Privacy policy
Effective date: [date] · Version [1.0]
This policy explains what personal information ORO168 collects when you visit our website or apply for a loan, why we collect it, who we share it with, and the choices and rights you have. We follow Canada’s federal privacy law (PIPEDA) and, where they apply, the private-sector privacy laws of Alberta, British Columbia and Quebec.
1. Who we are
ORO168 is the operating name of [Oro168 Legal Entity Inc.], a [province] corporation (business number [BN]). We offer online personal loans of up to $5,000 to residents of [provinces served]. We are responsible for personal information under our control, including information handled for us by our service providers.
2. Our Privacy Officer
Our Privacy Officer is accountable for this policy and for how we handle your information.
- Email: privacy@oro168.ca
- Mail: Privacy Officer, ORO168, [mailing address or PO box]
- Phone: [1-8XX-XXX-XXXX]
3. What this policy covers
This policy covers oro168.ca and our online application at apply.oro168.ca, which a service provider runs on our behalf. It also covers your loan, payments and communications with us. Our use of cookies is explained in our Cookie policy.
4. Information we collect
| When | What we collect |
|---|---|
| You use our website | Contact details you type into our callback or waitlist forms; device and usage information through cookies, only as described in our Cookie policy |
| You apply | Name, date of birth, address, phone, email, employment and income, housing costs, the loan amount and purpose |
| We verify your identity | Government-issued ID details[, a photo of your ID and a selfie to confirm it matches you] |
| We assess your application | Your credit report and score from a credit bureau; bank account information you choose to share through our bank-verification provider |
| You have a loan with us | Payment history, pre-authorized debit details, and records of calls, emails and texts with us |
We collect information directly from you, from credit bureaus, from our identity and bank-verification providers, and, with your consent, from references you give us. We do not knowingly collect information from anyone under the age of majority in their province, and we do not lend to them.
5. How we use your information
To provide your loan (required):
- confirm your identity and prevent fraud
- assess your application and decide whether to lend, and on what terms
- set up, service and collect your loan, including pre-authorized debits
- send you messages about your application and loan
- meet our legal, licensing and regulatory obligations
Optional, only with your consent:
- send you offers and news by email or text (see our Email & SMS consent page)
- measure and improve our website through analytics cookies
We won’t use your information for a new purpose without telling you and, where required, asking for your consent.
6. Credit reports
With your consent, we obtain your credit report from [Equifax Canada and/or TransUnion Canada]. [Checking your rate uses a soft inquiry, which other lenders can’t see and which doesn’t affect your credit score. If you accept an offer, we make a hard inquiry, which may appear on your credit file.] [We report your loan and repayment history to [bureau(s)], which may affect your credit score.]
If we decline your application or change its terms because of your credit report, we’ll tell you, name the credit bureau we used, and explain how to get a copy of your report.
- Equifax Canada: equifax.ca
- TransUnion Canada: transunion.ca
7. Bank account verification
If you choose to connect your bank account, our provider, [provider name], gives us read-only access to your account details, balances and recent transactions. We use this only to confirm your identity and income and to assess your application. We can’t move money or make changes through this connection. Access ends [when your application is decided / after [X] days], and you can revoke it at any time through [method]. You can choose to upload bank statements instead.
8. Automated decisions
[Some steps in our credit decision are made automatically, using your credit report, income and banking information.] If a decision about you is made entirely by automated means, we’ll tell you. On request, we’ll explain the main factors that led to it, and a member of our team will review it.
9. Who we share your information with
We never sell your personal information. We share it only as needed for the purposes above:
- Service providers working for us: our loan application platform, identity verification, bank verification, payment processing, email and text messaging, website hosting and security (including Cloudflare), and analytics. They may use your information only to provide services to us, under written contracts that require them to protect it.
- Credit bureaus, to obtain your report[ and to report your repayment history].
- Collection agencies, if a loan is in default.
- Funders, purchasers or assignees of loans, or a buyer of our business, who must protect your information as this policy does.
- Regulators, courts and law enforcement, when the law requires or permits it.
10. Where your information is stored
Our website and main systems are hosted in Canada. Some service providers may store or process information outside Canada, including in the United States. Information held outside Canada is subject to the laws of that country and may be accessed by its courts and authorities. For Quebec residents, we assess privacy risks and put a written agreement in place before information is communicated outside Quebec.
11. How we protect your information
We use physical, organizational and technical safeguards suited to how sensitive the information is. These include encryption in transit and at rest, multi-factor authentication for staff, access limited to the people who need it, monitoring, and regular security testing. Only our [underwriting, customer service, collections and compliance] staff can access loan files, and only as their work requires. No system is perfectly secure, and we review our safeguards regularly.
12. How long we keep it
We keep information only as long as we need it for the purposes above or as the law requires, then securely destroy or anonymize it.
| Information | How long we keep it |
|---|---|
| Loan files: agreement, disclosures, payments, identity verification result | [7] years after the loan is repaid or closed |
| Declined or abandoned applications, including the credit report used | [24] months after the decision |
| Photos of ID and selfies (if used) | [X] days after verification; we keep only the result |
| Bank verification data | Until the application is decided, or while needed to service your loan |
| Callback and waitlist requests | [12] months, or [6] months after we launch in your province |
| Records of your marketing consent | While we send you messages, plus [3] years |
| Unsubscribe list | Permanently, so we never contact you again by mistake |
13. Your consent and choices
We ask for your consent separately for the credit check, for connecting your bank account, and for marketing. Marketing consent is never a condition of getting a loan. You can withdraw consent at any time by contacting our Privacy Officer, subject to legal or contractual limits. For example, if you have a loan with us, we still need to process payments and send account messages. We’ll explain what withdrawing means before you decide.
14. Your rights
You can ask us to:
- give you access to the personal information we hold about you
- correct information that is inaccurate or incomplete
- explain how we’ve used or shared it
- [delete information we no longer need to keep]
Quebec residents can also ask us to provide computerized personal information in a structured, commonly used format, and to stop disseminating their information or de-index links to it where the law allows.
Send requests to privacy@oro168.ca. We’ll verify your identity, then respond within 30 days. Access is free. If we can’t fully meet a request, we’ll explain why.
If you’re not satisfied with our answer, you can complain to the privacy regulator:
- Office of the Privacy Commissioner of Canada: priv.gc.ca
- Alberta residents: Office of the Information and Privacy Commissioner of Alberta, oipc.ab.ca
- British Columbia residents: Office of the Information and Privacy Commissioner for BC, oipc.bc.ca
- Quebec residents: Commission d’accès à l’information, cai.gouv.qc.ca
15. If there is a privacy breach
If a breach involving your information creates a real risk of significant harm to you (or, in Quebec, a risk of serious injury), we’ll notify you and the appropriate privacy regulator as soon as feasible, and tell you what we’re doing about it. We keep a record of every breach.
16. Changes to this policy
We’ll post any update here with a new effective date. If a change materially affects how we use your information, we’ll tell you in advance by email or on our website, and ask for your consent where required. [Previous versions are available on request.]
17. Contact us
Questions about this policy or your information: Privacy Officer, privacy@oro168.ca, [phone], [mailing address].