Privacy Policy

Portage Collections Inc. ("Portage", "we", "us", "our")
120 Adelaide Street West, Suite 2410, Toronto, ON M5H 1T1, Canada
privacy@portagecollections.com

Last updated: July 24, 2026
Privacy Officer: Mihail Palchikov, Director — reachable at privacy@portagecollections.com and at the address above.

1. Purpose and scope

This Privacy Policy explains how Portage collects, uses, discloses, retains and protects personal information in connection with:

• this website and any form, email or messaging channel linked from it (visitors);
• our clients — creditors who ask us to assess or recover commercial debts, and their staff (clients);
• debtors and related third parties — individuals acting for, guaranteeing, or otherwise connected to debtor businesses (debtors).

It applies to personal information handled in the course of our commercial debt recovery activities across the jurisdictions where we work, including Canada, the United States, the United Kingdom, the European Union, Australia and New Zealand.

This Policy is written to satisfy, as applicable: Canada's Personal Information Protection and Electronic Documents Act (PIPEDA); Québec's Act respecting the protection of personal information in the private sector (as modernized by Law 25); the Alberta and British Columbia Personal Information Protection Acts; the EU and UK General Data Protection Regulation (GDPR / UK GDPR); and equivalent statutes in other jurisdictions where a debtor resides.

2. What we collect

2.1 Information you give us (visitors and clients)

• Contact details: name, company name and role, email address, phone number, WeChat ID or WhatsApp number.
• Enquiry details: debt amount, debtor's country, and anything you write in free-text fields or messages.
• Engagement materials: invoices, contracts, purchase orders, bills of lading, customs and delivery records, account statements, correspondence with the debtor, and any background you provide about the debt or the debtor.

2.2 Information about debtors

• Identification and contact details of the debtor business and of individuals acting for it (directors, officers, guarantors, accounts-payable contacts).
• Details of the underlying transaction: contracts, invoices, shipping and delivery records, payment history, correspondence.
• Where an engagement requires it and the law permits: corporate registry records, litigation and insolvency records, property and lien (PPSA/UCC) registry data, and other lawfully obtained public-record or licensed-database information.

We do not seek to collect sensitive personal information (health, biometric, racial or ethnic origin, religious beliefs, sexual orientation) about debtors, and we ask clients not to send it.

2.3 Technical data

• Server logs (IP address, browser type, pages requested) used for security and troubleshooting.
• This website sets no advertising or tracking cookies. If privacy-respecting, anonymized analytics are used, they are configured not to identify individual visitors.

3. Business contact information

Much of our work concerns debts owed by businesses. Under PIPEDA, the collection, use and disclosure of business contact information (an individual's name, title, business address, business telephone number and similar details) is exempt from Part 1 of the Act where it is used solely to communicate with the person in relation to their employment, business or profession. We rely on this exemption only for its narrow statutory purpose. Information beyond business contact details — including information about sole proprietors, partners and guarantors, whose business and personal identities often overlap — is treated as personal information under this Policy.

4. Why we use personal information, and on what legal basis

4.1 Clients and prospective clients

4.2 Debtors and related third parties

Our legitimate interests are those of our clients in recovering sums lawfully owed to them and our own interest in performing our engagements. We balance these against the rights of individuals and do not process more than the engagement requires.

4.3 We never

• sell personal information;
• use case materials for marketing;
• make decisions producing legal or similarly significant effects about individuals solely by automated means.

5. Where debtor information comes from

• The client who engaged us, from their own records;
• The debtor and its representatives, in correspondence and negotiations;
• Public sources: corporate registries, court and tribunal records, insolvency registers, land and lien registries, professional licensing bodies;
• Licensed commercial databases and credit information providers, used only where we have a lawful purpose permitted by the applicable consumer-reporting legislation.

6. Who we share it with

We disclose personal information only as needed to perform an engagement, and only to:

• Local counsel and law firms in the debtor's jurisdiction, retained to demand, negotiate, sue or enforce — bound by professional secrecy;
• Courts, arbitration tribunals, sheriffs, bailiffs and process servers, as filings and service require;
• Counter-parties and their counsel in the course of negotiation or proceedings;
• Translators and notaries, where documents must be translated, sworn or apostilled;
• Service providers that host or secure our systems (email, document storage, practice-management tools), bound by contract to protect the information and use it only on our instructions;
• Regulators, law enforcement or tax authorities, where the law compels disclosure;
• A successor entity, if our business or a relevant part of it is sold or merged — subject to this Policy and to any statutory notice requirements.

We do not disclose debtor information to credit reporting agencies unless the law permits it for the specific debt and the underlying agreement so provides; if that ever applies to a file, it will be identified in our engagement documents.

7. Cross-border processing

We are headquartered in Canada and operate internationally; members of our team and some service providers may access or process information outside Canada, including in Mainland China and other countries where we or our vendors operate.

What this means for you:

• Under PIPEDA we remain accountable for personal information transferred to third parties, wherever it is processed, and we use contractual and organizational measures to maintain a comparable level of protection.
• For Québec personal information, we assess cross-border communications before they occur and use written agreements providing protection equivalent to Québec's Act, as sections 8 and 17 of that Act require.
• For EU/UK personal information transferred to us or onward, we rely on adequacy decisions where available and on appropriate safeguards (including standard contractual clauses) where they are not.
• Where the Personal Information Protection Law of the PRC applies to information of individuals in Mainland China (for example, client-side contacts), we process it in accordance with that law.

Messaging channels: if you choose to communicate with us by WeChat or WhatsApp, the content transits Tencent's or Meta's infrastructure under their own terms and privacy policies, on servers we do not control. For transmission of case documents we offer a secure alternative channel and encourage you to use it.

8. Retention

• Active engagements: for the life of the engagement, then seven (7) years after closure, to satisfy legal, accounting, tax and limitation-period requirements in the jurisdictions where we act.
• Free-audit materials for files we decline: deleted within twelve (12) months of our response, unless you ask us to keep the file open or return/destroy the materials sooner.
• Marketing contacts: until you unsubscribe, with periodic re-confirmation at least every 24 months.
• Breach records: retained as section 10 requires.

When retention ends, records are securely destroyed or irreversibly anonymized. Backup copies cycle out within 90 days.

9. Security

• Encryption in transit (TLS) and at rest for stored case materials;
• Access restricted to the assigned case team on a need-to-know basis, with individual accounts and multi-factor authentication;
• Segregated matter files; no case documents on personal devices;
• Confidentiality undertakings by every team member and contractor before any file access;
• Vendor selection that weighs security posture and data-location commitments.

No system is perfectly secure; if you believe your interaction with us is no longer secure, notify us immediately at privacy@portagecollections.com.

10. If something goes wrong (breach response)

If a breach of security safeguards involving personal information occurs, we will assess it promptly. Where the breach creates a real risk of significant harm to an individual, we will, as required by law:

• report it to the Office of the Privacy Commissioner of Canada (and to the Commission d'accès à l'information for Québec information, or to other supervisory authorities where their law applies) as soon as feasible;
• notify affected individuals directly, as soon as feasible, with information about the breach and the steps they can take to reduce harm;
• notify any other organization that may be able to reduce the risk of harm.

We keep an internal record of every breach of security safeguards — whether or not it is reportable — for at least 24 months, and make those records available to regulators on request.

11. Your rights

Depending on your jurisdiction, you may have some or all of the following rights in relation to your personal information:

• Access — to know whether we hold your information and to obtain a copy;
• Correction — to have inaccurate or incomplete information rectified;
• Deletion / erasure — subject to our legal retention duties and to the establishment, exercise or defence of legal claims;
• Withdrawal of consent — where processing is based on consent (this does not affect prior processing);
• Restriction or objection (EU/UK) — including objection to processing based on legitimate interests;
• Portability (EU/UK, and Québec from September 2024) — to receive certain information in a structured, machine-readable format;
• Complaint — to us first (we will respond within 30 days), and then to your regulator:
  • Canada: Office of the Privacy Commissioner of Canada (priv.gc.ca);
  • Québec: Commission d'accès à l'information (cai.gouv.qc.ca);
  • UK: Information Commissioner's Office (ico.org.uk);
  • EU: your national data protection authority.

A note for debtors: rights are not a route to erase a valid debt or obstruct lawful proceedings. Where the law lets us continue processing to establish, exercise or defend legal claims, we will say so in response to your request rather than simply refusing it.

To exercise any right, write to privacy@portagecollections.com. We may need to verify your identity; authorized agents must provide proof of authority. We answer within the time the applicable law sets (30 days under PIPEDA; one month under GDPR).

12. Marketing communications (CASL)

We send commercial electronic messages only where Canada's Anti-Spam Legislation permits — with your express consent or under a statutory exemption (for example, an existing business relationship) — and every message identifies us and carries a working unsubscribe mechanism. We do not buy address lists.

13. Children

Our services are directed at businesses. We do not knowingly collect personal information from persons under 18. If you believe we hold such information, contact us and we will delete it.

14. Changes to this Policy

We may update this Policy as our practices or the law evolve. The "Last updated" date will change, and for material changes we will post a notice on this page. The version in force when information was collected governs that information until you agree otherwise or the law requires otherwise.

15. Contact

Privacy Officer, Portage Collections Inc.
120 Adelaide Street West, Suite 2410, Toronto, ON M5H 1T1, Canada
privacy@portagecollections.com · +1 (905) 932-2178

This Policy is provided for transparency. It is not legal advice, and it does not create rights beyond those the applicable law provides; where this Policy conflicts with a mandatory legal rule, the law prevails.