Whitby Industries — Privacy Policy

1. Introduction

This Privacy Policy describes the policies and procedures of Whitby Industries (“Whitby Industries,” “the Company,” “we,” “us,” or “our”) regarding the collection, use, and disclosure of your information when you (a) use our website at https://www.whitbyindustries.ca (the “Service”), and (b) sell scrap metal at our Ontario location. It explains what personal information we collect, why we collect it, how it is protected, how long we keep it, and who we may share it with.

By using the Service or by transacting with us in person, you agree to the collection and use of information in accordance with this Privacy Policy.

We collect personal information only to the extent required to operate our Service, to complete transactions with you, and to the extent required by applicable municipal licensing bylaws and federal privacy law. As described in Section 6 below, we obtain your explicit consent before in-person transaction information is retained.

2. Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for You to access our Service or parts of our Service.
• Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to Whitby Industries, 280 Hopkins Street, Whitby, Ontario, L1N 2B9.
• Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website among its many uses.
• Country refers to: Ontario, Canada.
• Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.
• Personal Data is any information that relates to an identified or identifiable individual.
• Service refers to the Website.
• Service Provider means any natural or legal person who processes data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service, or to assist the Company in analyzing how the Service is used.
• Third-party Social Media Service refers to any website or any social network website through which a User can log in or create an account to use the Service.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
• Website refers to Whitby Industries, accessible from https://www.whitbyindustries.ca.
• You means the individual accessing or using the Service, or transacting with us in person, or the company or other legal entity on behalf of which such individual is acting, as applicable.

3. Information We Collect

3.1 Website — Personal Data

While using Our Service, We may ask You to provide certain personally identifiable information that can be used to contact or identify You, including but not limited to:

• Email address
• First name and last name
• Phone number
• Usage Data

3.2 Website — Usage Data

Usage Data is collected automatically when using the Service. This may include Your Device's Internet Protocol (IP) address, browser type and version, the pages of our Service that You visit, the time and date of Your visit, time spent on those pages, unique device identifiers, and other diagnostic data. When You access the Service through a mobile device, We may similarly collect the type of device, unique device ID, mobile IP address, operating system, and mobile browser type.

3.3 Website — Cookies and Tracking Technologies

We use Cookies and similar tracking technologies (beacons, tags, and scripts) to track activity on Our Service and to store certain information. Cookies can be "Persistent" or "Session" Cookies; You can instruct Your browser to refuse Cookies or to indicate when a Cookie is being sent, though some parts of the Service may not function properly without them. We use:

• Necessary / Essential Cookies (Session) — required to provide the Service and authenticate users.
• Cookies Policy / Notice Acceptance Cookies (Persistent) — record whether You have accepted our use of cookies.
• Functionality Cookies (Persistent) — remember choices such as login details or language preference to provide a more personalized experience.

We also use Google Places, a third-party Service Provider operated by Google, which returns information about places using HTTP requests. Google Places may collect information from You and from Your Device for security purposes. The information gathered by Google Places is held in accordance with Google's Privacy Policy: https://www.google.com/intl/en/policies/privacy/.

3.4 In-Person Transactions — Information Collected at Our Location

When you sell scrap metal at our location, we collect the following information directly from you:

• Full legal name (first, middle, last)
• Current residential address
• Type and number of government-issued identification (driver's licence or provincial ID), and its expiry date
• Phone number
• Vehicle licence plate (if applicable to the transaction)
• Details of the transaction, including date, time, and material sold

We check the date of birth printed on your identification at the time of scanning, solely to confirm you are 18 years of age or older. Your date of birth itself is not recorded or retained — only the result of this check.

We do not collect, extract, or store other information encoded on your identification document, including physical descriptors such as height, weight, eye colour, gender, hair colour, organ donor status, or licence restriction codes. Our scanning system is configured to extract only the fields listed above and to discard all other data present on the barcode.

4. How We Use Your Information

4.1 Website Personal Data

The Company may use Personal Data collected through the Service for the following purposes:

• To provide and maintain our Service, including monitoring its usage;
• To manage Your Account and registration;
• For the performance of a contract, including the purchase of products, items, or services;
• To contact You by email, telephone, SMS, or other electronic means regarding updates, security notices, or informative communications;
• To provide You with news, special offers, and general information about goods and services, unless You have opted out;
• To manage and respond to Your requests;
• For business transfers, as described in Section 7; and
• For other purposes such as data analysis, identifying usage trends, and improving our Service, products, marketing, and Your experience.

4.2 In-Person Transaction Information

We collect and use in-person transaction information for the following purposes:

• To identify sellers of scrap metal and verify eligibility to transact, as required by law;
• To create and maintain a transaction register, as mandated by applicable municipal licensing bylaws governing scrap metal and salvage dealers;
• To assist law enforcement and municipal licensing authorities in the prevention, investigation, and recovery of stolen property;
• To detect and prevent fraudulent transactions;
• To meet our contractual, legal, and regulatory obligations; and
• To manage our general business operations.

We do not use in-person transaction information for marketing purposes, and we do not sell this information to third parties.

5. Legal Authority for In-Person Collection

Collection of government identification is normally restricted under Canadian privacy law. The federal Personal Information Protection and Electronic Documents Act (PIPEDA) and the Office of the Privacy Commissioner of Canada require that collection of identifiers such as a driver's licence number be limited to circumstances where a specific statutory mandate applies. For our Ontario operations, that mandate is provided by applicable municipal licensing bylaws governing scrap metal and salvage dealers in the municipality where the transaction occurs.

Because this authority is a narrow exception to general privacy law, we limit our in-person collection to only the fields named in the applicable municipal bylaw for the location where your transaction takes place.

6. Consent

In-person transactions: If our records show you have not sold to us before, a notice is displayed on our point-of-sale screen after your first ID scan, describing what information will be collected and why. You confirm your consent by presenting your identification for a second scan after this notice is shown; we verify that the same identification is used for both scans so that consent is confirmed by you personally. We record the date and time your consent was given, and which version of this notice was displayed to you, together with your customer record.

If you do not wish to consent, please tell a member of staff. We will be unable to complete a scrap metal purchase transaction with you without this information, as collection is a condition of the transaction under applicable law.

Website: By using the Service, You consent to the collection and use of information as described in this Privacy Policy.

7. Sharing and Disclosure of Your Information

We may share Your personal information in the following situations:

• With Service Providers: to monitor and analyze use of our Service, and to contact You.
• For business transfers: in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.
• With Affiliates: who will be required to honor this Privacy Policy.
• With business partners: to offer You certain products, services, or promotions.
• With other users: when You share information or interact in public areas of the Service. If You interact with other users or register through a Third-Party Social Media Service, Your contacts on the Third-Party Social Media Service may see Your name, profile, pictures and description of Your activity; similarly, other users will be able to view descriptions of Your activity, communicate with You and view Your profile.
• With Your consent: for any other purpose with Your consent.
• With law enforcement or municipal licensing/bylaw officers: upon a lawful request in connection with the investigation or prevention of theft, or the enforcement of applicable scrap metal licensing bylaws.
• As required by law, court order, or legal process.
• With Our service providers who process in-person transaction data on Our behalf strictly for the purposes described in this policy, under obligations of confidentiality.

We do not sell, rent, or use in-person transaction information for marketing or advertising purposes.

8. Retention of Your Information

Website Personal Data and Usage Data: We retain Your Personal Data only as long as necessary for the purposes set out in this Privacy Policy, including to comply with legal obligations, resolve disputes, and enforce our agreements and policies. Usage Data is generally retained for a shorter period, except where needed to strengthen security, improve functionality, or as legally required.

In-Person Transaction Information: We retain personal information collected in person only for as long as necessary to fulfill the purposes described in this policy and to meet our statutory recordkeeping obligations. For our Ontario location, this is 1 to 2 years from the date of transaction, as specified by the applicable municipal licensing bylaw. Once this retention period has expired and no ongoing legal, regulatory, or business purpose requires continued retention, we securely destroy or anonymize the applicable records.

9. Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in processing are located. This means Your information may be transferred to, and maintained on, computers located outside of Your state, province, country, or other governmental jurisdiction where data protection laws may differ.

Your consent to this Privacy Policy, followed by Your submission of such information, represents Your agreement to that transfer. The Company will take all steps reasonably necessary to ensure Your data is treated securely and no transfer of Your Personal Data will take place to an organization or country without adequate controls in place.

10. How We Protect Your Information

• Encryption: Identification numbers collected in person are encrypted at rest using industry-standard encryption (AES-256) and are never stored in plain, readable form.
• Front-counter display: Identification numbers and addresses are not displayed in full on any customer-facing or cashier-facing screen; only partially masked versions are shown once identification has been scanned.
• System access: Full, unmasked identification numbers are accessible only to authorized personnel for the purposes described in this policy, including compliance, audit, and lawful law enforcement or municipal licensing requests.
• Data storage: Personal information is stored in a secured database with access restricted to authorized personnel and systems.

No method of transmission over the Internet, or method of electronic storage, is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

11. Children's Privacy

Our Service does not address anyone under the age of 13, and We do not knowingly collect personally identifiable information from anyone under the age of 13. If You are a parent or guardian and are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 13 without verification of parental consent, We take steps to remove that information from Our servers.

Separately, in-person transactions require that sellers be 18 years of age or older, verified as described in Section 3.

12. Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third-party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services.

13. Your Rights

You may request access to, or correction of, the personal information we hold about you, subject to applicable legal exceptions. To make a request, or if you have questions about this policy, please contact us using the information in Section 15.

14. Changes to This Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of changes by posting the new Privacy Policy on this page and, where appropriate, via email or a prominent notice on Our Service prior to the change becoming effective. The "Last Reviewed" date at the top of this policy indicates when it was last updated. The original website policy this document supersedes was last updated January 6, 2021. You are advised to review this Privacy Policy periodically for any changes.

15. Contact Us

If you have questions about this Privacy Policy or how we handle your personal information, please contact: