Privacy Policy
Last updated: 26 July 2026
SortaHub ("SortaHub", "we", "us", or "our") respects your privacy. This policy explains what personal information we collect, how we use and protect it, and the rights you have. It is written to align with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, the EU/UK General Data Protection Regulation (GDPR). SortaHub operates from Ontario, Canada and ships worldwide.
1. Who we are
SortaHub is a supplier of general business supplies and everyday essentials to business (B2B) and consumer (B2C) customers. For privacy questions, the contact details are at the end of this policy. Where GDPR applies, SortaHub is the "data controller" of your personal information.
2. Information we collect
- Account & contact details — name, email, phone, business name, and billing/shipping addresses.
- Order & quote information — products requested, quotes, invoices, order history, and related correspondence.
- Payment information — payments are processed by our payment providers (e.g. Stripe) or made by EFT/Interac e-Transfer. We do not store full card numbers on our systems; we retain payment references and status.
- Technical & usage data — IP address, device/browser type, pages viewed, and similar analytics data collected via cookies and similar technologies (see our Cookie Policy).
- Communications — messages you send us and our replies.
3. How we use your information
- To create and manage your account and process quotes, orders, invoices, and payments.
- To arrange shipping and fulfil orders, including sharing necessary details with suppliers and carriers.
- To provide customer support and respond to your enquiries.
- To operate, secure, and improve our website and services, including analytics.
- To send transactional messages (order, invoice, and payment updates) and, where permitted, service communications.
- To comply with legal, tax, accounting, and regulatory obligations.
4. Legal bases (GDPR)
Where GDPR applies, we rely on: performance of a contract (to fulfil your orders); legitimate interests (to run and secure our business and improve our services); consent (for non-essential cookies and optional marketing, which you may withdraw at any time); and legal obligation (to meet tax and record-keeping requirements). Under PIPEDA we collect, use, and disclose personal information with your knowledge and consent, except where the law permits otherwise.
5. Sharing your information
We do not sell your personal information. We share it only with:
- Service providers that operate our platform and business — for example hosting and infrastructure (Cloudflare), payment processing (Stripe), email delivery, analytics (Google Analytics, Cloudflare Analytics), and shipping carriers/suppliers.
- Professional advisers and authorities where required by law, regulation, or legal process, or to protect our rights.
- A successor entity in the event of a merger, acquisition, or sale of assets.
6. International transfers
Because we operate from Canada, ship worldwide, and use global service providers, your information may be processed in countries other than your own, including Canada and the United States. Where required, we use appropriate safeguards (such as standard contractual clauses) for transfers of personal information out of the EU/UK.
7. Data retention
We keep personal information only as long as necessary for the purposes above and to meet legal, tax, and accounting obligations (for example, invoices and transaction records are retained for the period required by Canadian law). When no longer required, information is securely deleted or anonymised.
8. Security
We use technical and organisational measures — including encryption in transit, access controls, and trusted infrastructure providers — to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. Your rights
Subject to applicable law, you may request to access, correct, update, or delete your personal information; object to or restrict certain processing; withdraw consent; and, where GDPR applies, request data portability. To exercise these rights, contact us using the details below. You may also complain to the Office of the Privacy Commissioner of Canada or, where GDPR applies, your local supervisory authority.
10. Children
Our services are intended for businesses and adults. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. The "Last updated" date above reflects the latest version. Material changes will be posted on this page.