1Who we are and how to contact us
Abento Inc. (“Abento”, “we”, “us” or “our”) provides infrastructure that enables merchants and businesses to accept, send and settle payments involving digital assets, including conversion to fiat currency for settlement.
This notice applies to https://abento.io, related business enquiries, and the Abento payment services identified in the notices presented when you use them. It covers website visitors, prospective customers, merchant representatives, directors and beneficial owners, and individuals whose payment information we process as payers or beneficiaries. It does not replace separate employment or applicant privacy notices.
Personal information means information about an identifiable individual. Business contact details, wallet addresses and transaction identifiers can be personal information when they identify or can reasonably be linked to a person.
Abento is responsible for personal information where it determines the purposes and means of processing. In certain services, we may process information on a business customer’s instructions. The applicable service agreement and collection notice identify that role. We remain separately responsible for processing we determine for our own legal, security or business purposes.
A merchant, bank, wallet provider or other service you choose may also process information under its own privacy notice. Their separate activities are not governed by this notice.
Contact our privacy lead
Email: compliance@abento.io
Postal address: 120 Adelaide Street West, Suite 2215, Toronto, Ontario, M5H 1T1, Canada.
2Information at the point of collection
We explain when information is mandatory and the consequences of not providing it. For example, we may be unable to establish a payment relationship or complete a transaction without information needed to verify identity, meet applicable requirements or process the payment.
Providing optional information or consenting to optional marketing or analytics is not a condition of obtaining a service where that information is unnecessary to deliver it.
Please use our designated secure channels for identity documents and payment information. Do not send wallet recovery phrases, private keys, passwords or unnecessary identity documents in website enquiries.
3Information we collect
The information involved depends on your relationship with Abento, the service and the applicable requirements. We limit collection to information needed for the stated purposes.
Contact and relationship information includes your name, business contact details, role, correspondence, enquiries, account identifiers and communication preferences.
Identity and verification information may include date of birth, residential address, identification document details, verification results, and information about representatives, directors or beneficial owners. Where required for a relevant assessment, this may include occupation, source of funds or wealth, and sanctions or politically exposed person screening results.
Payment and financial information may include payer and beneficiary details, transaction amounts and timestamps, currency or asset type, wallet addresses, transaction hashes, bank settlement details, payment references and transaction status. The exact fields depend on the payment method.
Technical and usage information may include IP address, browser and device information, session and security events, pages requested and cookie identifiers. Optional analytics and advertising technologies are subject to the choices described in section 12 and our Cookie Policy.
Support and compliance information may include support messages, complaints, verification correspondence, fraud indicators, investigation records and records of privacy or consent requests.
4Where information comes from
We receive information directly when you contact us, complete forms, participate in verification or use a service. We may receive payment or business relationship information from a merchant or business customer, a payer or beneficiary, authorized representatives, banks, payment providers and other transaction counterparties.
Where relevant to verification or financial crime prevention, information may come from identity verification providers, screening providers, public corporate registers, sanctions sources and blockchain analytics providers. Public blockchain information may be associated with other information to evaluate a transaction.
If information is supplied by someone else, we provide the information required by applicable law, including the source and categories concerned, within the required period unless a lawful exception applies. Information being publicly available does not by itself remove privacy obligations.
5Why we use personal information
5.1 Purposes and Canadian consent
We use personal information to respond to enquiries; establish and administer business relationships; verify authorized representatives and relevant owners; provide and reconcile payments and settlement; maintain service security; investigate fraud and financial crime indicators; meet applicable legal requirements; resolve complaints; and manage records and legal claims.
Optional uses, including marketing and non-essential website measurement, are explained separately. We do not treat acceptance of this notice or continued website use as consent to every activity described here.
Where Canadian law requires consent, we seek consent that is meaningful and appropriate to the sensitivity of the information and reasonable expectations. We explain significant consequences and obtain express consent where required. We may process information without consent only where applicable law permits or requires it. Consent does not make an otherwise inappropriate purpose acceptable.
You can withdraw consent for processing that relies on it, subject to legal or contractual restrictions and reasonable notice where permitted. We explain relevant consequences, including whether a service can continue. Withdrawal does not undo earlier lawful processing.
6Legal bases where the GDPR applies
The following bases apply only where the GDPR governs the processing and the conditions for the identified basis are met. We explain any additional purpose before using information for it and obtain consent when required.
| Purpose | Applicable basis and limits |
|---|---|
| Respond to an individual’s service request or perform their contract | Contract necessity where the individual is a contracting party or requests pre-contract steps. For contacts acting for a company, legitimate interests in responding and managing the business relationship. |
| Administer business accounts and communicate with merchant representatives | Legitimate interests in operating and supporting the business relationship, subject to a balancing assessment. |
| Execute and reconcile payments | Contract necessity where the individual is party to the relevant contract; otherwise assessed legitimate interests in completing requested business payments and resolving errors. |
| Prevent fraud and protect services | Legitimate interests in detecting misuse and safeguarding people and systems, with necessary and proportionate processing. |
| Meet a binding EU or Member State legal duty | Legal obligation, identifying the applicable obligation in the relevant collection or service notice. |
| Optional analytics and consent based marketing | Consent where required; separate choices and withdrawal controls. |
| Manage complaints and legal claims | Legitimate interests in resolving disputes and protecting legal rights, or a specific legal obligation where applicable. |
Canadian AML duties do not automatically qualify as an EU legal obligation under GDPR Article 6(1)(c). Where GDPR applies, we assess the appropriate basis for related processing separately. We also assess any additional rules for sensitive data, criminal offence information and transfers.
7Who receives personal information
7.1 Service providers and transaction participants
We disclose personal information only for identified purposes and with an appropriate legal basis. Recipients may include the following, to the extent relevant to the service:
Service providers supporting hosting, infrastructure, security, identity verification, sanctions screening, blockchain analysis, customer support, communications and record management. Providers acting on our behalf receive contractual instructions and safeguards appropriate to their role.
Merchants and business customers associated with a payment or account, including information needed to identify, reconcile or investigate a transaction. Access is limited to information appropriate to their role; identity documentation is not routinely shared merely because a merchant participates in a payment.
Banks, payment processors, settlement partners, wallet or custody providers and other transaction counterparties involved in executing a payment. Where applicable, originator and beneficiary information is transmitted to another financial institution or virtual asset service provider to meet travel rule requirements. This is distinct from publishing information on a blockchain.
Professional advisers, auditors and insurers where necessary for advice, assurance, claims or the management of legal obligations.
Regulators, financial intelligence authorities, courts and law enforcement where a disclosure is required or otherwise lawfully justified. We assess the authority, scope and applicable restrictions of requests. Some reporting or investigation details cannot lawfully be disclosed to the affected individual.
Parties involved in a proposed or completed business transaction, such as a merger or asset sale, where disclosure is lawful and subject to confidentiality, purpose limitations and other required safeguards.
8Limits on sharing and separate responsibility
A recipient may act as our processor, as an independent controller, or in another role depending on its activities. Contractual labels do not determine the role where the actual processing is different.
We require providers acting on our behalf to protect information, restrict its use, control authorized access and support applicable deletion, incident response and individual rights obligations.
We do not authorize a new advertising or unrelated secondary use merely by disclosing information for service delivery.
9International transfers and blockchain
9.1 Processing across borders
Personal information may be processed in Canada, including locations used by our service providers and transaction counterparties. Information in another country may be accessible to courts, law enforcement or other authorities under that country’s laws.
We assess cross-border arrangements and use contractual and other safeguards appropriate to the information, destination, recipient and applicable law. You can contact our privacy lead for information about these arrangements.
For transfers subject to the GDPR, we use an applicable adequacy decision or another valid transfer mechanism, such as appropriate standard contractual clauses with any necessary supplementary measures. An adequacy decision applies only within its stated scope. For example, Canada’s EU adequacy status concerns commercial organizations covered by the relevant decision; it is not a blanket approval of every Canadian recipient or onward transfer.
Where required, we assess destination-country laws and practices and the effectiveness of safeguards. Exceptions for particular situations are assessed individually and are not treated as a routine substitute for safeguards.
You may request information about the transfer mechanism used for your information and a copy of relevant safeguards, subject to lawful redactions via email at compliance@abento.io.
9.2 Public blockchain transactions
Depending on the service and network, a transaction may publish wallet addresses, transaction hashes, asset types, amounts, timestamps or transaction metadata to a public blockchain. Such records may be accessible worldwide, copied, analyzed and retained by independent network participants.
Blockchain records are generally difficult or impossible for Abento to amend or delete. Wallet addresses and other identifiers are not necessarily anonymous: information can become associated with a person through payment records, public information or analytics.
Before you submit a transaction, the relevant service information identifies the network and information to be made public. We seek to minimize personal information placed on public networks. Do not include names, identity documents or unnecessary personal information in transaction memo fields.
A blockchain’s technical characteristics do not remove our responsibility for information under our control. We assess privacy requests concerning off-chain records and identifiers separately, and explain any technical or legal limits affecting the particular request.
10Retention and security
10.1 How long we retain information
We retain personal information for as long as reasonably necessary for the stated purposes, including applicable legal recordkeeping, dispute resolution and security needs. Retention depends on the record category and the event that starts the retention period.
| Record category | Retention period or determining criteria |
|---|---|
| Unsuccessful enquiries and prospective customer records | Last substantive contact, distinguishing consented marketing records. |
| Account and merchant relationship records | Duration of the relationship plus 7 years and 6 months, subject to specific recordkeeping requirements. |
| Verification and AML records | Applicable statutory period for the particular record, measured from the legally specified event. Many Canadian MSB records require at least five years; the trigger differs by record type. |
| Payment and settlement records | Duration of the relationship plus 7 years and 6 months. |
| Security and website logs | Duration of the relationship plus 7 years and 6 months. |
| Support and complaint records | Period after resolution of issue plus 7 years and 6 months. |
| Marketing and consent records | Until withdrawal or expiry for active marketing use. |
| Cookies and similar technologies | Technology specific durations in our Cookie Policy and cookie register; these are separate from retention of data collected using the technology. |
A specific legal hold or ongoing claim may require restricted retention beyond the routine period. We retain only information relevant to that need and reassess it when the hold ends.
When retention is no longer justified, we securely delete information or irreversibly anonymize it using methods appropriate to the data. Pseudonymized data remains personal information where it can be linked back to someone.
11How we protect information
We use administrative, technical and physical measures proportionate to the sensitivity and risks of the information.
No system can guarantee absolute security. If an incident involves personal information, we investigate, contain the incident and make notifications to individuals and authorities where required by applicable law. Contact compliance@abento.io to report a suspected issue; do not include unnecessary sensitive information.
12Cookies marketing and automated decisions
12.1 Cookies and similar technologies
Our Cookie Policy describes cookies, pixels, local storage and related technologies, including their purposes, providers and durations. Necessary technologies support functions such as security, session management and requested transactions.
Our proposed standard is to activate optional analytics or advertising technologies only after your affirmative consent. You can accept or reject optional categories and change your choices. Rejecting optional technologies does not prevent access to the service’s essential functions.
Withdrawal stops future optional activity covered by the choice; it does not automatically erase every record previously collected. For deletion requests, use the contact in section 1. Browser controls may supplement our settings but are not the only withdrawal route.
13Marketing communications
Where required, we obtain consent before sending promotional communications and keep records of that consent. Each electronic marketing message provides a way to unsubscribe. You may also contact us directly.
We distinguish promotional messages from necessary service, security and transaction communications. Opting out of marketing does not stop messages needed to administer an existing service or fulfill a legal duty. We keep a limited suppression record where necessary to respect your choice.
14Your rights and our response
14.1 Privacy choices and requests
Depending on the applicable law and circumstances, you may request access to your information and an explanation of its use and disclosure, correction of inaccuracies, withdrawal of consent, deletion, restriction of processing or portability.
Where the GDPR applies, you may object to processing based on legitimate interests on grounds relating to your situation. You may object to direct marketing, including related profiling, at any time; we will stop that marketing processing. Other objections are assessed under the applicable legal test.
Quebec residents may have additional applicable rights, including receiving computerized information collected from them in a structured, commonly used format, subject to statutory conditions and exceptions.
To make a request, contact the privacy lead listed in section 1. Describe your relationship with Abento, the right you wish to exercise and information that helps locate the relevant records. An authorized representative may act where permitted; we may need evidence of their authority.
We verify identity using proportionate measures and request additional information only where reasonably necessary. Please do not send a complete identity document unless we explain why it is needed and provide a secure method.
We respond within the applicable legal period. For requests governed by PIPEDA’s access provisions this is normally 30 days; under the GDPR it is normally one month. Where an extension is legally available, we notify you within the required period and explain the reason.
We generally handle requests without charge. Any permitted fee or refusal is assessed under applicable law and explained. We do not deny service or reduce its quality merely because you exercise a privacy right, although a requested withdrawal or deletion may affect functions that genuinely require the information.
15Limits and complaints
Rights are subject to lawful limits. We may need to preserve certain AML, transaction, security or legal records, protect another person’s information, or comply with restrictions on disclosure. We assess the particular record and request rather than applying a blanket exclusion to all financial information.
If we cannot grant a request in whole or in part, we explain the reason and available complaint options to the extent permitted by law. Where a business customer controls the relevant processing, we identify that role and help route the request appropriately.
You may complain to our privacy lead and to the competent privacy authority. In Canada, this may be the Office of the Privacy Commissioner of Canada or the relevant provincial commissioner, including Quebec’s Commission d’accès à l’information, as applicable. Authority information: www.priv.gc.ca • www.cai.gouv.qc.ca
Children changes and additional notices
16Children and younger individuals
Our business services are intended for people who are 21 years and older. We do not design the website to solicit personal information from children. A payment participant may nevertheless be younger than the account holder or merchant representative. If we learn that information about a child has been collected in circumstances requiring additional protections, we assess the applicable requirements and take appropriate steps, which may include restricting processing, seeking valid authorization or deleting information that is not lawfully required.
17Additional notices and third party links
Short notices may appear when you submit an enquiry, complete identity verification, initiate a payment or enable an optional feature. They explain the information relevant to that activity and should be read with this notice.
If a feature involves biometric identification, sensitive information or another activity requiring additional authorization or disclosures, the relevant notice explains those details before the activity occurs.
Links to external websites and third party wallet or payment services are provided for convenience. Review their privacy notices before submitting information to them.
18Changes to this notice
We may update this notice to reflect changes in our services, processing or legal requirements. The effective date at the top identifies the current version.
For material changes, we provide appropriate notice through the website or another suitable channel. Where a new purpose or processing activity requires consent, we obtain that consent before starting the activity. Posting a revised notice does not by itself authorize an incompatible use of previously collected information.