Privacy policy

Overview

HalSouk ("HalSouk", "we", "us", or "our") is committed to protecting your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25), and all other applicable Canadian federal and provincial privacy legislation. This Privacy Policy explains what personal information we collect, why we collect it, how we use and disclose it, and the choices available to you. We collect only the minimum personal information necessary to provide our services (data minimization principle). We do not use your personal information to build profiles for advertising purposes, and we do not sell, rent, or trade your personal information to any third party.

Information we collect

We collect the following categories of personal information: (a) Account information you provide when registering — name, email address, phone number, and business address; (b) Profile and listing information — business descriptions, product details, pricing, and images you publish on the Platform; (c) Media uploads — profile photos, banner images, and product images you upload, which are stored on our file hosting service and may be publicly visible; (d) Transaction data — when you purchase an optional visibility feature (Boost or Bump), payment records processed via our third-party payment processor (Stripe); we do not store credit card numbers or full payment card details; (e) Communications — messages exchanged through our in-platform chat system and any contact form submissions; (f) Reviews and ratings you submit, which are publicly visible; (g) Technical data — IP address, browser type, device information, pages visited, and session durations collected automatically through essential cookies and server logs; (h) Consent records — timestamps of your acceptance of our Terms of Use and Privacy Policy.

How we use your information

We use your personal information only for the following purposes: (a) to operate, maintain, and improve the Platform; (b) to create and manage your account; (c) to process payments for optional paid features; (d) to facilitate communication between businesses and buyers; (e) to verify your identity and email address; (f) to send transactional account notices (email verification, password resets, and payment confirmations); (g) to send promotional communications only where you have provided separate, express consent — you may withdraw this consent at any time through your profile settings or by clicking Unsubscribe in any marketing email; (h) to enforce our Terms of Use and detect and prevent fraud and abuse; (i) to comply with legal obligations. We will not use your personal information for purposes other than those listed without obtaining your prior consent.

Legal basis for processing

We process your personal information based on: (a) your express consent, obtained at account registration and separately for marketing communications; (b) the performance of our contract with you (Terms of Use) — for example, processing your payment for an optional paid feature; (c) our legitimate interests in operating and securing the Platform and preventing fraud, where those interests are not overridden by your privacy rights; and (d) compliance with applicable legal obligations. Under Quebec Law 25, we collect and use personal information only for purposes that a reasonable person would consider appropriate given the circumstances.

Public information and search indexing

If you create a business profile or product listing on the Platform, certain information you provide is made publicly visible by default — including your business name, city, product listings, descriptions, prices, and any profile or product images you upload. This public information may be indexed by external search engines (such as Google and Bing) and may appear in search results outside of HalSouk. You acknowledge this when publishing a listing. Reviews you post are also permanently public and attributed to your account.

Data sharing and third-party service providers

We do not sell your personal information. We may share it only in the following circumstances: (a) Third-party service providers who assist us in operating the Platform under contractual data protection obligations — currently these include: our hosting and infrastructure provider, our database hosting provider, Stripe (payment processing for optional paid features), our transactional email provider, and our media hosting provider — an up-to-date list of our service providers is available on request at support@halsouk.ca; (b) Other users of the Platform — business contact information, product listings, and reviews you choose to make public are visible to all visitors; (c) Legal authorities when required by applicable law, valid court order, or governmental regulation; (d) In connection with a merger, acquisition, or sale of assets — with prior notice; (e) With your explicit consent.

Cookies and tracking technologies

We use only essential cookies that are strictly necessary for the Platform to function — specifically, session authentication cookies (to keep you signed in). We do NOT use advertising or marketing cookies, third-party analytics or tracking cookies (such as Google Analytics), social media tracking pixels, or fingerprinting technologies. Since we use only essential cookies, no separate cookie consent banner is required for their operation under current applicable law.

Your rights

Under PIPEDA and Quebec Law 25, you have the following rights regarding your personal information: (a) Access — request a copy of the personal information we hold about you; (b) Rectification — request correction of inaccurate or incomplete information; (c) Deletion — request deletion of your personal information and account; (d) Withdrawal of consent — withdraw consent to processing for non-essential purposes at any time; (e) Data portability — request your personal information in a structured, machine-readable format; (f) De-indexing — request de-indexing of your personal information; (g) Object — object to processing based on our legitimate interests; (h) Opt out of marketing communications. To exercise any of these rights, contact us at support@halsouk.ca. We will acknowledge your request within 10 business days and provide a substantive response within 30 days.

Data retention

We retain your personal information for as long as your account is active or as needed to provide our services. Specific retention periods: (a) Account data — permanently deleted immediately upon account deletion, except where legal retention obligations apply; audit logs retained up to 2 years; (b) Payment records — retained for a minimum of 7 years as required by Canadian tax and accounting regulations; (c) Chat messages — retained for the life of the conversation; (d) Server logs — retained for up to 90 days; (e) Consent records — retained for the duration of the business relationship plus 3 years; (f) Data breach records — retained for a minimum of 2 years.

Data security

We implement appropriate technical and organizational security measures to protect your personal information, including: (a) bcrypt hashing for all stored passwords; (b) HTTPS/TLS encryption for all data in transit; (c) access controls limiting who within HalSouk can access personal data; (d) regular review of our security practices. In the event of a data breach posing a real risk of significant harm, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada (OPC) and the Commission d'accès à l'information du Québec (CAI) within the timeframes required by law.

Automated decision-making

In limited circumstances, HalSouk may take automated actions that affect your account. The only such action is automated detection of patterns consistent with spam, fraud, or abuse, which may trigger a review of the account. Where a fully automated decision has a significant effect on you, you have the right to request human review by contacting us at support@halsouk.ca.

Children's privacy

The Platform is intended for use by adults. You must be at least 18 years of age to create an account. We do not knowingly collect personal information from individuals under 18. If we become aware that we have inadvertently collected information from a person under 18, we will delete it promptly.

Data transfers outside Quebec and Canada

Your personal information is primarily stored and processed in Canada. Some of our third-party service providers (including Stripe and our hosting, database, and email providers) may process data in the United States or other jurisdictions. When your data is processed outside of Quebec or Canada, we ensure that appropriate contractual safeguards are in place as required by Quebec Law 25 and PIPEDA.

Person responsible for privacy

In accordance with Quebec Law 25, HalSouk has designated a person responsible for the protection of personal information. This person is the highest-ranking officer of the organization. For any privacy-related inquiries, requests to exercise your rights, complaints, or to obtain information about our privacy practices, you may contact the privacy officer using the contact information below.

Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised "Last updated" date. If the changes are material, we will notify you by email and/or by posting a prominent notice on the Platform at least 30 days before the changes take effect.

Contact

For privacy-related questions, to exercise your data rights, or to file a complaint, contact our Privacy Officer at support@halsouk.ca.

If you are not satisfied with our response, you may escalate your complaint to:

• Commission d'accès à l'information du Québec (CAI) — for Quebec privacy law complaints
• Office of the Privacy Commissioner of Canada (OPC) — for federal PIPEDA complaints