AvenaCredit, operated by Conseil AvenaCredit Inc. ("AvenaCredit," "we," "us," or "our"), respects your privacy and is committed to protecting your personal information. This Privacy Policy describes how we collect, use, disclose, retain, and protect your personal information in connection with our credit-building membership services and our website avenacredit.com (the "Services").
This Privacy Policy is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), the Act respecting the protection of personal information in the private sector (Quebec, including amendments under Law 25), and other applicable Canadian federal and provincial privacy laws. Where you reside in a province with substantially similar private-sector privacy legislation, that legislation applies in addition to PIPEDA.
1. Privacy Officer
AvenaCredit has appointed a Privacy Officer who is responsible for compliance with this Privacy Policy and applicable privacy laws. You may contact the Privacy Officer with any question, concern, request, or complaint regarding the handling of your personal information:
Privacy Officer — AvenaCredit
Email: info@avenacredit.com
2. Personal Information We Collect
We collect personal information that you provide to us directly, that we generate as you use the Services, and that we receive from third parties such as Credit Bureaus and payment processors. This includes:
- Identification information: full legal name, date of birth, residential address, telephone number, email address, government-issued identification (where required for identity verification), and Social Insurance Number where required for credit reporting purposes.
- Financial information: banking information for pre-authorized debits (institution number, transit number, account number), credit or debit card information (collected and stored by our payment processor in tokenized form), payment history, billing records, and refund history.
- Credit and account information: information about your AvenaCredit Membership, payment activity, account status, communications with us, and information that we receive from or send to Credit Bureaus.
- Technical information: IP address, device identifiers, browser type, operating system, log files, pages visited, referral URLs, and usage data, collected automatically via cookies, pixels, and similar technologies.
- Marketing information: your consent preferences, marketing engagement, and responses to surveys, promotions, or feedback requests.
- Sensitive information: to the extent we collect sensitive information (such as your Social Insurance Number), we collect it only where required and with your express consent, and we apply enhanced protections.
3. Purposes for Which We Use Your Personal Information
We collect, use, and disclose your personal information for the following purposes:
- to verify your identity, eligibility, and capacity to enter into a contract;
- to provide, operate, administer, and improve the Services, including processing payments and reporting to Credit Bureaus;
- to communicate with you about your account, billing, renewals, service updates, and customer support;
- to deliver add-on services that you have purchased and to manage related billing;
- to detect, prevent, and investigate fraud, security incidents, abuse, and breaches of contract;
- to comply with legal, regulatory, and contractual obligations, including tax, accounting, anti-money laundering, and Credit Bureau requirements;
- to send marketing communications about AvenaCredit and related products and services, where you have consented or where permitted by law (you may withdraw consent at any time — see Section 9);
- to perform analytics, business reporting, and product development; and
- for any additional purpose that we identify to you and for which you provide your consent.
4. Consent
We collect, use, and disclose your personal information with your consent, except where collection, use, or disclosure without consent is permitted or required by law.
Depending on the sensitivity of the information and the context, your consent may be express (for example, by signing or clicking to agree) or implied (for example, by your continued use of the Services after notice). For sensitive personal information (including your Social Insurance Number and information shared with Credit Bureaus), we obtain your express consent.
You may withdraw your consent at any time, subject to legal or contractual restrictions and on reasonable notice. Withdrawing consent to certain uses or disclosures may prevent us from continuing to provide the Services. We will tell you the consequences of withdrawing consent before you do so.
5. How We Share Your Personal Information
We share your personal information only as necessary for the purposes described above and only with the following categories of recipients:
- Credit Bureaus: Equifax Canada Co. and any other consumer reporting agency to which we report payment data.
- Service providers: payment processors, identity verification vendors, hosting and IT infrastructure providers, customer support tools, email and SMS providers, and analytics providers, all bound by contractual confidentiality and data protection obligations.
- Professional advisors: legal counsel, auditors, and accountants, where reasonably required.
- Government, regulators, and law enforcement: where required by law, court order, subpoena, or to respond to a lawful request, or to protect our rights, property, or safety, or the rights, property, or safety of others.
- Successors in interest: in connection with a merger, acquisition, financing, or sale of assets, with appropriate confidentiality protections.
We do not sell your personal information for monetary consideration.
6. Storage, Cross-Border Transfers, and Outsourcing
Your personal information is processed and stored in Canada and may also be processed and stored by service providers located in the United States or other jurisdictions. When personal information is transferred outside of Canada, it remains subject to the laws of the foreign jurisdiction, including potential lawful access by foreign government authorities, regardless of contractual protections we put in place.
AvenaCredit takes reasonable contractual, organizational, and technical measures to ensure that service providers protect your personal information at a level comparable to that required under Canadian law, including the use of confidentiality clauses, data processing agreements, and security requirements.
If you would like more information about our cross-border transfers or wish to obtain a list of countries in which your personal information may be processed, please contact our Privacy Officer.
7. Retention
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, to provide the Services, to comply with legal, regulatory, accounting, and tax obligations, and to enforce our agreements. Specifically:
- account and Membership records are retained for the duration of your Membership and for at least seven (7) years after termination, in accordance with applicable record-keeping and tax laws;
- payment records are retained for at least seven (7) years to satisfy tax, accounting, and audit obligations;
- credit reporting data is retained as required by Credit Bureau policies and applicable law;
- marketing records are retained until consent is withdrawn or longer where required by anti-spam law;
- technical logs are typically retained for up to twenty-four (24) months.
When personal information is no longer required, it is securely destroyed, deleted, or anonymized in accordance with our retention schedule.
8. Security Safeguards
AvenaCredit applies physical, organizational, and technical safeguards appropriate to the sensitivity of personal information, including: encryption in transit and at rest; access controls and least-privilege principles; multi-factor authentication for administrative access; secure software development practices; vendor due diligence; staff training; and incident response procedures.
Despite our safeguards, no method of transmission or storage is completely secure. In the event of a privacy breach involving a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada and, where applicable, the Commission d'accès à l'information du Québec, in accordance with applicable law.
9. Your Rights
Subject to applicable law and any legal exceptions (such as solicitor-client privilege or interference with the rights of others), you have the right to:
- Access: obtain confirmation of whether we hold personal information about you and request access to that information, including details about how it has been used and to whom it has been disclosed.
- Correction: request correction of inaccurate, incomplete, or outdated personal information.
- Withdrawal of consent: withdraw your consent to any use or disclosure of your personal information, subject to legal or contractual restrictions and reasonable notice.
- Portability (Quebec): if you reside in Quebec, request a copy of your computerized personal information in a structured, commonly used technological format, where applicable.
- De-indexing / cessation of dissemination (Quebec): if you reside in Quebec, request the cessation of dissemination of your personal information or the de-indexing of links associated with your name, where the legal conditions are met.
- Information about automated decision-making (Quebec): if a decision affecting you is based exclusively on automated processing of your personal information, you may, at your request, be informed of the principal personal information used and the principal factors and parameters that led to the decision, and you have the right to submit observations for review by a human.
- Complaints: file a complaint with our Privacy Officer or with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, if you reside in Quebec, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca), or the equivalent provincial regulator in your jurisdiction.
To exercise any of these rights, please contact our Privacy Officer at info@avenacredit.com. We will respond within thirty (30) days of receipt of a written request, or sooner if required by applicable law. We may need to verify your identity before fulfilling your request.
10. Cookies, Tracking, and Targeted Advertising
AvenaCredit uses cookies, web beacons, and similar tracking technologies to operate and improve the Services, remember your preferences, analyze website traffic, and (where you consent) deliver targeted advertising on our website and on third-party platforms.
You may adjust your cookie preferences at any time through your browser settings. Refusing cookies may affect the functionality of the Services.
We do not knowingly engage in cross-context behavioural advertising involving the personal information of children.
11. Children
The Services are intended for adults only. AvenaCredit does not knowingly collect personal information from individuals under the age of majority in their province or territory of residence. If you believe a minor has provided personal information to us, please contact our Privacy Officer so that we can take appropriate action.
12. Automated Decision-Making
AvenaCredit may use automated systems to assist with identity verification, fraud prevention, and account management. To the extent that any decision affecting you is based exclusively on automated processing of your personal information, we will inform you in advance, provide the information required by applicable law (including Quebec Law 25), and provide you with the right to request review by a human and to submit observations regarding the decision.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The updated Privacy Policy will be posted on avenacredit.com with a revised "Last updated" date. Where required by law, we will obtain your consent before applying changes to existing personal information. We encourage you to review this Privacy Policy periodically.
14. Contact Us
Questions, concerns, requests, or complaints about this Privacy Policy or AvenaCredit's handling of personal information should be directed to:
Privacy Officer — AvenaCredit
Conseil AvenaCredit Inc.
Email: info@avenacredit.com