Privacy policy

One person is responsible for the personal information we hold and for answering questions about this policy:

Account and business details. When you request pricing, create an account or place an order we collect your name, company name, business email address, phone number, and your billing and delivery addresses. We use these to set up your trade account, price your order correctly, deliver it, and invoice you.

Order and quote information. The products and quantities you order or request a quote on, your purchase order number, requested delivery date, delivery notes, order history and the prices we quote you. We use these to fulfil and invoice orders, honour quoted pricing, and answer questions about past orders.

Sign-in information. If you create an account we store your email address. If you choose to add a password, our sign-in provider stores a securely hashed version and we never store the password itself. If you sign in with Google instead, we receive your name and email address from Google to identify your account.

Address lookup. When you type an address into a delivery or account form, what you type is sent to our server, which asks Geoapify, an address autocomplete service, to suggest matching addresses. The request to Geoapify comes from our server rather than your browser, so Geoapify receives what you typed but not your IP address. If the service is unavailable the field simply works as a normal text box.

Technical and usage information. Our host receives the request information needed to deliver and protect the site, including your IP address and browser details. If you allow optional analytics, Google Analytics also processes page, device and referral information to tell us which pages and products people find useful. See section 4.

Automated-abuse protection. On forms that can send a sign-in, signup, invitation or password-reset email, Cloudflare Turnstile processes the browser, device and network signals needed to distinguish automated abuse. We do not send Cloudflare the name, email address or business details typed into those forms.

Security logs. Requests for paths commonly used to probe websites for exposed secrets or administration tools are blocked and logged for investigation. The private log can include the IP address, time, requested URL and query (with credential-like query values redacted), request and hosting-region identifiers, browser and network metadata, approximate IP location, TLS fingerprint, and up to the first 8 KB of a request body. It never stores cookies, authorization headers or Vercel signatures. We use this record only to investigate and block abuse and protect the service.

What we do not collect. The current customer flow does not take card details, so it does not collect or store credit or debit card numbers. Orders are paid by invoice or Interac e-Transfer separately from the browser. We do not sell personal information to anyone, and we do not use it for advertising or retargeting.

When you create an account, request a quote or place an order, we explain the business purpose at the collection point and use the information only to provide that service. Optional analytics is a separate choice and stays off unless you allow it. We ask for fresh consent if we want to use your information for a new purpose.

You can withdraw consent at any time by contacting the Privacy Officer, subject to legal and contractual limits. For example, we cannot delete invoices and other records we are required by tax law to keep, and withdrawing consent may mean we can no longer supply your account.

Essential cookies. When you sign in, our sign-in provider sets cookies that maintain and protect your session. Account features cannot work without them.

Browser storage. Your cart is stored in this browser so it survives a return visit; it contains product display details and quantities and is cleared when you clear the cart or sign out. An interrupted signup is stored only in that tab’s session storage and can contain your email, company, delivery locations, location contacts and business hours. It is removed when the signup code is sent, when you choose Clear all, or when that browser-tab session ends. We also store your analytics choice in this browser until you change it.

Google Analytics. Google Analytics 4 does not load unless you choose Allow analytics. If allowed, it sets or reads identifiers and receives your IP address, device, referral and page information. Staff and internal paths are excluded, as are private quote-review, receipt and invitation links. You can withdraw your choice at any time through Analytics choices in the site footer. Analytics is not required for account, quote or ordering features.

We share personal information only with the service providers that run parts of our business, and only as much as each one needs. They are bound to protect it and may not use it for their own purposes.

We also share delivery details with our own drivers and, where needed, with a courier. We may disclose information if the law requires it, such as a court order or a lawful government request, or to establish or defend a legal claim.

Our accounting records are held on Zoho’s Canadian data centre. Some other providers may store or process information outside Canada. Their exact locations are not verified by this application’s source code and must be confirmed in the relevant provider account. While information is in another country it is subject to that country’s laws, and may be accessible to its courts and law enforcement agencies under those laws. You can ask the Privacy Officer which country a particular provider holds your information in.

Our current policy is to keep invoices, orders and related accounting records for seven years after the end of the tax year they relate to. That is a company retention period; the CRA’s general minimum is six years, with exceptions. Account details, addresses, quotes and Google Analytics records do not currently have a repo-enforced automatic deletion schedule; Google Analytics retention is configured in its provider dashboard. Security event records also currently have no automatic expiry. You can ask the Privacy Officer about the retention of a particular record.

All traffic between your browser and our site is encrypted with HTTPS. Account records are protected by database-level access rules so one customer’s data cannot be read from another customer’s session. Staff access is limited by role, so employees see only what their job requires, and staff sessions require an emailed sign-in code or an enrolled authenticator check. Changes made by staff to customer and order records are logged. Passwords are stored only as salted hashes.

No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner as PIPEDA requires.

You can see most of what we hold at any time by signing in and visiting your account pages, where you can update your contact details and addresses yourself.

You can also write to the Privacy Officer to ask what personal information we hold about you, how we have used it and who we have given it to, to correct anything inaccurate, or to ask us to delete information we are not required to keep. We will confirm your identity before answering, and we will respond within 30 days. If we need longer, or if we have to refuse part of a request, we will tell you why in writing.

If you are unhappy with how we have handled your information, contact the Privacy Officer first. We will investigate and write back to you. If you are still not satisfied, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.

This is a wholesale site for businesses. It is not directed at children and we do not knowingly collect information from anyone under 18.

We update this policy when our practices change. The effective date at the top shows the current version. If a change materially affects how we use information you have already given us, we will tell account holders by email before it takes effect.

Questions about this policy or your information go to the Privacy Officer, Wealthy Supplies, 1303F Aerowood Drive, Mississauga, Ontario L4W 2P6, privacy@wealthysupplies.com, (905) 282-1882.