Privacy policy

This policy covers personal information we handle when you apply for or operate a wholesale account, use the buyer portal, or contact our team. We are a business-to-business distributor; we do not market to or transact with consumers.

• Business identity: legal name, business number, licence numbers and copies, ship-to addresses
• Contact details: names, work emails, phone numbers, and roles of authorized users
• Account activity: orders, invoices, payments, returns, and portal sign-in records
• Payment details: processed by our payment provider — full card numbers never touch our servers

• Licence verification and age-restriction compliance before and during the account relationship
• Fulfilling orders: picking, shipping, invoicing, credit management, and recall traceability
• Meeting legal obligations: tax, excise, and provincial reporting where required
• Account communications — service messages about orders, invoices, and policy changes

We do not sell personal information. Ever.

We share information only with service providers needed to run the business — carriers (delivery details), our payment processor, licence-verification services, and cloud infrastructure — under contracts limiting their use, and with regulators where the law requires it.

Transaction and licensing records are retained as long as tax and excise law requires (generally seven years), then destroyed. Data is encrypted in transit and at rest, access is role-restricted, and portal sessions use short-lived, httpOnly credentials.

Authorized account contacts may request access to or correction of their personal information, or ask us to remove a former employee's access, by writing to privacy@thevapebusiness.com. We respond within 30 days. Complaints may also be directed to the Office of the Privacy Commissioner of Canada.