Selling a marketplace platform in Canada

In a marketplace sale the asset a buyer wants may be a network of people who never agreed to be sold, which raises privacy questions that an ordinary small-business sale may not. Before approaching anyone, an owner can prepare three things: evidence that the network works, a lawful route for user information to reach a buyer, and the cooperation of the third parties the deal may need, above all the payment provider. The privacy and payments steps depend on other parties’ timetables, so it is worth starting them early.

Prepare the numbers a buyer may ask for first

A buyer of a marketplace may ask for figures organized differently from an ordinary profit and loss statement, so it helps to be able to produce transaction history by month with new and returning participants separated on each side, the time listings take to reach a first response and a first transaction, the take rate by segment, your largest participants by volume and any special terms they hold, and your dispute, refund and support logs. BDC says buyers will ask to look at historic and interim financial statements, projections, tax returns and other records, and suggests reviewing those records with your accountant. It adds that a lawyer familiar with business transitions supplies information to buyers during due diligence, so involve one before the data room opens rather than after.

Decide what user information can be shown, and when

Your user list is personal information, and PIPEDA has a specific route for it. Under subsection 7.2(1), organizations that are parties to a prospective business transaction may use and disclose personal information without the individual’s knowledge or consent if they have an agreement requiring the recipient to use and disclose it solely for purposes related to the transaction, to protect it with safeguards appropriate to its sensitivity, and, if the deal does not proceed, to return it to the organization that disclosed it or destroy it within a reasonable time, and if the information is necessary to decide whether to proceed and, if so, to complete the deal. Subsection 7.2(4) says this does not apply to a transaction whose primary purpose or result is the purchase or sale of personal information itself. That is a reason to keep aggregated figures for the early stages and hold identifiable records back until an agreement of that kind is signed.

For Quebec users, the Commission d’accès à l’information describes a parallel rule: since September 2022 a business may communicate personal information without consent where that is necessary to conclude a commercial transaction, subject to conditions. It also says an organization must carry out a privacy impact assessment before communicating personal information outside Quebec, so a buyer or a data room hosted elsewhere adds work.

Tidy the breach record before it is requested

Under PIPEDA an organization must keep a record of every breach of security safeguards involving personal information under its control, whether or not the breach had to be reported, and the Privacy Commissioner can request access to, or a copy of, those records. Where it is reasonable in the circumstances to believe a breach creates a real risk of significant harm, it must be reported to the Commissioner and, unless otherwise prohibited by law, notified to the individuals affected. Before listing, compare the register with support tickets and security emails so that any gaps are found first. In Quebec, the Commission’s guidance requires businesses to notify the Commission and the people concerned of a confidentiality incident that presents a risk of serious injury, and to keep a register of confidentiality incidents to be sent to the Commission on request.

Read your payment agreements before you list

Read the agreement with your payment provider for what it says about the account, the funds in transit and each seller’s payout details, and about assignment or consent on a change of control. Before you list, ask the provider whether a change of ownership triggers a fresh review, what documents it would request from a buyer and how long that takes, then place the answer on the closing timetable. Apply the same questions to the hosting, identity-verification and mapping vendors whose terms the platform runs on.

Shares or assets, and buyers from outside Canada

Whether the buyer purchases the corporation’s shares or the platform’s assets can change which contracts, accounts and user agreements have to be moved individually, and it can change your tax result. The CRA’s guidance for people selling a business notes that selling assets can produce a recapture or a terminal loss of capital cost allowance, and that a capital gains deduction may be available on qualified small business corporation shares; asset sale vs share sale in Canada sets out the differences. If the likely buyer is not Canadian, the Investment Canada Act applies to non-Canadians who acquire control of an existing Canadian business, who must submit a notification or an application for review unless an exemption applies. The government’s description of the Act adds that it allows review of foreign investments of any size on national security grounds, and it names sensitive Canadian personal data among the concerns.

Items that can hold up a closing

These are items to look for in your own file before you list, because each depends on a third party or on records rather than on the price.

• A user agreement whose wording does not clearly allow user information, and the agreement itself, to pass to a new owner.
• A payment provider’s review of the buyer running longer than the closing timetable allows.
• A breach register that cannot be reconciled with support and security records.
• An open dispute or safety complaint that the buyer wants indemnified or carved out of the deal.
• A foreign buyer’s filing under the Investment Canada Act, or a Quebec privacy impact assessment for data leaving the province.