1. Who We Are

1.1 This Privacy Policy describes how 11698729 CANADA CORP ("we", "us", "our", or "the Company"), the owner and operator of crawfty.com ("the Website"), collects, uses, discloses, and protects your personal information.

1.2 11698729 CANADA CORP is the data controller responsible for your personal information. We are subject to the Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5) ("PIPEDA") and applicable provincial privacy legislation.

1.3 By accessing the Website or using our Services, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

2.1 Information You Provide Directly:

• Name, email address, postal address, telephone number
• Billing and payment information (processed via third-party payment providers — we do not store full credit card numbers)
• Account registration details (username, password)
• Communications you send to us (enquiries, support requests, feedback)
• Any other information you voluntarily submit

2.2 Information Collected Automatically:

• IP address, browser type and version, operating system
• Device identifiers and characteristics
• Pages visited, time spent on pages, referring URLs, click patterns
• Cookies and similar tracking technologies (see Section 6)
• Transaction and purchase history
• Log data and usage analytics

2.3 Information from Third Parties:

• Payment processors (transaction confirmations and fraud screening)
• Analytics providers (aggregated usage data)
• Advertising partners (where applicable)
• Social media platforms (if you interact with us through social media)

3. How We Use Your Information

3.1 Under PIPEDA, we collect and use your personal information only for purposes that a reasonable person would consider appropriate in the circumstances. We use your information to:

• (a) Fulfil Orders and Provide Services: Process transactions, deliver products, manage your account, provide customer support;
• (b) Communicate with You: Respond to enquiries, send order confirmations, service updates, and (with your consent) marketing and promotional communications;
• (c) Improve Our Services: Analyse usage patterns, conduct research, develop new features, and improve user experience;
• (d) Legal Compliance: Comply with applicable federal and provincial laws, regulations, court orders, and legal processes;
• (e) Security and Fraud Prevention: Detect, investigate, and prevent fraud, unauthorised access, and other illegal activities;
• (f) Enforce Our Terms: Enforce our Terms of Service, protect our rights and property, and protect the safety of our users and the public;
• (g) Business Operations: Internal record-keeping, auditing, and corporate reporting.

4. Consent

4.1 Under PIPEDA (Principle 3), we rely on your consent to collect, use, and disclose your personal information, except where the law permits or requires action without consent.

4.2 Express Consent: We obtain your express consent for sensitive information and marketing communications.

4.3 Implied Consent: Your consent may be implied when you voluntarily provide information for an obvious purpose (e.g., providing your address to ship a product).

4.4 Withdrawal of Consent: You may withdraw your consent at any time by contacting us at [email protected], subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may affect our ability to provide certain Services to you.

5. Legal Bases for Processing (EU/EEA Users)

5.1 If you are in the European Union or European Economic Area, we process your personal data under the General Data Protection Regulation (GDPR) on the following bases:

• (a) Contractual Necessity (Art. 6(1)(b)): Processing necessary to perform our contract with you;
• (b) Legitimate Interests (Art. 6(1)(f)): Processing necessary for our legitimate business interests, provided such interests are not overridden by your rights;
• (c) Consent (Art. 6(1)(a)): Where you have given specific consent;
• (d) Legal Obligation (Art. 6(1)(c)): Where processing is required by law.

6. Cookies and Tracking Technologies

6.1 We use cookies and similar technologies to enhance your experience. Types include:

• Essential Cookies: Required for the Website to function (e.g., shopping cart, login sessions) — these cannot be disabled;
• Analytics Cookies: Help us understand how users interact with the Website (e.g., Google Analytics);
• Functional Cookies: Remember your preferences and settings;
• Marketing Cookies: Used to deliver relevant advertisements and measure campaign effectiveness (where applicable).

6.2 You can control cookies through your browser settings. Disabling certain cookies may affect Website functionality.

6.3 EU Users: Non-essential cookies will only be placed with your prior consent.

6.4 Do Not Track: We currently do not respond to "Do Not Track" browser signals, as there is no industry-wide standard for compliance.

7. Sharing and Disclosure

7.1 We do not sell your personal information. In accordance with PIPEDA (Principle 5), we may share your information with:

• (a) Service Providers: Third parties who assist in operating the Website and providing Services (payment processors, hosting providers, shipping partners, analytics services), bound by contractual obligations to protect your data and use it only for specified purposes;
• (b) Legal Requirements: When required by law, court order, subpoena, or regulatory authority, or when we believe disclosure is necessary to comply with a legal obligation;
• (c) Business Transfers: In connection with a merger, acquisition, reorganisation, or sale of all or part of 11698729 CANADA CORP, your information may be transferred as a business asset — you will be notified of any such change;
• (d) Protection of Rights: To protect the rights, property, or safety of 11698729 CANADA CORP, our users, or the public;
• (e) With Your Consent: For any other purpose with your express consent.

8. Data Retention

8.1 Under PIPEDA (Principle 5), we retain your personal information only as long as necessary to fulfil the purposes for which it was collected, or as required by law.

8.2 General retention periods:

• Account information: Duration of your account plus two (2) years after closure;
• Transaction records: Minimum seven (7) years for tax and legal compliance under the Income Tax Act (R.S.C., 1985, c. 1 (5th Supp.));
• Marketing preferences: Until you withdraw consent;
• Analytics data: Aggregated and anonymised within twenty-four (24) months.

8.3 When personal information is no longer needed, it will be securely destroyed, erased, or anonymised.

9. Data Security

9.1 Under PIPEDA (Principle 7), we implement appropriate technical and organisational safeguards to protect your personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest;
• Access controls and authentication measures;
• Regular security assessments;
• Employee training on data protection obligations.

9.2 No method of transmission over the Internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

9.3 In the event of a data breach posing a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as required under PIPEDA (Division 1.1).

10. Your Rights

10.1 Canadian Users (PIPEDA):

• (a) Access: You have the right to request access to your personal information held by us (Principle 9);
• (b) Correction: You may request correction of inaccurate or incomplete information (Principle 9);
• (c) Withdraw Consent: You may withdraw consent to collection, use, or disclosure, subject to legal or contractual restrictions;
• (d) Complain: You may file a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) if you believe your rights have been violated.

10.2 EU/EEA Users (GDPR):

• (a) Access, rectification, erasure, restriction of processing, data portability, and objection;
• (b) Right to withdraw consent at any time;
• (c) Right to lodge a complaint with your local Data Protection Authority.

10.3 Jamaican Users: Your data is handled in accordance with applicable Jamaican law, including the Data Protection Act, 2020.

10.4 To exercise any of these rights, contact us at [email protected]. We will respond within thirty (30) days.

11. International Transfers

11.1 Your personal information may be transferred to and processed in countries outside your country of residence, including Canada.

11.2 Canada has been recognised by the European Commission as providing an adequate level of data protection (Commission Decision 2002/2/EC), facilitating lawful transfers of personal data from the EU/EEA to Canada.

11.3 Where data is transferred to jurisdictions without an adequacy decision, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses).

12. Children

12.1 The Website is not directed to individuals under the age of eighteen (18) or the age of majority in their jurisdiction. We do not knowingly collect personal information from children.

12.2 If we become aware that a child has provided us with personal information, we will take steps to delete it promptly.

13. Changes to This Privacy Policy

13.1 We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date.

13.2 For material changes, we will provide prominent notice (e.g., email notification or Website banner).

13.3 Your continued use of the Website after changes are posted constitutes acceptance of the revised Privacy Policy.

14. Contact

11698729 CANADA CORP

Corporation registered in Canada

Privacy Officer: [email protected]

Website: crawfty.com

Office of the Privacy Commissioner of Canada

30 Victoria Street, Gatineau, QC K1A 1H3

Toll-free: 1-800-282-1376

Website: www.priv.gc.ca

For EU-specific enquiries: [email protected]