Privacy Policy

Last Updated: January 15, 2026

Effective Date: January 15, 2026

Version: 3.1

1. Introduction

Crust & Crumb Supplies Ltd. ("Crust & Crumb," "we," "us," or "our") is committed to protecting the privacy and confidentiality of personal information entrusted to us by our clients, prospective clients, website visitors, suppliers, and other individuals with whom we interact in the course of our business operations. This Privacy Policy describes how we collect, use, disclose, retain, and safeguard personal information in connection with our wholesale distribution services, our website (www.crustandcrumb.ca), and all related business activities.

This Privacy Policy has been developed in compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5) and its ten fair information principles, as well as applicable provincial privacy legislation, including Ontario's forthcoming privacy framework. We are committed to adhering to the highest standards of privacy protection and to being transparent about our information practices.

By engaging with Crust & Crumb Supplies Ltd. — whether by visiting our website, submitting an inquiry, opening a wholesale account, placing an order, or otherwise providing us with personal information — you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal information as described herein.

2. Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Information" means information about an identifiable individual, as defined under PIPEDA. This includes, but is not limited to, an individual's name, email address, telephone number, mailing address, business title, credit or financial information, and any other information that can be used to identify an individual, either on its own or in combination with other data. Personal information does not include the name, title, business address, or telephone number of an employee of an organization when used in a business context.
• "Client" means any individual or business entity that holds an active wholesale account with Crust & Crumb Supplies Ltd. or has placed an order for products or services.
• "Website" means the website operated by Crust & Crumb Supplies Ltd. at www.crustandcrumb.ca, including all pages, subdomains, and associated web-based applications.
• "Service" or "Services" means the wholesale distribution, product supply, custom packaging, equipment sales, and related services provided by Crust & Crumb Supplies Ltd.

3. Accountability

Crust & Crumb Supplies Ltd. has designated a Privacy Officer who is accountable for the organization's compliance with this Privacy Policy and with PIPEDA. The Privacy Officer is responsible for overseeing the implementation of privacy policies and procedures, responding to privacy-related inquiries and complaints, and ensuring that all employees and contractors who handle personal information are appropriately trained on their obligations.

Our designated Privacy Officer can be contacted at:

4. Information We Collect

We collect personal information that is necessary for the purposes identified below. The types of personal information we collect depend on the nature of your interaction with us:

4.1 Information Provided Directly by You

• Account Registration: When you apply for a wholesale account, we collect your full name, business name, business address, email address, telephone number, fax number, business registration number, HST/GST registration number, and trade references.
• Credit Application: For clients requesting credit terms (Net-30 or Net-45), we collect financial information including bank references, credit references, estimated annual purchase volume, and years in business. This information is used solely for the purpose of assessing creditworthiness.
• Order Processing: When you place an order, we collect your name, delivery address, contact details, product selections, quantities, and payment information (credit card number, expiration date, and CVV for card payments; bank account details for wire transfers or pre-authorized debit arrangements).
• Website Inquiries: When you submit an inquiry through our website contact form, we collect your name, business name, email address, phone number, inquiry type, and the content of your message.
• Correspondence: When you communicate with us via email, telephone, fax, or postal mail, we may collect and retain the content of those communications along with your contact information for the purpose of responding to your inquiry and maintaining accurate records of our interactions.

4.2 Information Collected Automatically

• Website Usage Data: When you visit our website, our web server automatically collects certain technical information, including your IP address, browser type and version, operating system, referring URL, pages visited, time and date of access, and duration of visit. This information is collected through server logs and cookies (see Section 9 below and our Cookie Policy).
• Device Information: We may collect information about the device you use to access our website, including device type, screen resolution, and language preferences.

4.3 Information from Third Parties

• Credit Reporting Agencies: For credit applications, we may obtain credit reports or credit scores from recognized Canadian credit reporting agencies (Equifax Canada, TransUnion Canada) for the purpose of evaluating your credit application.
• Trade References: We may contact the trade references you provide as part of your account application to verify your payment history and business standing.

5. Purposes of Collection, Use, and Disclosure

Crust & Crumb collects, uses, and discloses personal information for the following identified purposes:

1. Account Administration: To establish and manage your wholesale account, including identity verification, credit assessment, account activation, and ongoing account maintenance.
2. Order Fulfillment: To process, fulfill, and deliver your orders; to manage inventory allocation; to coordinate delivery logistics; and to communicate order confirmations, shipping notifications, and delivery updates.
3. Payment Processing: To process payments for goods and services, including credit card transactions, electronic funds transfers, and the management of accounts receivable and billing statements under agreed-upon credit terms.
4. Customer Service: To respond to your inquiries, requests, and complaints; to provide technical support for equipment products; and to administer product returns, exchanges, and warranty claims.
5. Product and Service Improvement: To analyze purchasing patterns and client feedback for the purpose of improving our product offerings, service delivery, and overall client experience.
6. Communication: To send you information related to your account, including invoices, statements, product availability updates, price list revisions, delivery schedule changes, and other operational communications necessary for the management of our business relationship.
7. Legal and Regulatory Compliance: To comply with applicable laws, regulations, and legal processes, including tax reporting obligations under the Income Tax Act, product recall requirements under the Canada Consumer Product Safety Act, and food safety reporting obligations under the Safe Food for Canadians Act.
8. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, unauthorized access to accounts, and other activities that may violate our Terms of Service or be illegal.

6. Consent

We obtain your consent for the collection, use, and disclosure of your personal information at the time the information is collected, except where consent is not required by law (for example, where collection is clearly in your interest and consent cannot be obtained in a timely manner, or where the information is publicly available as defined under PIPEDA).

Consent may be express (written or verbal) or implied, depending on the circumstances and the sensitivity of the information. By providing personal information to Crust & Crumb — for example, by completing a credit application, placing an order, or submitting a website inquiry — you are providing implied consent for us to use that information for the identified purposes described above.

You may withdraw your consent at any time, subject to legal or contractual restrictions and upon providing reasonable notice. Please note that withdrawal of consent may affect our ability to provide certain services to you. For example, if you withdraw consent for the processing of payment information, we may be unable to fulfill orders under credit terms and may require prepayment for future orders.

To withdraw consent, please contact our Privacy Officer using the contact details provided in Section 3 above.

7. Limiting Collection

We limit the collection of personal information to that which is necessary for the purposes identified in this Privacy Policy. We do not collect personal information indiscriminately, and we do not collect information through deceptive or misleading means. We collect personal information by fair and lawful means, and we endeavour to collect personal information directly from the individual concerned wherever possible.

8. Limiting Use, Disclosure, and Retention

Personal information collected by Crust & Crumb will not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required or permitted by law. We do not sell, trade, rent, or otherwise provide personal information to third parties for marketing purposes.

We may disclose personal information to the following categories of third parties in connection with the purposes identified above:

• Payment Processors: We share payment information with our payment processing service provider for the purpose of processing credit card transactions and electronic payments. Our payment processor is PCI-DSS Level 1 certified.
• Delivery Partners: We share delivery addresses and contact telephone numbers with our logistics and freight carrier partners for the purpose of coordinating and completing deliveries.
• Credit Reporting Agencies: We may share account payment history with credit reporting agencies as part of our credit reporting obligations and for the purpose of maintaining accurate credit files.
• Professional Advisors: We may disclose personal information to our legal counsel, auditors, and accountants as necessary for the provision of professional services to our organization.
• Law Enforcement and Regulatory Bodies: We may disclose personal information where required by law, regulation, court order, or subpoena, or where disclosure is necessary for the investigation of a breach of an agreement, a contravention of a federal or provincial law, or as otherwise required to comply with our legal obligations.

Personal information is retained only for as long as necessary to fulfill the identified purposes or as required by applicable law. Our standard retention periods are as follows:

• Active account information: Duration of business relationship plus 7 years
• Transaction and order records: 7 years from date of transaction (per CRA requirements)
• Credit application information: 7 years from date of application or account closure
• Website inquiry records: 2 years from date of inquiry
• Website analytics and log data: 26 months

Upon expiry of the applicable retention period, personal information is securely destroyed or anonymized. Paper records are cross-cut shredded, and electronic records are permanently deleted using industry-standard data sanitization methods.

9. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyze website traffic, and support the functionality of our website. For detailed information about the types of cookies we use, their purposes, and how you can manage your cookie preferences, please refer to our Cookie Policy.

10. Safeguards

Crust & Crumb Supplies Ltd. employs appropriate physical, organizational, and technological security measures to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification. The nature and extent of these safeguards are proportional to the sensitivity of the information.

Our security measures include, but are not limited to:

• Physical Safeguards: Locked filing cabinets for paper records; restricted access to office and warehouse areas where personal information is stored; alarm and surveillance systems at both facilities; visitor sign-in protocols.
• Organizational Safeguards: Employee privacy training upon onboarding and annually thereafter; role-based access controls ensuring employees can only access personal information necessary for their job functions; confidentiality agreements with all employees and contractors; documented incident response procedures.
• Technological Safeguards: SSL/TLS encryption for all website data transmissions; encrypted storage of sensitive financial information; firewalls and intrusion detection systems; regular security updates and patch management; periodic vulnerability assessments.

11. Openness

Crust & Crumb is committed to making information about our privacy policies and practices readily available. This Privacy Policy is published on our website and is available in print upon request. We will notify clients and website visitors of any material changes to this Privacy Policy by posting the updated policy on our website with a revised "Last Updated" date. Where practicable, we will also notify active account holders of material changes via email.

12. Individual Access

Upon written request and verification of identity, you have the right to:

• Be informed of the existence, use, and disclosure of your personal information held by Crust & Crumb;
• Access your personal information held by Crust & Crumb;
• Challenge the accuracy and completeness of your personal information and have it amended as appropriate.

We will respond to access requests within 30 calendar days, as required by PIPEDA. In certain limited circumstances, we may be unable to provide access to all personal information — for example, where the information is subject to solicitor-client privilege, where disclosure would reveal confidential commercial information, or where the information was collected in the course of a formal dispute resolution process. In such cases, we will provide you with the reasons for denying access.

To submit an access request, please contact our Privacy Officer in writing using the contact details provided in Section 3.

13. Challenging Compliance

If you have a concern or complaint about our privacy practices, we encourage you to contact our Privacy Officer first. We will investigate all complaints promptly and will notify you of the outcome of our investigation within 30 days.

If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada:

14. Cross-Border Data Transfers

Crust & Crumb Supplies Ltd. stores and processes personal information primarily within Canada. However, in certain limited circumstances, personal information may be transferred to, stored, or processed in the United States — for example, when using cloud-based payment processing or email hosting services whose servers are located in the United States. In such cases, your personal information may be subject to the laws of the United States, including the USA PATRIOT Act, which may permit access by U.S. government authorities.

We take reasonable steps to ensure that any third-party service providers to whom we transfer personal information provide a comparable level of protection. All such service providers are bound by contractual obligations requiring them to protect the confidentiality and security of personal information and to use it only for the purposes for which it was provided.

15. Changes to This Privacy Policy

We reserve the right to modify or update this Privacy Policy at any time. Any material changes will be reflected by updating the "Last Updated" date at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal information. Continued use of our website or services following the posting of changes constitutes your acceptance of such changes.

16. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us: