Privacy Policy

Last updated: 26 July 2026

SortaHub ("SortaHub", "we", "us", or "our") respects your privacy. This policy explains what personal information we collect, how we use and protect it, and the rights you have. It is written to align with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, the EU/UK General Data Protection Regulation (GDPR). SortaHub operates from Ontario, Canada and ships worldwide.

1. Who we are

SortaHub is a supplier of general business supplies and everyday essentials to business (B2B) and consumer (B2C) customers. For privacy questions, the contact details are at the end of this policy. Where GDPR applies, SortaHub is the "data controller" of your personal information.

2. Information we collect

• Account & contact details — name, email, phone, business name, and billing/shipping addresses.
• Order & quote information — products requested, quotes, invoices, order history, and related correspondence.
• Payment information — payments are processed by our payment providers (e.g. Stripe) or made by EFT/Interac e-Transfer. We do not store full card numbers on our systems; we retain payment references and status.
• Technical & usage data — IP address, device/browser type, pages viewed, and similar technical data needed to operate and secure the site (see our Cookie Policy). We do not currently load third-party analytics cookies from this website.
• Communications — messages you send us and our replies.

3. How we use your information

• To create and manage your account and process quotes, orders, invoices, and payments.
• To arrange shipping and fulfil orders, including sharing necessary details with suppliers and carriers.
• To provide customer support and respond to your enquiries.
• To operate, secure, and improve our website and services.
• To send transactional messages (order, invoice, and payment updates) and, where permitted, service communications.
• To comply with legal, tax, accounting, and regulatory obligations.

4. Legal bases (GDPR)

Where GDPR applies, we rely on: performance of a contract (to fulfil your orders); legitimate interests (to run and secure our business and improve our services); consent (for non-essential cookies and optional marketing, which you may withdraw at any time); and legal obligation (to meet tax and record-keeping requirements). Under PIPEDA we collect, use, and disclose personal information with your knowledge and consent, except where the law permits otherwise.

5. Sharing your information

We do not sell your personal information. We share it only with:

• Service providers that operate our platform and business — for example hosting and infrastructure (Cloudflare), payment processing (Stripe), email delivery, and shipping carriers/suppliers.
• Professional advisers and authorities where required by law, regulation, or legal process, or to protect our rights.
• A successor entity in the event of a merger, acquisition, or sale of assets.

6. International transfers

Because we operate from Canada, ship worldwide, and use global service providers, your information may be processed in countries other than your own, including Canada and the United States. Where required, we use appropriate safeguards (such as standard contractual clauses) for transfers of personal information out of the EU/UK.

7. Data retention

We keep personal information only as long as necessary for the purposes above and to meet legal, tax, and accounting obligations (for example, invoices and transaction records are retained for the period required by Canadian law). When no longer required, information is securely deleted or anonymised.

8. Security

We use technical and organisational measures — including encryption in transit, access controls, and trusted infrastructure providers — to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights

Subject to applicable law, you may request to access, correct, update, or delete your personal information; object to or restrict certain processing; withdraw consent; and, where GDPR applies, request data portability. To exercise these rights, contact us using the details below. You may also complain to the Office of the Privacy Commissioner of Canada or, where GDPR applies, your local supervisory authority.

10. Children

Our services are intended for businesses and adults. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date above reflects the latest version. Material changes will be posted on this page.