Privacy Policy

1. Overview and scope

This policy explains how REACH Supply handles personal information for ReachSupply.ca, including accounts, orders, trade applications, product-fit requests, returns, warranties, files and customer support.

Applicable requirements may include British Columbia’s Personal Information Protection Act, the federal Personal Information Protection and Electronic Documents Act where it applies, and other applicable provincial privacy laws, including Québec’s private-sector privacy law.

2. Accountability and privacy contact

REACH Supply is accountable for personal information under its control, including information transferred to service providers for processing. The privacy contact is Privacy Officer — REACH Supply, reachable at [email protected].

The Privacy Officer receives questions, access and correction requests, consent withdrawals and complaints. Employees and service providers are expected to handle personal information only for authorized purposes and with safeguards appropriate to the information.

3. Information we collect

Depending on how you interact with the store, we may collect:

• Identity and contact information: name, business name, email, telephone number, billing address, shipping address, and account username.
• Order and transaction information: products, quantities, prices, discounts, taxes, status, shipping, tracking, returns, refunds, warranty claims, invoices, and transaction identifiers.
• Payment-related information: payment method type, billing details, authorization and payment status, and limited identifiers supplied by processors. We generally do not store complete payment-card numbers.
• Account information: protected credentials, saved addresses, preferences, order history, user roles, saved lists, quotes, and account settings.
• Trade-account information: legal and operating business details, contacts, business type, purchasing needs, tax documents, verification results, pricing group, and account communications.
• Support and product-fit information: equipment brand, model and serial number, existing part number, photographs, videos, installation details, technical findings, correspondence, and claim evidence. Uploaded images may incidentally contain addresses, faces, licence plates, documents, or other information, so submit only what is relevant.
• Device and usage information: IP address, browser, device, operating system, referring page, pages viewed, approximate location derived from IP, cookie identifiers, and interactions with the site or emails.
• Marketing and consent information: subscription choices, consent records, campaign interactions, and unsubscribe status.
• Fraud, security, and compliance information: signals and records used to prevent unauthorized transactions, account abuse, chargebacks, and security incidents.

4. How information is collected

We collect information directly from you through checkout, accounts, forms, emails, calls, support requests, trade applications, and uploaded files.

We also collect information automatically through essential cookies, server logs, security tools, and, where enabled with the required choices, analytics or advertising technologies.

Information may also come from payment processors, carriers, suppliers, fulfilment partners, fraud-prevention providers, business registries, public business sources, and other service providers involved in a transaction or account review.

5. How information is used

We may use personal information to:

• create and administer customer and trade accounts;
• verify identity, business information, addresses, payments, and eligibility;
• authorize and capture payments and process orders, shipments, refunds, returns, warranties, and disputes;
• identify products and assess compatibility using information you provide;
• communicate about orders, accounts, security, recalls, policies, and support;
• operate, secure, troubleshoot, personalize, and improve the website and services;
• measure performance and understand customer journeys;
• send marketing where consent or another lawful basis exists;
• prevent fraud, misuse, unauthorized access, and security incidents;
• meet tax, accounting, recordkeeping, regulatory, and legal obligations; and
• establish, exercise, or defend legal claims and enforce agreements.

We do not use information for a materially different new purpose without any additional notice or consent required by law.

6. Consent and lawful exceptions

Where consent is required, it must be meaningful and appropriate to the information, purpose and circumstances. We identify why information is needed and distinguish the information required to fulfil your request from optional uses.

Refusing optional marketing or non-essential tracking does not by itself prevent a purchase or a support request. Withdrawing consent may affect a service that genuinely requires the information; we will explain the relevant consequence and any lawful retention obligations.

Collection, use or disclosure without consent is limited to situations permitted or required by the applicable law, such as specified investigations, emergencies, legal proceedings or compliance obligations. This policy does not create additional exceptions.

7. Service providers and other disclosures

Where necessary for the identified purpose and permitted by law, information may be shared with:

• payment processors and financial institutions;
• carriers, freight providers, suppliers and other fulfilment partners;
• hosting, security, email, support and other technology providers;
• analytics or advertising providers where those tools are used with the required choices;
• professional advisers, insurers, accountants and auditors;
• regulators, courts, law-enforcement bodies or other parties when a lawful basis exists; and
• parties to a proposed or completed business transaction, subject to required safeguards.

Service providers processing information for us are restricted to the authorized service and applicable legal requirements. A disclosure is not unrestricted permission for an unrelated use. Independent payment or other services may also have their own notices for activities they control.

REACH Supply does not rent customer lists or sell customer personal information for money. This statement does not mean that no information is disclosed to service providers or that advertising technologies require no consent.

8. Suppliers and direct fulfilment

Because many orders may be fulfilled directly by suppliers, distributors, manufacturers, warehouses, or logistics partners, we may provide them with the information required to confirm, pack, ship, deliver, track, recall, return, or administer warranty service for an order.

This may include the recipient name, company, shipping address, telephone number, email where required for delivery, products ordered, quantities, order references, and claim details. We do not provide complete payment-card details to fulfilment partners.

9. Payments, fraud screening, and automated tools

Payment services collect and process payment data under their own notices. REACH Supply generally receives billing details, method type, limited identifiers and authorization or payment status rather than a complete payment-card number. Do not send full card numbers, security codes or banking credentials through support forms.

Automated fraud or security tools may assess order, account, device and transaction signals. An order can be delayed or referred for review. Contact the Support Center if you believe a security decision was made in error.

Where applicable law regulates a decision based exclusively on automated processing, we provide the required notice, information about the data and principal factors involved, and the opportunity to correct information or make representations to a person able to review the decision.

10. Cookies, analytics, and advertising

The store and its providers may use cookies, local storage, pixels or similar technologies for:

• Essential functions: keeping a cart, maintaining login, checkout, security and fraud prevention.
• Preferences: remembering selections and display choices.
• Analytics: measuring traffic, errors and performance when enabled.
• Advertising: measuring campaigns or building audiences when enabled and lawfully permitted.

Non-essential uses must have the consent or other basis required by the applicable law. Privacy choices for functions that identify, locate or profile you must be provided as required; where the law requires activation by you, those functions are not authorized merely by continued browsing.

Use the privacy controls actually displayed on the website, or contact our Privacy Officer about available choices. Browser settings can block or delete cookies, but may not control every tracking technology, and blocking essential storage can affect checkout or accounts.

11. Commercial electronic messages

Promotional emails or texts are sent only with express consent, valid implied consent or another applicable CASL exception. Where required, messages identify the sender, provide contact information and include a working, no-cost unsubscribe method.

We honour marketing unsubscribe requests without delay and no later than 10 business days where CASL applies. Use the message’s unsubscribe link or contact [email protected]. An account login is not required simply to unsubscribe.

Necessary order, security, recall, warranty or support messages may continue where lawful. A service-message exception is not used to add unrelated promotions without the required basis.

12. Processing outside your province or Canada

Some providers and systems may process or store information outside your province or Canada, including in the United States. Information processed elsewhere may be subject to the laws and lawful-access powers of that jurisdiction.

REACH Supply remains accountable for information transferred for processing. Appropriate contractual and other safeguards, and any legally required transfer or privacy-impact assessment, apply before the transfer.

Ask the Privacy Officer for more information about relevant processing arrangements. Purchasing from the Canadian storefront is not a promise that every supplier or technology provider stores data only in Canada.

13. Retention and disposal

We retain information only as long as reasonably necessary for the identified purposes and for order fulfilment, warranty, fraud prevention, tax, accounting, legal, dispute, security, and recordkeeping requirements.

Retention varies by information type, sensitivity, purpose, account status, and legal obligation. When no longer required, information is securely deleted, destroyed, or anonymized. Protected backups may retain information until the normal backup cycle removes it.

14. Security and privacy incidents

We use administrative, technical and physical safeguards intended to protect information in proportion to its sensitivity, including appropriate access restrictions and protection of transmission, records and service-provider arrangements. No website or storage method can guarantee absolute security.

Suspected privacy incidents are assessed so they can be contained, documented and addressed. We provide regulator reports, notifications to affected people and incident records when required under the applicable law; the applicable threshold and process may differ by jurisdiction.

If you suspect a privacy or account-security issue, contact [email protected]. Do not send a password or unnecessary sensitive documents as proof.

15. Access, correction, and privacy rights

Depending on the applicable law, you may ask whether we hold information about you, request access or correction, withdraw consent, unsubscribe from marketing and complain about our practices. Deletion, portability, de-indexing or other rights apply only where the relevant law provides them; they are not identical across Canada.

Where Québec law applies, additional rights may include obtaining eligible computerized information you provided in a structured, commonly used format and information or review concerning exclusively automated decisions. Statutory conditions and exceptions apply.

We request only the identity or authority information reasonably necessary to verify a request. We respond within the applicable statutory period and explain any lawful extension, fee or refusal where required. Access may be restricted to protect another person’s information, privilege or another legally protected interest.

Deleting an account does not necessarily delete invoices, mandatory tax records or evidence needed for a live claim. We explain relevant retention limits rather than promise immediate deletion of every record.

16. Children and minors

The store is intended for adults and business customers and is not directed to children. We do not knowingly collect personal information from a child without the consent or authority required by applicable law.

If you believe a child has provided personal information, contact the Privacy Officer so the situation can be reviewed.

17. Changes to this policy

We may update this Privacy Policy to reflect changes in services, providers, technology, practices, or law. The revised page will show its effective and reviewed dates.

Material changes will receive any additional notice or consent required by law.

18. Contact and complaints

Use the Support Center for a privacy request, or contact the Privacy Officer directly. You do not need an account, a prior order or acceptance of new purchase terms to make a privacy request.

Include your contact details and a description of the request. Avoid unrelated personal information. We may ask for proportionate verification before releasing or changing a record.

You may contact the regulator with jurisdiction, including the British Columbia privacy commissioner, Office of the Privacy Commissioner of Canada, or Commission d’accès à l’information du Québec. An unresolved internal complaint is not a waiver of an available regulatory remedy.