Privacy Policy — Drayton Banking

Drayton Banking Ltd. ("Drayton Banking," "we," "us," or "our") is committed to protecting the personal information of everyone who uses our services. This privacy policy explains — in plain language — what data we collect, why we collect it, how we protect it, and what rights you have under the Personal Information Protection and Electronic Documents Act (PIPEDA).

We don't hide anything behind legal jargon. If something in this policy confuses you, that's our failure — call us at (213) 286-6611 or email contact@draytonbanking.com and we'll explain it in person.

1. Information We Collect Through Forms

When you fill out a contact form, apply for an account, or sit down with one of our advisors, we collect the personal information necessary to serve you. Nothing more.

What we collect:

Your name, email address, phone number, and mailing address
Date of birth (required for account verification and regulatory compliance)
Financial details you share during consultations — income, employment status, existing banking relationships, debt obligations
Identity documents: government-issued photo ID and proof of address, collected under Anti-Money Laundering (AML) and Know Your Customer (KYC) requirements per FINTRAC regulations

We collect this information because the law says we must (FINTRAC regulations are non-negotiable) and because we need it to actually help you. We don't ask for information we don't plan to use.

2. Information We Collect Through Cookies

Our website uses a small number of cookies. Here's what each one does — no mystery:

Session cookies: These keep you logged into online banking. They expire when you close your browser. Without them, you'd need to re-authenticate on every single page.
Preference cookies: These remember your language setting and accessibility preferences so you don't have to reset them every visit.
Analytics cookies (Google Analytics): These help us understand how people use our website — which pages are visited most, where visitors leave, and how navigation flows work. This data is anonymized. No personal financial data is ever included in analytics.

Your cookie consent choice is stored in your browser's localStorage — not on our servers. You can change it at any time by clearing your browser data.

3. Information We Collect Through Analytics

When you visit our website, our analytics tools record some non-personal information to help us improve the experience:

Page views and time spent on each page
Navigation patterns (which pages you visit in sequence)
Device type (phone, tablet, desktop) and browser type
General geographic location at the city level (e.g., "Edmonton, AB" — not your street address)

What we never include in analytics: banking transaction data, account balances, personal financial details, names, or email addresses. Period.

We use this information to make the website better. If everyone abandons a page halfway through, we know that page needs rewriting. That's the extent of it.

4. How We Use Your Information

Your information serves four purposes — and only these four:

To provide and manage your banking services: Opening accounts, processing transactions, issuing cards, managing mortgages, and everything else you signed up for.
To comply with federal banking regulations: OSFI requires us to verify your identity. FINTRAC requires us to monitor and report certain transaction patterns. PIPEDA governs how we handle all of it. We don't have a choice here — and frankly, you want us complying with these rules.
To communicate with you about your accounts: Rate changes, service updates, account activity alerts, and scheduled reviews. We don't send marketing emails unless you've opted in.
To improve our website and digital banking platform: Using the anonymized analytics data described in Section 3 to fix what's broken and simplify what's confusing.

We refuse to use your personal information for purposes you haven't agreed to. That sounds obvious, but it's worth saying out loud.

5. How We Protect Your Information

We take security seriously — and not in the vague, corporate-brochure way. Here's exactly what we do:

256-bit AES encryption for all stored personal data. This is the same standard used by military and intelligence agencies.
TLS 1.3 for all data in transit. Every connection between your browser and our servers is encrypted.
Multi-factor authentication available (and strongly recommended) for all online banking accounts.
Annual third-party security audits conducted by independent firms. We don't grade our own homework.
Incident response protocol with public disclosure commitment. If something goes wrong, we tell you. We publish full incident reports — root cause, timeline, and corrective action. (Ask us about our 2019 interest calculation error. The report is still on our website.)

Our Director of Client Experience, Olivia Fong, runs the public Transparency Dashboard showing real-time system uptime and complaint resolution metrics. We believe security includes accountability.

6. Your Rights Under PIPEDA

You have real, enforceable rights over your personal information. Here's what you can do:

Right to access: You can ask us for a copy of all the personal information we hold about you. We'll provide it within 30 days. No runaround.
Right to correction: If any of your information is inaccurate, tell us and we'll fix it. Promptly.
Right to withdraw consent: You can withdraw consent for non-essential data processing at any time. Some data — like what FINTRAC and OSFI require us to retain — we're legally obligated to keep. We'll explain exactly what we can and can't delete.
Right to complain: If you believe we've handled your information improperly, you can file a complaint with the Office of the Privacy Commissioner of Canada. We'd prefer you talk to us first — we take complaints seriously — but the right is yours.

To exercise any of these rights, contact our Privacy Officer directly. We don't make you jump through hoops.

7. Third-Party Sharing

Let's be direct: we do not sell your personal information. Not to data brokers, not to advertisers, not to anyone. That's non-negotiable.

We share data only with the following parties, and only when legally required or operationally necessary:

Canada Deposit Insurance Corporation (CDIC): Your deposits are insured, which means CDIC needs to know they exist.
Credit bureaus (Equifax and TransUnion): If you have credit products with us — credit cards, mortgages, lines of credit — we report your account activity to both major bureaus. This is how your credit score gets built and maintained.
FINTRAC: Canada's financial intelligence unit. We're legally required to report certain transaction types and maintain identity records for regulatory compliance.
Payment processors (Interac, Visa network): When you use your debit or credit card, the payment network needs enough information to process the transaction securely.

Every entity on that list has a specific, narrow reason for receiving your data. We don't share more than necessary with any of them.

8. Contact for Privacy Concerns

Our Privacy Officer is Dr. Priya Venkatesh, Chief Risk Officer & VP of Compliance. She's not a generic inbox or an outsourced call center. She's a real person with a PhD in Financial Economics who designed our risk framework from scratch.

Privacy Officer: Dr. Priya Venkatesh

Email: contact@draytonbanking.com

Phone: (213) 286-6611

Mailing Address: 10723 Violet Henry King Plaza, Edmonton, Alberta T5K 0G1

If you have a concern about how we've handled your personal information, we want to hear about it — directly and without delay. We respond to privacy inquiries within 10 business days. Most of the time, much faster than that.

If our response doesn't satisfy you, you have the right to escalate to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

The Short Version

We collect what we need. We protect it with the best tools available. We never sell it. We tell you when something goes wrong. And if you want to know exactly what we have on file about you, just ask.

That's the whole philosophy. The seven sections above are the details.

Important Disclosures

Drayton Banking Ltd. is a federally chartered Schedule I bank regulated by the Office of the Superintendent of Financial Institutions (OSFI). Member institution of the Canada Deposit Insurance Corporation (CDIC). Eligible deposits are insured up to $100,000 per depositor, per insured category. CDIC Member Certificate No. FI-2014-0738.

Service fees may apply — see our published Schedule of Fees for full details, updated quarterly.

Drayton Banking Ltd. | Registered Office: 10723 Violet Henry King Plaza, Edmonton, Alberta T5K 0G1 | FINTRAC MSB Registration No. M14263801

Mortgage products subject to qualification under OSFI Guideline B-20 stress test requirements. All interest rates subject to change without notice.