Privacy Policy

FastDox (“FastDox”, “we”, “us” or “our”) is committed to protecting personal information and handling it responsibly, transparently and securely.

This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you visit our websites, contact us, request a demonstration, use a FastDox-powered journey or portal, upload documents, use AI-assisted features, book appointments, sign documents, or otherwise interact with the FastDox platform.

FastDox provides technology to organisations including debt and insolvency firms, Licensed Insolvency Trustees (“LITs”), financial-services businesses and professional-services organisations. Where a customer uses FastDox to collect or process information about its debtors or clients, that customer will normally determine why the information is collected and how it is used. In those circumstances, FastDox generally acts as a service provider processing information on that customer’s behalf.

1. Canadian privacy laws

Depending on the circumstances, our handling of personal information may be subject to Canadian privacy laws including the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and substantially similar provincial private-sector legislation in Alberta, British Columbia and Québec, together with other applicable federal or provincial privacy requirements.

We aim to apply the core privacy principles of accountability, identifying purposes, meaningful consent where required, limiting collection and use, appropriate retention, safeguards, openness, and access and correction rights.

2. Our role

When you deal directly with FastDox

FastDox determines how personal information is used when you visit our website, contact us, book a demo, enter into a commercial relationship with us, or use an account that FastDox administers directly.

When you use FastDox through one of our customers

A debt, insolvency, legal, financial-services or other organisation may use FastDox to deliver a digital journey to you. That organisation generally decides what information it requires, why it requires it, what professional service it is providing, how long information must be retained, and who it may be shared with. FastDox processes that information to provide the technology and services requested by the organisation.

If you want to exercise rights in relation to information collected by a FastDox customer, you may need to contact that organisation directly. We will support our customers in responding to appropriate privacy requests where required.

3. Personal information we may collect

The information we process depends on the service being used and may include:

• Identity and contact information, including name, date of birth, address, email address, telephone number, identification details and customer or file references.
• Financial information, including income, expenditure, assets, liabilities, creditor information, account balances, banking and transaction information, payment information and tax or payroll information.
• Household and circumstances information, including household composition, housing, employment, dependants, commitments and reasons for seeking assistance.
• Documents and evidence, including identity documents, payslips, bank statements, creditor statements, letters, contracts, signed documents and other supporting files.
• Journey and file information, including form answers, progress, evidence requirements, tasks, review outcomes, appointments, communications, signatures and workflow activity.
• Communications, including emails, messages, support enquiries, chatbot interactions, AI-assisted conversations and appointment communications.
• Technical information, including IP address, browser and device information, authentication events, security logs, cookies and analytics data.
• Business contact information, including name, job title, organisation and professional contact details.

4. How information is collected

We may collect personal information directly from you, from the organisation providing services to you, through forms and journeys, through uploaded documents, through authorised integrations, through banking or data providers where enabled, from communications with you, automatically through use of our websites and platform, or from other sources permitted by applicable law.

5. Why we use personal information

Depending on our role and the service being used, personal information may be processed to:

• provide, operate, secure and support the FastDox platform;
• create and manage enquiries, debtor records and files;
• deliver onboarding and information-gathering journeys;
• collect and structure financial information;
• request, receive and manage evidence;
• store documents privately;
• classify documents and extract information;
• analyse banking or transaction information;
• compare declared, observed and reviewed information;
• identify potential inconsistencies or exceptions;
• support staff and professional review;
• prepare information for an LIT or other authorised professional;
• schedule and manage appointments;
• generate, send, accept and sign documents;
• communicate with users and customers;
• integrate with authorised third-party systems;
• prepare structured downstream handoffs;
• maintain audit and activity records;
• prevent fraud, misuse and unauthorised access;
• meet contractual, legal and regulatory obligations; and
• improve platform performance and reliability.

6. AI-assisted features

FastDox includes AI-assisted functionality designed to help organisations process and prepare information more efficiently. Depending on the configured service, AI may assist with conversational information gathering, document classification, data extraction, financial and banking analysis, summarisation, comparison of information from different sources, identification of possible discrepancies and preparation of information for human review.

AI-assisted outputs may be incomplete or incorrect and should not automatically be treated as verified facts. FastDox is designed so that important professional and regulated decisions remain with appropriately authorised people. In insolvency use cases, FastDox may prepare and organise information, but it does not replace the professional judgement or statutory responsibilities of an LIT.

7. Declared, observed and reviewed information

FastDox may preserve information from different sources separately. Information provided by a debtor may be recorded as debtor-declared information; information extracted from documents may be recorded as document-observed information; banking information may be recorded as bank-observed information; and information confirmed by authorised staff may be recorded as reviewed information.

Where observed information differs from declared or reviewed information, FastDox may flag the difference for review rather than automatically replacing the existing value.

8. Consent and permitted processing

Where consent is required, we or our customers seek consent appropriate to the sensitivity of the information and the circumstances. Consent may be express or implied where permitted by law. In other situations, information may be collected, used or disclosed without consent where applicable privacy law permits or requires it.

You may withdraw consent to certain activities, subject to legal, contractual or operational restrictions and reasonable notice. Withdrawal may affect the ability to provide some services.

9. Sensitive personal information

The FastDox platform may process sensitive information including identity documents, detailed financial information and information about a person’s financial circumstances. Customers are expected to collect only information reasonably required for legitimate purposes. We apply safeguards appropriate to the sensitivity of the information being processed.

10. Documents and private storage

Documents uploaded through FastDox are intended to be stored using controlled, non-public storage. Access is restricted according to platform permissions and customer configuration. We do not intentionally expose private document storage locations as public download links.

11. Banking information

Where banking functionality is enabled, FastDox may process bank statements, account information, transactions, recurring payments, income patterns, expenditure patterns and creditor-payment information. Information may be uploaded directly or received through an authorised provider or integration.

Banking observations do not automatically replace reviewed information unless the configured workflow and authorised reviewer permit that change.

12. Electronic acceptance and signatures

Where electronic-signature functionality is used, we may process document identifiers, signer information, acceptance status, signature status, timestamps and supporting audit information. Electronic acceptance and document signature may be maintained as separate events where required by the workflow.

13. Who information may be shared with

Personal information may be shared with:

• the organisation providing services to you and its authorised personnel;
• service providers supporting cloud infrastructure, storage, security, communications, electronic signatures, document processing, AI services, analytics, monitoring, support and integrations;
• connected systems authorised by the customer, such as case-management, insolvency-administration, CRM, banking, identity-verification and communications systems;
• professional advisers, courts, regulators or authorities where legally required; and
• parties involved in a merger, acquisition, financing, restructuring or sale, subject to applicable privacy requirements.

Where a customer requires a current list of relevant subprocessors for its deployed FastDox service, that information can be provided through the applicable contracting or due-diligence process.

14. Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, to provide services, meet contractual, legal or regulatory obligations, resolve disputes, support security and maintain appropriate records. Where FastDox processes information on behalf of a customer, retention periods may be determined by that customer.

When information is no longer required, it may be deleted, anonymised or securely disposed of in accordance with applicable requirements and our retention practices.

15. Security

We use administrative, technical and organisational measures intended to protect information against unauthorised access, disclosure, alteration, loss, misuse and destruction. Depending on the service, these may include access controls, authentication, private document storage, encryption technologies, audit and activity records, secure-development practices, monitoring, backups, supplier controls and incident-response procedures.

No system can be guaranteed to be completely secure. Users are also responsible for protecting account credentials and using the platform appropriately.

16. Privacy and security incidents

We maintain processes for assessing and responding to suspected privacy and security incidents. Where required by applicable law, FastDox or the relevant customer will notify affected individuals and the appropriate privacy authority where a breach meets the applicable legal threshold. We maintain incident records where required.

17. Your privacy rights

Depending on the law that applies, you may have rights to ask whether personal information is held about you, request access, request correction of inaccurate or incomplete information, ask how information is used or disclosed, withdraw consent where applicable, challenge compliance with privacy requirements and complain to the relevant privacy regulator.

If FastDox holds information solely on behalf of one of our customers, we may refer your request to that customer or assist the customer in responding.

18. Québec residents

Where Québec privacy law applies, additional requirements and rights may apply, including rights concerning access, rectification, withdrawal of consent, transparency about collection and use, and information concerning processing outside Québec.

Where Québec privacy law applies, FastDox will meet any applicable requirements concerning responsibility for the protection of personal information and transparency about privacy governance.

19. Cookies and analytics

Our websites and platform may use cookies or similar technologies for essential site operation, authentication, security, preferences, analytics and performance. Where required, we provide appropriate choices regarding non-essential cookies. Third-party services may also process technical information in accordance with their own terms.

20. Children

FastDox business services are not designed for use by children independently. Customers are responsible for ensuring that any collection of information concerning minors is lawful, necessary and subject to any consent or safeguarding requirements that apply.

21. Third-party websites and services

FastDox may link to external websites or integrate with third-party services. Independent third parties operate under their own terms and privacy practices, and we encourage users to review those notices.

22. Changes to this Policy

We may update this Privacy Policy to reflect changes to our services, technology, legal requirements or privacy practices. Where appropriate or required, we will provide notice of material changes.

23. Regulators

Depending on where you are located and which law applies, you may have the right to contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy authority, including the privacy regulators in Alberta, British Columbia or Québec.