Canada Privacy Policy

Last Updated: March 2019

Scope

This document outlines our Privacy Policy which describes how we collect, use and disclose personal information in connection with our business in Canada

Personal Information

We collect your personal information through reports to us from TransUnion, credit grantors and other institutions with whom you deal, and who are responsible for obtaining your consent in order to provide your information to us.
We also may collect your personal information from other sources permitted by law, including from public records, and from you if you have direct dealings with us.
Our files may include: identifying information, including your SIN; credit history; public information; and lists of persons who have received a copy of your credit report.

Uses

We facilitate consumer transactions by providing consumer credit reports to our clients, which include banks, credit-card companies, finance companies and other institutions who are evaluating your creditworthiness.
We also provide authentication services to assist our clients identifying potentially fraudulent transactions by verifying information provided to Trans Union by a credit applicant against the information we have on file about that applicant.
We use your personal information for the purposes for which you have consented or otherwise as permitted or required by law. We require our clients to similarly restrict their use of your personal information to such purposes.

Your Options

You can always review a copy of your credit report to ensure that the information is current and accurate.
If you believe that the information is wrong, we have procedures to verify and, if appropriate, correct your information.
You are welcome to ask us about our policies and practices relating to the management of your personal information.

How to Contact Us:

Scratch Financial, Inc.

Mail: 225 S. Lake Ave. Suite 250, Pasadena, CA 91101 Toll Free: (855) 727-2395 Email: [email protected] Website: www.scratchpay.com

How to Contact TransUnion:

Quebec Toll-Free: 1 877 713 3393 Local: 514 335 0374

Mail: TransUnion 3115 Chemin Harvester, Suite 201 Burlington ON L7L 3N8 Other Provinces Toll-Free: 1 800 663 9980

Mail: TransUnion 3115 Harvester Road, Suite 201 Burlington ON L7L 3N8 Online www.transunion.ca

E-mail [email protected]

Further Information

For more detailed information about our privacy policies and practices, please review our Privacy Policy. For information about how to request access to, or dispute the accuracy of, your personal information in our files, please visit our website or contact us as described above.

This Privacy Policy sets out Scratchpay’s approach to the collection, use and disclosure of personal information in connection with our business in Canada, including but not limited to personal information collected, used and disclosed when you access or use our Website.

Scope of this Privacy Policy

We are committed to protecting your privacy, and support a general policy of openness about how we collect, use and disclose personal information in connection with our business in Canada. This Privacy Policy provides an overview of our business and explains how we collect, use and disclose personal information in connection with our business in Canada.

By using our Website, you consent to the collection, use and disclosure of your personal information in accordance with this Privacy Policy.

Definitions

In this Privacy Policy, we will use the following terms:

“Cookies” are small text files offered to a user's computer by web servers in order to keep track of the user's browser as a website is navigated.
“Personal information” means any information about an identifiable individual.
“Principals” means individuals that own and/or are involved in the management of a business.
“Us”, “we”, “our” and “Scratchpay” means Scratch Financial, Inc.
Website” means the website operated by Scratchpay and located at http://www.scratchpay.com

About Us

Scratchpay is a foreign registered company and a licensed credit lender operating across Canada. We were formed in 2016 with the goal of offering the highest quality consumer credit-related products and services to the U.S. and Canadian market. Today, we serve both consumers and the veterinary community by providing consumer credit products in the veterinary space to help our customers make caring decisions for their pets and defer their costs to a payment plan to help manage their veterinary care.

In addition to the Canadian federal Personal Information Protection and Electronic Documents Act, Scratchpay is regulated by provincial consumer reporting legislation designed to protect the privacy of credit information and to ensure the fairness and accuracy of credit-reporting systems. Therefore, Scratchpay has a history of commitment to acquiring and maintaining accurate and up-to-date credit information and to safeguarding the credit information in our control.

An Overview of Our Business

We facilitate consumer payment transactions by providing consumer lending to our customers, which our veterinary prodivers. By their nature, our services must include some personal information about consumers. Accordingly, we regularly collect, use and disclose personal credit information of our Canadian applicant consumers. Credit grantors including TransUnion provides Scratchpay with factual information about how their customers pay their bills and other debts. Credit reporting agencies, such as TransUnion, compile and assemble this information, along with public record information, into a "file" for each consumer. In return, Scratchpay, pursuant to the applicable provincial consumer reporting legislation, obtains credit reports about consumers applying for Scratchpay payment plans.

Our Collection Practices

We primarily collect your personal information from the following sources:

Reports about you that are provided to us by credit grantors or other institutions that are responsible for obtaining your consent to provide the information to us;
Collection agencies;
Directly from you in response to our application process and any dealings we have with you; and
Public records, federal and provincial government offices, public registries, and other sources permitted by law.

We limit our collection of personal information to include only what is necessary to supply Scratchpay with the accurate and up-to-date information needed to make meaningful decisions and in order to provide applicant customers with the services described in this Privacy Policy. We periodically review the data in our credit-reporting system to ensure that it only contains information relevant to the services we provide. Furthermore, we ensure that our retention policies comply with the requirements of privacy laws and provincial consumer reporting legislation. If you call us, we may record and retain the recording to ensure the accuracy of our discussions and for quality control and record keeping purposes. We may use video surveillance in and around our walk-in locations for the safety of our customers and employees, and to protect against theft, property damage and fraud.

Information We Collect

(a) What is Included in Our Credit Reports

Consumer Credit Reports:

TransUnion’s consumer credit reports may contain the following personal information:

Identifying information: Consumer name, previous name(s), date of birth, Social Insurance Number (including temporary and/or previous Social Insurance Numbers), current and previous addresses and telephone numbers, and current and previous employers;
Credit history: Record of payment history on current and previous bills/debt obligations, including payments on loans, credit cards, lines of credit and mortgages owing to organizations such as retail stores, banks, finance companies and telecommunications companies.
Public records: Information that may affect creditworthiness, such as judgments, bankruptcies, consumer proposals and registered items;
Inquiries: A list of credit grantors and other parties authorized by the consumer and/or by law that have received all or part of a consumer’s credit information. Also lists organizations that have received a service from TransUnion where consumer credit information was used but not necessarily disclosed, such as authentication;
Collections: Information about collection matters. This segment may include information about outstanding collections on business accounts if you are personally liable for the debt. It may also include information about outstanding family maintenance support obligations, if permitted by law;
Banking: Information about bank accounts that were closed by an institution for reasons such as empty envelope deposit, NSF cheques or uncollected overdraft charges; and
Remarks: All remarks that have been added to your file, such as a fraud alert or a consumer statement.

(b) Identification Requirements

We also collect other information you have provided to confirm your identity, which we maintain for quality control and authentication purposes. This information may include your name and contact information, copies of, or information from, your driver’s licence, birth certificate, passport, credit cards, signature, photograph, copies of bills or correspondence or proof of business ownership. This information is not part of your credit report.

(c) Other Information

We may also collect:

Contact information, such as your name, email address, telephone number and postal address, for the purposes of responding to your inquiries or requests, communicating with you, and verifying your identity;
Information necessary to process payments for services that you have purchased from us, such as your credit card number and expiry date;
Death records; and
Information you have reported to us as lost, stolen and/or misused, such as your Social Insurance Number.

Information We Do Not Collect

Scratchpay reports do not contain:

Medical histories;
Information about purchases paid in full with cash or cheques;
Race, creed, colour, ancestry, ethnicity or political affiliations; or

While TransUnion may furnish credit or other scores to Scratchpay based on the information contained in a consumer or business credit file, the score itself does not form part of the credit file. TransUnion does not maintain or update scores in individual consumer credit files.

Our Use and Disclosure of Your Personal Information

We limit our use of personal information to those purposes which have been disclosed to the individual by us or our customers and for which appropriate consents have been obtained, or for purposes which are otherwise permitted by law. In connection with our credit reporting services, we do not have direct relationships with individual consumers or principals. Accordingly, we inform payment plan applicants of the purposes for which they are providing personal information to Scratchpay and obtain appropriate consent at the time the information is collected from the individual applicant and/or prior to its use by Scratchpay. Scratchpay limits the use of personal information obtained from TransUnion to purposes that are permitted by law. TransUnion uses and discloses personal information in the following circumstances:

To provide our consumer credit reporting services, and other related services to our customers;
To provide fraud detection and monitoring, authentication, ID verification and/or credit monitoring services to customers when purchasing the credit file;
To deliver data and products to direct-to-Scratchpay with which they have contracted directly;
To provide consumer credit information directly to consumers who have dealings with us (i.e., who have requested a copy of their credit report), or to provide services to consumers, such as placing a potential fraud alert on a consumer’s file;
To manage, administer, collect or otherwise enforce accounts;
If Scratchpay was ever sold, or if we merged with another company, or transferred part or all of our shares or assets, we may disclose and/or transfer personal information to our successor or assign who may collect, use and disclose the personal information for substantially the same purposes as described in this Privacy Policy;
To assist in the investigation of a contravention of a law and/or fraudulent activities;
To fulfill our obligations under consumer reporting and privacy legislation (such as, a request to initiate an investigation); and
To act in respect of an emergency that threatens the life, health or security of an individual or for other purposes as permitted or required by law.

In addition, we may provide anonymous information (i.e., information that does not identify individual consumers or principals) in the form of aggregate or demographic data to our clients or service providers. We may also generate and use anonymous information to develop, enhance or validate our products, processes or services. Personal information will necessarily be used to generate anonymous information and, when required, to research, validate and test the use of anonymous information in such processes, products, services and enhancements.

Scratchpay may share personal information with third parties engaged to assist us in providing services and information to our customers and to individual consumers. In addition, we may engage third parties to assist us with infrastructure maintenance and support. These service providers are prohibited from using your personal information for any purpose other than to provide this assistance and are required to protect personal information disclosed by Scratchpay and to comply with the general privacy principles described in this Privacy Policy. Some of these service providers are located outside of Canada. As a result, your personal information may be subject to local laws, which may permit local law enforcement, government or national security authorities to have access to your personal information in certain circumstances.

We also utilize authentication services for Scratchpay in identifying potentially fraudulent transactions. In the course of providing these services, we may use personal information contained in our credit files to see if it matches the information that has been provided by an applicant. When we look to authentication services, we typically do not disclose credit information; instead we use the consumer’s credit file to check the information internally. While preventing fraud is in everybody’s best interest, these services may directly benefit consumers if someone is attempting to pose as the consumer by misappropriating the consumer’s identity and personal credit information.

Obtaining Consent

We collect, use and disclose personal information when the individual is aware of the purposes for which the information will be used or disclosed, and has given his or her consent to such use or disclosure, except where collection, use or disclosure of personal information without consent is permitted or required by law.

We will not, as a condition in the supply of a service, require you to consent to the collection, use or disclosure of information beyond that required to fulfill the explicitly specified and legitimate purposes for which the information is being provided. For example, you do not need to consent to receiving communications from Scratchpay about services that may be of interest to you as a condition of receiving a service from us. If you have previously agreed to receive communications from us and you would like to withdraw your consent, please contact us in any of the ways noted in the “Contacting Us” section of the Privacy Policy.

Scratchpay requires applicant customers to obtain consent prior to providing Scratchpay with personal information, and prior to accessing the personal information contained in their credit files.

Our Accountability

We have appointed both a Compliance Manager and a Chief Privacy Officer to oversee our compliance with the privacy principles established by the federal Personal Information Protection and Electronic Documents Act, and with provincial privacy and credit reporting legislation. However, protecting personal information does not begin and end there: we are committed to fostering a sense of responsibility amongst our employees for protecting the privacy and accuracy of personal information while it is in our care.

Likewise, Scratchpay has obligations to individuals when accessing their personal information. We have processes in place to encourage Scratchpay to comply with applicable law and obtain the necessary consents. Such processes include entering into binding agreements with our customers and conducting random audits of our internal procedures; the responsibility compliance ultimately rests with Scratchpay.

Our Safeguarding Practices

We take the protection of personal information seriously. Scratchpay has implemented a security program that is aligned with industry best practices and has appointed a Security Manager to oversee our security program. We have adopted procedures to secure storage of personal information and are committed to working to protect the security of personal information during any transfer to or from us. We have also instituted a number of safeguards to identify and prevent the fraudulent use of personal credit information. Scratchpay uses firewall technology to protect its data from would-be intruders and has implemented other safeguards to secure information such as passwords, encryption, antivirus software and physical security measures. Our authorized employees and representatives will have access to your personal information to the extent necessary to perform their job functions.

Fraud affects us all, which is why we co-operate, to the full extent of our ability and to the extent permitted by law, with law enforcement officials to identify and prevent fraud.

Retention of Your Personal Information

Scratchpay retains your personal information in our credit information database for as long as necessary to fulfill the purpose(s) for which it was collected and to comply with applicable laws. Please refer to Frequently Asked Questions on the Website for more information about how long Scratchpay retains consumer credit information on file.

Scratchpay may delete personal information reported about you by a data supplier if our relationship with the data supplier comes to an end. The end of a data supplier relationship may impede our ability to maintain a current and accurate credit file and/or carry out our investigation procedures. We may delete personal information in these circumstances to ensure that your credit file remains as accurate, complete and up-to-date as possible. Please review our website at www.scratchpay.com for additional information.

Access and Accuracy of Credit Reports

Scratchpay engages TransUnion, a mature consumer reporting group. They are a mature group that welcomes consumer access and/or correction requests, and addresses any other questions or concerns. For information on how to request a copy of your consumer credit file or dispute or update your personal credit information, please visit their Website.

When gathering personal information, we work with our data suppliers to increase their awareness of the importance of providing only personal information that is accurate and up-to-date. However, Scratchpay cannot alter the information reported by our customers or data suppliers, unless the information is determined to be wrong, incomplete or otherwise inaccurate. If you do not agree with the accuracy of the information Scratchpay has on file, we have procedures to ensure that such information is verified, and, where appropriate, amended or corrected. We also have an established complaint procedure to address consumer concerns and to ensure any inquiries and complaints are appropriately investigated and addressed.

If have a complaint about our personal information handling practices or this Privacy Policy, please contact us as described below.

Contacting Us

Please contact our Consumer Relations Support Team using the contact information below. Our Consumer Support Team is staffed by trained personnel who can assist with your inquiries. You may also direct your inquiry or request directly to our Compliance Manager or our Chief Privacy Officer. We may require that you put any request for access or correction in writing.

Contacting our Consumer Relations Support Team:

Tel: 1-855-727-2395 Email: [email protected]

Contacting our Compliance Manager or our Chief Privacy Officer:

Attention: Chief Privacy Officer Scratch Financial, Inc. 225 S. Lake Avenue, Suite 250 Pasadena, California 91101 USA Consumers can also visit our website at www.scratchpay.ca or contact the support team at [email protected]

Customers can contact TransUnion at:

TransUnion (for French support) Telephone: (877) 713-3393 or (514) 335-0374 3115 Chemin Harvester, Suite 201 Burlington ON L7L 3N8

TransUnion (for English Support) Telephone: (800) 663-9980 E-mail: [email protected] 3115 Harvester Road, Suite 201 Burlington ON L7L 3N8 Hours of operation: 8:30 a.m.-5:00 p.m. ET (Monday - Friday)

Adverse Action

When Scratchpay bases its decision to deny credit to an individual in part on information received from TransUnion, Scratchpay has a statutory obligation to inform the individual that it obtained the credit information from TransUnion. In this situation, Scratchpay will provide individuals who are declined credit with TransUnion’s contact information so that the individual can verify the content of his credit file and, if necessary, request that information be amended or deleted. TransUnion does not play a role in the decision to deny or advance credit, and accordingly, the individual should deal directly with Scratchpay for more information on the denial of credit.

Inquiries

Inquiries are a statement of fact to Scratchpay and other recipients of the consumer credit file that a TransUnion customer requested information contained in the consumer’s credit report on a particular date. Inquiries also provide a phone number for the consumer to contact the inquiring customer for further information on the pull. By posting inquiries, TransUnion is reporting certain details about the inquiring customer (such as name and phone number) in compliance with its obligations under consumer reporting legislation. However, inquiries reveal no information about the underlying debt or obligation, if any. Please refer to Frequently Asked Questions on the Website for more information about how long TransUnion retains inquiries on file.

Protecting Yourself from Identity Theft

Identity theft is one of Canada’s fastest growing crimes, and one which the victim may not discover until long after significant damage has been done to his or her credit report. There are a variety of ways that you could fall victim to this crime, including “phishing” (seemingly genuine, but forged, e-mails purportedly sent from a reputable company that require you to provide personal information in a linked website or risk losing certain benefits from that company), and “Dumpster diving” (where individuals sort through garbage looking for bank statements, invoices, etc., that reveal an individual’s personal information).

The best way to guard against identity theft is to learn about this crime in order to identify suspicious activity. Please visit our Website at www.transunion.ca for tips on how to protect yourself.

Cookies

Scratchpay's Website makes use of "per-session" cookies. Unlike "persistent" cookies, which are stored on a user's hard drive and can last indefinitely, per-session cookies are stored only in a browser's temporary memory and are deleted when the browser is shut down.

When users visit our Website, our web server offers the user's browser a per-session cookie. As the Website is navigated, this cookie is read back to our web server, allowing us to generate an anonymous "click trail" profile of the visit. From the aggregated information about visits, Scratchpay learns how visitors interact with its Website, how the Website design and content can be improved, and how visitors' experiences can be improved.

Scratchpay does not link, share or associate the contents of the per-session cookie with any other information in a way that would enable the identification of visitors to our Website. Nor do we track or link together multiple visits by any single user over time. Our per-session cookies cannot be "read" by any other web servers, so users cannot be tracked or profiled using Scratchpay's cookies if they visit multiple sites on the Internet.

Some browsers can be set to reject all cookies. If a user chooses to modify a browser in this manner, some pages of our Website may not function properly.

IP Addresses and Server Logs

Unique Internet Protocol (IP) addresses are assigned to all Internet users by their Internet Service Providers (ISPs). IP addresses do not directly identify Internet users; however, through an ISP, an IP address may be linked to a particular user.

During a visit to a website, certain information about a user's traffic patterns, linked with the user's IP address, is passively and automatically collected in the normal course of establishing and maintaining a website connection. This information is logged by the web server of the website that is visited.

The following information is logged by Scratchpay web servers during visits to our Website: IP addresses, type of operating system, time and duration of visit, web pages visited and browser type. We do not link server log information to any other information in a way that would enable the identification of visitors to our Website. Server log information is analyzed by us in order to improve our Website and to customize the Website for users. In addition, from time to time, server logs may be reviewed for security purposes; for example, to detect unauthorized activity on our Website. In such cases, server log data, containing IP addresses, would be shared with law enforcement bodies in order that they may identify users in connection with their investigation of the unauthorized activities.

Links to Third Party Sites

Our Website may offer links to other third party websites, like TransUnion. You should be aware that operators of linked websites may also collect your personal information and information generated through the use of cookies or other tracking technologies when you visit their websites. Scratchpay is not responsible for how such third parties collect, use or disclose your personal information, so it is important to familiarize yourself with their privacy policies before visiting their websites or providing them with your personal information.

Changes to this Privacy Policy

Scratchpay reserves the right to modify this Privacy Policy at any time without notice. The Privacy Policy posted at any time or from time to time via this website shall be deemed to be the Privacy Policy then in effect. Last Updated March 2019.

What type of business are you?