Privacy Policy

Last updated: May 2026.

Norpex (“we,” “our,” “us”) respects your privacy. This policy describes what personal information we collect when you use norpex.ca or interact with us, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have under Canadian privacy law — including the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation including Quebec’s Law 25.

1. What we collect

The categories of personal information we collect:

• Identification & contact information: name, business name, email address, phone number, billing address, shipping address.
• Account credentials: hashed passwords, account preferences, order history, B2B account tier.
• Payment information: credit card details are tokenized and processed by our payment processor (Stripe). We do not store full card numbers on Norpex servers. Bank details for ACH/wire are stored only as needed to process the transaction.
• Order & transaction data: products ordered, shipping addresses, freight quotes, invoices, returns, warranty claims.
• Communications: emails you send us, live-chat transcripts (handled via Chatwoot), call recordings if provided with notice.
• Technical data: IP address, browser type, device type, pages visited, referrer, session duration. Collected via cookies and analytics tools.
• Marketing preferences: if you opt in to email marketing, your subscription status and engagement history.

2. Why we collect it

• To process orders, generate invoices, and ship the equipment you bought.
• To create and manage your account, including B2B account features (tier pricing, Net-30 invoicing, tax exemption).
• To respond to support requests, quote requests, and warranty claims.
• To send transactional communications (order confirmations, shipping notifications, invoices).
• To send marketing communications — only if you’ve opted in, and you can opt out at any time.
• To prevent fraud, debug issues, secure the site, and improve performance.
• To comply with legal obligations including tax records, anti-money-laundering checks where applicable, and lawful court orders.

3. Who we share it with

We share personal information only with parties who need it to deliver the service you’ve requested or to meet our legal obligations:

• Payment processors — Stripe (and other processors as we add them) for credit card and ACH processing.
• Shipping carriers and freight brokers — Canada Post, Purolator, FedEx, UPS, plus LTL carriers and freight brokers, all of whom need your delivery address and contact info.
• Manufacturer drop-ship partners — when an item ships direct from the manufacturer’s warehouse, the manufacturer receives the shipping address and order details.
• Customer support tooling — Chatwoot (live chat) and our email systems.
• Analytics — privacy-respecting analytics (e.g., server-side analytics, Plausible, or similar). We do not currently sell behavioral data to third parties.
• Email marketing platform — for opt-in marketing only.
• Legal authorities — when compelled by valid legal process.

We don’t sell your personal information. We don’t trade it for advertising. We don’t share it with data brokers.

4. Cookies

We use cookies in three categories:

• Essential cookies — required for the cart, login session, and checkout. You can’t disable these without breaking the site.
• Performance cookies — used by analytics to understand how the site is used. Aggregated, not tied to individual identity.
• Marketing cookies — used only if you opt in via the cookie banner. These power retargeting and conversion measurement.

You can manage cookie preferences via the cookie banner on first visit, via your browser settings, or by emailing privacy@norpex.ca.

5. Your rights under PIPEDA and provincial law

You have the right to:

• Access the personal information we hold about you.
• Correct personal information that is inaccurate or incomplete.
• Withdraw consent for non-essential uses (such as marketing) at any time.
• Request deletion of your personal information, subject to our legal retention obligations (we are required to keep tax and order records for the period prescribed by Canadian tax law — typically 6-7 years).
• Lodge a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.

To exercise any of these rights, email privacy@norpex.ca with your request and enough information to verify your identity. We respond within 30 days.

6. Quebec residents — Law 25

If you are a Quebec resident, additional rights and obligations apply under Quebec’s Act respecting the protection of personal information in the private sector (“Law 25”). These include the right to data portability and the right to be informed of automated decision-making. Norpex does not currently use automated decision-making in any way that materially affects your account. For Law 25 inquiries, contact privacy@norpex.ca.

7. Children’s privacy

Norpex’s services are intended for commercial buyers. The site is not directed to individuals under 18, and we do not knowingly collect personal information from anyone under 18. If we become aware that we’ve collected such information, we will delete it.

8. Data retention

We keep personal information only as long as needed for the purposes it was collected and to satisfy legal requirements:

• Order and tax records: 7 years (Canadian tax law).
• Active account data: as long as the account is active, plus a reasonable wind-down period after closure.
• Marketing preferences: until you unsubscribe.
• Live chat and support transcripts: 24 months by default.
• Server logs: 12 months.

9. International transfers

We use Canadian and US-based service providers. Some processing therefore takes place in the United States. Where personal information is transferred outside Canada, we use contractual safeguards consistent with PIPEDA requirements and ensure providers meet appropriate security standards.

10. Security

We use standard industry safeguards: TLS encryption in transit, encryption at rest for sensitive data, hashed passwords, role-based access control, regular security patching, and limited employee access on a need-to-know basis. No system is 100% secure, but we treat your data with the seriousness our own would deserve.

11. Changes to this policy

If we materially change this policy, we’ll update the “Last updated” date and, for significant changes, post a notice on the site or email account holders. Continued use of the site after changes take effect constitutes acceptance of the updated policy.

12. Contact

Privacy questions, access requests, complaints: privacy@norpex.ca. Postal mail: Norpex, Privacy Officer, Kitchener, Ontario, Canada.