A. SCOPE

Our products and services are offered by Wave Financial Inc. or by companies related by common ownership or control, including, Wave Financial USA Inc. and Wave Money Inc., (collectively, “Wave,” “we,” “us,” or “our”).

This privacy policy applies to:

• waveapps.com and its subdomains (the “Site”);
• our mobile apps that incorporate this privacy policy; and
• products and services branded with the Wave name.

In simple Terms

Policies like these aren’t always the easiest to understand (or fun to read). We’ll do our best to make the legal language make sense on this side. The stuff along the left is what you’re agreeing to.

This privacy policy does not apply to products or services offered on or through our Site or services by our Business Partners, third-party websites, or our affiliate H&R Block, (“Business Partners”), which have their own policies. You should carefully read the privacy policies and any terms and conditions applicable to such Business Partners. When you request products or services from such Business Partners, you give us permission to provide these companies with information about you necessary to fulfill or process your request.

In simple Terms

Sometimes, we work with other companies and organizations to bring our customers an unbeatable experience. When this happens, their privacy policies apply and they’ll have access to some of your information, but only as much as is absolutely necessary to provide the service you want.

Special Note to Parents: Because of the nature of the services we provide, we do not market our services to children under the age of 13, nor do we knowingly collect information from children under the age of 13.

“Personal Information,” means information about an identifiable individual. That’s what this policy is about – our collection, protection, use, retention, disclosure and other processing of Personal Information and your rights relating to these activities Specifically, we collect the following categories of personal information: 

• Contact Information (e.g., name, phone number, address, and email address);
• Social Insurance Number or Social Security Number, and other government identification numbers (e.g., Driver’s License Number);
• Financial Information (e.g., income, revenue, assets, credits, deductions, expenses, and bank account information);
• Date of Birth;
• Payment Data (e.g., checking, debit and credit card account numbers, balances and payment history);
• Health Information (e.g., health insurance status and financial information related to payment for healthcare services);
• Geo-Location Information;
• Website, Mobile Application, and Email Usage Data (e.g., interactions with a website, application or advertisement);
• Device Information (e.g., internet protocol (IP) address, device type, unique identifier, app version, operating system, network data, and phone state);
• Login Information; 
• Demographic Information;
• Professional or employment-related information; and
• Education information.

In simple Terms

We treat your personal information with the same respect we want our own to be treated with—and when you deal with finances like we do, there’s a lot of personal information involved. Here’s a list of exactly what we collect.

We also compile certain aggregate or anonymized data about our users. What is aggregate data? “Tim Smith buys a coffee at a coffee shop on Main Street” is the Personal Information of Tim Smith, but “20% of Wave users buy coffee on Tuesdays” is aggregate data. We may use and disclose aggregated or anonymized information in our public statements and to identify individuals that may be interested in our Services.

In simple Terms

Understanding our customers is a huge part of building better experiences. To do this, we may look at and share customer data in summarized and anonymous forms, but rest assured, when we do, we cannot identify you or any customer personally.

We use Personal Information to provide you and your business with the services. Our Privacy Policy is based on the following ten fair information principles:

1. Accountability
2. Identifying purposes
3. Consent
4. Limiting collection
5. Limiting use, disclosure, and retention
6. Accuracy
7. Safeguards
8. Openness
9. Individual access
10. Challenging compliance

In simple Terms

The government provides these 10 principles on collecting, storing, and using personal information. By following this list, we cover all our bases so you can rest easy knowing your personal information is safe.

1. Accountability and Challenging compliance

Wave has named a Privacy Officer who is responsible for all things privacy at Wave. This includes our policies and procedures that are designed to keep your information safe. If you have any questions about our privacy practices or this policy, you can contact us at:

Wave Financial Inc.
Privacy Officer
155 Queens Quay E, Box 3, Toronto, ON, M5A 0W4
Email: [email protected]

If you’re not satisfied with our response, you have the option of contacting the Office of Canada’s Privacy Commissioner of Canada.

In simple Terms

If you have any questions or concerns about your privacy, we have someone to listen and help. Here’s how you can get in touch with that person.

2. Identifying Purposes

Wave collects, uses, discloses, and otherwise manages Personal Information in a variety of ways related to our Site and the services we provide. We’ve outlined these below. Your use of the services determines which information we collect and use. For example, payroll information is optional, unless you’d like to use Wave Payroll to run payrolls, at which point we will need to collect payroll information to provide you with this service. Similarly, when you create an invoice, your customer’s email is optional, but if you’d like us to deliver the invoice by email, this information becomes necessary.

In simple Terms

Many Wave services and features simply wouldn’t work without some personal information. Here’s why and how that information is collected, stored, and used.

• In order to provide you with the services you request, which may include the following:
• We collect information directly from you when you use or interact with our Site or our services. This Personal Information may relate to you, your employees, or individuals you interact with.
• We may also collect information from third parties when you connect your Wave account to them. These integrations may pull data into or share data out of Wave. In some cases, we use a service provider to connect you to a third-party service (e.g., when you connect  a bank account to Wave). When you connect your Wave account with a third-party service, their terms and policies apply.
• We may also collect your name and email address from third parties when you sign up and login to our Site using single sign-on (SSO).

In simple Terms

We sometimes connect with other service providers to deliver the best products and services. When this happens, your information also falls under their terms and policies.

• Our Site or services may offer publicly accessible blogs or community forums. You should be aware that any information you provide in these areas may be read, collected, and used by others who access them. To request removal of your Personal Information from our blog or community forum, you may contact us by emailing us at [email protected]. In some cases, we may not be able to remove your personal information, in which case we will let you know if we are unable to do so and why.
• To promote or offer you services, and to determine your eligibility for new products services we may offer from time to time.
• To offer you products and services from our Business Partners.
• To provide you with educational materials and guides relevant to the services you use.
• To contact you for the purposes of Service updates and system and account notifications. 
• To provide you with support in connection with the services.
• We collect information and usage data whenever you interact with us, whether online, through a mobile application, or through an email. This data may include which websites you visit, what you click on, and when you performed those actions. These activities may be performed by us or a service provider acting on our behalf.

In simple Terms

Personal Information would only appear in our blog or community if you posted it. If you’ve posted on our site and want it removed, just let us know. We can almost always remove it, and if not, we’ll let you know why.

We do not sell your Personal Information to other companies.

In simple Terms

We will not sell your details, ever.

How we Disclose Information.

We may disclose your information to other Wave companies, our affiliates, or to third parties with whom we have a written contract limiting the use and disclosure of your information. We may share your information to support the products and services you request or provide you information on products and services that may benefit you.

In simple Terms

There are times when personal information does need to be disclosed. You have the right to know about these situations, so we’ve listed them here.

• Business Partners. We work closely with a variety of business partners that are not Wave companies. We may offer products jointly with our Business Partners.  We may share information that is related to such transactions with that Business Partners. We require all Business Partners to have written agreements with us that require them to safeguard your information and prohibit them from selling, retaining, using or disclosing your personal information for any purpose other than for the specific purpose of performing the contract.

In simple Terms

Online products like Wave need to interact with other business partners in order to work properly. When this involves sharing personal information, we’re vigilant about ensuring the information is managed securely and responsibly.

• Service Providers. We may transfer (or otherwise make available) your personal
• information to third parties who provide services on our behalf. We have written agreements with our service providers that require them to utilize appropriate physical, technical, and administrative controls to protect personal information and prevent them from using personal information for any purpose other than performing the service they provide. For example, we may use service providers to host our website and to process payments. Your Personal Information may be maintained and processed by these third parties in other jurisdictions. We use service providers in Canada and the United States. When your information is in another jurisdiction, it will be subject to their laws. We only share the information these service providers need to perform the service and we don’t authorize them for any other use or disclosure of personal information.

In simple Terms

We also occasionally need to share personal information with service providers. This is especially true for complicated tasks like transferring money electronically. We take the same high level of caution, and ensure the information is used only for the purposes needed.

• Persons Who Acquire Our Assets or Business. If we sell or transfer any of our business or assets (including insolvency or bankruptcy proceedings), certain information about our clients may be a part of that sale or transfer. In the event such sale or transfer results in a material change to this privacy policy, we will notify you. The notification procedure will be the same as the procedure we use to notify you of a change to this Privacy Notice  as described below.

In simple Terms

If the ownership of Wave changes, customer information may be included in the transfer of ownership. Rest assured, we’ll let you know if that change causes material updates to these policies.

• Responses to Legal Requests. We may disclose your information when we have a good faith belief that such disclosure is required or permitted by law pursuant to a legal request. This may occur in connection with a court order, legal process, or other judicial, administrative or investigative proceeding that produces a request for information from us. In certain situations, we may be required to disclose your information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

In simple Terms

When laws require us to share customer information with the proper authorities, we’re obligated to do so.

• Protection of Wave and Others. We may disclose your information when we believe that disclosure is necessary to protect either your or our rights and safety. We may disclose your information to federal, state, provincial, or local officials in order to, and only to the extent necessary, inform the official of activities that may constitute, or may have constituted, a violation of any criminal law or to assist the official in investigating or prosecuting a violation of criminal law.

In simple Terms

Like the point above, information may be shared with government authorities when legally required.

• Aggregate Data. We may disclose aggregate information compiled using information that does not identify you individually or personally. This may include, for example, the total number of visitors from a particular geographic area or the average user age.

In simple Terms

Some summarized, anonymous information may be shared publicly, but could never be connected to individual customers.

Closing your Wave Account

At any time and without penalty, you can close your Wave account and stop using our services. Please ensure you complete the account closure process which includes a confirmation email. Otherwise, your account may not be closed.

In simple Terms

We’d be sad to see you go, but if you do, we won’t make closing your account a hassle. Just don’t forget the confirmation email to make it official.

Email and Communications Consent

At any time, you can opt-out of commercial email communications from us by clicking on the unsubscribe link in such emails, or via the Email Preferences settings in your account. Certain non-commercial communications may still be sent to you that are required to provide you with our services. For example, system notifications, major product changes, changes to our Terms of Use, or other news that we believe will materially affect how you interact with Wave.

The only way to completely stop all emails from Wave is to close your account as outlined above.

In simple Terms

4. Limiting Collection

Wave only collects the Personal Information necessary to provide the services to you. The services you use will determine most of the information Wave collects. We’ll also provide you the option of sharing additional information to enhance your Wave experience.

Wave may also use third-party services to supplement or enrich our understanding of our customers. This includes cross-referencing information like a name, business name, email address or IP address in third-party databases and using the information there to improve our understanding of you and your business.

In simple Terms

We only collect the personal information we need to deliver the services you want. What we collect depends on which services you use.

Some of the services allow you to provide access to your Wave account to other authorized users, which we call “guest collaborators”. Guest collaborators have access to information in your Wave account, including Personal Information, and may perform various tasks on your behalf. You take full responsibility for any collection, use or disclosure of your Personal Information by your guest collaborator(s).

To provide access to your account to a guest collaborator, you must provide the guest collaborator’s name and email address. We will send them a single email inviting them to the Site. Wave only uses this information to invite your guest collaborator. Please ensure that you only submit email addresses of individuals or businesses that you have a relationship with and who would want to receive the message. The guest collaborator may contact us at [email protected] to request that we remove their name and email address from our database. This will remove the guest collaborator’s ability to access to or perform tasks on your behalf in your Wave account.

In simple Terms

You can allow someone else to access and use your Wave account. Be vigilant, as you are responsible for how that person uses the information they can access.

5. Limiting Use, Disclosure and Retention

We will use and disclose your Personal Information as described in this policy. Some Wave employees who have access to your Personal Information outside of Canada and the US. Regardless of where a Wave employee is physically located, your Personal Information is protected by the safeguards described in this Privacy Policy. 

We will retain your information for the period necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. To be clear, that means we’ll retain your Personal Information while you have an active account, and afterward if we need to do so to meet our legal obligations. If you choose to close your Wave account, we will destroy your Personal Information within 60 days unless we are otherwise legally obliged to keep it longer consistent with our retention policies or if we determine it is necessary to defend against legal claims.

In simple Terms

We take our responsibilities about using, disclosing, and storing your personal information seriously. With rare legal exceptions, your information will be destroyed within 60 days of closing your account.

6. Accuracy

Wave relies on you to provide us with information that is accurate and complete. We provide you the mechanisms and rely on you to keep your information up to date. You can request updates or corrections of any inaccuracies in your Personal Information at any time by contacting us at the contact information listed in the policy. We will respond to your request within a reasonable timeframe.

In simple Terms

It’s up to you to ensure the information you provide Wave is accurate. If you need to make changes, just let us know.

7. Safeguards

Wave uses a combination of reasonable and appropriate safeguards designed to protect your information. These safeguards are administrative controls (things like policies, procedures, and training), technical controls (things like encryption, firewalls, and secure coding frameworks), and physical controls (secured hosting environments). For additional details, please see our security page. If you have questions about security on our Site, you can contact us at [email protected]. Nevertheless, no method of transmission over the Internet or electronic storage is 100% secure. Therefore, we cannot guarantee absolute security.

In simple Terms

From policies to software to physical measures, we do everything we can to protect your information. If you’d like more details, feel free to reach out.

We ensure that any third party acting on our behalf maintains reasonable and appropriate safeguards in respect of your Personal Information. Additional information about our third parties’ privacy practices is available upon request.

In simple Terms

When we work with another partner, we make sure they’re vigilant about protecting your information too.

You are also responsible for helping to protect the security of your Personal Information. For instance, never give out your email account information or your password for the sServices to third parties. Our team will never request your password or PIN, and we ask that you never post account or credit card numbers to our support channels.

In simple Terms

Here are some best practices to help you keep your information secure on your end.

8. Openness

This policy outlines our privacy practices. If you have questions about it, please contact our Privacy Officer at [email protected].

In simple Terms

We have someone to help if you have any questions about this document, so reach out.

9. Individual Access

You may access, update and correct inaccuracies in the Personal Information in our custody or control at any time, subject to limited exceptions prescribed law. You can download or export data you input into the Site at any time, or to correct inaccuracies, simply log in to your account and make the necessary changes.

In simple Terms

We’ve made it easy for you to access and update your information on your own by logging into your account.

You can also request access, corrections or updates to all your Personal Information, including information not available through your account, by contacting us as set out in this privacy policy. We may request certain Personal Information for the purposes of verifying the identity of the individual seeking access to their personal information records.

In simple Terms

Not all information can be edited by you in your account. For those cases, here’s how to get it done.

B. ADDITIONAL DETAILS

‍

1. Public Content and Social Media

Wave has public forums and blogs. Any information submitted there may be read and collected by anyone. You may request removal of Personal Information from forum or blog posts and comments by contacting us at [email protected].

In simple Terms

When you post or provide information to somewhere like a comments section or forum, other people may see it. If you’d like this information removed, get in touch and we’ll get it done.

If you provide us with a testimonial, with your consent we may post it on our Site or in other materials and media, along with your name. If you want your testimonial removed, please contact us at [email protected].

You may engage with us through social media sites. When you engage with us on these sites, we may have access to certain information about your account (e.g., name, username). These sites may collect your IP address, how you’re engaging with us, and may use cookies to enable the site to function properly. We may use this information to personalize your experience and to provide you with other products or services you may request.

In simple Terms

Same thing goes for testimonials you may have provided. If you’d like it removed, just ask.

2. Additional Information on Service Providers

We may use service providers to verify bank account information you provide to us in providing our services to you. If you are in the U.S., please note that:
Wave uses Plaid Inc. (“Plaid”) to gather your data from financial institutions. By using our service, you grant Wave and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution. You agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid Privacy Policy.

In simple Terms

In some cases we work with external partners to make sure information is accurate and services can be provided. By using Wave, you agree to sharing your information with these partners.

We may also use services provided by third-party platforms (such as social networking sites) to serve targeted ads on such platforms to you or others, and we may provide a hashed version of your email address or other information to the platform provider for such purposes. To opt-out of the sharing of your information with such platforms, please send an email to [email protected].

In simple Terms

When third-parties are involved, we keep your details anonymous

3. California Consumer Privacy Act

If you live in California, you may have the following rights over your information:

• For the period covering the 12 months preceding your request, you may request that we disclose to you the categories and specific pieces of information collected about you, the categories of sources from which we collected that information, and the purposes for which your information was collected.
• You may also request that we delete information we collected from you.
• You have the right not to be discriminated against for exercising your rights over your information.

As stated above, we do not sell your personal information.

You may submit a request to exercise your rights by emailing [email protected] or calling us toll-free at 1 (877) 596-0796. When receiving a request, we will collect personal information to verify the identity of the individual making the request. Government identification may be required.

In simple Terms

Some states have different laws. Here’s some of the ways things work in California.

4. General Data Protection Regulation

Our services are hosted on servers located in Canada and the United States. We also use service providers located in Canada and the United States to provide you with our services. The transfer of your information, and the information you input into our services, to Canada and the United States is necessary to deliver our services. Please be aware that the laws in Canada or the United States may not provide the same level of protection to your personal information as your home country. 

We have updated documentation, internal policies and procedures, and agreements to align with GDPR requirements applicable to us.

You should consult with your legal professional to understand your GDPR compliance obligations. If you are deemed a data controller, you are responsible for ensuring that you have a legitimate basis for the collection, processing, and transfer of the personal data you input into our services. By using our services, you represent to us that you have met your GDPR compliance obligations.

In simple Terms

Most of what we do happens in Canada and the United States. So, information you provide will likely pass through these two countries.

If you are accessing our services from the European Union, you may have certain rights regarding the processing of your personal information. For instance, if the information you provide contains special categories of personal data, we will only process it with your explicit consent, which can be withdrawn at any time. You may have the following additional rights: 

• You have the right to access and correct your information. 
• You have the right to obtain erasure of your information, object to or restrict processing activities related to your information, or withdraw your consent to the processing of your information after you have provided it. 
• You have the right to obtain a copy of your information in a structured, commonly used, machine readable format. 
• You have the right to lodge a complaint with your local supervisory authority regarding our processing of your information.

To exercise your rights, or if you otherwise have questions about the processing of your personal data, you may contact us at [email protected].

In simple Terms

Like California, the European Union provides residents with unique rights and responsibilities.

5. Visiting the Site and Using the Mobile Apps

In general, you can visit the Site without telling us who you are or submitting any Personal Information. However, we and/or our service providers (such as Google Analytics) collect IP (Internet protocol) addresses from all visitors to the Site and other related information such as page requests, browser type, operating system, and average time spent on our Site. When you use any of our mobile apps, we also collect device type, operating system, unique device identifier, and date and time stamp. This information is used to help us understand the activity on, and to monitor and improve, our Site and mobile apps.

In simple Terms

To help make our apps and website the best they can be, we look at information on how they’re used.

6. Cookies, Tags, and Web Beacons

We treat the personal information of everyone who comes to our Site in accordance with this Privacy Policy, whatever their “do not track” setting. While we do not respond to web browser “do not track” signals, we give you choices about receiving promotional offers. You can exercise your choices as described in this privacy policy.

In simple Terms

Although we track web activity, you can choose to receive or not receive promotional offers from us.

Technologies such as cookies, web beacons, tags and scripts are used by Wave, our advertising and analytics service providers (such as Google analytics), and affiliates to analyze usage trends, administer the Site, and to gather demographic information about our user base as a whole.

In simple Terms

As always, we only collect information as required and to improve what we offer.

A cookie is small piece of data that our Site can send to your browser, which may then be stored on your device so we can recognize you when you return. We use cookies for session tracking to make it possible to navigate the secure environment inside our Site. These cookies (1) may let us know who you are, (2) are necessary to access your account, and (3) will give us information that we can use to personalize our Site according to your preferences. You can control the use of cookies in your browser. If you disable cookies, you will not be able to access your account or take advantage of all of the features of the Site and mobile apps.

In simple Terms

7. Notification of Privacy Policy Changes

We may update this privacy policy to reflect changes to our information practices. If we make any material changes we will notify you by email (sent to the e-mail address specified in your account) or by means of a notice on our website prior to the change becoming effective. We encourage you to periodically review our privacy policy for the latest information on our privacy practices.

In simple Terms

It’s a good idea to check in on this policy here and there for updates. If the updates are significant, we’ll let you know.

8. Updating or Deleting your Information

You may update or delete your information through your Wave account. We may maintain a copy of the information in our records. Additionally, if you request we permanently delete your account or information, we may still retain and use your information as necessary to comply with our legal obligations.

In simple Terms

You’re free to update or delete your information. We will only hang on to anything we legally need to keep.