Privacy policy

One person is responsible for the personal information we hold and for answering questions about this policy:

Account and business details. When you request pricing, create an account or place an order we collect your name, company name, business email address, phone number, and your billing and delivery addresses. We use these to set up your trade account, price your order correctly, deliver it, and invoice you.

Order and quote information. The products and quantities you order or request a quote on, your purchase order number, requested delivery date, delivery notes, order history and the prices we quote you. We use these to fulfil and invoice orders, honour quoted pricing, and answer questions about past orders.

Sign-in information. If you create an account we store your email address and a securely hashed version of your password. We never store your password itself. If you sign in with Google instead, we receive your name and email address from Google to identify your account.

Address lookup. When you type an address into a delivery or account form, your browser sends what you type directly to Geoapify, an address autocomplete service, so it can suggest matching addresses. Because your browser makes that request itself, Geoapify also receives your IP address. If the service is unavailable the field simply works as a normal text box.

Technical and usage information. Like most websites we receive your IP address, device and browser type, the pages you view and the site you arrived from. Google Analytics processes this to tell us which pages and products people find useful. See section 4.

Security logs. Requests for paths commonly used to probe websites for exposed secrets or administration tools are blocked and logged for investigation. The private log can include the IP address, time, requested URL and query (with credential-like query values redacted), request and hosting-region identifiers, browser and network metadata, approximate IP location, TLS fingerprint, and up to the first 8 KB of a request body. It never stores cookies, authorization headers or Vercel signatures. We use this record only to investigate and block abuse and protect the service.

What we do not collect. This site does not take card payments, so we never collect or store credit card, debit card or bank account numbers. Trade orders are invoiced to your account and paid separately. We do not sell personal information to anyone, and we do not use it for advertising or retargeting.

By creating an account, requesting a quote or placing an order you consent to us collecting and using your information for the purposes above. We ask for fresh consent if we ever want to use it for something new.

You can withdraw consent at any time by contacting the Privacy Officer, subject to legal and contractual limits. For example, we cannot delete invoices and other records we are required by tax law to keep, and withdrawing consent may mean we can no longer supply your account.

Essential cookies. When you sign in we set cookies that keep you signed in and keep your cart and session secure. The site cannot work without these.

Google Analytics. Public pages of the site load Google Analytics 4, which sets cookies and sends Google your IP address, device information and the pages you visit so we can see how the site is used. We deliberately exclude our staff and internal pages from analytics, and pages reached through a private link, such as a quote review or an account invitation, are never reported to Google.

You can block analytics by installing Google’s browser opt-out add-on, or by blocking cookies in your browser settings. Blocking analytics cookies does not affect ordering.

We share personal information only with the service providers that run parts of our business, and only as much as each one needs. They are bound to protect it and may not use it for their own purposes.

We also share delivery details with our own drivers and, where needed, with a courier. We may disclose information if the law requires it, such as a court order or a lawful government request, or to establish or defend a legal claim.

Our accounting records are held on Zoho’s Canadian data centre. The other providers listed above host their services outside Canada, so some of your information is stored and processed in other countries. While it is in another country it is subject to that country’s laws, and may be accessible to its courts and law enforcement agencies under those laws. You can ask the Privacy Officer which country a particular provider holds your information in.

We keep invoices, orders and related accounting records for seven years after the end of the tax year they relate to, as Canadian tax law requires. Account details, addresses and quotes are kept for as long as your account is active and for two years after it closes, so we can answer questions about past business. Google Analytics data expires on Google’s standard retention schedule. Security event records currently have no automatic expiry and are kept until they are no longer needed to investigate or defend against abuse. When information is no longer needed we delete it or render it anonymous.

All traffic between your browser and our site is encrypted with HTTPS. Account records are protected by database-level access rules so one customer’s data cannot be read from another customer’s session. Staff access is limited by role, so employees see only what their job requires, and we use two-factor authentication to protect staff accounts. Changes made by staff to customer and order records are logged. Passwords are stored only as salted hashes.

No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner as PIPEDA requires.

You can see most of what we hold at any time by signing in and visiting your account pages, where you can update your contact details and addresses yourself.

You can also write to the Privacy Officer to ask what personal information we hold about you, how we have used it and who we have given it to, to correct anything inaccurate, or to ask us to delete information we are not required to keep. We will confirm your identity before answering, and we will respond within 30 days. If we need longer, or if we have to refuse part of a request, we will tell you why in writing.

If you are unhappy with how we have handled your information, contact the Privacy Officer first. We will investigate and write back to you. If you are still not satisfied, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.

This is a wholesale site for businesses. It is not directed at children and we do not knowingly collect information from anyone under 18.

We update this policy when our practices change. The effective date at the top shows the current version. If a change materially affects how we use information you have already given us, we will tell account holders by email before it takes effect.

Questions about this policy or your information go to the Privacy Officer, Wealthy Supplies, 1303F Aerowood Drive, Mississauga, Ontario L4W 2P6, privacy@wealthysupplies.com, (905) 282-1882.