1. Who we are
This policy is issued by Crestline Technologies Ltd., which provides its services under the Lyria brand (“Lyria”, “we”, “us”), 1100-1200 West 73rd Avenue, Vancouver, British Columbia V6P 6G5, Canada. Lyria is responsible for the personal information described in this policy.
We comply with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia’s Personal Information Protection Act (PIPA), as applicable. Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to our processing, section 11 also applies.
2. Scope
This policy covers personal information we handle when you:
- visit lyria.one or contact us;
- represent a prospective or existing client, partner or supplier, including as a director, beneficial owner, employee or authorised signatory;
- are a customer of one of our clients and your information is processed through our services; or
- apply for a job with us.
Where we process personal information on behalf of a client, for example the details of that client’s own customers, we do so under our agreement with that client, and the client’s privacy notice will also apply. Other brands in the Lyria ecosystem may publish their own privacy notices for their services.
3. Information we collect
Information you give us
- Contact details: name, job title, company, email address, telephone number and the content of your messages.
- Due diligence information: for clients and partners, information about the business and the individuals connected to it, such as identity documents, date of birth, residential address, ownership and control, source of funds and source of wealth.
- Recruitment information: CVs, application details and references.
Information created when services are used
- Transaction information: payment, payout and transfer details, including amounts, dates, counterparties, payment method details (card numbers are tokenised) and related metadata.
- Risk and fraud signals: device information, IP address, location indicators, velocity and behavioural signals used to prevent fraud and financial crime.
- Account and usage information: logins, activity logs and settings in client-facing tools.
Information collected automatically on this website
- Technical information such as IP address, browser type, device type and request logs, used to deliver and secure the website. See our cookie policy.
Information from third parties
- Company registries, identity verification providers, sanctions, politically exposed person and adverse media databases, credit and fraud prevention agencies, our banking and acquiring partners, and our clients.
4. How we use information
| Purpose | Examples |
|---|---|
| Responding to enquiries | Replying to messages, arranging meetings, sending information you request. |
| Onboarding and due diligence | Verifying identity and beneficial ownership, assessing risk, screening against sanctions and PEP lists. |
| Providing services | Processing payments, transfers, conversions and payouts; settlement; reporting; support. |
| Legal and regulatory compliance | Meeting obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, sanctions laws, tax laws and requests from authorities. |
| Preventing fraud and financial crime | Transaction monitoring, fraud scoring, investigating suspicious activity. |
| Security and operations | Protecting our systems, detecting incidents, maintaining records, improving our services. |
| Business communications | Sending relevant updates to business contacts, where permitted by law. |
| Recruitment | Assessing applications and communicating with candidates. |
5. Consent
We collect, use and disclose personal information with your knowledge and consent, except where the law permits or requires otherwise, for example where information is needed to meet our anti-money laundering obligations, to detect or prevent fraud, or to respond to a lawful request from an authority. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may mean we cannot provide a service.
6. Sharing information
We do not sell personal information. We share it only where necessary, with:
- banking, acquiring, payment, liquidity and custody partners that help deliver our services;
- service providers that support our operations, such as hosting, identity verification, screening, communications and professional advisers, under contracts that require them to protect it;
- our clients, where the information relates to their own customers or transactions;
- FINTRAC, law enforcement, courts, regulators and other authorities, where required or permitted by law; and
- a prospective buyer or successor in a business transaction, under confidentiality obligations.
7. International transfers
Our service providers and partners may store or process personal information outside Canada, including in the United States and the European Union. When information is transferred outside Canada, it is subject to the laws of that jurisdiction and may be accessible to its authorities. We use contractual and other measures to give it a comparable level of protection.
8. Retention
We keep personal information only as long as needed for the purposes described here or as required by law. Records relating to client identification and transactions are generally kept for at least five years, as required by Canadian anti-money laundering law. Enquiry records are generally kept for up to two years after our last contact, and unsuccessful job applications for up to one year, unless you ask us to delete them sooner.
9. Security
We protect personal information with administrative, technical and physical safeguards appropriate to its sensitivity, including encryption in transit and at rest, role-based access control, multi-factor authentication, monitoring and staff training. Card data is tokenised and handled in PCI DSS-compliant environments. No system is perfectly secure; if a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the relevant regulators as the law requires.
10. Your rights
You may ask to access the personal information we hold about you, to correct it if it is inaccurate or incomplete, and to withdraw consent where applicable. We will respond within the time limits the law sets, normally within 30 days. We may need to verify your identity, and in some cases we may be legally required or permitted to refuse a request, for example where disclosure would reveal information about a report made to FINTRAC.
You can unsubscribe from business communications at any time using the link in the message or by writing to us. We send commercial electronic messages in accordance with Canada’s Anti-Spam Legislation (CASL).
11. Visitors in the EU and UK
Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract or steps before entering into one; compliance with legal obligations; our legitimate interests in running, securing and developing our business, preventing fraud and communicating with business contacts; and consent, where we ask for it.
In addition to the rights above, you may have the right to erasure, to restrict or object to processing, and to data portability, and the right to lodge a complaint with your local data protection authority. Transfers to Canada benefit from an adequacy decision of the European Commission for organisations subject to PIPEDA; other transfers are protected by appropriate safeguards such as standard contractual clauses.
12. Children
Our services and this website are intended for businesses and are not directed at children. We do not knowingly collect personal information from children.
13. Changes to this policy
We may update this policy from time to time. The current version is always available on this page, with its date of last update.
14. Contact and complaints
Our Privacy Officer is responsible for our compliance with this policy. Contact: [email protected], or by post to Privacy Officer, Crestline Technologies Ltd., 1100-1200 West 73rd Avenue, Vancouver, British Columbia V6P 6G5, Canada.
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or, where BC PIPA applies, the Office of the Information and Privacy Commissioner for British Columbia.