Privacy Policy

Privacy policy

This policy explains what personal information Bid Boss Inc. collects, why, who processes it, how long we keep it, and your rights. It is written to the Personal Information Protection and Electronic Documents Act (PIPEDA) and applies to our websites, portals, mobile applications, auctions, warehouse and pickup operations.

1. Who is responsible

1.1 Bid Boss Inc., Unit 4, 12 Vulcan St, Etobicoke, Ontario M9W 1L2, is responsible for personal information under its control. Our accountable contact is Privacy Officer, Bid Boss Inc., privacy@bidbossinc.ca. Direct access requests, correction requests, complaints and questions there.

2. What we collect

2.1 Account and contact: name, email, phone, addresses, and business details where you provide them.

2.2 Transactions: bids, purchases, invoices, wallet balance and history, payment references, pickup bookings, shipping addresses and tracking, claims and their evidence.

2.3 Identity verification: where verification is required before certain money actions, a third-party provider verifies your identity. We receive and keep only the outcome of the check and a reference code. We never receive or store your identity documents or biometric data.

2.4 Consignor payout details: banking details for payouts are collected only inside the authenticated seller portal after your agreement is signed, never on a public form, are stored encrypted, and any change holds the next payout until re-verified.

2.5 Technical: IP address, device and browser data, and interactions with the Services.

2.6 Support and correspondence: the contents of support tickets, messages and attachments you send us, whether or not you hold an account, including from visitors who contact us without registering.

2.7 Premises: video surveillance operates in and around the warehouse for safety, security and fraud prevention, with signage posted. Footage is kept for the period in section 6 and disclosed only where the law requires or permits.

2.8 We do not knowingly collect information from anyone under 18, and we delete it if identified.

3. Why we use it

3.1 To run auctions and accounts; to invoice, collect payment, and operate the wallet; to fulfil pickup and shipping; to verify identity and prevent fraud; to handle claims and disputes; to provide support; to analyze bidding, search and platform activity in order to operate, improve and price our services, using aggregated or de-identified information where practicable; to meet legal, tax and safety obligations; and, with your consent, to send marketing.

3.2 Marketing consent is separate, optional, and never a condition of buying or selling. Every commercial message identifies us and carries a working unsubscribe honoured within 10 business days. Transactional messages about your orders, payments, pickups, shipping, safety and account continue regardless of marketing choices. Our communications and consent statement carries the detail.

4. Who processes it

4.1 We use service providers to run the business. Categories and current providers: infrastructure and database hosted in Canada (Supabase, Canada Central region; Vercel); email (Resend); SMS (Twilio); card payments (Helcim; card numbers never touch our systems and are handled by PCI-compliant processors); identity verification (Didit, outcome and reference only); carriers (Stallion Express, Freightcom, and the carriers they engage); product data (Keepa); auction hosting and clerking (HiBid, AuctionFlex360); payments by Interac e-transfer through our bank. Consignor payouts by EFT may be processed through VoPay, a payout processor held in reserve and used only once switched on; this policy is updated before any new provider goes live. Providers act under contracts limiting their use of your information to providing the service.

4.2 Some providers process data outside Canada, including in the United States and Europe. Where information leaves Canada it remains protected by contract, and remains subject to the laws of the destination country. We remain accountable for information we transfer.

4.3 We disclose personal information where the law requires, to protect safety, to collect amounts owed, or in a business transaction with protections in place.

5. Payment card information

5.1 Card payments are processed by PCI-DSS-compliant providers. We do not store full card numbers, and card numbers must never be sent to us by email or chat.

6. How long we keep it

6.1 We keep personal information as long as the purpose and the law require, then destroy or de-identify it. Our retention schedule: financial and transaction records, 6 years from the end of the fiscal year; executed agreements, 7 years past termination; terms-acceptance records, life of the account plus 7 years; marketing consents and lists, 2 years past your last engagement; dispute and claim evidence, 2 years past resolution; surveillance footage, 30 days unless preserved for an incident; identity documents, never held at all.

6.2 Ledger and settlement records are append-only by design and are retained for the financial-record period.

7. Your rights

7.1 You may request access to the personal information we hold about you, request correction of it, withdraw marketing consent at any time, and make a complaint. Write to support@bidbossinc.ca; we respond within 30 days. You may complain to the Office of the Privacy Commissioner of Canada. Quebec residents: we apply the protections of Quebec's private-sector privacy law to your information where it applies to us; requests go to the same address.

8. Safeguards and breach

8.1 We protect personal information with technical and organizational safeguards appropriate to its sensitivity, including encryption of payout banking details, access controls, and audit logging. If a breach creates a real risk of significant harm, we notify affected individuals and report to the Privacy Commissioner as the law requires, and we keep records of all breaches.

9. Cookies and mobile applications

9.1 Our cookie and tracking notice explains what runs on the sites. Our mobile applications request permission before sending push notifications, collect the categories in section 2 plus device push tokens, and include an in-app path to delete your account. App-store privacy labels reflect this policy.

10. Changes

10.1 We update this policy as the business changes, post the new version with its date, and re-ask for acceptance where a change is material.