Canada Privacy Notice (PIPEDA)

Effective: September 18, 2026
Updated: September 18, 2026
Version: 1.5

On this page

This notice explains how Tanqory Inc. (“Tanqory”, “we”, “us”) collects, uses, discloses, transfers, and safeguards personal information in Canada under the Personal Information Protection and Electronic Documents Act (PIPEDA). It follows the 10 fair information principles, reflects OPC guidance, and aligns with Tanqory’s global standards so merchants, customers, partners, and visitors understand their rights and choices.

Scope, roles, and accountability

This notice applies when you: (a) use Tanqory as a merchant or team member; (b) check out or interact as a merchant’s customer; (c) visit our sites, apps, dashboards, or developer tools; or (d) integrate with Tanqory APIs as a partner. When you interact directly with Tanqory, we act as controller. When your data comes from a merchant, the merchant is controller and we process under our Data Processing Addendum. A Privacy Officer for Canada oversees compliance and subprocessors.

How we apply the 10 PIPEDA principles

Accountability: Privacy Officer oversight, controls, audits, and subprocessors listed at Subprocessors List.
Identifying purposes: Stated at or before collection with clear notices.
Consent: Express consent for sensitive or higher-risk processing; implied consent only where appropriate. Impacts of withdrawal are explained.
Limiting collection: Only necessary data, collected fairly and lawfully.
Limiting use, disclosure, retention: Used for stated or compatible purposes; deleted or de-identified when no longer needed or required by law.
Accuracy: Reasonable steps keep information accurate when used for decisions.
Safeguards: Measures proportionate to sensitivity and risk, including encryption, access controls, logging, and vetted vendors.
Openness: Accessible notices, policies, and contact channels.
Individual access: Responses within statutory timeframes, subject to lawful exceptions.
Challenging compliance: Clear complaint routes before OPC escalation.

What we collect, why we use it, who receives it, and how long we keep it

Account and contact (names, business contacts, role, credentials, preferences): Service delivery, authentication, support, billing, communications. Shared with hosting, email, and support tools. Basis: consent or contract. Retention: relationship duration plus required periods.
Transactions and payments (orders, payments, refunds, chargebacks, shipping, disputes): Order processing, fraud prevention, accounting/tax. Shared with payment providers, banks, accounting, and risk vendors. Basis: contract and legal obligations. Retention: financial/tax periods.
Technical and events (IP, device/browser, logs, necessary cookies/identifiers, language/time zone, telemetry): Security, performance, bot detection, product improvement. Shared with hosting, security, analytics providers. Basis: legitimate interests and consent for non-essential cookies. Retention: cookie lifetimes and security log policies.
Merchant customer data (order, fulfillment, payment data passed through the platform, preferences, data rights requests): Order processing, fulfillment, merchant support, fraud mitigation. Merchant is controller; we process under contract. Shared with payment, shipping, analytics, and support providers. Retention: per merchant instructions and law.
Communication and marketing preferences: Updates or offers where permitted. Shared with email/SMS providers. Basis: consent or applicable permission. Retention: until withdrawal or end of purpose.
KYC/AML documentation (where required by law or schemes): Identity documents, source of funds, screening results for AML/ATF, sanctions, and fraud prevention. Shared with verification and payment partners. Basis: legal obligation and, where applicable, express consent. Retention: per financial regulations.
Support records and content you submit: Issue resolution and audit trails. Shared internally as needed and with support tooling. Basis: contract and legitimate interests. Retention: support log policies.
Data minimization and retention: Timings are in our Data Retention Schedule; you may request a copy.

Purposes of use and legal bases

We process personal information for:

Service delivery: account creation, authentication, payments, fulfillment, dashboards, and support. Basis: contract or consent where required.
Security and fraud prevention: detecting misuse, bots, unauthorized access, chargebacks, sanctions risks, and platform abuse with proportionate controls. Basis: legitimate interests and legal obligations.
Product improvement and analytics: reliability monitoring, debugging, controlled testing, and contextual tuning without invasive profiling. Basis: legitimate interests, with consent for non-essential cookies/trackers.
Legal and regulatory compliance: recordkeeping, tax, AML/ATF, sanctions screening, lawful requests, and enforcing terms. Basis: legal obligations.
Direct marketing (where permitted): updates, offers, and education with clear opt-out, honoring CASL and spam rules. Basis: consent or applicable permission.
Dispute management: chargebacks, collections, claims, and defense of rights. Basis: legitimate interests and legal obligations.

Email marketing: requires express consent; every email includes an unsubscribe link processed without undue delay.
SMS or push notifications: require express consent; you can withdraw by replying STOP/UNSUBSCRIBE or changing app settings.
Non-essential cookies/trackers: collected only after consent via banner or preference center; you can adjust settings anytime in the preference center or browser.
Withdrawing consent: you can withdraw at any time; we explain any service impact (e.g., inability to deliver marketing or optional features) before processing the withdrawal.

We work with hosting, cloud, CDN, payment, email, analytics, security, and support providers as subprocessors listed at Subprocessors List. Merchants remain controllers for their customer data; we act on their instructions. We disclose personal information to government authorities or courts when legally required and limit disclosures to what is necessary. Contractual and technical safeguards (e.g., encryption, access controls, audit rights) apply to subprocessors and cross-border transfers.

Cross-border transfers

Personal information may be transferred to Singapore, the United States, the European Union, and other provider locations. We use contractual safeguards, access controls, encryption, vendor risk assessments, and monitoring to provide protection comparable to PIPEDA, and apply additional measures where needed.

Retention and deletion

We retain personal information only as long as necessary for stated purposes, to meet legal/financial obligations, or per merchant instructions. When it is no longer needed, we delete or de-identify it in line with the Data Retention Schedule.

Your rights under PIPEDA

Access and portability: Request access to or copies of your personal information; we aim to respond within 30 days, subject to lawful exceptions.
Correction: Request updates where information is inaccurate or incomplete; if we decline, we explain and can note disagreement.
Withdrawal of consent: Withdraw consent for processing that relies on consent (e.g., marketing, optional cookies); we act promptly.
Challenge and complaints: Challenge compliance through our Privacy Team; you may escalate to the OPC if unresolved.
Safeguards transparency: Ask how we protect data, including cross-border measures and subprocessors.

Cookies and tracking technologies

We use:

Strictly necessary cookies: for login, security, session continuity, and fraud prevention (e.g., non-invasive device fingerprinting).
Performance and analytics cookies: to measure reliability, usage patterns, feature adoption, and error diagnostics in aggregated form.
Marketing cookies/trackers: enabled only with consent; always paired with easy opt-out.

Controls: manage cookies via browser settings and our preference center. Some features may be limited if non-essential cookies are refused. We respect applicable opt-out signals where required.

Security safeguards and incident response

We protect personal information with measures proportionate to sensitivity and risk, including:

Encryption in transit and at rest.
Role-based access with logging and multi-factor authentication.
Network security, vulnerability management, and periodic testing.
Monitoring, incident response playbooks, and post-incident reviews.
Employee privacy training and vendor due diligence with contractual controls.

If an incident poses a real risk of significant harm, we investigate, contain, mitigate, notify affected individuals and the OPC when required, and document remediation such as key rotation or control updates. Notifications occur as soon as reasonably practicable based on scope, sensitivity, and impact.

Complaints and contact

If you have questions, requests, or complaints, email privacy@tanqory.com with your contact details and a description of the matter. We typically respond within 30 days and will let you know if more time is needed. If you are unsatisfied, you may escalate to the Office of the Privacy Commissioner of Canada (OPC).

Privacy Officer (Canada): Privacy Officer (Canada), c/o Tanqory Privacy Team, c/o Tanqory Privacy Team, c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, USA
North America contact address: c/o Privacy Compliance, 16192 Coastal Hwy, Lewes, DE 19958, USA
Subprocessors: Subprocessors List
Retention schedule: Data Retention Schedule
Policy website: https://legal.tanqory.com/

Relationship to other Tanqory policies

Read this notice alongside the Tanqory Privacy Policy, Cookie Policy, Data Processing Addendum, Subprocessor List, platform terms, and product-specific notices. If there is any conflict, the stricter document or stricter applicable law prevails.

Updates to this notice

We may update this notice to reflect legal changes, industry standards, or product updates. Material changes will be communicated through our services or your primary contact channel. Continued use after publication of updates constitutes acceptance; please check the “Last updated” date above.