Privacy and Cookie Notice
Last updated: 24 October 2026
1. Who is responsible
ALTA MONEY SERVICES LTD. (the “Company”) is responsible for personal information under its control through its corporate website, contact form, Investment Research Service and Business Verification Service.
Privacy questions, access or correction requests, account-closure requests and complaints may be sent to info@altamoneyservices.com.
2. Scope
This notice applies to:
- altamoneyservices.com and its contact form;
- the Investment Analysis page and authenticated area at /invest/;
- the Business Verification page and published company profiles;
- related support, corrections, complaints and security administration; and
- the cookies and local browser storage described below.
A third-party website applies its own privacy notice after a user leaves the Company’s service.
3. Information handled
3.1 General website and contact form
The Company may handle:
- requested pages, request time, Internet Protocol address, browser/device information and security records;
- full name, optional company name, business email, optional telephone number, enquiry topic and message; and
- contact-form consent and request-verification information needed to protect and deliver the enquiry.
Do not submit passwords, banking credentials, payment-card information, identity documents, source-of-funds records or other unnecessary sensitive information through the contact form.
3.2 Investment Research Service
When a user chooses Google sign-in, the Company receives the stable Google account identifier, verified email address and display name needed for the research account. The Company does not receive the user’s Google password.
The service may also handle:
- account status, session and request-verification information;
- selected market, security type, ticker, research stage and request time;
- research status, results, source references, source documents and report history;
- credit grants, reservations, use and release records;
- error, integrity, access and security records; and
- complaints and correction requests.
Research-data sources may receive the selected ticker, market route or security type when the service requests market, filing or reference information. The Company does not send the user’s Google password to those sources.
The current service does not ask for a user’s complete portfolio, income, assets, debts, investment objectives, risk tolerance, time horizon or tax position to personalize a result.
3.3 Business Verification Service
Company searches and optional name screening are sent to the Company’s same-origin search endpoints for processing against approved public-source datasets and server-held indexes. Search terms are not placed in public profile URLs or sitemaps, and the Company does not send raw search terms to Google Analytics.
Names of individuals are used only to screen against applicable public sanctions lists; they are not used to return company relationships. A person may request correction of Business Verification information through the existing Business Verification correction channel.
The Company publishes approved public profile fields such as legal name, jurisdiction, entity type/status, general location, identifiers, source and dates. A correction request may contain the requester’s contact information, the disputed profile or field, supporting source and related correspondence.
The service does not publish private client files, identity documents, ownership evidence, internal risk scores, monitoring alerts, case notes or payment-service compliance decisions.
4. Purposes
The Company uses personal information to:
- deliver and protect the website and contact form;
- respond to enquiries, privacy requests, complaints and corrections;
- authenticate research users and separate account records;
- process, display and preserve requested research and credit entries;
- verify result identity, sources and integrity;
- publish and correct approved public company profiles;
- detect misuse and investigate security events;
- maintain service, legal and dispute records; and
- comply with lawful obligations and establish, exercise or defend legal claims.
The Company does not use current research requests to create personalized investment recommendations.
5. Service providers and processing locations
Google provides user-initiated identity authentication for /invest/, and Google Cloud provides infrastructure used by the corporate website and Investment Research Service. ADM.TOOLS provides email-related services. These and other service providers may process personal information for the functions they provide to the Company. Information may be processed outside Canada and may be accessible to courts, law-enforcement or national-security authorities under the laws of the jurisdiction where it is processed. Processing locations can vary by provider and configuration; current information is available on request.
Research-data providers may process ticker, market, security-type and source requests.
The Company may disclose personal information:
- to service providers acting for the Company;
- to professional advisers bound by confidentiality;
- to investigate abuse or a security event;
- to establish, exercise or defend legal rights; or
- where required or authorized by law.
The Company does not currently use a payment provider or behavioural-advertising provider. When a visitor chooses to allow optional analytics, Google Analytics processes pseudonymous website-use information for traffic and page-performance reporting. The Company does not send names, email addresses or contact-form contents to Google Analytics.
6. Cookies and local browser storage
| Name | Type and purpose | Duration |
|---|---|---|
| ALTA_CONTACT | First-party Secure, HttpOnly, SameSite=Strict session cookie used to protect the contact form and bind its request-verification value. | Browser session; the request-verification value is accepted for no more than 30 minutes. |
| alta-analytics-consent-v1 | First-party local storage recording whether the visitor allowed or refused optional analytics. | Until site data is cleared or the choice is replaced. |
| _ga and _ga_* | Google Analytics cookies used only after permission to distinguish pseudonymous visitors and sessions and measure page usage. Advertising signals are disabled. | Up to 2 years, subject to browser controls and Google Analytics configuration. |
| __Secure-financial-login | First-party Secure, HttpOnly, SameSite=Lax cookie limited to /invest; protects and binds the Google sign-in request. | 10 minutes; cleared after successful sign-in. |
| __Secure-financial-session | First-party Secure, HttpOnly, SameSite=Lax cookie limited to /invest; maintains the authenticated research session. | 24 hours, or earlier on sign-out or revocation. |
| altamani-language | First-party local storage that remembers Ukrainian or English display preference. | Until site data is cleared or another language is selected. |
No advertising cookie or active third-party media embed is used. Google Analytics loads only after the visitor selects Allow analytics; choosing Essential only leaves the analytics tag unloaded.
Google may set or read provider-controlled cookies on Google pages during sign-in. Those cookies are controlled by Google, not by the Company’s domain.
7. Choices and consent
The contact and authentication cookies are necessary for the requested security or account function. Blocking them may prevent contact-form submission or sign-in. The alta-analytics-consent-v1 and altamani-language local-storage values remember the visitor’s analytics choice and research-interface language preference. They can be removed through browser controls.
The alta-analytics-consent-v1 value records the visitor’s analytics choice. It is not contractual acceptance. Refusing analytics does not block the core website.
Optional Google Analytics remains off until the visitor chooses Allow analytics. A visitor may refuse by choosing Essential only and can change the choice at any time through the Privacy choices control. Any future advertising, profiling or other non-essential technology will require a separate notice and applicable choice before activation.
8. Retention
Temporary sign-in state expires after 10 minutes. An authenticated research session expires after 24 hours unless ended sooner. Browser local-storage values remain until cleared or replaced.
Except for the specific temporary periods above, the Company applies record-specific retention criteria rather than one universal period. Contact, account, credit, research, source, profile-correction, complaint and security records are retained only while reasonably required for the stated purpose, the service relationship, applicable law, contractual obligations, security, dispute resolution or a documented legal hold. Signing out does not delete persistent account or research records. Deletion may be manual and is not triggered solely by signing out.
Where British Columbia law requires information used to make a decision directly affecting an individual to be retained for at least one year, the Company follows that requirement unless a longer lawful period applies.
As soon as it is reasonable to conclude that retaining personal information no longer serves the purpose for which it was collected and is no longer necessary for legal or business purposes, the Company must destroy the documents containing it or remove the means of associating it with an individual. A longer applicable retention requirement or documented legal hold continues to apply.
9. Security
The Company uses measures appropriate to the information, including transport security, restricted accounts, request verification, session controls, account separation and integrity checks. No method of transmission or storage is completely secure.
Users should sign out on shared devices, protect their Google account and report suspected unauthorized access promptly.
10. Access, correction, account closure and withdrawal
Subject to applicable law, a person may request access to personal information under the Company’s control, information about how it has been used and, where required, to whom it has been disclosed; request correction; withdraw a consent where applicable; or make a privacy complaint.
Separately, a research-account holder may ask the Company to close the account or delete information that is no longer required.
Signing out ends the current authenticated session. It does not close the research account or delete account, credit, request, result, source, complaint or security records.
The Company may require reasonable identity verification. Access and correction requests will be handled within the deadlines required by applicable law, subject only to an exception or extension permitted by that law. If access or correction is refused or limited, the Company will provide the notice, reasons and information about recourse required by applicable law.
For an account-closure or deletion request, applicable legal or business retention requirements, security needs, disputes, record-preservation duties and backup treatment may affect what can be deleted or when. The Company will explain a material limitation and continue to protect retained information. A contractual or backup requirement does not override a statutory access or correction right.
Requests should be sent to info@altamoneyservices.com with enough information to locate the record, but without unnecessary sensitive information.
11. Complaints
A privacy complaint may be sent to info@altamoneyservices.com with the subject “Privacy Complaint.” The Company will review the complaint and provide an outcome as required by applicable law. A person may also contact the applicable privacy regulator.
12. Changes to this notice
The Company will update this notice when a material service, provider, location, collection, use, disclosure or browser technology changes. A new choice will be obtained where applicable law requires it.