Privacy Policy
MasterCase Canada respects your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use mastercase.ca. If anything is unclear, contact our Privacy Officer at privacy@mastercase.ca.
WHO WE ARE AND HOW TO REACH US
MasterCase Canada is operated by MasterCase Wholesale Inc., a company incorporated in British Columbia, Canada.
Privacy Officer
Email: privacy@mastercase.ca
Mailing Address: 2055 Pendrell St., Vancouver, B.C. V6G 1T9, Canada
If you have any questions, concerns, or requests regarding your personal information, please contact our Privacy Officer at the address above. We will respond within 30 days of receiving your request.
If you are a Quebec resident and your concern is not resolved to your satisfaction, you may file a complaint with the Commission d'accès à l'information (CAI) at www.cai.gouv.qc.ca. For all other provinces, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca.
SCOPE OF THIS POLICY
This Privacy Policy explains how MasterCase Wholesale Inc. collects, uses, discloses, retains, and protects personal information about:
- Consumers who browse or purchase products through mastercase.ca
- Vendors who apply to sell products on the MasterCase Canada marketplace
- Visitors to our website and any associated mobile interfaces
This Policy does not govern the personal information practices of independent vendors who sell on our platform. Each vendor is a separate, independent business with its own privacy practices.
This Policy is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5; the BC Personal Information Protection Act (PIPA), S.B.C. 2003, c. 63; and, for residents of Quebec, the Act to Modernize Legislative Provisions as Regards the Protection of Personal Information (Law 25), S.Q. 2021, c. 25.
WHAT PERSONAL INFORMATION WE COLLECT AND WHY
Information You Provide Directly
| Category | Examples | Purpose | Retention |
|---|---|---|---|
| Account information | Name, email address, password (hashed) | Create and manage your account; authenticate your identity | Duration of account + 2 years after closure |
| Order information | Shipping address, order history, case quantities purchased | Process and fulfill your order; provide customer support; generate shipping labels | 7 years (CRA requirement for financial records) |
| Payment information | Credit card type, last 4 digits, billing address | Process payment; fraud detection | Full card numbers are never stored — processed and tokenized by Stripe |
| Vendor profile information | Business name, address, GS1 prefix, province, GST/HST registration number, SIN or BN (for CRA reporting), Stripe payout account | Vendor onboarding; commission payouts; CRA Part XX digital platform reporting; GST/HST compliance | Duration of vendor relationship + 7 years (CRA requirement) |
| Communications | Emails, support tickets, vendor applications | Respond to your inquiries; improve our service | 3 years from last communication |
Information Collected Automatically
| Category | Examples | Purpose | Retention |
|---|---|---|---|
| Usage data | Pages visited, products viewed, search queries, click patterns, session duration | Improve platform performance; understand user behaviour; analytics | 26 months |
| Device and technical data | IP address, browser type and version, operating system, device type, referring URL | Security monitoring; fraud prevention; technical troubleshooting | 12 months |
| Cookies and tracking technologies | Session cookies, preference cookies, analytics cookies | See Cookies section | See Cookies section |
LEGAL BASIS FOR COLLECTION AND CONSENT
We collect personal information with your knowledge and consent, or as otherwise permitted or required by law.
- Implied consent applies to personal information that is reasonably necessary to complete a transaction you have initiated (e.g., we collect your shipping address when you place an order).
- Express consent (an affirmative opt-in) is required for: marketing and promotional emails; non-essential cookies; any use of your personal information for a new purpose not identified at the time of collection.
- Legal obligation requires us to collect and retain certain information regardless of consent, including financial records (7 years, under the Income Tax Act) and CRA digital platform reporting data (Income Tax Act, Part XX).
You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice, by contacting our Privacy Officer. Withdrawal of consent may affect our ability to provide services to you.
Quebec residents: We obtain consent for each distinct purpose separately. Pre-checked boxes are not used as a consent mechanism. Withdrawal of consent is as easy as giving it.
HOW WE USE YOUR PERSONAL INFORMATION
We use personal information only for the purposes identified at or before the time of collection:
- Processing and fulfilling orders (including generating shipping labels via Shippo API)
- Communicating order status, shipping notifications, and delivery confirmations
- Managing vendor accounts and processing vendor payouts via Stripe Connect
- Complying with tax and regulatory obligations, including GST/HST collection and CRA digital platform reporting (Part XX, Income Tax Act)
- Detecting, investigating, and preventing fraud and security incidents
- Improving and personalizing the platform experience
- Sending marketing or promotional communications, only with your express consent
- Enforcing our Terms of Service and Vendor Agreement
- Complying with applicable law, court orders, or government requests
We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.
WHO WE SHARE YOUR PERSONAL INFORMATION WITH
We share personal information only with the parties listed below, and only to the extent necessary for the purposes identified:
| Recipient | Purpose | Location |
|---|---|---|
| Stripe Inc. | Payment processing; vendor payout via Stripe Connect Express; fraud detection; chargeback management | United States |
| Shopify Inc. | E-commerce platform hosting; order management; storefront infrastructure | Canada (data may be processed in the United States) |
| Shippo Inc. (EasyPost) | Shipping label generation; carrier rate selection; shipment tracking | United States |
| Klaviyo Inc. | Transactional and marketing email delivery; email automation | United States |
| Google LLC | Analytics (Google Analytics); website performance measurement | United States |
| Vendors on the MasterCase Platform | Consumer shipping address and order details are shared with the vendor fulfilling the order, strictly for fulfillment purposes | Canada |
| Canada Revenue Agency (CRA) | Annual digital platform reporting (vendor SIN/BN, remuneration data) as required by Part XX of the Income Tax Act | Canada |
| Law enforcement or government authorities | When required by law, court order, or to protect the rights and safety of MasterCase, its users, or the public | Canada or as required |
All third-party service providers are bound by confidentiality obligations and data processing agreements that restrict their use of personal information to the services they provide to us.
CROSS-BORDER TRANSFERS OF PERSONAL INFORMATION
Several of our service providers are located in the United States, which means your personal information is transferred to, stored in, and processed in the United States. The United States has different privacy laws than Canada and Quebec. Your information may be accessible to US law enforcement and government authorities under US law.
We have entered into data processing agreements or standard contractual clauses with each US-based service provider to ensure your personal information receives a level of protection consistent with Canadian privacy law.
Quebec residents: Pursuant to the Act to Modernize Legislative Provisions as Regards the Protection of Personal Information (Law 25), we maintain a register of our cross-border data transfers, available to the CAI upon request.
DATA SECURITY
We implement physical, administrative, and technical safeguards appropriate to the sensitivity of the personal information we hold, including:
- Encryption: All data transmitted to and from mastercase.ca is encrypted using TLS 1.2 or higher. Personal information at rest in our systems is encrypted.
- Payment security: We do not store credit card numbers. All payment card data is processed and tokenized by Stripe, which is certified to PCI-DSS Level 1 — the highest level of payment security certification.
- Access controls: Access to personal information is restricted to employees and contractors who require it to perform their duties. Access is role-based and logged.
- Vendor account isolation: Each vendor on the platform can only access their own data. Technical controls prevent any vendor from accessing another vendor's account, orders, or personal information.
- Breach response: We maintain a data breach response procedure. In the event of a breach that poses a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada as soon as feasible. For Quebec residents, we will notify the Commission d'accès à l'information within 72 hours. Affected individuals will be notified directly as required by law.
No security system is impenetrable. If you believe your account has been compromised, contact us immediately at privacy@mastercase.ca.
COOKIES AND TRACKING TECHNOLOGIES
We use cookies and similar technologies to operate the platform and improve your experience. Cookies are small text files stored on your device.
| Cookie Type | Purpose | Duration | Consent Required? |
|---|---|---|---|
| Strictly necessary | Session management, shopping cart, account authentication, fraud prevention | Session or up to 1 year | No — required for platform function |
| Functional | Remember your language, currency, and display preferences | Up to 1 year | Yes |
| Analytics | Understand how visitors use the site (via Google Analytics) | Up to 2 years | Yes |
| Marketing | Personalized advertising and remarketing | Up to 1 year | Yes |
Where required by law, we will request your consent before setting non-essential cookies. You may also manage or disable cookies through your browser settings. Note that disabling certain cookies may affect your ability to use some features of the platform.
YOUR PRIVACY RIGHTS
Depending on your province of residence, you have the following rights regarding your personal information:
| Right | Description | How to Exercise |
|---|---|---|
| Access | Request a copy of the personal information we hold about you | Email privacy@mastercase.ca — we will respond within 30 days |
| Correction | Request that inaccurate or incomplete personal information be corrected | Log in to your account settings, or email privacy@mastercase.ca |
| Withdrawal of consent | Withdraw consent for processing not required by law or contract | Email privacy@mastercase.ca or use the unsubscribe link in any marketing email |
| Erasure / De-indexing (Quebec residents) | Request deletion or de-indexing of personal information, subject to legal retention requirements | Email privacy@mastercase.ca |
| Data portability (Quebec residents) | Request a copy of personal information in a structured, commonly used technological format | Email privacy@mastercase.ca — available for information you provided directly to us |
| File a complaint | Escalate unresolved concerns to the OPC (all provinces) or CAI (Quebec) | See the first section for regulator contact information |
EMAIL COMMUNICATIONS — CASL COMPLIANCE
We send two types of electronic messages:
Transactional messages (no consent required): Order confirmations, shipping notifications, delivery confirmations, account security alerts, and payout notifications to vendors. These messages relate directly to a transaction or relationship you initiated.
Marketing and promotional messages (express consent required): Newsletters, new vendor announcements, promotions, and any message whose primary purpose is to encourage a commercial activity. We will only send these messages if you have opted in by checking the relevant box at account creation or on our email sign-up form.
You may unsubscribe from marketing messages at any time by clicking the "Unsubscribe" link in any such message or by contacting us at privacy@mastercase.ca. We will process your unsubscribe request within 10 business days.
CHILDREN'S PRIVACY
MasterCase Canada is not intended for persons under 18 years of age. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected information from a minor, please contact us immediately at privacy@mastercase.ca and we will delete it promptly.
Quebec residents: In accordance with the Consumer Protection Act (Quebec), we do not direct advertising or commercial communications to children under 13 years of age.
LINKS TO THIRD-PARTY WEBSITES AND VENDOR PAGES
Vendor product listings on MasterCase Canada may contain links or references to third-party websites operated by vendors or other parties. This Privacy Policy does not apply to those third-party websites. We encourage you to review the privacy policies of any third-party sites you visit.
DATA RETENTION
We retain personal information only as long as necessary for the purposes for which it was collected, or as required by law. Specific retention periods are noted in the section above on what personal information we collect. When personal information is no longer needed, we securely destroy or anonymize it.
Note: certain financial and tax records must be retained for a minimum of 7 years under federal and provincial tax law, regardless of account closure.
CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. If we make material changes, we will notify you by email (to the address associated with your account) and post a prominent notice on mastercase.ca at least 30 days before the changes take effect.
The "Last Updated" date at the top of this Policy will always reflect the date of the most recent version. Your continued use of the platform after the effective date of any changes constitutes your acceptance of the updated Policy.
CONTACTING US
For any questions, concerns, or requests relating to this Privacy Policy or your personal information:
Privacy Officer
MasterCase Wholesale Inc.
Email: privacy@mastercase.ca
Mailing address: 2055 Pendrell St., Vancouver, B.C. V6G 1T9, Canada