Privacy policy

This policy explains what personal information we collect, why, and what you can do about it. It follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply to you, the UK GDPR, the EU GDPR and U.S. state privacy laws.

Who is responsible: NorthernITShop, operated by Northern IT, 343 Spruce Grove Crescent, Newmarket, ON L3X 2X2, Canada. Privacy questions go to the Privacy Officer, reachable at sales@northernitshop.com.

EU and UK buyers: if the law requires us to appoint a representative in the EU or UK, we will do so and list their details here. Until then, we handle all requests directly at sales@northernitshop.com.

What we collect

When you send a quote request, source-a-part request or question:

• Your name and email address (required), and optionally your company, phone number and country.
• Your message, the parts and quantities you ask about, and any files you upload (for example a bill of materials or spec sheet).
• The page you sent the form from, and campaign tags in that page's address (such as utm tags or a Google Ads click ID).
• Your approximate location (country, region and city) from our hosting provider's request headers. We do not store your IP address.

When you browse the site:

• Your quote list is stored only in your own browser (local storage) until you send it.
• Your chosen currency is stored in a small cookie.
• If you accept analytics cookies, we use Google Analytics to see which pages are visited, where visitors come from and whether a request was sent. Google Analytics sets cookies (named _ga) and Google processes the data on our behalf. If you decline, no analytics cookies are set. You can change your choice at any time with "Cookie settings" at the bottom of every page.
• We measure page speed with Vercel Speed Insights, which uses no cookies and does not identify you.
• We do not use advertising cookies.

Why we use it

• To reply to your request and prepare your quote (to take steps at your request before a contract).
• To process and deliver orders, and handle warranty and returns (to perform a contract).
• To prevent spam and abuse, and to understand which pages and campaigns bring requests (our legitimate interests).
• To meet legal obligations such as tax records and export compliance checks.

We do not sell your personal data.

Who processes it for us

• Supabase: database and file storage (United States).
• Vercel: website hosting and page speed measurement.
• Google: Google Analytics (only if you accept analytics cookies).
• Resend: sending emails (processed in Japan).
• Stripe and PayPal: card and online payments. They receive the payment details you enter on their pages; we do not store full card numbers.
• Shipping carriers (DHL, FedEx, UPS and Purolator): delivery name, address and phone number for your order.
• Our accountant or bookkeeping provider: order and invoice records.

Some of these providers store or process information outside Canada and outside your country, including in the United States and Japan. While it is there, it may be accessible to courts, law enforcement and national security authorities of that country. We choose providers with contractual privacy and security commitments, and for EU and UK data we rely on standard contractual clauses or other approved safeguards.

Emails we send

We send emails you asked for: the confirmation of your request, our reply and messages about your order. We do not send marketing emails without your consent, in line with Canada's Anti-Spam Legislation (CASL), and every marketing email would include a way to unsubscribe.

How long we keep it

• Quote requests that do not become orders: 24 months.
• Order and invoice records: as long as tax law requires, 7 years under Canadian tax law.
• Uploaded files: download links expire after 30 days; files are deleted after 90 days.

Your rights

You can ask to access or correct the personal information we hold about you, or withdraw your consent (which may mean we can no longer respond to a request). Depending on where you live, for example under the UK GDPR, the EU GDPR or California law, you can also ask us to delete or export your data, or object to or restrict how we use it.

Email sales@northernitshop.com. We reply within 30 days, and may ask you to confirm your identity first.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), the UK Information Commissioner's Office (ico.org.uk) or the data protection authority in your EU country.

Children

This site is for business buyers and is not directed at children. We do not knowingly collect information from anyone under 16.

Security

Data is sent over encrypted connections and stored with access limited to staff who need it. Uploaded files are kept in private storage and shared only through expiring links.

Changes

We will post any changes on this page and update the date at the top.