Privacy Policy

Scope of this policy

This policy applies to this website and to personal information I collect in the course of quoting, contracting, sourcing, importing, and delivering goods. It does not apply to third-party websites I link to, which have their own policies.

Most of what I handle is business contact information — your name, title, company, work email, work phone, and business address, used solely to communicate with you in relation to your work. PIPEDA generally exempts that category from its consent requirements. I apply the safeguards in this policy to it anyway.

Personal information I collect

Information you give me

When you contact me by email: your name, company, email address, and whatever your message includes — typically a description of what you are sourcing, target quantities, target landed price, required dates, certification requirements, and delivery location, along with any drawings, specifications, or photographs you attach. I keep those, together with my correspondence with you by email, telephone, and messaging.

Information I collect if you become a customer

Billing and shipping addresses, purchase order and invoice records, your business number and any import or account numbers required for customs, customs and shipping documentation, inspection and certification records, and payment records. I do not collect or store full payment card numbers. Payments are made by bank transfer or cheque and are handled by my financial institution.

Information collected automatically

My hosting provider records standard server logs for each request — IP address, browser user agent, requested URL, referring page, and timestamp — used to keep the site available and to defend against abuse.

I do not knowingly collect personal information from anyone under 18, and I do not collect sensitive categories of personal information such as health or biometric data, or financial account details beyond what an import transaction requires.

Cookies, analytics, and tracking

This site sets no cookies, runs no analytics, and loads no third-party tracking scripts, advertising pixels, or embedded social media. Typefaces are self-hosted, so displaying this page sends no request to any outside service. There is nothing here to opt out of. If I add analytics in future, I will update this policy first and choose a tool that does not build cross-site profiles of visitors.

Why I collect it

I use personal information only to:

• respond to your enquiry and prepare a quotation;
• identify, evaluate, and negotiate with manufacturers, and place orders with them;
• arrange inspection, testing, certification, and bilingual labelling;
• arrange freight, insurance, customs clearance, and delivery;
• meet my obligations as importer of record, including customs record-keeping;
• invoice you, collect payment, and manage my accounts;
• provide warranty support and handle claims;
• communicate with you about an order in progress.

I do not send marketing email unless you ask me to, and any such message will identify me and carry a working unsubscribe link, as Canada’s Anti-Spam Legislation (CASL) requires. I use information only for the purposes listed above or purposes consistent with them. If a new purpose arises, I will ask your consent first.

Consent

By corresponding with me, you consent to my collecting, using, and disclosing your information for the purposes in section 04. You may withdraw consent at any time by writing to me as Privacy Officer, subject to legal and contractual restrictions and reasonable notice. If you withdraw consent while an order is in progress, I may be unable to complete it. Records I am required to keep under section 09 will be retained regardless.

Who I disclose it to

I share personal information only with the parties needed to do the job you have asked me to do:

• Manufacturers and suppliers, principally in mainland China — I send technical specifications, drawings, and quantities.
• Freight forwarders, carriers, and customs brokers — consignee name, delivery address, contact telephone, commercial invoice, and packing list.
• The Canada Border Services Agency and other regulators — as required for customs entry and product compliance.
• Testing and certification bodies — where a product requires CSA, UL/cUL, or other certification.
• My service providers — website host, email provider, accountant, bank, insurer, and legal counsel, each permitted to use the information only for the service they provide to me.
• Where required by law — in response to a court order, subpoena, or other lawful demand, and only to the extent required.
• On a business transfer — if the business or its assets are sold or reorganized, records may pass to the acquirer, which will remain bound by this policy.

Information stored or processed outside Canada

I operate between Canada, Hong Kong, and mainland China. Some of my service providers store or process data outside Canada, including in the United States and Hong Kong. While information is in another country, it is subject to the laws of that country, and may be accessible to its courts, law enforcement, and national security authorities under a lawful order made there, without notice to you.

I select providers that offer a comparable level of protection by contract, and I disclose to them only what they need. If you would prefer that a drawing or specification not leave Canada by email, contact me and I will arrange another method.

How I protect it

I maintain physical, organizational, and technological safeguards proportionate to the sensitivity of the information: the whole site is served over HTTPS; I am the only person with access to customer records; accounts are protected with strong, unique passwords and two-factor authentication where available; devices are encrypted; and paper records are kept secured.

No method of transmission over the internet is completely secure, and ordinary email in particular is not encrypted end to end. Please do not send me anything you consider highly confidential by unencrypted email without arranging a secure method with me first.

How long I keep it

• Quote requests that do not become orders — up to 24 months from last contact, then deleted.
• Order, customs, and accounting records — at least six years from the end of the year to which they relate, as required of an importer under the Customs Act and of a corporation under the Income Tax Act, and longer where a warranty or limitation period is still running.
• Server logs — a short rolling window set by my hosting provider, typically 30 days or less.

When information is no longer needed for the purpose it was collected for and is past any retention period required by law, I destroy, erase, or anonymize it.

Your right to access and correct

On written request, I will confirm whether I hold personal information about you, tell you how it has been used and to whom it has been disclosed, and give you access to it. I respond within 30 days. There is no charge for a reasonable request; if a request would involve significant cost, I will give you an estimate first and you can decide whether to proceed.

If information I hold is inaccurate or incomplete, I will correct it and, where appropriate, notify anyone I disclosed it to. You may also ask me to delete information I am no longer required to keep. I may ask you to verify your identity before I act on a request. In limited cases the law requires or permits me to refuse access — for example where disclosure would reveal personal information about a third party, or privileged or confidential commercial information — and I will give you the reason in writing.

If you are in Quebec, you also have the right to receive the personal information you gave me in a structured, commonly used technological format (portability), and the right to ask me to cease disseminating information or to de-index it in the circumstances the law provides. I do not use personal information to make any decision based exclusively on automated processing.

Breach of security safeguards

If a breach of security safeguards involving personal information under my control creates a real risk of significant harm, I will notify the affected individuals and the Office of the Privacy Commissioner of Canada as soon as feasible, notify any organization that can reduce the risk, and keep a record of the breach, as PIPEDA requires. Where Quebec’s confidentiality incident rules apply, I meet those requirements in parallel.

Questions and complaints

Please raise any concern with me first — I am the Privacy Officer — using the contact details in section 14. I will acknowledge your complaint, investigate it, and give you a written response. If you are not satisfied with the outcome, you may complain to:

Office of the Privacy Commissioner of Canada

30 Victoria Street, Gatineau, Quebec K1A 1H3

1-800-282-1376 · priv.gc.ca

Residents of Quebec may instead contact the Commission d’accès à l’information du Québec; residents of British Columbia and Alberta may contact their provincial Information and Privacy Commissioner.

Changes to this policy

I may update this policy as my business, my service providers, or the law changes. The effective date at the top of this page always reflects the current version. Where a change is material, I will note it on this page and, if you have an order in progress, tell you directly. Continuing to use the site or to do business with me after a change means you accept the updated policy.

How to reach me

Privacy Officer

Liam Zhan

Zhan Supply Co. Ltd.

203 Mission Trail Cres, Ottawa, ON K2T 0H7, Canada

liam@zhansupply.ca · 343-347-0025

Write to me in English or French; I answer in the language you write in.