Privacy Policy

1. What we collect

• Identification & contact information: name, business name, email address, phone number, billing address, shipping address.
• Account data: sign-in records, account preferences, quote and order history.
• Payment information: card details are tokenized and processed by our payment processor. We do not store full card numbers on Norpex servers. Bank details for EFT/wire are stored only as needed to process the transaction.
• Order & transaction data: products quoted or ordered, shipping addresses, freight quotes, invoices, returns, warranty claims, any drawings or documents you upload with a quote, and the screenshot or receipt you upload when you pay by Interac e-Transfer or bank transfer (kept with the order, seen only by our staff).
• Communications: emails you send us, live-chat transcripts, call recordings if provided with notice.
• Technical data: IP address, browser type, device type, pages visited, referrer, session duration, and an approximate location (city and the first three characters of the postal code) derived from your IP address. Our staff can see these with the pages you visit, to help with a cart, checkout or quote; the IP address and location are deleted 30 days after your last visit, and are never kept if you are or may be in Quebec.
• Marketing preferences: if you opt in to email marketing, your subscription status and engagement history.

2. Why we collect it

• To price quotes, process orders, generate invoices and ship the equipment you bought.
• To create and manage your account, including tax exemption.
• To respond to support requests, quote requests and warranty claims.
• To send transactional communications (quote confirmations, order confirmations, shipping notifications, invoices).
• To send marketing communications — only if you've opted in, and you can opt out at any time.
• If you start checking out and don't finish, we may use the email address you typed to remind you about the cart you left — at most three times, with an unsubscribe link in every message.
• If you ask us to email your cart, we send it once to the address you give, with a PDF copy, and keep what you sent (the products, quantities, postal code and delivery price) with that address. No other email follows from it.
• To prevent fraud, debug issues, secure the site and improve performance.
• To comply with legal obligations including tax records and lawful court orders.

3. Who we share it with

We share personal information only with parties who need it to deliver the service you've requested or to meet our legal obligations:

• Payment processors for card and EFT processing.
• Shipping carriers and freight brokers — Canada Post, Purolator, FedEx, UPS, plus LTL carriers and freight brokers, all of whom need your delivery address and contact info.
• Manufacturer and distributor drop-ship partners — when an item ships direct from their warehouse, they receive the shipping address and order details.
• Customer support tooling — live chat and our email systems.
• Product videos — the videos on product and brand pages and at /videos are the manufacturers' own YouTube videos, which we find using YouTube API Services. Before you press play, your browser loads only the thumbnail image from YouTube's image server; pressing play loads YouTube's player, which Google operates under the Google Privacy Policy. We do not send YouTube any information about you, and we do not collect any information about which videos you watch.
• Analytics — privacy-respecting analytics. We do not sell behavioural data to third parties.
• Advertising measurement (Google Ads) — our shop pages load Google's tag from googletagmanager.com so we can tell whether our Google ads lead to visits, quote requests and orders. Like any request, it gives Google your IP address and browser details. From our side it receives only that a page or product was viewed, that a product was added to the cart or checkout was started (the product's catalogue number and price), that a quote request of a given type was sent, or an order's number and merchandise value — never your name, email, phone or address. It runs in Google's consent mode with its cookies switched off until you accept advertising cookies in our cookie banner. Until then Google receives only cookieless signals, which it uses to measure ad results in aggregate. If you accept, Google may also set advertising cookies to measure our ads and to show them to people who have visited before. If you arrive from one of our Google ads, the ad's click identifier may be carried along in the page address as you browse our site, so Google can still count a resulting order or quote request without setting a cookie. All of this is under the Google Privacy Policy. It does not load on our back office or supplier pages.
• Email marketing platform — for opt-in marketing only.
• Advertising measurement (Meta Pixel) — only if you accept advertising cookies in our cookie banner, our shop pages load Meta's pixel from connect.facebook.net so we can tell whether our Facebook and Instagram ads lead to visits, quote requests and orders, and show those ads to people who have visited before. Until you accept, nothing of Meta's loads. Once loaded, it gives Meta Platforms your IP address and browser details, may set Meta's cookies (_fbp, and _fbc when you arrive from a Meta ad), and receives from our side the same facts as the Google tag: that a page or product was viewed, that a product was added to the cart or checkout was started (the product's catalogue number and price), that a quote request of a given type was sent, or an order's merchandise value and its number (used only so Meta counts it once) — never your name, email, phone or address. If you are signed in to Facebook or Instagram in the same browser, Meta may link these events to your account under its own terms. Meta processes this information in the United States and elsewhere under the Meta Privacy Policy, and you can also control ads from us in your Facebook or Instagram ad preferences. Choosing Reject, or changing your choice under Cookie settings, stops the pixel and clears its cookies. It does not load on our back office or supplier pages.
• Ad results reported from our server (Google and Meta) — only if you had accepted advertising cookies in our cookie banner when you sent a quote request or placed an order, our server tells Google and Meta that it happened, so we can see which ads lead to real requests and sales even when the page in your browser did not report it. Google receives the identifier of the Google ad you clicked, the time, and the request's estimated value or the order's merchandise value. Meta receives the same, the request or order number (so it counts it once), its _fbp and _fbc cookies, your IP address and browser details, and your email address and phone number in encrypted (hashed) form so it can match the request or order to the Meta ad you saw. Never your name, address or the items you asked about or bought. If you rejected advertising cookies, or never answered the banner, nothing is reported.
• Advertising audiences (Google and Meta) — if you have bought from us or from the food equipment business that preceded Norpex, we may give Google and Meta your email address in encrypted (hashed) form, so they can show you our ads, or leave you out of them, on their services. They match it only against accounts they already hold, under their own terms. To be left out, unsubscribe from our emails or write to [email protected].
• Address suggestions (Google Maps) — when you type a street address at checkout, or a business name or address on our quote forms, our server sends what you have typed so far to Google's Places service to suggest matching addresses, and when you pick one it fetches that address's street, city, province and postal code. Your browser loads nothing from Google for this: Google receives only the typed text from our server, never your name, email address or order, under the Google Privacy Policy. Suggestions are asked for only while you type in that field; you can ignore them and type the whole address yourself.
• Delivery estimates (Google Maps) — when you check a delivery price on a product page, our server sends the postal code you entered, and nothing else, to Google's Places service to find the city it is in, so the carrier can quote it. We keep that postal code and its city on our server for up to a week so we don't ask again.
• Order surveys (Google Customer Reviews) — after a card order, or once you have sent an e-Transfer or bank transfer for an order, our confirmation page may show Google's invitation to rate your purchase. If you accept, Google emails you one short survey after the estimated delivery date, and your answers can count toward the store rating Google shows for Norpex. To make that offer, the page gives Google your order number, email address, country and estimated delivery date; if you decline, Google sends no survey. It is not offered for deliveries to Quebec. It runs under the Google Privacy Policy.
• Legal authorities — when compelled by valid legal process.

We don't sell your personal information. We don't trade it with other businesses for their advertising. We don't share it with data brokers.

4. Cookies

• Essential cookies — required for the cart and your sign-in session. You can't disable these without breaking the site.
• Performance cookies — used by analytics to understand how the site is used. Aggregated, not tied to individual identity, except the 30-day cookie set when you click a link in an email from us, described below.
• Marketing cookies — used only if you opt in, by choosing Accept in our cookie banner. Without that choice the Google Ads tag described above runs with its cookies switched off and the Meta pixel does not load at all. If your browser sends a Global Privacy Control signal, we never ask and treat the answer as no.
• Where you came from — two first-party cookies (np_attr and np_attr_last) remember how you first and most recently reached our site: the ad you clicked, the campaign tags in its link, or the site that linked to us. They are stored with a quote request or order, and shown to our staff with your current visit, so we know which ads and pages bring customers. They never leave our site by themselves, and they last 90 days if you accepted advertising cookies, otherwise only until you close your browser.

You can change your choice at any time under Cookie settings at the bottom of every page, through your browser settings, or by emailing [email protected].

5. Emails and links from us

When we email you — about a quote, an order, your marketplace account or listings, or a newsletter you signed up for — we record whether the email was delivered, when it was opened (the first and the most recent time) and whether you clicked a link in it. Quotes and payment links we email you are among these messages. When we send you a quote, we also count how many times you open its page, and when. For 30 days after you click one of those links, we also record which pages of norpex.ca you open, so our staff can follow up on your request. We keep this for 12 months. On a quote, invoice or payment page we send you, we also note which buttons you press (for example Accept or Pay), never what you type; we do not do this for customers in Quebec. If you are in Quebec, we record only whether our emails were delivered — not whether you opened them, clicked a link, opened your quote or which pages you visit. If your browser sends a Global Privacy Control signal, we record the click but none of the pages after it. You can ask us to delete any of it at [email protected].

5A. Recordings of your visit

If you accept analytics in our cookie banner, we may record how you use norpex.ca: the pages you open, your clicks and taps, and your scrolling. What you type is never recorded, and email addresses, phone numbers and postal codes shown on the page are blanked before anything leaves your browser. Our staff replay these visits to find pages that confuse people and checkouts that fail. Recordings are stored in our own systems and database; no third party receives or processes them. The basis is your consent, and you can withdraw it at any time under Cookie settings at the bottom of every page. We delete each recording after 30 days. If you are in Quebec we never record your visit, and if your browser sends a Global Privacy Control signal we do not record it either. If you delete your account, recordings of your visits linked to it are deleted too. You can ask us to delete any of it at [email protected].

6. Your rights under PIPEDA and provincial law

• Access the personal information we hold about you.
• Correct personal information that is inaccurate or incomplete.
• Withdraw consent for non-essential uses (such as marketing) at any time.
• Request deletion of your personal information, subject to our legal retention obligations (tax and order records are kept for the period prescribed by Canadian tax law — typically 6–7 years).
• Lodge a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy regulator (in Quebec, the Commission d'accès à l'information).

To exercise any of these rights, email [email protected] with your request and enough information to verify your identity. We respond within 30 days.

7. Quebec residents — Law 25

If you are a Quebec resident, additional rights and obligations apply under Quebec's Act respecting the protection of personal information in the private sector (“Law 25”). These include the right to data portability and the right to be informed of automated decision-making. Norpex does not use automated decision-making in any way that materially affects your account. For Law 25 inquiries, contact [email protected].

8. Children's privacy

Norpex's services are intended for commercial buyers. The site is not directed to individuals under 18, and we do not knowingly collect personal information from anyone under 18. If we become aware that we've collected such information, we will delete it.

9. Data retention

• Order and tax records: 7 years (Canadian tax law).
• Active account data: as long as the account is active, plus a reasonable wind-down period after closure.
• Marketing preferences: until you unsubscribe.
• Live chat and support transcripts: 24 months by default.
• Email and link activity (section 5): 12 months.
• Server logs: 12 months.

10. International transfers

We use Canadian and US-based service providers. Some processing therefore takes place in the United States. Where personal information is transferred outside Canada, we use contractual safeguards consistent with PIPEDA requirements and ensure providers meet appropriate security standards.

11. Security

We use standard industry safeguards: TLS encryption in transit, encryption at rest for sensitive data, passwordless customer sign-in, role-based access control with multi-factor authentication for staff, regular security patching, and limited employee access on a need-to-know basis. No system is 100% secure, but we treat your data with the seriousness our own would deserve.

12. Changes to this policy

If we materially change this policy, we'll update the “Last updated” date and, for significant changes, post a notice on the site or email account holders. Continued use of the site after changes take effect constitutes acceptance of the updated policy.

13. The Norpex app and deleting your account

The Norpex app for iPhone and Android uses the same account and the same records as norpex.ca. It collects what you give it: your email address to sign in, your name, business, phone number and delivery address when you check out or set up your profile, your orders, and, if you sell on the marketplace, your listings, the photos you add and the messages you send. Card and Google Pay or Apple Pay details go directly to Stripe, our payment processor; Norpex never receives or stores them. The app keeps your sign-in on your phone in its secure storage. It contains no advertising or tracking code and does not share anything with advertisers.

You can delete your account in the app (Account, then Delete account) or on our account deletion page. We delete your personal details, sign-in, saved items and the text of your messages, take down your unsold marketplace listings with their photos and descriptions, remove your name and contact details from support chats, and keep orders, invoices, payment records and the machines you sold for the period tax law requires (section 9).

14. Contact

Privacy questions, access requests, complaints: [email protected], attention of the Privacy Officer, or by phone at (226) 336-9954. See also our Terms & Conditions.