Privacy policy

Overview

HalSouk ("HalSouk", "we", "us", or "our") is committed to protecting your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25), and all other applicable Canadian federal and provincial privacy legislation. This Privacy Policy explains what personal information we collect, why we collect it, how we use and disclose it, and the choices available to you. We collect only the minimum personal information necessary to provide our services (data minimization principle). We do not use your personal information to build profiles for advertising purposes, We do not sell, rent, or trade your personal information to any third party.

Information we collect

We collect the following categories of personal information: (a) Account information you provide when registering — name, email address, phone number, and business address; (b) Profile and listing information — business descriptions, product details, pricing, and images you publish on the Platform; (c) Media uploads — profile photos, banner images, and product images you upload, which are stored on our file hosting service and may be publicly visible; (d) Transaction data — when you purchase an optional visibility feature (Boost or Bump), payment records processed via our third-party payment processor (Stripe); we do not store credit card numbers or full payment card details; (e) Communications — messages exchanged through our in-platform chat system and any contact form submissions; (f) Reviews and ratings you submit, which are publicly visible; (g) Technical data — IP address, browser type, device information, pages visited, and session durations collected automatically through essential cookies and server logs; (h) Consent records — the date, time, and method (registration checkbox or Google sign-in) of your acceptance of our Terms of Use and Privacy Policy; (i) Google sign-in information — if you choose to create an account or sign in with Google, Google provides us with your name, email address, confirmation of whether Google has verified that address, and the URL of your Google profile picture, which we store as your profile photo. We never receive your Google password. You can register with an email address and password instead; (j) Where your signup came from — if you arrive from one of our adverts or campaign links, the campaign labels in the web address (utm_source, utm_medium, utm_campaign) are saved with your account when you register, so we can tell which campaign brought you. These are campaign labels only, never an identifier for you, and they are never sent to a third party. See section 7 for how they are held during your visit; (k) Loyalty offer activity — if you save a business's loyalty card or offer to your wallet, we record which offer you saved, each visit that business confirms at its counter, and any reward you earn and use. This information is created by you and that business together, and is shown to that business (see section 6). It is not shared with any other business, and we do not use it to build a profile of you or to target advertising.

How we use your information

We use your personal information only for the following purposes: (a) to operate, maintain, and improve the Platform; (b) to create and manage your account; (c) to process payments for optional paid features; (d) to facilitate communication between businesses and buyers; (e) to verify your identity and email address; (f) to send transactional account notices (email verification, password resets, and payment confirmations); (g) to send promotional communications only where you have provided separate, express consent — you may withdraw this consent at any time by clicking Unsubscribe in any such email, or by writing to support@halsouk.ca and we will action it; (h) to enforce our Terms of Use and detect and prevent fraud and abuse; (i) to comply with legal obligations. We will not use your personal information for purposes other than those listed without obtaining your prior consent.

Legal basis for processing

We process your personal information based on: (a) your express consent, obtained at account registration and separately for marketing communications; (b) the performance of our contract with you (Terms of Use) — for example, processing your payment for an optional paid feature; (c) our legitimate interests in operating and securing the Platform and preventing fraud, where those interests are not overridden by your privacy rights; and (d) compliance with applicable legal obligations. Under Quebec Law 25, we collect and use personal information only for purposes that a reasonable person would consider appropriate given the circumstances.

Public information and search indexing

If you create a business profile or product listing on the Platform, certain information you provide is made publicly visible by default — including your business name, city, product listings, descriptions, prices, and any profile or product images you upload. This public information may be indexed by external search engines (such as Google and Bing) and may appear in search results outside of HalSouk. You acknowledge this when publishing a listing. Reviews you post are also permanently public and attributed to your account.

Data sharing and third-party service providers

We do not sell your personal information. We may share it only in the following circumstances: (a) Third-party service providers who assist us in operating the Platform under contractual data protection obligations — currently these include: our hosting and infrastructure provider, our database hosting provider, Stripe (payment processing for optional paid features), Google (authentication, only if you choose to sign in with Google), our transactional email provider, and our media hosting provider — an up-to-date list of our service providers is available on request at support@halsouk.ca; (b) Other users of the Platform — business contact information, product listings, and reviews you choose to make public are visible to all visitors; (c) Legal authorities when required by applicable law, valid court order, or governmental regulation; (d) In connection with a merger, acquisition, or sale of assets — with prior notice; (e) With your explicit consent; (f) The business whose loyalty offer you saved — it sees your first name, how many visits it has confirmed for you, and which rewards you have earned or used. It does not receive your email address, your telephone number, or your activity with any other business.

Cookies and tracking technologies

We use essential cookies that are strictly necessary for the Platform to function — a session authentication cookie (to keep you signed in), a language preference cookie (set only when you choose English or French), an internal preview cookie used by our team, and — only if you start signing up with Google — a short-lived cookie carrying the account type you chose (business or buyer) across the sign-in redirect, which expires within ten minutes. Separately, we use one first-party campaign-attribution cookie, which we list on its own because it is not strictly necessary and we will not pretend otherwise: if you arrive from one of our adverts or campaign links, it stores the campaign labels contained in the web address (utm_source, utm_medium, utm_campaign) for 30 days, so that if you then create an account we can tell which campaign brought you. It holds campaign labels only — never an identifier for you — it is read only by us, nothing is sent to any third party, and it cannot be used to follow you across other websites. It is deliberately given no on/off switch: it is written the moment you arrive, before any consent choice could exist, and a control that cannot actually govern a cookie would be a false promise; you can delete it at any time through your browser. We also use privacy-friendly aggregate traffic analytics that set no cookies and do not identify or profile individual visitors. We do NOT use advertising or marketing cookies, third-party tracking cookies (such as Google Analytics), social media tracking pixels, or fingerprinting technologies. Because we use no tracking or profiling technologies, no cookie consent banner is required under current applicable law.

Your rights

Under PIPEDA and Quebec Law 25, you have the following rights regarding your personal information: (a) Access — request a copy of the personal information we hold about you; (b) Rectification — request correction of inaccurate or incomplete information; (c) Deletion — request deletion of your personal information and account; (d) Withdrawal of consent — withdraw consent to processing for non-essential purposes at any time; (e) Data portability — request your personal information in a structured, machine-readable format; (f) De-indexing — request de-indexing of your personal information; (g) Object — object to processing based on our legitimate interests; (h) Opt out of marketing communications. To exercise any of these rights, contact us at support@halsouk.ca. We will acknowledge your request within 10 business days and provide a substantive response within 30 days.

Data retention

We retain your personal information for as long as your account is active or as needed to provide our services. Specific retention periods: (a) Account data — when you delete your account it is immediately deactivated and hidden from the Platform, and enters a 30-day recovery period during which you can restore it by signing in. After that period the account is permanently purged: your name, email address, phone number, postal address, business description, images and every other identifying detail are erased, your listings are deleted, and the account can no longer be recovered. Records you created jointly with someone else — the messages in a conversation, and reviews other people wrote about your business — are kept and stay visible to that other person, shown against an anonymous ‘Deleted user’, because those records belong to them as much as to you and a dispute cannot be settled from one side alone. Administrative audit logs, which may contain your email address and the actions taken on your account, are retained for up to 2 years and are then deleted; (b) Payment records — retained for a minimum of 7 years as required by Canadian tax and accounting regulations; (c) Chat messages — retained for the life of the conversation, and they remain available to the other participant if you close your account, as described in (a); (d) Server logs — retained for up to 90 days; (e) Consent records — retained for the duration of the business relationship plus 3 years; (f) Data breach records — retained for a minimum of 2 years; (g) Loyalty offer activity — retained while the offer is running and for 12 months afterwards, so that both you and the business can settle a dispute about a reward; it is deleted with your account; (h) Contact-form submissions and founding-programme applications — retained for up to 2 years after we have dealt with them, then deleted. These are not attached to a HalSouk account, so closing an account does not remove them; write to us and we will delete them sooner; (i) Retained identity records — when an account is permanently purged we keep a separate, minimal record of the identity behind it (name, email address, phone number, postal address and business contact details where they were provided, and the most recent IP address seen) for one purpose only: to prevent fraud and abuse on the Platform, and so that a dispute, a chargeback or a lawful request from a public authority can still be answered afterwards. It holds no profile content, no listings and no preferences. It is kept for 2 years after the account is purged, or for 5 years where the account had been blocked or suspended or was the subject of a report, and it is then deleted. It is never used for marketing, never shared with other businesses on the Platform, and never used to build a profile of you.

Data security

We implement appropriate technical and organizational security measures to protect your personal information, including: (a) bcrypt hashing for all stored passwords; (b) HTTPS/TLS encryption for all data in transit; (c) access controls limiting who within HalSouk can access personal data; (d) regular review of our security practices. In the event of a data breach posing a real risk of significant harm, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada (OPC) and the Commission d'accès à l'information du Québec (CAI) within the timeframes required by law.

Automated decision-making

In limited circumstances, HalSouk may take automated actions that affect your account. The only such action is automated detection of patterns consistent with spam, fraud, or abuse, which may trigger a review of the account. Where a fully automated decision has a significant effect on you, you have the right to request human review by contacting us at support@halsouk.ca.

Children's privacy

The Platform is intended for use by adults. You must be at least 18 years of age to create an account. We do not knowingly collect personal information from individuals under 18. If we become aware that we have inadvertently collected information from a person under 18, we will delete it promptly.

Data transfers outside Quebec and Canada

Your personal information is primarily stored and processed in Canada. Some of our third-party service providers (including Stripe and our hosting, database, and email providers) may process data in the United States or other jurisdictions. When your data is processed outside of Quebec or Canada, we ensure that appropriate contractual safeguards are in place as required by Quebec Law 25 and PIPEDA.

Person responsible for privacy

In accordance with Quebec Law 25, HalSouk has designated a person responsible for the protection of personal information. This person is the highest-ranking officer of the organization. For any privacy-related inquiries, requests to exercise your rights, complaints, or to obtain information about our privacy practices, you may contact the privacy officer using the contact information below.

Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised "Last updated" date. If the changes are material, we will notify you by email and/or by posting a prominent notice on the Platform at least 30 days before the changes take effect.

Contact

For privacy-related questions, to exercise your data rights, or to file a complaint, contact our Privacy Officer at support@halsouk.ca.

If you are not satisfied with our response, you may escalate your complaint to:

• Commission d'accès à l'information du Québec (CAI) — for Quebec privacy law complaints
• Office of the Privacy Commissioner of Canada (OPC) — for federal PIPEDA complaints