Privacy Policy
Privacy Policy
Cashco Financial Inc.
1. About this policy
Cashco Financial Inc. (“Cashco,”“we,” “our,” or “us”) is committed to protecting the privacy of every personwho interacts with us. This Privacy Policy explains how we collect, use,disclose, and safeguard your personal information in connection with ourshort-term lending, and related financial services.
This Policy applies to clients,applicants, and website visitors across all provinces in which Cashco operates.Depending on your province of residence, your personal information is governedby:
· Alberta: the Personal Information Protection Act, SA 2003, cP-6.5 (“Alberta PIPA”)
· British Columbia: the Personal Information Protection Act, SBC2003, c 63 (“BC PIPA”)
· Saskatchewan: the Personal Information Protection and ElectronicDocuments Act, SC 2000, c 5 (“PIPEDA”)
Where personal informationcrosses provincial or national borders, PIPEDA also applies in conjunction withapplicable provincial law. Cashco complies with whichever law provides thegreater privacy protection in the circumstances.
This Policy should be read alongside the privacy notice providedto you at the time of your loan application. If any conflict exists betweenthis Policy and a specific notice, the specific notice governs.
2. Who we are
Cashco Financial Inc. is aprovincially licensed short-term lender operating retail and online locationsacross Alberta, British Columbia, and Saskatchewan. We are not a federallyregulated financial institution and are not subject to the federal Bank Act.
Privacy Officer — Accountability(PIPEDA Principle 1 / PIPA s. 5)
Cashco has designated a PrivacyOfficer who is accountable for our compliance with this Policy and applicableprivacy legislation. The Privacy Officer oversees our privacy managementprogram, responds to access and correction requests, and handles complaints.
· Email: jmoores@cashcofinancial.com
· Toll-free: 1-855-525-3410
· Mail: Jessie Moores,Privacy Officer
Cashco Financial Inc.
Unit 202, 9636 51 Ave NW, Edmonton, AB T6E 6A5
3. Personal information we collect — LimitingCollection (PIPEDA Principle 4 / PIPA s. 11)
“Personal information” means anyinformation about an identifiable individual, recorded or not. It does notinclude business contact information used solely for professionalcommunication, or information that has been anonymized. We collect only theinformation reasonably necessary for the purposes described in Section 4.
Identity and contact information
· Full legal name, date of birth, and gender
· Home address, phone number, and email address
· Government-issued photo identification (e.g., driver’s licence,provincial ID card)
· Social Insurance Number, where required by law or for identityverification purposes
Financial information
· Employment status, employer name, and income details
· Banking information, including institution, branch, accountnumber, and void cheque or pre-authorized debit agreement
· Credit history, credit score, and repayment records
· Loan application details, account history, and transactionrecords
· NSF, declined payment, or collections records
Website and digital information
· IP address, browser type, and device identifiers
· Pages visited, time spent, and navigation behaviour on ourwebsite
· Cookie and tracking data (see Section 11)
Communications records
· Records of calls, emails, text messages, and in-personinteractions with our staff
· Customer service notes, complaint records, and disputecorrespondence
4. Why we collect your information — IdentifyingPurposes (PIPEDA Principle 2 / PIPA s. 13)
We identify and communicate thepurposes for collecting personal information at or before the time it iscollected. We collect, use, and disclose your personal information only for thefollowing purposes, each of which a reasonable person would consider appropriatein the circumstances.
Primary purposes (loan services)
1. To verify your identity and assess your eligibility for ashort-term loan
2. To process your loan application, approve or decline credit, anddisburse funds
3. To administer your account, process payments, and managerenewals or extensions
4. To collect amounts owing under your loan agreement, includingthrough third-party collection agencies
5. To communicate with you about your account, upcoming payments,and changes to our services
6. To meet our obligations under provincial short-term lendinglegislation, the federal Income Tax Act, and other applicable laws
7. To detect, prevent, and investigate fraud, identity theft, moneylaundering, and other financial crimes
8. To report borrowing and repayment information to Canadian creditbureaus as required or permitted by law
9. To resolve disputes, respond to legal proceedings, and defendCashco’s legal rights
Secondary purposes (with yourconsent)
10. To inform you of other Cashcoproducts or services that may be of interest to you
11. To conduct client satisfactionsurveys or research to improve our services
We will not use your personalinformation for any new purpose without first identifying that purpose andobtaining your consent where required. You may withdraw consent to secondaryuses at any time without affecting our ability to provide your primary loanservices.
5. Consent — (PIPEDA Principle 3 / PIPA ss.7–10)
We obtain your knowledge andconsent before collecting, using, or disclosing your personal information,except where the law permits or requires otherwise. Consent may be express (forexample, a signature or checkbox on your application) or implied (for example,voluntarily providing information in a context where the purpose is clear).
Express consent is required when
· The collection, use, or disclosure is outside what you wouldreasonably expect given your relationship with Cashco
· The information is particularly sensitive (such as your SIN,detailed financial hardship circumstances, or health-related information)
· We wish to contact you for marketing or promotional purposes
· Your personal information will be transferred outside Canada forprocessing (see Section 9)
Withdrawing consent
You may withdraw your consent toany non-essential use or disclosure of your personal information at any time,subject to legal or contractual restrictions and reasonable notice. We willtell you the consequences of withdrawing consent before processing yourrequest. You can withdraw consent in any of the following ways:
· Log into your Cashco online account, navigate to Profile, and update yourcommunication and consent preferences
· Contacta Cashco agent by phone at 1-855-525-3410 or in person at any Cashco branchlocation
· Submit awritten request to our Privacy Officer at jmoores@cashcofinancial.com
When consent is not required
Applicable law permitscollection, use, or disclosure without consent in limited circumstances,including:
· Where required or authorized by law, court order, or regulatoryrequirement
· To investigate a breach of an agreement or a contravention ofapplicable law
· To collect a debt owed to Cashco
· In an emergency that threatens the life, health, or security ofan individual
· For journalistic, artistic, or literary purposes (does not applyto Cashco)
6. How we disclose your information — LimitingUse, Disclosure & Retention (PIPEDA Principle 5)
We do not sell your personalinformation. We do not share personal information with third parties for theirindependent marketing purposes without your express consent. We disclose yourpersonal information only as described in this Policy or with your knowledgeand consent.
Service providers
We may share your personalinformation with third-party service providers who assist us in delivering ourservices. These include providers of:
· Cloud storage, data hosting, and IT infrastructure
· Identity verification and credit reporting services (includingEquifax and TransUnion)
· Payment processing and banking connectivity (e.g., Interac,direct debit processors)
· Fraud detection and anti-money laundering screening
· Debt collection services
· Legal, accounting, audit, and professional advisory services
· Loan management and customer relationship software providers
All service providers arerequired by written contract to protect your personal information usingsafeguards comparable to those required under applicable Canadian privacy law.We conduct privacy assessments of service providers before engagement and monitortheir ongoing compliance.
Credit bureaus
We report your borrowing andrepayment history to Canadian credit bureaus, including Equifax and TransUnion,in accordance with applicable credit reporting legislation. This reporting mayaffect your credit score.
Legal and regulatory disclosure
We may disclose your personalinformation without consent to comply with a legal obligation, respond to avalid court order, subpoena, search warrant, or law enforcement request, or tocooperate with a government regulator or licensing body. We will notify you ofany such disclosure where permitted by law and where we believe it isreasonable to do so.
Business transactions
In the event of a merger,acquisition, financing, or sale of all or part of Cashco’s business, yourpersonal information may be reviewed during due diligence and transferred to asuccessor. We will ensure any successor is bound by privacy obligations consistentwith this Policy and applicable law.
7. How long we keep your information — Retention(PIPEDA Principle 5 / PIPA s. 18)
Weretain your personal information for as long as necessary to fulfill thepurposes for which it was collected and to meet our legal, regulatory, andoperational obligations. Personal information is deleted after 7 years from theapplicable retention trigger, as set out below. This standard meets or exceedsall minimum periods required under provincial and federal law.
Minimum retention periods by record type
· Short-termloan application records (approved and declined): retained for the longer of(a) 7 years from the date of the application, as required by the federal IncomeTax Act; or (b) in British Columbia, a minimum of 2 years from the date of fullloan repayment — which may extend well beyond 7 years depending on therepayment date
· Activeaccount records: retained for the duration of the account relationship plus theapplicable minimum retention period above after account closure
· Complaintand dispute records: 7 years from the date of resolution
· Identityverification records: as required by anti-money laundering legislation(typically 5–7 years from the end of the business relationship)
· Marketingconsent records: until consent is withdrawn, plus 1 year
· Websiteand digital records (server logs, cookie data): 13 months or as set out in ourcookie policy
Legal proceedings and the limitation period clock
Cashcomay have the right to commence legal proceedings to recover an outstanding debtfor up to 2 years from the date the debt was last acknowledged by the borrower.Under applicable limitation legislation, a written acknowledgment of a debt —such as a payment, a written promise to pay, or an express admission of thedebt — restarts the 2-year limitation period. This means that records relatedto outstanding or disputed accounts may need to be retained beyond the standardperiods set out above, for as long as a limitation period may still be running.
Data deletion and retention practice
Cashcoretains personal information for a maximum of 7 years following the end of theapplicable retention trigger (such as the date of loan application, date offull repayment, or date of account closure, depending on the record type).After 7 years, personal information is deleted from our systems in accordancewith our data retention schedule. This 7-year standard meets or exceeds theminimum retention periods required under the federal Income Tax Act, provincialshort-term lending legislation, and applicable anti-money launderingregulations.
Uploadeddocuments and manually entered data — including identification documents,income verification records, banking details, and loan application files — aresubject to this 7-year deletion schedule. Once the applicable retention periodhas expired, records are deleted or securely destroyed. This practice isconsistent with the data minimization and retention-limitation principlesrequired under Alberta PIPA, BC PIPA, and PIPEDA.
Note for clients: If you believeCashco holds personal information about you that is no longer required for alegal or operational purpose and that should be deleted ahead of the standard7-year schedule, you may submit a written request to our Privacy Officer. Wewill review your request, advise you of any legal or contractual reason we arerequired to retain the information, and delete any information we are notlegally required to keep.
8. Accuracy — (PIPEDA Principle 6 / PIPA s. 17)
We take reasonable steps toensure that the personal information we use and disclose is accurate, complete,and as current as necessary for the purposes for which it is used. We do notroutinely update personal information unless there is an ongoing operationalneed for it to be current.
You may request a correction topersonal information we hold about you at any time. See Section 12 for how tomake a correction request. Where we agree that a correction is required, wewill make it promptly and, where appropriate, notify third parties who receivedthe incorrect information. Where we do not agree, we will note yourdisagreement in your file.
9. Transfer of personal information outsideCanada
Cashco works with third-partyservice providers some of whose systems are located outside Canada, includingin the United States. This section sets out our obligations and your rights inconnection with cross-border transfers, by province.
Alberta clients — Alberta PIPA,s. 34 (required notice)
Some of the personal informationwe collect from Alberta clients may be stored, processed, or accessed bythird-party service providers whose systems are located outside Canada,including in the United States. These providers support functions such as cloudstorage, data processing, identity verification, and payment infrastructure.
When your information is heldoutside Canada, it may be subject to the laws of that country, including lawsthat allow government authorities to access personal information without yourknowledge or consent. Cashco requires all third-party service providers toprotect your information using safeguards comparable to those required underAlberta’s Personal Information Protection Act. Cashco Financial Inc. remainsfully accountable for your personal information regardless of where it isstored or processed.
Questions about cross-bordertransfers of your personal information may be directed to our Privacy Officerat jmoores@cashcofinancial.com.
British Columbia clients — BCPIPA, s. 34
Some of the personal informationwe collect from British Columbia clients may be transferred to third-partyservice providers whose systems are located outside British Columbia, includingoutside Canada. Cashco ensures that any organization receiving your personalinformation outside BC provides a level of privacy protection comparable tothat required under BC’s Personal Information Protection Act. Cashco FinancialInc. remains fully accountable for your personal information at all times,regardless of where it is stored or processed.
Saskatchewan clients — PIPEDA(federal)
For Saskatchewan clients, yourpersonal information is governed by the federal Personal Information Protectionand Electronic Documents Act (PIPEDA). PIPEDA permits transfers of personalinformation outside Canada for processing but requires Cashco to ensure thatcomparable protections apply wherever your information is held. Cashco remainsaccountable for your personal information at all times.
Risk of foreign government access
When your personal information isstored or processed outside Canada, it may be subject to the laws of thatcountry, including laws that permit government authorities to access personalinformation. In the United States, the Clarifying Lawful Overseas Use of DataAct (CLOUD Act) may allow US authorities to compel access to data held byUS-based technology companies, including data stored on servers physicallylocated in Canada.
We cannot guarantee that foreigngovernments will not seek access to your information under the laws of theircountry. We mitigate this risk by: (a) requiring contractual privacyprotections from all service providers; (b) preferring, where operationallyfeasible, service providers whose primary infrastructure is located in Canada;and (c) limiting the personal information transferred outside Canada to what isreasonably necessary for the service being provided.
The Office of the Privacy Commissioner of Canada has stated that“data residency requirements alone cannot guarantee protection from foreignlegal processes.” We believe transparency about this risk is in keeping withour obligations and our values.
10. Security safeguards — (PIPEDA Principle 7 /PIPA s. 34)
Cashco uses security safeguardsappropriate to the sensitivity of your personal information to protect itagainst unauthorized access, collection, use, disclosure, copying,modification, and disposal. Financial and identity information is among themost sensitive personal information we hold, and we treat it accordingly.
Physical safeguards
· Locked filing systems and access-controlled premises
· Restricted physical access to areas where personal informationis stored or processed
· Secure destruction of paper documents containing personalinformation (cross-cut shredding)
Technological safeguards
· Encryption of personal information in transit (TLS) and at rest
· Multi-factor authentication for all systems containing personalinformation
· Role-based access controls limiting access to staff with alegitimate need to know
· Intrusion detection, system monitoring, and audit logging
· Regular security patching, vulnerability assessments, andpenetration testing
Organizational safeguards
· Mandatory privacy and data security training for all staff whohandle personal information, at hiring and annually thereafter
· Confidentiality agreements with all employees, contractors, andservice providers
· Written privacy policies and procedures, reviewed and updated atleast annually
· Privacy impact assessments for new programs or systems thatinvolve sensitive personal information
· Vendor privacy assessments conducted before engaging any newthird-party processor
Privacy breach notification
If Cashco experiences a privacybreach that poses a real risk of significant harm to you, we will notify youand the applicable regulator as required by law. “Real risk of significantharm” includes financial loss, identity theft, damage to reputation, loss ofemployment, and physical harm.
· Alberta (PIPA): notification to the OIPC of Alberta withoutunreasonable delay; individual notification if directed by the Commissioner
· British Columbia (PIPA): notification to the OIPC of BC as soonas reasonably possible
· Saskatchewan (PIPEDA): notification to the Office of the PrivacyCommissioner of Canada as soon as feasible; individual notification where areal risk of significant harm exists
We maintain a privacy breachregister and investigate all suspected breaches promptly.
11. Openness and website practices — (PIPEDAPrinciple 8)
We make this Privacy Policypublicly available on our website at cashcofinancial.com/privacy. We providepaper copies on request at any Cashco branch location. We are transparent aboutour privacy practices and will answer questions about how we handle personalinformation.
Cookies and website tracking
Our website uses cookies andsimilar technologies to support website functionality, analyze traffic, andimprove your experience. We use the following types of cookies:
· Strictly necessary cookies: required for the website and onlineapplication system to function. These are set automatically and cannot bedisabled without impairing the website.
· Performance and analytics cookies: help us understand howvisitors use our site (e.g., page views, bounce rate). These are set only withyour consent.
· Functionality cookies: remember your preferences and settings toimprove your experience. These are set only with your consent.
You may manage your cookiepreferences at any time through our cookie consent tool or your browsersettings. Disabling certain cookies may affect the functionality of our onlineapplication. We do not use targeting or advertising cookies.
12. Your rights — Individual Access (PIPEDAPrinciple 9 / PIPA ss. 23–27)
You have the following rightsregarding personal information Cashco holds about you. To exercise any of theserights, submit a written request to our Privacy Officer. We may ask you toverify your identity before processing your request.
Right of access
You may request access to: (a)the personal information Cashco holds about you; (b) how that information hasbeen used and disclosed; and (c) the names of any third parties to whom it hasbeen disclosed. We will respond in writing within 45 calendar days of receivingyour written request. We may, with notice, extend this period by a further 30days if the request requires a large volume of records or consultation. We maycharge a reasonable fee for access; we will notify you of any fee beforeprocessing.
Right to correction
You may request that we correctpersonal information you believe to be inaccurate or incomplete. Where we agreethat a correction is warranted, we will make it as soon as reasonably possibleand, where appropriate, notify third parties who received the information.Where we disagree, we will note your disagreement in your file and explain ourreasons.
Right to withdraw consent
You may withdraw consent tosecondary or non-essential uses of your personal information at any time, asdescribed in Section 5.
How to submit a request
· Email: jmoores@cashcofinancial.com (subject line: “Privacy Request”)
· Mail: Jessie Moores, Privacy Officer
Cashco Financial Inc.
Unit 202, 9636 51 Ave NW, Edmonton, AB T6E 6A5
· In person: at any Cashco branch location
We will acknowledge receipt ofyour request within 5 business days.
13. Questions and complaints — ChallengingCompliance (PIPEDA Principle 10 / PIPA s. 47)
If you have a question orcomplaint about how we handle your personal information, please contact ourPrivacy Officer first. We will: acknowledge your complaint within 5 businessdays; investigate it fairly and impartially; and provide a written responsewithin 30 calendar days where possible. We keep a record of all complaintsreceived and use them to improve our privacy practices.
If you are not satisfied with ourresponse, or if we fail to respond within the required timeframe, you mayescalate your complaint to the applicable privacy regulator at no cost to you:
Alberta residents
Office of the Information andPrivacy Commissioner of Alberta
· Website: oipc.ab.ca
· Phone: 1-888-878-4044
· Email: info@oipc.ab.ca
· Mail: Suite 2460, 801 – 6 Avenue SW, Calgary, AB T2P 3W2
British Columbia residents
Office of the Information andPrivacy Commissioner for British Columbia
· Website: oipc.bc.ca
· Phone: 1-800-663-7867
· Email: info@oipc.bc.ca
· Mail: PO Box 9038 Stn Prov Govt, Victoria, BC V8W 9A4
Saskatchewan residents
Office of the PrivacyCommissioner of Canada
· Website: priv.gc.ca
· Phone: 1-800-282-1376
· Email: info@priv.gc.ca
· Mail: 30 Victoria Street, Gatineau, QC K1A 1H3
14. Updates to this policy
We review and update this PrivacyPolicy at least annually and whenever there is a material change to how wecollect, use, or disclose personal information. The effective date at the topof this Policy reflects when the current version came into force.
For material changes, we willpost the updated Policy on our website and provide notice to active clients byemail or through our online account portal at least 30 days before the changestake effect. Continued use of our services after notice of a material changeconstitutes your acknowledgment of the updated Policy.
Prior versions of this Policy areavailable on request from our Privacy Officer.
15. Contact us
For all privacy matters —including access requests, corrections, consent withdrawal, complaints, orgeneral questions — please contact:
Jessie Moores, Privacy Officer — Cashco Financial Inc.
· Email: jmoores@cashcofinancial.com
· Toll-free: 1-855-525-3410
· Mail: Unit 202, 9636 51 Ave NW, Edmonton, AB T6E 6A5
· Online: cashcofinancial.com/privacy
· In person: at any Cashco branch location
© 2025 Cashco Financial Inc.