delete every record about you. Verification, transaction and settlement records are retained for the periods described in section 9, and blockchain entries remain on the ledger.
11. Security
We use administrative, technical and physical safeguards appropriate to the sensitivity of the information we hold. These include encrypted connections to the platform, encryption of stored data by our cloud provider, role-based access controls and database security rules that restrict which accounts can read or write which records, separate administrative access for approval and escrow functions, audit logging of administrative actions, and review of access rights.
No system is completely secure. You are responsible for keeping your sign-in credentials confidential, for using a strong and unique password, and for notifying us promptly at info@e-tradeftz.com if you believe your account has been accessed without your authorization.
If a breach of security occurs that creates a real risk of significant harm to you, we will notify you and the appropriate authorities as required by applicable law.
13. Children
The platform is intended for use by businesses and by individuals acting on their behalf who are of the age of majority in their jurisdiction. We do not knowingly collect information from children. If we learn that we have, we will delete it.
14. Changes to this policy
We may update this policy as the platform, our service providers, or the legal requirements that apply to us change. The "last updated" date at the top of this page shows when the current version took effect.
Where a change materially affects how we handle your information, we will give you notice through the platform or by email before it takes effect. Continuing to use the platform after a change takes effect means you accept the updated policy.
15. Contact us
For privacy questions, access or deletion requests, or to raise a concern about how we have handled your information, contact:
- Email: info@e-tradeftz.com — please put "Privacy Request" in the subject line.
- Mail: Privacy Inquiries, TradExim, 270 George St. N, Peterborough, Ontario, K9J 3H1, Canada.
If you are not satisfied with our response, you may be entitled to raise the matter with the privacy regulator in your jurisdiction. In Canada, that is the Office of the Privacy Commissioner of Canada or the equivalent provincial authority.
See also our Terms of Use and Risk & Disclosures.