PayFast Privacy Policy

1. INTRODUCTION AND SCOPE

1.1 This Privacy Policy (the “Policy”) explains how BITFLYER LTD., carrying on business as PayFast (“PayFast”, “we”, “us” or “our”), collects, uses, discloses, retains and protects personal information when you visit https://payfast.ca, communicate with us, create or use an account, use our web or mobile interfaces, submit or receive payment instructions, buy or sell digital assets, obtain support or otherwise use our services. In this Policy, “Platform” means our websites, interfaces and accounts; “Services” means the services we make available; “Providers” means the third-party organizations described in Section 9; and “Applicable Law” means the privacy and other laws applicable to the relevant processing.

1.2 This Policy applies to personal information under PayFast’s control, whether collected online or through related offline communications. Providers that collect or use information independently are responsible for their own privacy practices. We will identify relevant providers and make their privacy notices available when required, including when you use a service involving an independent provider.

1.3 “Personal Information” means information about an identifiable individual and includes information that can identify an individual alone or in combination with other information. Depending on Applicable Law, certain business contact information used solely for business communications may be excluded from the statutory definition.

1.4 This Policy is a transparency notice. It is not a request for blanket consent to every described practice. PayFast or a Provider will obtain a separate choice or consent where Applicable Law requires one and will identify material purposes before or at the time of collection.

1.5 The Platform may contain links to third-party websites, services or applications. Those third parties have their own privacy practices. PayFast does not control information that a third party collects independently and encourages you to review the applicable notice before using the third-party service.

1.6 If you do not wish to provide information required for Account security, eligibility, identity verification, payment processing, fraud prevention, recordkeeping or another integral function, PayFast or the responsible Provider may be unable to provide the affected service. Optional processing is subject to the choices described in this Policy.

2. ACCOUNTABILITY AND PAYFAST'S PRIVACY ROLES

2.1 PayFast has designated a Privacy Officer who is accountable for PayFast's compliance with this Policy and applicable privacy law. Contact information appears in Section 21. PayFast maintains policies, procedures, safeguards, training, service-provider controls and complaint processes appropriate to the Personal Information under its control.

2.2 PayFast is accountable for personal information under its control, including information processed on its behalf by service providers. Where PayFast processes information on behalf of another organization, PayFast acts in accordance with the applicable agreement and lawful instructions, subject to its independent legal obligations. The applicable service notice will explain any material allocation of privacy responsibilities.

2.3 PayFast independently determines purposes and is directly accountable for Personal Information used to operate and secure PayFast's own website, Platform and Accounts; authenticate users; provide PayFast support; protect PayFast technology and legal rights; administer PayFast's business, accounting, audit, insurance and legal compliance; create permitted aggregated or de-identified operational analytics; and send PayFast marketing where a lawful basis exists.

2.4 Financial institutions, payment processors and networks, identity-verification providers, conversion providers, wallet providers, digital-asset issuers and other Providers may be independently accountable for information they collect or use for their own legal, risk, security or service purposes. Their notices should be read together with this Policy.

2.5 The allocation of privacy responsibility depends on the specific information and purpose. If a request or complaint concerns records controlled by another organization, PayFast may direct you to that organization or coordinate a response, while remaining responsible for information under its own control.

3. INFORMATION WE COLLECT

Depending on how you use the Platform and which functions are activated, PayFast may collect the categories below. A particular form or point-of-collection notice should identify which fields are required and which are optional.

3.1 Identity and Eligibility Information

• 3.1.1 legal and preferred name, date of birth, age, residential and mailing address, nationality, citizenship, country of residence and tax residency;
• 3.1.2 government-issued identification type, number, issuing authority, expiry date and images;
• 3.1.3 occupation, employer, business role, authority to act and relationship to an organization or transaction;
• 3.1.4 sanctions, politically exposed person, adverse-media, fraud, identity and eligibility screening results; and
• 3.1.5 where specifically activated and separately disclosed, a selfie, liveness signal, facial-comparison or biometric-like verification result.

3.2 Business, Ownership and Authority Information

• 3.2.1 legal and trade names, registration numbers, jurisdiction, registered office, operating addresses and websites;
• 3.2.2 directors, officers, partners, trustees, authorized signatories and beneficial owners;
• 3.2.3 organizational documents, ownership charts, licences, permits, business activities and expected transaction activity;
• 3.2.4 source-of-funds, source-of-wealth, transaction-purpose and counterparty information; and
• 3.2.5 information about customers, payees or other persons on whose behalf a Business User acts.

3.3 Contact, Account and Authentication Information

• 3.3.1 email address, telephone number, username, Account identifier, language and communication preferences;
• 3.3.2 password hashes, authentication factors, device registrations, login history, access roles and recovery information;
• 3.3.3 consent, acknowledgement, cookie, notification and marketing preference records; and
• 3.3.4 Account status, permissions, approvals, restrictions and support history.

3.4 Payment, Financial, Wallet and Transaction Information

• 3.4.1 payer and payee information, bank and account details, institution and transit numbers, masked account numbers and payment references;
• 3.4.2 Payment Instructions, amount, currency, date, time, source, destination, purpose and transaction status;
• 3.4.3 wallet addresses, blockchain network, transaction hash, public blockchain data and digital-asset amount where an activated function applies;
• 3.4.4 conversion quote, rate, spread, network charge, fee, refund, return, reversal and chargeback information;
• 3.4.5 reconciliation entries, exceptions, holds, rejection reasons and Provider response codes; and
• 3.4.6 records showing the capacity in which PayFast acted and the applicable transaction rules, authorizations or instructions.

3.5 Compliance, Fraud and Risk Information

• 3.5.1 identity and document verification results;
• 3.5.2 device, Account, behavioural and transaction risk signals;
• 3.5.3 sanctions, AML, fraud, suspicious-activity and transaction-monitoring alerts;
• 3.5.4 information concerning the source, destination, ownership and purpose of funds or digital assets;
• 3.5.5 requests for information, enhanced review, escalation, restriction and decision records; and
• 3.5.6 information received from payment service providers, financial institutions, networks, authorities, public records and other lawful data sources.

3.6 Device, Technical, Cookie and Usage Information

• 3.6.1 IP address, device identifier, browser, operating system, mobile carrier and approximate location derived from IP;
• 3.6.2 login, session, authentication, API, security, diagnostic, performance and event logs;
• 3.6.3 pages and features viewed, interactions, referral URL, date, time and duration;
• 3.6.4 cookie, local-storage, SDK and similar technology identifiers; and
• 3.6.5 security telemetry, vulnerability, error, incident and fraud-prevention data.

3.7 Communications and Support Information

• 3.7.1 emails, web forms, chats, calls, complaint records and support tickets;
• 3.7.2 documents, screenshots and other materials you provide;
• 3.7.3 survey responses and feedback; and
• 3.7.4 records of notices, transaction confirmations, disputes and resolutions.

3.8 Sensitive Information and Secret Credentials

3.8.1 Government identification, financial information, source-of-funds information, fraud or sanctions data, and any selfie, liveness or biometric-like verification information may be sensitive. PayFast applies heightened safeguards and seeks express consent where Applicable Law or the circumstances require it.

3.9 PayFast may create statistical, aggregated or de-identified information from Personal Information. PayFast will take reasonable measures appropriate to the context to reduce the risk of re-identification and will not use information represented as anonymized if it can reasonably identify an individual.

4. HOW WE COLLECT INFORMATION

4.1 PayFast may collect Personal Information:

• 4.1.1 directly from you or your authorized representative when you complete a form, create an Account, submit documents or instructions, communicate with support or otherwise interact with the Platform;
• 4.1.2 from payment service providers in connection with eligibility, instructions, transaction administration, oversight, complaints or regulatory requirements;
• 4.1.3 from financial institutions, payment networks or other account or payment Providers;
• 4.1.4 from identity-verification, sanctions, AML, fraud, cybersecurity and risk vendors;
• 4.1.5 from an approved conversion provider, wallet provider, blockchain network, digital-asset issuer or public blockchain if a digital-asset function is activated;
• 4.1.6 from your employer, business, customer, payer, payee, counterparty or another person involved in a transaction;
• 4.1.7 automatically from your device and use of the Platform through the technologies described in Section 5;
• 4.1.8 from public records, corporate registries, sanctions lists, court records, media and other lawful sources; and
• 4.1.9 from regulators, law enforcement, professional advisers, insurers and other persons where authorized by law.

4.2 If you provide Personal Information about another individual, you represent that you are authorized to provide it and have given any required notice or obtained any required consent. You must not provide more information than is reasonably necessary for the stated purpose.

5. COOKIES AND OTHER AUTOMATIC DATA COLLECTION TECHNOLOGIES

5.1 The Platform may use cookies, local storage, pixels, software development kits (SDKs), API logs and similar technologies. Where required, information about the technologies used, their providers, purposes and duration will be provided through a cookie notice or consent interface before non-essential technologies are activated.

5.2 PayFast may use these technologies for:

• 5.2.1 strictly necessary purposes: including authentication, session management, load balancing, security, fraud prevention and transaction integrity;
• 5.2.2 functional purposes: including language, display and user preferences;
• 5.2.3 analytics purposes: including performance measurement, error diagnosis and understanding feature use; and
• 5.2.4 marketing purposes: if activated, including campaign measurement or relevant content, subject to applicable consent requirements.

5.3 Non-essential technologies will be used only in accordance with the choices required by Applicable Law. You can manage available choices through the cookie controls presented on the Platform, where available, and your browser or device settings. Disabling necessary technologies may prevent the Platform from functioning.

5.4 PayFast does not use transaction data for unrelated cross-site behavioural advertising. PayFast will not activate cross-site behavioural advertising, precise device location or a non-essential profiling technology without an updated notice, appropriate impact assessment and the consent required by Applicable Law.

5.5 Browser and device privacy signals may operate differently across technologies. Use the privacy controls made available on the Platform to communicate your choices, and contact the Privacy Officer if you need assistance. PayFast will honour applicable legally required privacy choices.

5.6 Where Quebec law applies, PayFast will inform individuals about technology that can identify, locate or profile them and will provide the available means to activate or deactivate relevant functions as required.

6. HOW WE USE PERSONAL INFORMATION

6.1 PayFast may use Personal Information to:

• 6.1.1 create, administer, authenticate and secure Accounts;
• 6.1.2 determine eligibility and verify identity, business ownership or authority;
• 6.1.3 provide the Platform and the Services you request, including payment and digital-asset functions where available;
• 6.1.4 receive, validate, format, transmit and administer Payment Instructions;
• 6.1.5 provide transaction status, records, reconciliation and reporting;
• 6.1.6 collect know-your-customer (KYC) information, verify identity, conduct sanctions and fraud screening, monitor transactions and escalate matters for review;
• 6.1.7 administer authorized refunds, returns, reversals or chargebacks;
• 6.1.8 facilitate digital-asset purchases, sales, conversion, allocation, transfers or routing where those functions are available;
• 6.1.9 communicate operational, security, transaction, support and legal information;
• 6.1.10 detect, prevent, investigate and respond to fraud, abuse, unauthorized activity, cyber threats, incidents, errors and disputes;
• 6.1.11 comply with Applicable Law, court orders, regulatory requests, audit, recordkeeping and reporting duties;
• 6.1.12 establish, exercise or defend legal rights and enforce agreements;
• 6.1.13 manage Providers, insurance, corporate transactions, accounting, governance and business continuity;
• 6.1.14 measure availability, diagnose errors and improve PayFast security and technology using aggregated, de-identified or otherwise authorized information; and
• 6.1.15 send marketing messages where consent or another lawful basis applies.

6.2 PayFast will not sell or rent Personal Information, monetize identifiable transaction data, profile users for unrelated advertising or use identifiable service data to train a general-purpose commercial model unless PayFast first provides a separate, specific notice and obtains every consent required by Applicable Law.

6.3 PayFast may collect, use or disclose Personal Information without consent where Applicable Law permits or requires, including for fraud prevention, investigations, debt collection, legal proceedings, emergencies, regulatory reporting or compliance with a lawful demand. PayFast documents material reliance on a consent exception.

7. CONSENT AND YOUR CHOICES

7.1 PayFast seeks meaningful consent where required. Material purposes will be described in clear language before or at the time of collection, including the information collected, the organizations involved, the principal uses and disclosures, and meaningful risks that may reasonably be expected.

7.2 Some processing is integral to the Platform or Services, including authentication, identity verification, payment instruction processing, fraud and sanctions controls, security, recordkeeping and disclosures to necessary Providers. If you do not provide required information or withdraw consent for integral processing, the affected service may be unavailable.

7.3 Optional processing, such as non-essential analytics, marketing or certain cookies, will be subject to an appropriate choice or consent mechanism where required. An optional choice will not be bundled with an integral service unless the combination is reasonably necessary and lawfully explained.

7.4 The form of consent will reflect sensitivity and reasonable expectations. PayFast will seek express consent for sensitive liveness, facial-comparison or biometric-like processing where required and will explain the provider, purpose, retention and consequence of declining.

7.5 You may change cookie or marketing preferences through the settings and methods described in Sections 5 and 18. You may withdraw consent for future processing in accordance with Section 17, subject to legal or contractual restrictions and reasonable notice.

8. AUTOMATED PROCESSING AND RISK DECISIONS

8.1 PayFast and Providers may use automated tools to verify identity, compare documents or liveness information, detect anomalies, screen sanctions lists, assess fraud or cybersecurity risk, apply transaction rules or prioritize matters for review.

8.2 An automated signal may cause a transaction or account to be delayed, restricted, declined or referred for review. PayFast or the responsible Provider makes decisions within its respective role and legal responsibilities.

8.3 Where Applicable Law gives you a right concerning a decision based exclusively on automated processing, you may request information about the use of automated processing, the principal factors or parameters considered and the means to submit observations or request review, subject to fraud, security, confidential-control and legal restrictions.

9. DISCLOSURE AND TRANSFER OF PERSONAL INFORMATION

9.1 PayFast may disclose or transfer Personal Information to the following categories of recipients for the identified purposes:

• 9.1.1 payment service providers and processors: to provide payment services, administer instructions and transactions, determine eligibility, manage compliance and risk, maintain records, resolve complaints and process refunds;
• 9.1.2 financial institutions and payment networks: to provide account or settlement infrastructure, maintain relevant account or sub-ledger records, process transfers, apply holds, reconcile transactions, investigate issues and comply with law;
• 9.1.3 identity, compliance, fraud and security Providers: to process identification documents, selfies or liveness information, screening data, device signals, cybersecurity telemetry, fraud indicators and transaction data;
• 9.1.4 digital-asset Providers: if activated, to process fiat conversion, wallet, blockchain, digital-asset routing, compliance and support information;
• 9.1.5 technology and business service providers: for cloud hosting, communications, analytics, customer support, document management, logging, monitoring, accounting, insurance and other operations;
• 9.1.6 professional advisers, auditors and insurers: to obtain advice, complete audits, manage insurance, investigate matters and establish or defend rights;
• 9.1.7 authorities and legal recipients: where authorized or required by law or reasonably necessary to protect persons, property, funds, systems or legal rights; and
• 9.1.8 a buyer, financier or successor: in connection with a proposed or completed financing, reorganization, merger, sale, insolvency or transfer of business, subject to lawful confidentiality, use restrictions and notice requirements.

9.2 Service providers are required by contract or other appropriate measures to protect Personal Information and use it only for authorized purposes, subject to their independent legal obligations. A Provider may have separate purposes and privacy practices for information under its own control.

9.3 PayFast may share information that has been lawfully anonymized so that it no longer identifies an individual. PayFast will not represent information as anonymous where there is a serious possibility of re-identification in the circumstances.

10. CROSS-BORDER PROCESSING AND SERVICE PROVIDERS

10.1 Personal information may be processed or stored outside your province or outside Canada by PayFast or its Providers. The laws of another jurisdiction may permit its courts, law enforcement or authorities to access information in that jurisdiction.

10.2 PayFast remains accountable for Personal Information under its control and uses contractual, organizational and technical measures intended to provide a comparable or otherwise appropriate level of protection when information is processed by a service provider.

10.3 You may contact the Privacy Officer for information about material service providers, their purposes and processing locations. Where Applicable Law requires specific information about providers or processing countries, PayFast will make that information available in the applicable service notice or other required disclosure.

10.4 Where Alberta privacy law applies, PayFast will provide the information required about service providers outside Canada and a contact able to answer questions about related policies and practices.

10.5 Before communicating Personal Information outside Quebec where Quebec law requires it, the responsible organization will conduct the required privacy impact assessment and enter into a written arrangement reflecting the assessment and appropriate safeguards.

11. PUBLIC BLOCKCHAIN INFORMATION

11.1 If you use an activated digital-asset function, wallet addresses, transaction hashes, token amounts, timing and other transaction information may be recorded on a public blockchain.

11.2 Public blockchain records are replicated across independent systems, may be accessible globally and generally cannot be deleted, altered or controlled by PayFast. A wallet address may become Personal Information when linked with other information.

11.3 Do not include unnecessary Personal Information in an on-chain memo, reference or transaction field. PayFast cannot fulfil a deletion or correction request by altering an immutable public blockchain record, but may correct or annotate PayFast-controlled off-chain records where appropriate.

12. INFORMATION SECURITY

12.1 PayFast maintains administrative, technical and physical safeguards proportionate to the sensitivity of Personal Information and the risks of the Platform. Measures may include:

• 12.1.1 role-based access, least privilege, segregation of duties and periodic access review;
• 12.1.2 strong authentication, credential management and prompt deprovisioning;
• 12.1.3 encryption in transit and, where appropriate, at rest;
• 12.1.4 logging, monitoring, anomaly detection and incident response;
• 12.1.5 secure development, vulnerability management, patching and malware protection;
• 12.1.6 backups, resilience, business continuity and disaster recovery;
• 12.1.7 personnel confidentiality, training and acceptable-use obligations; and
• 12.1.8 Provider due diligence, contractual controls and security assurance.

12.2 PayFast may exchange relevant security assurance information with Providers, auditors or authorities where appropriate, subject to confidentiality, security restrictions and Applicable Law. Such exchanges are limited to information necessary for the relevant purpose.

12.3 No method of transmission, storage or security is completely secure. You are responsible for securing your devices, email, passwords, authentication factors and wallets and for promptly reporting suspected compromise. PayFast does not make absolute security promises that its controls cannot reasonably guarantee.

13. PRIVACY AND SECURITY INCIDENTS

13.1 PayFast maintains procedures to detect, assess, contain, investigate, remediate and document privacy and security incidents and coordinates with relevant Providers according to their respective responsibilities.

13.2 Where a breach of security safeguards creates a real risk of significant harm or another legally reportable risk, the organization responsible under Applicable Law will report to the applicable privacy authority and notify affected individuals as soon as required. PayFast will provide reasonable assistance and information within its control.

13.3 PayFast maintains records of breaches and confidentiality incidents as required by Applicable Law, including records of incidents that do not meet a reporting threshold.

13.4 An incident notice may be delivered by email, Account message, website notice, telephone, mail or another reasonable method, depending on urgency, sensitivity, risk and available contact information.

14. RETENTION, DESTRUCTION AND ANONYMIZATION

14.1 PayFast retains Personal Information only as long as reasonably necessary for the identified purposes, Applicable Law, security, dispute resolution, audit and enforcement. Retention periods vary by record type and responsibility.

14.2 Transaction and service records are generally retained for seven years after the end of the calendar year in which the relevant transaction occurred, or longer where required by Applicable Law, an unresolved investigation, litigation hold, audit, tax requirement or other applicable legal obligation.

14.3 Account, identity, KYC, compliance, complaint and support records may be retained for the applicable statutory period and PayFast’s approved retention schedule. Where cookie or analytics technologies are used, applicable retention information will be provided through the relevant cookie notice or consent interface.

14.4 After the applicable period, information will be securely destroyed, deleted or anonymized in accordance with approved procedures and standard backup cycles. Information may remain in protected backups until overwritten in the ordinary course and may be isolated from active use.

14.5 PayFast may retain aggregated or anonymized information that can no longer reasonably identify an individual and may use it for lawful security, analytics, research and business purposes.

15. ACCURACY

15.1 PayFast takes reasonable steps to keep Personal Information accurate, complete and current for the purposes for which it is used, having regard to its sensitivity and the consequences of error.

15.2 You must keep Account, contact, identity, business, banking and wallet information current and promptly report an error. PayFast is not responsible for a result caused by materially inaccurate or incomplete information supplied by you or a Provider if PayFast did not know of the error or promptly escalated it after discovery.

16. ACCESS, CORRECTION AND OTHER PRIVACY RIGHTS

16.1 Subject to Applicable Law and applicable exceptions, you may request:

• 16.1.1 confirmation of whether PayFast holds Personal Information about you;
• 16.1.2 access to that information and an account of its use and disclosure;
• 16.1.3 correction of inaccurate or incomplete information;
• 16.1.4 withdrawal of consent to future processing where consent is the basis;
• 16.1.5 deletion, destruction or anonymization where legally available;
• 16.1.6 a copy of eligible computerized Personal Information in a structured, commonly used technological format where a portability right applies;
• 16.1.7 information and review concerning an exclusively automated decision where Applicable Law provides that right;
• 16.1.8 cessation of dissemination, de-indexation or re-indexation where a Quebec right or another applicable right is established; and
• 16.1.9 information about PayFast's privacy practices and material service providers.

16.2 To make a request, contact the Privacy Officer using Section 21. PayFast may request information reasonably necessary to verify your identity and authority. Do not send unnecessary identity documents through ordinary email.

16.3 PayFast will respond within the period required by Applicable Law. A fee will not be charged unless law permits it and PayFast provides advance notice. PayFast may deny or limit a request where permitted or required to protect another person, legal privilege, confidential commercial information, fraud controls, security, an investigation or a legal prohibition, and will explain the reason where required.

16.4 If another Provider controls the relevant information, PayFast may direct the request to that organization or coordinate a response. PayFast remains responsible for responding to requests about information under its own control.

16.5 A public blockchain record generally cannot be altered or deleted by PayFast. Where appropriate, PayFast may correct a linked off-chain record, record a dispute or take another technically and legally available measure.

17. WITHDRAWING CONSENT

17.1 Where processing is based on consent, you may withdraw consent to future processing by contacting the Privacy Officer or using an available preference control, subject to legal or contractual restrictions and reasonable notice.

17.2 Withdrawal does not affect processing already lawfully completed and does not require deletion of records that must be retained for legal, regulatory, fraud, security, audit or dispute purposes.

17.3 If consent is necessary for identity verification, security, payment processing or another integral function, withdrawal may mean that PayFast or the responsible Provider cannot continue the affected service. PayFast will explain the reasonably foreseeable consequence when the withdrawal request is made.

18. MARKETING AND COMMERCIAL ELECTRONIC MESSAGES

18.1 PayFast may send marketing email, text or other commercial electronic messages only where consent or another lawful basis applies.

18.2 Marketing messages will identify the sender, include the contact information required by law and provide a readily performed unsubscribe mechanism that remains valid for the required period. PayFast will give effect to an unsubscribe request without delay and no later than ten business days after receipt, at no cost and without requiring an Account login.

18.3 You may withdraw marketing consent at any time through the unsubscribe mechanism or by contacting the Privacy Officer using Section 21. You may continue to receive operational, security, transaction, legal and relationship messages that are not marketing.

18.4 PayFast does not disclose Personal Information to an unaffiliated third party for that third party's own marketing without the consent required by Applicable Law.

19. CHILDREN AND MINORS

19.1 The Platform and Services are not directed to individuals who have not reached the age of majority in their province or territory. PayFast does not knowingly permit a minor to open an Account or submit a Payment Instruction.

19.2 If you believe a minor has provided Personal Information without appropriate authority, contact the Privacy Officer. PayFast will investigate and take appropriate action, subject to legal retention and safeguarding requirements.

20. CHANGES TO THIS POLICY

20.1 PayFast may update this Policy to reflect changes in Applicable Law, the Platform, Providers, data flows, security practices or business operations. The updated Policy will be posted with a revised “Last updated” date.

20.2 PayFast will provide additional notice where a change is material. If a change creates a materially new purpose, use or disclosure for existing Personal Information, PayFast or the responsible organization will obtain consent where Applicable Law requires it rather than treating silence as consent.

20.3 You may request information about an earlier version of this Policy from the Privacy Officer. Where Quebec law applies, affected individuals will be notified of Policy updates in the manner required by law.

21. CONTACT INFORMATION AND CHALLENGING COMPLIANCE

21.1 PayFast welcomes questions, access or correction requests, consent withdrawals and complaints concerning this Policy or PayFast's handling of Personal Information. PayFast has procedures to investigate and respond to complaints and will not retaliate against an individual for raising a good-faith privacy concern.

21.2 If you are not satisfied with PayFast's response, you may complain to the Office of the Privacy Commissioner of Canada or the privacy authority in your province or territory, subject to that authority's jurisdiction. Contacting PayFast first may permit a faster resolution but does not waive a statutory complaint right.