Demerton Merchant Solutions Inc., operating as Vital Payments (“Vital Payments”, “we”, “our”, or “us”), respects your privacy and is committed to protecting the personal information you provide to us. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you visit our website, communicate with us, or engage our merchant services.

This Privacy Policy applies to our website located at https://vitalpayments.ca and to information collected through our business operations within Canada.

Our Commitment

Vital Payments complies with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

We collect only the information reasonably necessary to provide merchant service solutions, respond to inquiries, and facilitate introductions to our payment processing partners.

Privacy Officer

If you have questions regarding this Privacy Policy or your personal information, please contact:

Privacy Officer

Matthew Demers

Demerton Merchant Solutions Inc. o/a Vital Payments

Email: admin@vitalpayments.ca

Phone: 888-519-1958

Information We Collect

Depending on your interaction with us, we may collect the following information:

• Name
• Business name
• Business address
• Email address
• Telephone number
• IP address
• Device and browser information
• Information submitted through our contact form
• Government-issued identification where required for merchant application or identity verification

Most merchant application information is collected directly from prospective merchants during the application process rather than through our website.

We do not collect or store credit card or debit card payment information through our website.

Government-Issued Identification

Certain payment processing partners require identity verification as part of merchant onboarding and regulatory compliance.

Where government-issued identification is requested, Vital Payments facilitates the collection of this information solely for submission to the applicable payment processor or financial institution. We do not retain copies of government-issued identification once they have been securely transmitted unless required by law.

How We Use Personal Information

We use personal information to:

• Respond to inquiries
• Evaluate merchant service requests
• Prepare merchant applications
• Communicate regarding products and services
• Verify identity where required
• Connect merchants with payment processing partners
• Improve our website
• Meet legal and regulatory obligations

We do not sell personal information.

Cookies and Website Analytics

Our website uses cookies and similar technologies to improve website functionality and understand visitor activity.

These technologies may collect:

• IP address
• Browser type
• Device information
• Pages visited
• Time spent on pages
• Referral information

You may disable cookies through your browser settings, although some website functionality may be affected.

Google Analytics

We use Google Analytics to understand how visitors use our website.

Google Analytics may collect information such as your IP address, browser type, operating system, pages visited, and time spent on the website.

Google may process this information on servers located outside Canada.

You may opt out of Google Analytics through Google’s browser add-on.

Meta (Facebook) Pixel

Our website uses the Meta Pixel to better understand website traffic and measure advertising effectiveness.

Meta may collect information regarding your interaction with our website through cookies and similar technologies.

For more information, please review Meta’s Privacy Policy.

Information Sharing

We only share personal information when necessary to provide merchant services or where required by law.

Your information may be shared with trusted business partners including:

• Fiserv
• Clover
• Shift4
• Financial institutions
• Payment processors
• Regulatory authorities where legally required

Each organization maintains its own privacy practices and is responsible for protecting the information under its control.

Service Providers

We use third-party providers to support our business operations, including:

• Google Workspace for business email and communications
• Google Analytics
• Meta Business tools

These providers may process information outside Canada while maintaining appropriate security safeguards.

Security Safeguards

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, loss, misuse, or alteration.

These safeguards include:

• Secure email systems
• Password-protected business accounts
• Access controls
• Encryption where appropriate
• Limited employee access to personal information

No method of electronic transmission or storage can be guaranteed to be completely secure.

Data Retention

Personal information is retained only for as long as necessary to fulfill the purposes for which it was collected or as required by applicable laws and contractual obligations.

When information is no longer required, it is securely deleted or destroyed.

Your Privacy Rights

Subject to applicable law, you may request to:

• Access your personal information
• Correct inaccurate information
• Withdraw consent for certain uses of your information
• Ask questions regarding our privacy practices

Requests may be submitted to our Privacy Officer.

Third-Party Websites

Our website may contain links to third-party websites.

Vital Payments is not responsible for the privacy practices or content of external websites. We encourage you to review their privacy policies before providing personal information.

Children’s Privacy

Our services are intended for businesses and individuals who are at least 18 years of age.

We do not knowingly collect personal information from children under 18.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, regulatory, or operational changes.

The revised version will be posted on this page with an updated Effective Date.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact:

Matthew Demers

Privacy Officer

Demerton Merchant Solutions Inc. o/a Vital Payments

Email: admin@vitalpayments.ca

Phone: 888-519-1958

Anti-Spam (CASL) Policy

1. Purpose

Demerton Merchant Solutions Inc., operating as Vital Payments (“Vital Payments”), is committed to complying with Canada’s Anti-Spam Legislation (CASL). This policy outlines how we obtain consent, send commercial electronic messages (CEMs), and respect recipients’ communication preferences.

2. Scope

This policy applies to all employees, contractors, representatives, and any third parties acting on behalf of Vital Payments who send commercial electronic messages, including emails and other electronic communications promoting our products or services.

3. Consent

Vital Payments only sends commercial electronic messages where:

• The recipient has provided express consent;
• An existing business relationship or other form of implied consent exists as permitted under CASL; or
• Another exemption under applicable law applies.

Express consent may be obtained through:

• Merchant onboarding;
• Website contact forms;
• Requests for information;
• Written or verbal authorization; or
• Other documented business interactions.

Records of consent are maintained where applicable.

4. Commercial Electronic Messages

All commercial electronic messages sent by Vital Payments will:

• Clearly identify Vital Payments as the sender;
• Include accurate contact information;
• State the purpose of the communication; and
• Include a clear and functioning unsubscribe mechanism where required by law.

5. Withdrawal of Consent

Recipients may withdraw their consent to receive marketing communications at any time.

Consent may be withdrawn by:

• Clicking the unsubscribe link included in commercial electronic messages (where applicable); or
• Contacting Vital Payments at admin@vitalpayments.ca.

Unsubscribe requests will be processed promptly and in accordance with applicable law.

Operational communications relating to existing merchant accounts, applications, customer support, or legal obligations may continue where permitted by law.

6. Employee Responsibilities

Employees and representatives of Vital Payments are responsible for:

• Complying with this policy;
• Obtaining appropriate consent before sending commercial electronic messages;
• Respecting unsubscribe requests;
• Protecting customer information; and
• Reporting any suspected violations to management.

7. Policy Review

This policy is reviewed periodically and updated as required to ensure ongoing compliance with Canadian Anti-Spam Legislation and industry best practices.

Contact

Questions regarding this Anti-Spam Policy may be directed to:

Matthew Demers
Privacy Officer
Demerton Merchant Solutions Inc. o/a Vital Payments

Email: admin@vitalpayments.ca

Phone: 888-519-1958

Information Security Policy

1. Purpose

Demerton Merchant Solutions Inc. operating as Vital Payments (“Vital Payments”) is committed to protecting confidential, proprietary, and personal information from unauthorized access, disclosure, alteration, and destruction.

This policy establishes the minimum information security controls used by Vital Payments.

2. Scope

This policy applies to all employees, contractors, consultants, and third parties who access company information or systems.

3. Security Responsibilities

Vital Payments is responsible for maintaining reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information we handle.

Responsibilities include:

• Protecting customer information
• Using secure passwords
• Enabling multi-factor authentication where available
• Limiting access to authorized personnel
• Reporting suspected security incidents immediately

4. Access Control

Access to company information is granted only to individuals requiring access for legitimate business purposes.

Access is reviewed periodically and revoked when no longer required.

5. Password Requirements

Company accounts must use:

• Strong passwords
• Multi-factor authentication whenever available
• Unique credentials
• Password managers where appropriate

Passwords must never be shared.

6. Email Security

Vital Payments uses Google Workspace for business email.

Employees must:

• Verify email senders
• Avoid opening suspicious attachments
• Report phishing attempts
• Never transmit confidential information unless appropriate safeguards are used

7. Device Security

Company devices should:

• Be protected with passwords
• Use automatic locking
• Receive operating system updates
• Use antivirus or endpoint protection where applicable

8. Information Handling

Personal information is collected only when necessary.

Information is shared only with authorized payment processing partners including:

• Fiserv
• Clover
• Shift4

Information is retained only as long as necessary.

9. Security Awareness

All personnel receive information security awareness training during onboarding and periodically thereafter.

Training includes:

• Password security
• Phishing awareness
• Privacy obligations
• Secure handling of customer information
• Incident reporting

10. Incident Response

Any suspected security incident must be reported immediately to management.

Vital Payments will:

• Investigate the incident
• Contain affected systems where applicable
• Notify affected parties where required by law
• Document corrective actions
• Review security controls following the incident

11. Vulnerability Management

Vital Payments does not maintain internally hosted public-facing infrastructure.

Security updates for cloud services and hosted infrastructure are managed by their respective service providers.

Company devices are kept current with security updates.

12. Business Continuity

Business-critical information is stored using reputable cloud service providers with backup and redundancy capabilities.

Google Workspace provides redundancy for business email and communications.

13. Policy Review

This policy is reviewed annually or following significant changes to business operations or applicable legal requirements.