Privacy Policy
PRIVACY POLICY AND PRIVACY NOTICE
Effective Date: October 7, 2026
This Privacy Policy and Privacy Notice ("Privacy Policy") explains how Mehmi Group Corp., doing business as Mehmi Financial Group ("Mehmi," "we," "us," or "our"), collects, uses, discloses, stores, protects and otherwise processes personal information.
This Privacy Policy applies to MehmiGroup.com, our online application forms, customer and partner portals, communications, commercial financing brokerage services, vendor and broker programs, and related services involving Canada, the United States, the United Kingdom and Australia. It applies to personal information handled in connection with an enquiry even if financing is not available or the enquiry does not proceed.
Mehmi is a Canadian commercial financing brokerage and intermediary. Mehmi is not a bank, credit union or direct lender. The availability of a particular brokerage service depends on the applicant, transaction, location and applicable legal requirements.
This Privacy Policy should be read together with our Terms of Use and any separate consent, credit authorization, financing application, vendor agreement, broker agreement or other document that applies to a particular relationship or transaction.
1. PURPOSE OF THIS PRIVACY POLICY
This Privacy Policy describes our privacy practices. It is not intended to serve as blanket consent for every collection, use or disclosure of personal information.
Where applicable law requires specific, express or separate consent, including consent concerning sensitive personal information, consumer credit reports, certain marketing activities, profiling, cookies or other processing, Mehmi will seek the applicable consent separately.
Using our Website does not by itself authorize Mehmi or any financing provider to obtain your personal consumer credit report.
2. WHO THIS POLICY APPLIES TO
This Privacy Policy may apply to individuals including business owners, directors, officers, employees, authorized representatives, sole proprietors, partners, shareholders, beneficial owners, personal guarantors, co-applicants, vendors, equipment dealers, brokers, referral partners, website visitors, prospective clients and other individuals whose personal information is provided to or obtained by Mehmi.
Commercial information about a corporation or other organization that does not identify an individual may not constitute "personal information" under applicable privacy legislation. Mehmi may nevertheless protect confidential business information through appropriate contractual, administrative and security measures.
Our financing services are intended for legitimate business and commercial purposes.
3. PERSONAL INFORMATION WE MAY COLLECT
Depending on your interaction with Mehmi, we may collect the following categories of information:
Identity and Contact Information:
Name, business title, mailing address, email address, telephone number and preferred language.
Business Information:
Business name, operating name, address, industry, website, legal structure, incorporation information, time in business and business activities.
Ownership Information:
Shareholders, directors, officers, partners, beneficial owners, ownership percentages and authorized representatives.
Government and Identification Information:
Date of birth, government-issued identification, driver's licence information, passport information and, where legitimately required, tax or government identification numbers.
Financial Information:
Business revenue, expenses, financial statements, tax information, bank statements, banking details, void cheques, payment history, outstanding obligations and debt.
Financing Application Information:
Requested amount, financing purpose, transaction structure, desired term, source of down payment and other underwriting information.
Credit Information:
Business credit information and, where separately authorized and lawfully obtained, personal consumer credit reports, scores, credit history and related information.
Guarantor Information:
Identity, contact, financial, ownership, credit and net-worth information relating to proposed personal guarantors.
Equipment and Collateral Information:
Asset description, make, model, year, serial number, VIN, mileage, hours, purchase price, invoice, seller, ownership, title, condition and collateral details.
Transaction Information:
Financing offers, approvals, declines, conditions, executed documents, funding status and transaction history.
Documents:
Financial statements, bank statements, tax documents, invoices, purchase orders, identification documents, corporate documents and other documents submitted in connection with a financing request.
Communications:
Emails, text messages, support messages, portal communications, notes and telephone or video communications, including recordings where permitted by law and appropriate notice or consent has been provided.
Website and Device Information:
IP address, browser type, operating system, device information, referring pages, pages viewed, dates and times, navigation, clicks and Website interactions.
Advertising and Analytics Information:
Cookie identifiers, advertising identifiers, campaign information, referral information and information concerning interactions with advertising or Website content.
Verification and Fraud-Prevention Information:
Identity-verification results, document-verification results, fraud signals, public-record information and other risk or compliance information.
Professional and Business-Contact Information:
Publicly available professional information, business-directory information and information obtained from referral or business-intelligence sources where lawful.
Preferences:
Communication preferences, marketing preferences, language and cookie/privacy preferences.
Inferences and Internal Assessments:
Internal categorization, application status, potential lender matches, fraud or risk indicators and other assessments generated from information relating to a financing request.
4. INFORMATION WE GENERALLY DO NOT NEED
Do not provide Mehmi with information that has not been requested and is not reasonably relevant to your financing request.
Do not send passwords, online banking passwords or other authentication credentials to Mehmi by ordinary email or through general Website contact forms.
Mehmi does not knowingly request biometric information unless it is required for a specific legitimate verification process, the collection is lawful and any legally required disclosure or consent has been provided.
5. HOW WE COLLECT INFORMATION
We may collect information directly from you when you complete a form, submit an application, upload documents, communicate with us, use a portal, speak with our team, enter into an agreement or otherwise interact with Mehmi.
We may also receive information from authorized business representatives, co-applicants, guarantors, vendors, dealers, brokers, referral partners, financing providers, credit-reporting agencies, identity-verification providers, fraud-prevention providers, banks or bank-verification providers, public records, corporate registries, security registries, business-information providers and other lawful sources.
When another person supplies information concerning you, any notice, authority or consent required by applicable law must also be provided or obtained. Where required, Mehmi will explain the categories of information received and its source. Providing information through a business representative does not remove the privacy rights of the individual concerned.
Providing another individual's information to Mehmi does not automatically authorize Mehmi to obtain that person's consumer credit report.
6. WEBSITE TECHNOLOGIES
Mehmi may use cookies, pixels, tags, scripts, software development kits and similar technologies in connection with the Website.
These technologies may be used for Website functionality, security, fraud prevention, analytics, performance measurement, marketing, advertising and remembering preferences.
Our current Website technologies may include services such as HubSpot, Google Analytics, Google advertising technologies, Meta advertising technologies and similar service providers.
The specific technologies used may change. Where appropriate, our Website or cookie-management tool may provide additional information about active technologies and available choices.
Some analytics tools may measure navigation, scrolling, clicks, page interactions or similar activity to help us understand Website performance and improve our services.
Advertising and analytics technologies should not be used to capture the contents of financing documents, bank statements, consumer credit reports, passwords or government identification documents.
7. COOKIES, PROFILING AND YOUR CHOICES
Where applicable law requires consent for cookies, pixels, tracking or similar technologies, consent must be specific, informed and given through an affirmative choice. Continued browsing or acceptance of this Privacy Policy does not supply that consent. A legally permitted exception applies only to the technology and purpose that satisfy its conditions.
You may be able to accept or reject categories of non-essential cookies through our Website cookie settings.
Disabling certain technologies may affect optional Website functionality but should not prevent you from requesting financing through another available channel.
Browser settings may also permit you to block or delete cookies.
Certain privacy laws require recognition of valid browser-based opt-out signals, such as Global Privacy Control, for processing covered by those laws. These rights depend on the applicable law and the processing concerned. You may also contact our Privacy Officer to exercise an applicable privacy right.
Our Cookie Policy identifies cookie controls and relevant technologies. The optional homepage country display uses an IP-based lookup from HackMyIP only after the functional-consent choice described there. The lookup provider receives the IP address and ordinary request information. The country result is kept in browser-tab session storage and cleared when that consent is withdrawn. The Cookie Policy explains how to manage this choice.
Legacy browser "Do Not Track" signals that do not constitute a legally recognized opt-out mechanism may not be interpreted uniformly by Website technologies.
8. HOW WE USE PERSONAL INFORMATION
Mehmi may use personal information to provide and operate our commercial financing brokerage services; review and package financing requests; determine whether a financing request appears suitable for submission to potential financing providers; communicate with applicants and business partners; verify identity, business information, ownership, financial information and documents; identify potential financing options; submit applications to appropriate financing providers; facilitate underwriting and closing; track application status; support funded transactions; maintain customer and partner relationships; prevent fraud and misuse; manage risk; maintain Website and information security; respond to support requests; improve our services; administer vendor and broker programs; maintain business records; comply with law, legal process and regulatory requirements; establish or defend legal rights; perform analytics; and conduct marketing where permitted.
We may also use information to determine which financing providers or products may potentially match a financing request. A lender match does not constitute an approval and does not guarantee a particular rate, term or funding result.
8A. UNITED KINGDOM DATA CONTROLLER AND LAWFUL BASES
Where the UK General Data Protection Regulation and the Data Protection Act 2018 apply to our processing, Mehmi Group Corp. is the controller of personal information for which it determines the purposes and means of processing. Our Canadian contact address and the contact details for our Privacy Officer appear in section 39. An independent financing provider may be a separate controller for its own assessment and services.
Services requested by an individual. Where you are personally a party to a contract with Mehmi, or ask us to take steps before entering into such a contract, we rely on contractual necessity for information needed to respond to that request, prepare and submit the application, communicate with you and perform our agreed brokerage services. This basis does not automatically apply to your information merely because your company has a contract with us.
Business contacts and corporate applications. Where we deal with an employee, director, owner, representative or proposed guarantor who is not personally a party to our contract, we rely on legitimate interests where the necessary balancing test is met. Those interests include responding to business enquiries, administering business relationships, assessing and presenting commercial financing requests, communicating with relevant parties and keeping appropriate transaction records.
Fraud prevention, security and business administration. We rely on legitimate interests, where that basis is available and the necessary balancing test is met, to verify relevant information, prevent fraud and misuse, maintain the security of our services, investigate complaints, maintain proportionate records and establish or defend legal claims. We do not rely on this basis where your interests or fundamental rights override the interests pursued.
Legal obligations. We rely on the legal-obligation basis where processing is necessary to comply with a legal duty recognized under UK data-protection law that applies to Mehmi, such as handling statutory privacy requests or complying with a binding legal requirement. An obligation under another country's law or under a contract does not automatically establish this UK lawful basis.
Marketing, analytics and consent. We rely on consent where it is required for marketing, tracking or another specific purpose, and only for the purposes covered by that consent. Where electronic-marketing rules permit business communications without consent, we may rely on legitimate interests for the related personal-information processing, subject to the required balancing test and your right to object. For service-improvement analytics that do not require consent, legitimate interests may apply where the relevant legal conditions are met. Accepting this Privacy Policy is not consent to optional marketing or tracking.
Where special-category or criminal-offence information is processed, an additional legal condition or authorization may be required as well as an ordinary lawful basis. The applicable basis depends on the purpose and circumstances. You may ask our Privacy Officer about the basis relevant to your information.
If information reasonably needed to assess, submit or administer your financing request is not provided, Mehmi or a financing provider may be unable to proceed. Any specific legal or contractual requirement to provide information, and the consequences of not providing it, will be explained where applicable.
9. CREDIT REPORTS AND CREDIT INFORMATION
Mehmi may obtain or facilitate access to business credit information where lawfully permitted.
A personal consumer credit report will be obtained only where there is a lawful permissible purpose and any authorization required by applicable law has been obtained.
Submitting a Website form or financing application does not, by itself, constitute blanket authorization for Mehmi to obtain the personal consumer credit report of every owner, officer, guarantor or other individual connected with a business.
Where personal consumer credit is required, Mehmi may request a separate Credit Report Authorization.
Each person whose personal credit may be accessed must provide their own authorization where required by law.
A financing provider may also request or obtain its own credit report after receiving an application where it has an applicable lawful basis and authorization.
A hard credit inquiry may appear on a consumer's credit file and may affect their credit score.
Where an application is submitted to more than one financing provider, more than one financing provider may conduct a separate inquiry where legally permitted and properly authorized.
Credit reports and consumer-report information are handled subject to applicable credit-reporting and privacy laws.
Mehmi does not provide an individual's consumer credit report to an equipment dealer, vendor, referral partner or independent broker merely because that person or organization referred the transaction, except where disclosure is legally permitted and appropriate authorization or another lawful basis exists.
10. FINANCING PROVIDERS
The central purpose of Mehmi's brokerage services is to help connect business applicants with potential financing providers.
Where appropriate to your financing request and permitted by law, Mehmi may disclose relevant information to prospective banks, credit unions, finance companies, leasing companies, factoring companies, asset-based lenders, private lenders, commercial-financing providers and other financing sources.
Information supplied may include application information, business information, ownership information, financial information, financing requirements, supporting documents, information concerning collateral and, where lawfully obtained and permitted to be disclosed, credit-related information.
Mehmi may submit a financing request to more than one financing provider when reasonably appropriate.
Mehmi is not required to submit your information to every financing provider in its network.
Financing providers are generally independent organizations. Once information is lawfully disclosed to an independent financing provider, that provider may process the information under its own privacy policies, regulatory obligations and legal requirements. This does not remove any responsibility that applicable law places on Mehmi for its own collection, use or disclosure, or for a recipient's handling of information.
Withdrawal of consent from Mehmi may prevent future submissions by Mehmi but ordinarily cannot reverse a disclosure already lawfully made, require another independent organization to erase information it is legally entitled or required to retain, or reverse a credit inquiry that has already occurred.
11. SERVICE PROVIDERS
Mehmi may use third parties to provide services such as Website hosting, cloud infrastructure, document storage, cybersecurity, CRM systems, communications, electronic signatures, analytics, identity verification, document verification, bank verification, fraud prevention, payment processing, customer support, accounting, legal services and other business operations.
We seek to use service providers appropriate to the nature and sensitivity of information being processed.
Where appropriate or required by law, contractual or other measures are used to restrict service providers' handling of personal information.
Service providers may themselves use subprocessors in accordance with their agreements and applicable law.
12. VENDORS, DEALERS, BROKERS AND REFERRAL PARTNERS
Where a financing application originates through a vendor, equipment dealer, broker, ISO, referral partner or similar business partner, Mehmi may exchange information reasonably necessary to administer the relationship or transaction.
For example, Mehmi may communicate whether additional documents are required or whether a transaction is pending, conditionally approved, declined, closed or funded where such communication is appropriate and lawful.
Mehmi will not disclose more sensitive personal information merely because a third party referred the applicant.
Separate agreements may govern how vendor, broker and referral partners may receive and use information.
13. CREDIT BUREAUS, VERIFICATION AND FRAUD-PREVENTION PROVIDERS
Where authorized or otherwise permitted by law, Mehmi may exchange relevant information with credit bureaus, identity-verification services, document-verification providers, fraud-prevention services, business-information services, public registries and similar services.
We may use this information to confirm identity, identify altered or inconsistent documents, validate ownership or business information, protect financing providers and applicants from fraud, and make internal decisions concerning whether Mehmi will continue processing a file.
14. FRAUD, SECURITY AND LEGAL COMPLIANCE
Mehmi may use or disclose information where reasonably necessary and legally permitted to detect, prevent, investigate or respond to suspected fraud, identity theft, cyberattacks, document manipulation, unauthorized access, illegal activity or threats to individuals, Mehmi, financing providers or others.
Information may also be disclosed where required or permitted by applicable law, regulation, subpoena, warrant, court order, regulatory request or other valid legal process.
Mehmi may preserve information where reasonably necessary for litigation, investigations, regulatory matters, enforcement of agreements or the establishment, exercise or defence of legal rights.
15. MARKETING COMMUNICATIONS
Mehmi may send commercial or promotional emails, SMS messages or similar communications only where permitted by applicable electronic-marketing law and supported by an applicable privacy-law basis. Where marketing consent is required, it must be obtained separately from accepting this Privacy Policy or submitting a financing request.
For recipients in Canada, commercial electronic messages are sent in accordance with applicable requirements of Canada's Anti-Spam Legislation.
United Kingdom. Where UK electronic-marketing rules apply, unsolicited marketing emails or SMS to individual subscribers, including sole traders and certain partnerships, require consent unless the conditions of an applicable soft opt-in are met. Different consent rules apply to corporate subscribers, but personal-information processing still requires a lawful basis and relevant objections must be respected. Publicly available contact details do not, by themselves, establish marketing consent.
Australia. Where Australian electronic-marketing law applies, commercial electronic messages require express or valid inferred consent, sender identification and a functioning unsubscribe option. Accepting this Privacy Policy does not, by itself, establish that consent. Unsubscribe requests must be given effect within the applicable legal period.
Promotional communications will contain or be accompanied by an appropriate method to unsubscribe where required.
Transactional communications concerning an application, requested service, security matter, documentation request or existing business relationship are different from optional marketing communications.
Withdrawing consent from promotional communications does not prevent Mehmi from sending service-related or legally required communications.
16. ADVERTISING AND TARGETED ADVERTISING
Mehmi may use advertising providers to measure campaigns, create audiences, understand Website usage or display advertisements.
These technologies may involve disclosing online identifiers, device information and Website activity to advertising platforms.
Mehmi does not sell personal financial application information for money.
However, certain U.S. privacy laws define terms such as "sale," "sharing," "targeted advertising" or "cross-context behavioural advertising" broadly enough that some disclosures involving advertising cookies or pixels may fall within those definitions even where Mehmi receives no monetary payment.
Where a law applying to Mehmi gives an individual the right to opt out of such processing, Mehmi will provide an applicable opt-out method.
Mehmi does not use or intentionally disclose bank statements, consumer credit reports, government identifiers, financial account numbers or uploaded financing documents for targeted advertising.
17. "DO NOT SELL OR SHARE" AND PRIVACY CHOICES
Where applicable law gives you a right to opt out of sale, sharing or targeted advertising, you may submit that request to our Privacy Officer at support@mehmigroup.com. Any additional Website privacy controls or browser-signal rights depend on the applicable law and the processing concerned. An electronic-marketing unsubscribe applies to the communication channel identified in that message.
An opt-out from advertising-related sharing does not prevent disclosures reasonably necessary to process a financing application, prevent fraud, maintain security, comply with law or provide requested services where those disclosures are otherwise lawful.
18. AUTOMATED TOOLS AND ARTIFICIAL INTELLIGENCE
Mehmi may use automated or artificial-intelligence-assisted tools to support administrative and brokerage activities such as extracting information from documents, categorizing applications, identifying missing information, detecting inconsistencies, assisting fraud review, generating summaries, prioritizing internal workflows and identifying potential financing-provider matches.
The use of such tools does not guarantee approval or funding.
Mehmi does not represent that an internal automated recommendation constitutes a lender's underwriting decision.
Where applicable law requires information or safeguards for a decision made wholly or partly through automated processing, Mehmi will provide the required information and applicable review or challenge rights. This may include information about the personal information used, the type of decision, its significance and the relevant decision process. You may contact our Privacy Officer about the use of automated tools in handling your information.
Where Québec law applies to a decision made exclusively through automated processing, the affected person may have the right to request information concerning the personal information used and the principal factors and parameters leading to the decision and to present observations to a member of Mehmi personnel capable of reviewing that decision.
19. BUSINESS TRANSFERS
Personal information may be disclosed in connection with a proposed or completed corporate transaction such as a financing, reorganization, merger, amalgamation, acquisition, asset sale, business sale or similar transaction where permitted by applicable law.
Appropriate confidentiality or other protective measures will be used where required.
20. CROSS-BORDER PROCESSING
Mehmi is based in Canada and provides commercial financing brokerage services involving eligible businesses in Canada, the United States, the United Kingdom and Australia, subject to applicable legal and regulatory requirements.
Personal information may be processed or stored in Canada, the United States or other countries where a relevant financing provider or service provider handles it. The actual destinations depend on the transaction and services used, and may differ from the countries in which we offer brokerage services. Where required, we will identify likely overseas recipient countries in the information provided for the relevant collection or disclosure.
Information processed in another jurisdiction may be subject to lawful access by courts, governmental bodies, regulators or law-enforcement authorities in that jurisdiction.
Where applicable law requires safeguards or an assessment before information is transferred or disclosed across borders, the relevant requirements must be satisfied before that transfer or disclosure proceeds. You may contact our Privacy Officer for information about the destinations and safeguards relevant to your information and, where applicable, how to obtain a copy of the safeguards.
Where Québec privacy legislation applies, Mehmi will conduct a privacy impact assessment before communicating personal information outside Québec where required and will use the written arrangements required by applicable law.
20A. UNITED KINGDOM AND AUSTRALIAN OVERSEAS DISCLOSURES
Where UK data-protection law applies to a restricted transfer of personal information, the transfer must be covered by applicable UK adequacy regulations, appropriate safeguards, or a valid legal exception. Adequacy for Canada is limited to information covered by Canada's Personal Information Protection and Electronic Documents Act. Other destinations or recipients may require a different transfer mechanism.
Where adequacy does not cover a restricted transfer, appropriate safeguards may include an applicable UK International Data Transfer Agreement or UK Addendum to approved contractual clauses, together with any required assessment and additional protections. The appropriate mechanism depends on the recipient and processing. Contact our Privacy Officer for information about the mechanism and safeguards relevant to your information.
Where the Australian Privacy Act 1988 and Australian Privacy Principles apply, overseas disclosures are subject to the applicable requirements, including reasonable steps concerning an overseas recipient's handling of personal information unless a legal exception applies. A recipient's independent status or a contract with that recipient does not, by itself, remove any accountability imposed on Mehmi by law.
21. RETENTION
Mehmi retains personal information only for as long as reasonably necessary for the purposes for which it was collected and for legitimate legal, regulatory, contractual, fraud-prevention, accounting, audit, dispute-resolution and record-keeping requirements.
Retention periods may vary based on the type and sensitivity of information, whether an application was funded, declined, withdrawn or abandoned, the relationship with a financing provider, limitation periods, applicable legal requirements and whether a dispute, audit or investigation is pending.
Information relating to funded transactions may be retained for a longer period than information concerning a basic Website inquiry.
Information concerning unsuccessful, declined or withdrawn applications may be retained for a reasonable period where necessary for compliance, audit, fraud prevention, dispute management or legitimate business records.
When information is no longer reasonably required and no legal basis requires further retention, Mehmi will take appropriate steps to securely destroy, delete or anonymize it in accordance with applicable law and our retention practices.
You may ask our Privacy Officer for information about the retention period or criteria applicable to your information.
22. SECURITY
Financial, identity and credit information can be highly sensitive.
Mehmi maintains administrative, technical and physical safeguards designed to protect personal information against unauthorized access, loss, theft, disclosure, copying, modification, misuse or destruction.
Safeguards may include access controls, authentication measures, encryption or secure transmission technologies where appropriate, logging and monitoring, employee confidentiality requirements, security awareness, vendor-management practices, secure disposal and other controls appropriate to the sensitivity of information and the nature and size of our business.
Access to personal information is intended to be limited to individuals and service providers who require access for legitimate business purposes.
No Internet transmission, electronic storage system or security program can guarantee absolute security.
Individuals should immediately notify Mehmi if they believe information supplied to Mehmi has been compromised.
23. SECURITY INCIDENTS AND PRIVACY BREACHES
Mehmi maintains procedures for identifying, investigating, containing and responding to suspected privacy and security incidents.
Where a breach triggers a legal reporting or notification obligation, Mehmi will notify the applicable privacy regulator, affected individuals or other parties in accordance with applicable law.
Where PIPEDA applies, this may include reporting breaches of security safeguards that create a real risk of significant harm and maintaining required breach records.
Where Québec law applies, Mehmi will comply with applicable obligations concerning confidentiality incidents presenting a risk of serious injury, including required notifications and records.
24. ACCURACY
Mehmi takes reasonable steps to ensure that personal information used to make material decisions is sufficiently accurate, complete and current for the purpose for which it is used.
Applicants are responsible for providing accurate information and advising Mehmi of material changes during the application process.
You may request correction of inaccurate personal information where applicable law provides that right.
25. YOUR CANADIAN PRIVACY RIGHTS
Depending on the applicable Canadian federal or provincial privacy legislation, you may have rights to request access to personal information held by Mehmi, understand how it has been used or disclosed, challenge its accuracy, request correction, withdraw consent subject to legal and contractual restrictions, challenge Mehmi's compliance with applicable privacy legislation and make a complaint to an appropriate privacy regulator.
A withdrawal of consent does not invalidate processing that was lawful before withdrawal.
Withdrawal may prevent Mehmi from continuing to provide a requested service when the relevant information is reasonably necessary to provide that service.
Certain information may be withheld where a legal exception to access applies, including information relating to another person, legally privileged information or information that applicable law otherwise permits Mehmi to withhold.
26. ADDITIONAL RIGHTS FOR QUÉBEC RESIDENTS
Where Québec's private-sector privacy legislation applies, individuals may have additional rights including rights concerning access and rectification, withdrawal of consent, portability of qualifying computerized personal information, information concerning automated decisions and, in limited circumstances, cessation of dissemination, de-indexation or re-indexation.
Beginning September 22, 2024, qualifying computerized personal information collected from the individual may be requested in a structured and commonly used technological format subject to applicable limitations.
A request concerning Québec privacy rights should be submitted in writing to Mehmi's Privacy Officer.
27. UNITED STATES STATE PRIVACY RIGHTS
Residents of certain U.S. states may have additional privacy rights where the applicable state privacy law applies to Mehmi and the information concerned.
Depending on applicable law, those rights may include the right to confirm whether personal data is processed, obtain access, receive a portable copy, correct inaccuracies, request deletion, opt out of the sale of personal data, opt out of targeted advertising, opt out of certain profiling, limit certain uses of sensitive personal information, use an authorized agent and appeal a denied privacy-rights request.
Mehmi will not unlawfully discriminate against an individual for exercising a privacy right.
These rights are subject to statutory exceptions and exemptions. Certain information, including information regulated under other financial or credit-reporting laws, may be wholly or partially exempt from a particular state privacy law.
28. CALIFORNIA PRIVACY NOTICE
This section applies if and to the extent Mehmi is subject to the California Consumer Privacy Act, as amended ("CCPA"), with respect to the individual or information concerned.
For purposes of the CCPA, the categories described in this Privacy Policy may include identifiers; customer-record information; commercial information; Internet or other electronic-network activity; professional or employment-related information; geolocation information at an approximate level derived from technical data; sensitive personal information where collected; and inferences derived from other information.
Mehmi may collect these categories directly from individuals and from the other sources described in this Privacy Policy.
Mehmi uses them for the business and commercial purposes described in this Privacy Policy.
Mehmi may disclose relevant categories to financing providers, verification providers, fraud-prevention providers, service providers, professional advisers, business partners and government or legal authorities as described above.
Mehmi does not sell application-level financial information for monetary consideration.
Certain advertising and analytics disclosures may constitute "sharing" or "sale" under the CCPA's statutory definitions. Where the CCPA applies, California residents have the applicable rights to opt out, including any right to use a legally recognized opt-out preference signal. Requests may be sent to our Privacy Officer at support@mehmigroup.com.
California residents may also have rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information and exercise their rights without unlawful discrimination, subject to applicable exemptions.
28A. UNITED KINGDOM PRIVACY RIGHTS AND COMPLAINTS
Where UK data-protection law applies, you may have rights to request access to your personal information, correct inaccurate information, request erasure, restrict processing and receive certain information in a portable format. These rights depend on the relevant processing and legal conditions. You may withdraw consent for future consent-based processing without affecting processing that was lawful before withdrawal.
Your right to object. You may object to processing based on legitimate interests for reasons relating to your particular situation. You have the right to object to the use of your personal information for direct marketing, including related profiling, at any time.
Where a solely automated decision has a legal or similarly significant effect on you and the relevant UK safeguards apply, you may request human intervention, make representations and contest the decision. You may ask for the information about the decision and its effects that the law requires us to provide. Contact our Privacy Officer to exercise an applicable right.
Privacy-rights requests may be sent to support@mehmigroup.com. We will respond within the applicable statutory period, generally one month for a UK rights request, subject to any lawful extension, identity-verification or clarification rules. We may need proportionate information to identify you or understand your request.
To raise a data-protection complaint, contact our Privacy Officer and explain the concern and the relevant interaction. Where UK law applies, we will acknowledge your complaint within 30 days, investigate without undue delay, keep you appropriately informed and communicate the outcome. You also have the right to complain to the UK Information Commissioner's Office (ICO).
28B. AUSTRALIAN PRIVACY RIGHTS AND COMPLAINTS
Where the Australian Privacy Act 1988 and Australian Privacy Principles apply to Mehmi and the information concerned, you may request access to personal information we hold about you and ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Contact our Privacy Officer at support@mehmigroup.com and describe the information or correction requested. We may need proportionate information to verify your identity.
We will handle requests within the period required by applicable law and explain any refusal and available complaint route where required. Access may be subject to lawful exceptions. Where required, there is no charge to make an access request or seek correction, and any permitted charge for providing access must be reasonable and explained.
If you believe we have mishandled your personal information or breached an applicable Australian privacy requirement, please contact our Privacy Officer with details. We will review the complaint and respond within a reasonable period, generally 30 days. If you are dissatisfied with our response or do not receive a response within a reasonable period, you may contact the Office of the Australian Information Commissioner (OAIC), subject to its jurisdiction and complaint requirements.
29. SENSITIVE PERSONAL INFORMATION
Mehmi processes sensitive personal information only for legitimate purposes connected with requested financing services, security, fraud prevention, identity verification, legal compliance or other purposes permitted by applicable law.
Mehmi does not use sensitive application information to infer unrelated personal characteristics for advertising purposes.
Where applicable law requires consent before processing sensitive personal information, Mehmi will obtain that consent.
30. PRIVACY REQUESTS
Privacy-rights requests and privacy complaints may be submitted to our Privacy Officer at support@mehmigroup.com or through the other contact information below. Please describe your concern or the right you wish to exercise and provide enough information for us to identify the relevant interaction.
Mehmi may need to verify your identity before fulfilling a request. Verification information will be used for the purpose of verifying or administering the request.
We will not provide sensitive personal information to a requester until we are reasonably satisfied that the request is authentic.
Where applicable law permits an authorized agent to make a request, Mehmi may require appropriate evidence showing the agent's authority.
Mehmi will respond within the period required by applicable law.
Where a request is denied in whole or in part, Mehmi will provide information concerning the denial or available appeal procedures when legally required.
31. PRIVACY APPEALS
Where applicable U.S. state privacy law gives a consumer the right to appeal a decision concerning a privacy request, the individual may submit a written appeal to the Privacy Officer using the contact information below and clearly identify the communication as a Privacy Appeal.
Mehmi will process the appeal in accordance with applicable law.
32. MARKETING OPT-OUTS
You may unsubscribe from marketing emails by using the unsubscribe mechanism contained in the message.
Where promotional SMS messages are offered, applicable messages will provide the appropriate opt-out instructions where required.
An opt-out from marketing does not constitute a request to delete an application or transaction record and does not prevent service-related communications.
33. CHILDREN AND MINORS
Mehmi's Website and commercial financing Services are not directed to children.
Financing applicants and individuals providing guarantees are expected to have the legal capacity required to enter into the applicable commercial transaction.
Mehmi does not knowingly collect children's personal information for commercial financing purposes.
If we learn that personal information belonging to a minor was collected in circumstances where it should not have been collected, we will take appropriate steps in accordance with applicable law.
34. THIRD-PARTY WEBSITES
The Website may link to financing providers, equipment vendors, social networks, credit services or other third-party websites.
Third-party websites and services operate under their own privacy practices.
Third-party websites and services have their own privacy practices. A hyperlink does not make Mehmi the operator of that website. Nothing in this section excludes a privacy obligation or responsibility that applicable law places on Mehmi, including in connection with a service provider or disclosure of personal information.
35. PRIVACY OFFICER AND ACCOUNTABILITY
Mehmi has designated responsibility for its privacy program to its Privacy Officer.
The Privacy Officer is responsible for receiving privacy inquiries and requests and overseeing Mehmi's privacy policies and practices.
Where Québec law applies, the person exercising the highest authority within Mehmi remains responsible for compliance unless duties have been delegated in writing as permitted by law.
36. GOVERNANCE
Mehmi maintains privacy and information-management practices appropriate to its operations.
These practices may address roles and responsibilities, access controls, retention and destruction, service-provider management, complaints, privacy incidents, employee awareness and other matters concerning the lifecycle of personal information.
Mehmi may conduct privacy or data-protection assessments where required by law or appropriate based on the sensitivity and nature of proposed processing.
37. CHANGES TO THIS PRIVACY POLICY
Mehmi may amend this Privacy Policy to reflect changes in our services, technology, service providers, business practices or legal obligations.
The current version will display its effective date.
Where a material change requires additional notice or consent under applicable law, Mehmi will provide that notice or obtain that consent as required.
We will not rely solely on continued Website use as consent to a new use of sensitive personal information where applicable law requires express or renewed consent.
38. OTHER FINANCIAL AND CREDIT PRIVACY LAWS
Certain information may be subject to additional national, federal, provincial, state or territory financial-services, credit-reporting or privacy legislation.
Nothing in this Privacy Policy is intended to reduce a right provided by applicable non-waivable law.
Where the Fair Credit Reporting Act, Gramm-Leach-Bliley Act or another applicable financial-information law imposes additional restrictions, notices, permissions or protections, Mehmi will handle the applicable information in accordance with those requirements.
39. CONTACT US
Privacy questions, privacy-rights requests, complaints and concerns may be directed to:
Privacy Officer
Mehmi Group Corp. d.b.a. Mehmi Financial Group
77 City Centre Drive, Suite 501
Mississauga, Ontario L5B 1M5
Canada
Email: Support@MehmiGroup.com
Telephone: 1-833-863-4644
Website: MehmiGroup.com
You may use Privacy Request or Privacy Complaint in the subject line to help route your message. You do not need to use those exact words for us to consider a request or complaint.
We may request information reasonably necessary to confirm your identity before releasing personal information.
Canadian individuals who are dissatisfied with our response may have a right to contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.
Québec residents may also have recourse to the Commission d'accès à l'information du Québec.
U.S. residents may have the right to contact their applicable state attorney general, privacy regulator or other competent authority.
40. ACKNOWLEDGEMENT
This Privacy Policy explains Mehmi's privacy practices.
Where separate consent or authorization is legally required, including authorization concerning personal consumer credit, acceptance of this Privacy Policy does not replace that separate authorization.
Applicants should review this Privacy Policy, our Terms of Use, any applicable Credit Report Authorization and all financing-provider documentation before submitting sensitive personal information.
.svg){kind=small}