1. Who is responsible for your information
Hashtek (“Hashtek,” “we,” “us”) is responsible for the personal information described in this policy. You can contact our privacy lead at sales@hashtek.ca, by telephone at +1 (905) 393-2941, or by mail at Hashtek, 790 Redwood Square, Unit 2, Oakville, Ontario L6L 6N3, Canada.
2. Information we collect
- Orders and quotes: name, email, phone number, company, billing and shipping addresses, products, order notes, tax and shipping information, transaction status, invoices, and related correspondence.
- Payments: Moneris collects card details directly through its hosted payment fields. Hashtek receives payment tokens, authorization results, and transaction records, not your complete card number or security code.
- Accounts: profile details, authentication identifiers, addresses, order history, preferences, subscriptions, and support activity. Our authentication provider handles password credentials.
- Inquiries and subscriptions: information you enter in contact, event, giveaway, distributor, and newsletter forms, together with the source, time, and consent record for the submission.
- Storefront activity: IP address, browser and device information, requested pages, referring page, approximate location, security events, cart contents, currency choice, and interactions with products and checkout.
- Information from others: carriers, payment providers, service providers, distributors, business customers, and publicly available sources may provide information needed to complete a transaction or protect the storefront.
3. Why we use information
We use personal information to:
- respond to inquiries, prepare quotes, create orders, take payment, arrange delivery, provide invoices, and honour warranties;
- create and secure accounts, remember carts and preferences, provide customer support, and recover saved carts;
- send requested newsletters, stock notices, event information, or other marketing, and record or honour your unsubscribe choice;
- operate, troubleshoot, measure, and improve the storefront and our products;
- detect fraud, misuse, and security incidents, enforce our terms, and protect customers and Hashtek; and
- meet tax, accounting, recordkeeping, legal, and regulatory requirements.
Where the GDPR applies, our legal bases are performing or preparing to enter a contract, complying with law, our legitimate interests in operating and securing the business and serving customers, and your consent for optional analytics, marketing, and other activities where consent is required. You may withdraw consent at any time without affecting earlier lawful processing.
4. Cookies and similar technologies
Cookies and browser storage are small records placed on your device. Necessary storage supports the cart, checkout, authentication, security, currency, saved carts, and privacy choices. Blocking it may prevent parts of the storefront from working.
| Category | Examples | Purpose and duration |
|---|---|---|
| Necessary | hashtek_privacy_choices, hashtek_currency, cart and checkout storage, authentication cookies | Remembers choices, maintains a cart or session, prevents duplicate orders, and secures accounts. Duration ranges from the session to one year; privacy choices last up to 180 days. |
| Analytics | Google Tag Manager and Google Analytics tags, such as _ga when configured | Measures visits, product interactions, and storefront performance. For EU, EEA, and UK visitors, disabled until you allow analytics; provider-set duration may be up to two years. |
| Marketing | Campaign measurement tags configured through Google Tag Manager | Measures campaigns or supports tailored advertising. For EU, EEA, and UK visitors, disabled until you allow marketing. |
You can change your choices at any time using . We also respect supported Global Privacy Control signals by keeping marketing storage off. Browser controls can delete or block storage, but may also remove your saved choice.
5. When we share information
We do not sell personal information for money. We disclose information only as reasonably needed to:
- operate the storefront and customer systems through hosting, database, authentication, email, analytics, and security providers, including Vercel, Supabase, Resend, and Google where enabled;
- process transactions and prevent payment fraud through Moneris and participating banks or card networks;
- calculate and complete deliveries through Freightcom and selected carriers;
- work with professional advisers, insurers, auditors, or a buyer in a business reorganization subject to appropriate confidentiality; or
- comply with law, legal process, or a valid request from an authority, and protect rights, safety, and security.
Optional advertising technologies may constitute “sharing” under some US privacy laws. You can disable marketing technologies using Cookie settings, and a supported Global Privacy Control signal keeps them disabled. Where applicable law requires prior consent, they remain disabled unless you allow marketing. We do not knowingly sell or share personal information of anyone under 16.
6. International processing
Hashtek is based in Canada. Providers and recipients may process information in Canada, the United States, or other countries where privacy laws and government access rights differ. Where European law requires a transfer safeguard, we use an applicable adequacy decision, approved contractual safeguards, or another legally recognized mechanism. Contact us to ask about safeguards relevant to your information.
7. How long we keep information
We keep personal information only as long as reasonably needed for the purposes above. The period depends on the relationship, warranty and support needs, whether an account remains active, consent or unsubscribe records, fraud and security needs, dispute limitation periods, and tax, accounting, and other legal requirements. Saved-cart recovery links normally expire after 30 days. We delete, anonymize, or securely isolate information when it is no longer required.
8. Your choices and rights
Depending on where you live, you may have the right to ask for access, a copy, correction, deletion, restriction, portability, or information about how we use and disclose personal information; to object to certain processing; and to withdraw consent. You may unsubscribe using a link in a marketing email, the newsletter preferences page, or by contacting us.
California residents may also have rights to know, correct, delete, limit certain uses of sensitive information, and opt out of sale or sharing where the CCPA applies. We will not discriminate against you for exercising an applicable privacy right.
Send requests to sales@hashtek.ca. Describe the request and the email or order associated with it. We may need to verify identity or authority before responding. We will respond within the period required by applicable law.
9. Complaints
Please contact us first so we can investigate. You may also complain to the Office of the Privacy Commissioner of Canada, an applicable provincial commissioner, your European data protection authority, the UK Information Commissioner, or the California Privacy Protection Agency, depending on your location and the law that applies.
10. Security and children
We use administrative, technical, and physical safeguards appropriate to the information and risk, including access controls, encrypted connections, hosted card entry, and service-provider controls. No system is completely secure, so please use a unique password and contact us if you suspect unauthorized account activity.
The storefront is intended for business customers and adults and is not directed to children under 16. Contact us if you believe a child supplied personal information without appropriate authorization.
11. Changes to this policy
We may update this policy when our practices, providers, or legal obligations change. We will post the revised version here, update the date above, and provide additional notice when a material change requires it.