Privacy Policy

← Back to Store

This Privacy Policy explains how Humanity First Canada collects, uses, and protects your personal information when you use our souvenir store. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

Who We Are
What We Collect
Why We Collect It
Legal Basis for Processing
How We Collect Information
Third-Party Service Providers
Cross-Border Data Transfers
Data Retention
Your Rights
Security Measures
Cookies & Tracking
Children's Privacy
Links to Other Sites
Changes to This Policy
Contact & Complaints

1 Who We Are

Humanity First Canada is a registered Canadian charitable organization that operates this online souvenir store to support our humanitarian missions worldwide. We are the "data controller" responsible for your personal information under PIPEDA.

Registered address: 600 Bowes Road, Concord, Ontario, L4K 4A3
Privacy contact: info@humanityfirst.ca
Website: humanityfirst.ca

2 What Personal Information We Collect

We collect only the information necessary to process your order and communicate with you.

Information you provide directly

Information	When Collected	Purpose
Full name	At checkout	Order fulfillment and communication
Email address	At checkout	Order confirmation, receipts, and support
Phone number	At checkout	Order coordination and pickup notification
Shipping address (street, city, province, postal code)	If shipping selected	Delivery of your order
Order notes	Optional at checkout	Fulfillment of special instructions

Payment information

Payment card details are entered directly into a Square Inc. secure payment form embedded in our store. We never see, store, or process your raw card data. Square provides us only with a payment confirmation reference and the last 4 digits of your card for record-keeping.

Information collected automatically

Information	Purpose
IP address	Fraud prevention, security, and abuse detection
Browser/device type (user agent)	Security and technical compatibility
Interaction patterns (presence of mouse movement, keystrokes — not content)	Bot detection — to distinguish humans from automated scripts
Order timestamp	Record-keeping and fraud prevention
reCAPTCHA score	Bot and fraud detection (processed by Google)

We do not collect sensitive personal information such as government ID numbers, health information, financial account details beyond payment tokenization, or racial/ethnic origin.

3 Why We Collect Your Information

We use your personal information only for the following purposes:

Order fulfillment: To process, prepare, ship, or arrange pickup for your order.
Payment processing: To facilitate secure card payments through Square Inc.
Order confirmation and receipts: To email you a confirmation and receipt of your purchase.
Customer support: To respond to your questions, complaints, or refund requests.
Fraud prevention and security: To detect and prevent fraudulent transactions, card testing, and abuse of our store.
Legal compliance: To maintain records required by Canadian tax, accounting, and charity law.
Dispute resolution: To provide evidence in the event of a payment dispute or chargeback.

We do not use your personal information for marketing, profiling, or advertising, and we do not share it with third parties for commercial purposes.

4 Legal Basis for Processing

Under PIPEDA, we collect and use your personal information with your knowledge and consent. By placing an order, you consent to the collection and use of your information as described in this Privacy Policy.

Some processing is also permitted without explicit consent where required by law or where the purpose is clearly in your interest (e.g., fraud prevention to protect your payment).

You may withdraw your consent at any time by contacting us, subject to legal or contractual obligations that may prevent us from deleting certain records.

5 How We Collect Information

We collect information through the following means:

Directly from you — when you complete the checkout form on our store.
Automatically — through your browser and our store's security systems (IP address, interaction patterns, request headers) when you visit or use the store.
From third parties — Square provides us with payment confirmation status and a masked card reference. Google provides a reCAPTCHA risk score (a number between 0 and 1).

6 Third-Party Service Providers

We engage the following third-party service providers to operate this store. Each provider processes certain personal information as part of the service they deliver to us:

Provider	Purpose	Data Shared	Location
Square Inc.	Payment processing	Payment token, order amount, currency	United States
Resend Inc.	Order confirmation emails	Name, email address, order details	United States
Google LLC (reCAPTCHA)	Bot and fraud detection	IP address, browser data, interaction score	United States
Cloudinary Inc.	Product image hosting	No personal data — images only	United States
Railway Corp.	Store hosting and infrastructure	Server logs including IP addresses	United States

We do not sell, rent, or trade your personal information to any third party for marketing or commercial purposes.

7 Cross-Border Data Transfers

All third-party service providers listed above are based in the United States. As a result, your personal information may be transferred to, stored in, and processed in the United States, where privacy laws may differ from those in Canada.

We have selected service providers who maintain appropriate security standards and, where required, have entered into data processing agreements to protect your information.

By using this store, you acknowledge that your personal information may be processed outside Canada, including in the United States, and consent to such transfer as described in this Privacy Policy.

8 Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this Policy and to meet our legal obligations:

Data Type	Retention Period	Reason
Order records (name, email, phone, items, amount)	7 years	Canadian tax and accounting law requirements for charitable organizations
Shipping addresses	2 years after delivery	Dispute resolution and delivery confirmation
Security logs (IP addresses, fraud events)	12 months	Fraud investigation and chargeback defence
IP blocklist entries	24 hours per block	Fraud prevention — auto-expiry after block period
Email velocity records	24-hour rolling window	Order limit enforcement — auto-expiry
Payment tokens	Not stored by us	Square retains payment records per their policy

After the applicable retention period, personal information is securely deleted or anonymized.

9 Your Rights Under PIPEDA

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the following rights:

Right to access: You may request a copy of the personal information we hold about you.
Right to correction: If your information is inaccurate or incomplete, you may request that we correct it.
Right to withdraw consent: You may withdraw your consent to our collection or use of your information at any time, subject to legal and contractual restrictions.
Right to complaint: If you believe we have not handled your personal information in compliance with PIPEDA, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise any of these rights, contact us at info@humanityfirst.ca. We will respond within 30 days.

Quebec residents: Quebec's Act respecting the protection of personal information in the private sector (Law 25 / Bill 64) grants additional rights including the right to data portability and the right to request erasure. Contact us to exercise these rights.

10 Security Measures

We take the security of your personal information seriously. The following measures are in place:

Card tokenization: Card numbers are tokenized by Square inside a PCI DSS-compliant iframe — we never receive or store raw card data.
HTTPS/TLS encryption: All data between your browser and our servers is encrypted. HSTS is enforced.
Rate limiting: Checkout requests are limited to 5 per hour per IP to prevent brute-force attacks.
IP blocklist: IP addresses associated with repeated payment failures are automatically blocked for 24 hours.
Bot detection: Human interaction signals and reCAPTCHA v3 scores detect and block automated submissions.
Access controls: Administrative access to order data is protected by authentication and rate limiting.
HTTP security headers: Content Security Policy, X-Frame-Options, HSTS, and other headers are enforced on all responses.
Data minimization: We collect only the information required to fulfill your order.

In the unlikely event of a data breach that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada in accordance with PIPEDA's mandatory breach reporting requirements.

11 Cookies & Tracking Technologies

This store uses a limited number of cookies and client-side storage mechanisms:

Session storage (browser): Your cart contents and checkout state are stored locally in your browser's session storage. This data does not leave your device and is cleared when you close your browser tab.
Google reCAPTCHA: When active, Google may set cookies or use browser fingerprinting to generate a bot-risk score. This is governed by Google's Privacy Policy and is used solely for fraud prevention — not advertising.
No advertising or analytics cookies: We do not use Google Analytics, Facebook Pixel, or any other advertising or behavioural tracking technologies on this store.
No cross-site tracking: We do not track your activity across other websites.

12 Children's Privacy

This store is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided personal information to us, please contact us at info@humanityfirst.ca and we will delete that information promptly.

Customers between the ages of 13 and 17 should have the consent and supervision of a parent or legal guardian when placing orders.

13 Links to Other Websites

This store contains links to external websites, including humanityfirst.ca and our service providers. We are not responsible for the privacy practices or content of those external sites. We encourage you to review the privacy policies of any websites you visit.

14 Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Changes will be posted on this page with an updated effective date.

For material changes, we will make reasonable efforts to notify customers by email or by a notice on the store.

15 Contact Us & Privacy Complaints

For any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information:

Humanity First Canada — Privacy Contact
600 Bowes Road, Concord, Ontario, L4K 4A3
Email: info@humanityfirst.ca
Website: humanityfirst.ca

We will acknowledge your inquiry within 5 business days and provide a full response within 30 days.

If you are not satisfied with our response, you may file a complaint with:

Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, Quebec, K1A 1H3
Toll-free: 1-800-282-1376
Website: priv.gc.ca

Contents