Canawa Privacy Policy/隐私政策
Effective date: August 13th, 2024
This Policy explains what personal information Canawa handles, why it is needed, who receives it and how you can exercise your choices.
1 Who we are and scope
Canawa 加年华 (“Canawa”, “we”, “us”) is operated by DIGIWORLDMEDIA, at 68 Cairns Dr, Markham, ON L3P 6J2. We are responsible for personal information under our control. Our privacy contact is identified in section 16.
This Policy explains how we handle personal information in connection with canawa.ca, customer accounts, community group purchases, pickup points, customer service and related communications. It also covers personal information supplied by group leaders, warehouse contacts and promoters in their dealings with us. Independent third-party services may have their own privacy policies.
This Policy is a notice of our practices, not a blanket consent to every use of information. We obtain consent where required and comply with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies.
2 Information you provide
Account and contact details: name, email address, telephone number, login credentials or verification records, language preference and any optional profile image you upload. Please do not send us passwords or verification codes in a customer service message.
Order and fulfillment details: purchased products, quantities, prices, selected group leader and pickup point, pickup verification, authorized collector details, and billing or delivery addresses where required. We also handle cancellation, refund and payment-status records.
Messages and contributions: enquiries, complaints, reviews, uploaded photos and information you choose to provide in order notes. Please avoid including unnecessary identity documents, medical information or other sensitive details. Allergy information you voluntarily provide may be sensitive; we use it only to address your request and share it only where necessary and lawful.
Partner information: where you apply to participate as a group leader, warehouse operator or promoter, we may collect contact and business details, the proposed pickup location, payment instructions, commission records and tax information legally needed for that relationship. We explain any additional verification requirement when it arises.
3 Information collected through technology and other sources
When you use the website, our systems and service providers may record your IP address, browser and device type, request times, pages requested, error logs, and session or cookie identifiers. These records support website operation, troubleshooting and security. See section 8 for optional tracking.
Your selected pickup point, postal code or delivery address may be used to identify available services. If a feature requests precise device location, we will explain why and request permission before accessing it. You may decline and use manual location selection where available; location permission can be changed in your browser or device settings.
If you choose an available social sign-in option, we may receive an account identifier, name, email address and profile image, depending on the provider and permissions you approve. We do not receive your social account password through that sign-in process. We may also receive payment results, pickup confirmations and delivery updates from providers involved in your order, or a referral identifier from a link you choose to use.
4 Why we use information
We use relevant information to create and secure accounts; verify sign-ins; process orders and payments; arrange procurement, sorting, pickup and delivery; handle refunds and support; and send necessary order, safety or recall notices.
We also use information to administer disclosed promotions and commission arrangements, investigate suspected fraud, resolve disputes, keep legally required records, and understand technical problems and service performance. Where possible, service analysis uses aggregated or de-identified information; we will not attempt to re-identify information that we represent as anonymous.
Optional personalized offers, non-essential analytics or advertising uses require the notice and consent appropriate to the activity. We will identify a materially new purpose and obtain further consent when required before using information for that purpose. We do not make access to ordinary shopping conditional on consenting to unrelated marketing.
5 Consent and your choices
We seek consent in a form appropriate to the information’s sensitivity and your reasonable expectations. Some information is necessary to provide a service you request; optional uses are distinguished from those necessary uses. Where law allows collection, use or disclosure without consent, we limit it to that lawful exception.
You may decline optional information, change available preferences, or contact us to withdraw consent, subject to legal or contractual restrictions and reasonable notice. We will explain any consequence, such as being unable to fulfill an order without required delivery information. Withdrawal does not automatically erase records that must lawfully be retained or invalidate earlier lawful processing.
If you provide another person’s details, such as an authorized collector’s name or telephone number, ensure you have authority to do so and let them know about this Policy. Provide only what the arrangement requires.
6 Sharing for orders and community pickup
We share only information reasonably needed for a recipient’s role. A seller or warehouse may receive relevant order and fulfillment details. Your assigned pickup operator or group leader may receive your name or collection identifier, contact details where needed, order contents and pickup status to sort goods, notify you and verify collection. A delivery provider may receive the recipient’s name, address, telephone number and delivery instructions.
Group leaders are not entitled to unrestricted access to your account, passwords, payment credentials or unrelated order history. Order information must not be used by them for independent marketing without a separate lawful basis. Referral and commission reporting should use identifiers or aggregated amounts where personal details are unnecessary; a referral does not authorize unrestricted access to customer information.
A residential pickup location may need to be displayed to customers selecting or using that location. Before listing a home as a pickup point, we will explain the audience, address details and contact information to be displayed and obtain the required authorization. We will not publish customers’ addresses, telephone numbers or complete order lists to other customers as part of ordinary group buying.
7 Service providers and other disclosures
We engage providers for functions such as hosting, security, payment processing, sign-in, SMS or email delivery, and operational support. We give processors access only for authorized purposes, use contractual or other appropriate safeguards, and remain accountable for information under our control. Some providers also handle information independently under their own policies, for example for payment-fraud prevention or legal compliance.
Payment details are handled according to the payment method selected. We may receive transaction references, payment tokens, status and limited card details, such as brand and last digits. The precise information flow and provider are described at checkout or in the service-provider notice. Never send full card details or a card security code to a group leader or customer service contact.
We do not sell personal information or provide customer lists for unrelated third parties’ own marketing. We may disclose information where legally required or permitted, including valid legal demands, protection against fraud or serious harm, or professional advice subject to appropriate confidentiality.
If a business transaction such as a merger or sale is proposed, relevant information may be shared only under applicable legal conditions and safeguards. Where required, the recipient must maintain appropriate protection, limit use, return or destroy information if the transaction does not proceed, and notify affected individuals after completion.
8 Cookies and similar technologies
Cookies and similar browser storage can support sign-in sessions, shopping carts, checkout security and saved preferences. Blocking essential storage may prevent these functions from working. Cookie identifiers may constitute personal information when linked to a person or account.
Before using optional analytics, advertising pixels or similar tracking, we will describe the providers, purposes, information collected and duration in our cookie notice and obtain consent where required. Optional advertising consent will not be presumed from acceptance of our Terms of Service.
You can manage cookies through your browser and any consent controls provided on the site. Deleting cookies may reset preferences or sign you out. Withdrawing optional consent stops the relevant future activity subject to technical implementation and applicable law; it does not automatically delete records already lawfully retained.
9 Email and text messages
Necessary verification, order, pickup, refund and product-safety messages are distinct from optional promotional messages. We send marketing only with the consent or other basis permitted under Canada’s anti-spam rules, and provide sender identification and a working unsubscribe mechanism as required.
You may unsubscribe using the mechanism in a promotional message or by contacting us. We will implement a marketing opt-out without delay and no later than 10 business days where CASL applies. We may keep a minimal suppression record to honour your choice. Opting out of marketing does not prevent necessary service messages, which will not be used to bypass your marketing preference.
10 Storage locations and international processing
Information may be stored or accessed outside your province or Canada when our providers operate there. We do not promise that all data stays in Canada.
We use appropriate contractual or other safeguards for outsourced processing and assess applicable requirements. Information processed abroad may be accessible to courts, law-enforcement or other authorities under that country’s laws. Contact our privacy contact for information about relevant providers, locations and safeguards.
11 Retention and deletion
We retain information only as long as reasonably necessary for the stated purposes and applicable legal requirements. Relevant factors include an active account or order, tax and accounting duties, warranty or refund handling, security investigations, legal limitation periods and a specific legal hold. We do not keep all information indefinitely merely because an account once existed.
Account/profile records are retained while needed to provide the account, then deleted or anonymized under our closure process. Order, payment and commission records may require longer legal retention. Support records and technical logs have separate schedules proportionate to their purpose; backups are removed through the backup rotation schedule. Marketing consent and suppression records are kept as needed to demonstrate compliance and honour choices.
Our applicable retention periods or criteria by category are available from our privacy contact. When information is no longer required, we securely delete, destroy or anonymize it. Account closure may not immediately remove lawful transaction records or backup copies, but retained copies remain protected and are not repurposed for unrelated marketing.
12 Security and incidents
We use reasonable administrative, technical and physical safeguards appropriate to information sensitivity, including access restrictions and safeguards for information handled by service providers. No internet service can guarantee absolute security. Protect your credentials and contact us promptly if you suspect misuse.
If a privacy incident occurs, we will investigate, contain it and take appropriate corrective action. We will maintain required breach records and notify affected individuals and authorities when applicable law requires it, including PIPEDA’s real-risk-of-significant-harm threshold where applicable. We will provide required information and practical steps to help affected individuals protect themselves.
13 Access correction and privacy requests
You may ask whether we hold personal information about you, request access and an explanation of its use and disclosure, and challenge inaccurate or incomplete information. You may also request account closure or deletion, or withdraw consent, subject to applicable law and necessary retention. Canadian law does not create an unconditional right to erase every record.
Send your request to the contact in section 16. We may reasonably verify your identity or an authorized representative’s authority, using only necessary information. Do not send identity documents unless we explain why they are needed and provide an appropriate submission method.
For access requests under PIPEDA, we normally respond within 30 calendar days. If a lawful extension or exception applies, we will provide the required notice, reasons and complaint information. Access is provided at minimal or no cost; any permitted charge will be explained in advance. Where lawful, we will separate information protected by an exception rather than withhold an entire record. If a correction is disputed, we will record the unresolved challenge as required.
14 Children and public content
Our shopping and account services are intended for people who have reached the age of majority in their province or territory. We do not knowingly invite children to create accounts or provide information independently. If you believe a child has supplied personal information without appropriate authority, contact us so we can investigate and take appropriate action.
When you choose to post a public review or use a public profile feature, the content and display name or image identified by that feature may be visible to others. Review the audience before submitting and do not include private contact information. A private account avatar will not be made public solely because it has been uploaded.
15 Updates and language
We will identify the effective date of this Policy and provide appropriate notice of material changes. If a new purpose or disclosure requires fresh consent, we will obtain it before proceeding; posting an updated policy alone does not replace that consent.
The English and Chinese versions are intended to have the same meaning. Any inconsistency will be interpreted consistently with applicable law and mandatory privacy rights. Mandatory language requirements take priority.
16 Contact and complaints
Privacy contact or officer: Nelson L. General Manager
Legal operator: DIGIWORLDMEDIA
Privacy email: service@canawa.ca
Mailing address: 68 Cairns Dr, Markham, ON L3P 6J2
Telephone: +1-878-888-2528
Website: https://canawa.ca
Please contact us about privacy questions, requests or complaints. We will investigate and respond appropriately. You may also complain to the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/en/report-a-concern/ or to the provincial privacy regulator with jurisdiction. Contacting us first does not remove your right to approach a regulator.
Canawa 加年华隐私政策
生效日期：2024年8月13日
本政策说明 Canawa 处理哪些个人信息、处理目的、接收对象，以及您如何行使相关选择与权利。
1 运营主体与适用范围
Canawa 加年华（“Canawa”“我们”）由DIGIWORLDMEDIA运营，地址为68 Cairns Dr, Markham, ON L3P 6J2。我们对自身控制下的个人信息负责。隐私事务联系方式见第16条。
本政策说明我们如何处理与 canawa.ca、客户账户、社区团购、提货点、客服及相关通讯有关的个人信息，也适用于团长、仓库联系人和推广员在与我们合作时提供的个人信息。独立第三方服务可能适用其自身的隐私政策。
本政策用于说明信息处理方式，不代表您对所有信息用途作出概括同意。我们在需要时取得同意，并遵守适用的加拿大隐私法律，包括在适用情况下遵守《个人信息保护与电子文件法》（PIPEDA）。
2 您提供的信息
账户和联系资料：姓名、电子邮箱、电话号码、登录凭据或验证记录、语言偏好，以及您自愿上传的头像。请勿在客服消息中发送密码或验证码。
订单和履约资料：商品、数量、价格、所选团长及提货点、提货核验信息、授权代取人的资料，以及在需要时提供的账单或配送地址。我们也处理取消订单、退款及付款状态记录。
沟通和投稿内容：咨询、投诉、评价、上传照片及您主动填写的订单备注。请避免提供不必要的身份证件、医疗资料或其他敏感信息。您自愿提供的过敏信息可能属于敏感信息；我们仅用于处理您的请求，并仅在必要且合法时共享。
合作方资料：申请成为团长、仓库运营者或推广员时，我们可能收集联系及业务资料、拟用提货地址、收款资料、佣金记录，以及合作关系中依法需要的税务信息。如需额外核验，我们会在收集时说明。
3 技术收集与其他来源的信息
使用网站时，我们的系统和服务商可能记录您的IP地址、浏览器及设备类型、请求时间、访问页面、错误日志，以及会话或Cookie标识。这些记录用于网站运行、故障排查和安全保护。可选追踪见第8条。
我们可能利用您选择的提货点、邮政编码或配送地址确定可提供的服务。如某项功能需要设备精确位置，我们会在访问前说明用途并请求授权。您可拒绝，并在提供手动选择功能时手动指定位置；也可在浏览器或设备设置中调整定位权限。
如选择平台提供的社交账号登录，我们可能根据服务商和您批准的权限，接收账户标识、姓名、邮箱及头像。我们不会通过该登录流程获得您的社交账号密码。我们还可能从参与履约的服务商处接收支付结果、提货确认及配送状态，或从您选择使用的推广链接接收推广标识。
4 信息用途
我们使用相关信息创建和保护账户、验证登录、处理订单和支付、安排采购分拣及提货配送、处理退款和客服事项，并发送必要的订单、安全或召回通知。
我们也利用信息管理已披露的优惠及佣金安排、调查涉嫌欺诈行为、处理争议、保存法律要求的记录，以及了解技术问题和服务表现。在可行情况下，服务分析采用汇总或去标识化信息；对于我们明确表示已匿名化的信息，不尝试重新识别个人。
可选的个性化优惠、非必要分析或广告用途，须提供与有关活动相适应的告知并取得所需同意。如拟用于重要的新目的，我们会先说明，并在需要时另行取得同意。我们不会把同意无关营销作为普通购物的必要条件。
5 同意与您的选择
我们会根据资料的敏感程度和您的合理预期，以适当方式取得同意。部分资料是提供您所请求服务所必需的；我们会区分必要用途与可选用途。法律允许无需同意而收集、使用或披露时，我们将处理范围限于相应法定例外。
您可拒绝提供可选资料、调整可用的偏好设置，或联系我们撤回同意，但可能受法律或合同限制，并需给予合理通知。我们会说明影响，例如缺少必要配送资料将无法履约。撤回同意不自动删除依法须保留的记录，也不否定此前合法的信息处理。
如提供他人资料，例如代取人的姓名或电话号码，请确保有权提供，并告知对方本政策；仅提供该安排所需的资料。
6 订单与社区提货的信息共享
我们仅共享接收方履行职责合理所需的信息。卖家或仓库可能收到相关订单及履约资料。负责您订单的提货点运营者或团长，可能收到姓名或提货标识、必要联系方式、商品明细和提货状态，以便分拣、通知及核验。配送方可能收到收货人的姓名、地址、电话及配送说明。
团长无权不受限制地查看您的账户、密码、支付凭据或无关订单历史，也不得在没有独立合法依据时将订单资料用于自己的营销。推广及佣金报表在无需个人资料时，应使用标识或汇总金额；推广关系不授权无限制访问客户资料。
住宅提货地址可能需要展示给选择或使用该提货点的客户。将住宅设为提货点前，我们会说明展示对象、地址范围和联系方式，并取得所需授权。普通团购流程不会向其他客户公开客户地址、电话号码或完整订单名单。
7 服务商与其他披露
我们使用服务商提供网站托管、安全、支付处理、登录、短信或邮件发送及运营支持等功能。处理商仅可为授权目的访问资料，我们采用合同或其他适当保护措施，并继续对自身控制下的信息负责。某些服务商亦可能依据其独立政策处理信息，例如进行支付反欺诈或履行法律义务。
支付资料的处理取决于您选择的支付方式。我们可能收到交易编号、支付令牌、付款状态及有限卡片信息，例如卡种和末几位数字。具体资料流向及服务商将在结账页面或服务商说明中说明。请勿向团长或客服发送完整卡号或银行卡安全码。
我们不出售个人信息，也不向无关第三方提供客户名单供其自行营销。在法律要求或允许的情况下，我们可能披露资料，包括响应有效法律要求、防范欺诈或严重伤害，或在适当保密条件下征求专业意见。
如拟进行合并或出售业务等交易，相关信息仅可在适用法律条件和保护措施下共享。在法律要求时，接收方须维持适当保护、限制用途、在交易未完成时返还或销毁信息，并在完成后通知受影响个人。
8 Cookie与类似技术
Cookie及类似浏览器存储可用于登录会话、购物车、结账安全和偏好保存。阻止必要存储可能导致这些功能失效。与个人或账户关联时，Cookie标识可能构成个人信息。
使用可选分析、广告像素或类似追踪技术前，我们将在Cookie说明中说明服务商、用途、收集信息及期限，并在需要时取得同意。接受服务条款不视为同意可选广告追踪。
您可通过浏览器及网站提供的同意管理功能控制Cookie。删除Cookie可能重置偏好或使您退出登录。撤回可选同意后，我们将结合技术实施及适用法律停止相应的未来活动，但这不自动删除此前合法保留的记录。
9 邮件与短信
必要的验证、订单、提货、退款和商品安全通知，与可选促销信息分开处理。营销信息仅在已取得同意或具有加拿大反垃圾信息规则允许的其他依据时发送，并按要求提供发送方身份和有效退订方式。
您可使用促销信息中的退订方式或联系我们退订。在CASL适用时，我们将及时处理，最迟不超过10个工作日。我们可能保留最低限度的退订记录以尊重您的选择。退订营销不影响必要服务通知，但我们不会利用服务通知绕过您的营销偏好。
10 存储地点与跨境处理
服务商在其他地区运营时，资料可能在您所在省以外或加拿大境外存储或访问。我们不承诺所有数据均保留在加拿大境内。
我们对外包处理采用适当合同或其他保护措施，并评估适用要求。境外处理的信息可能依当地法律被法院、执法或其他机关访问。有关服务商、地点及保护措施的信息，可向隐私事务联系人查询。
11 保存与删除
我们仅在已说明用途及适用法律要求合理必要的期间保留信息。相关因素包括账户或订单是否有效、税务会计义务、保修或退款处理、安全调查、法定诉讼时效及特定法律保全要求。我们不会仅因曾创建账户就无限期保留全部信息。
账户及个人资料在提供账户服务所需期间保留，之后依注销流程删除或匿名化。订单、付款和佣金记录可能依法需要保留更久。客服记录及技术日志按照与用途相称的独立期限保存；备份依轮换安排移除。营销同意及退订记录按证明合规和尊重选择所需的期限保留。
各类资料的适用保存期限或判断标准可向隐私事务联系人索取。不再需要时，我们将安全删除、销毁或匿名化。注销账户可能不会立即移除依法保留的交易记录或备份，但保留资料仍受保护，且不会转用于无关营销。
12 安全与事件处理
我们采用与信息敏感程度相适应的合理管理、技术及实体保护措施，包括访问限制及对服务商处理信息的保护安排。任何互联网服务均无法保证绝对安全。请保护登录凭据，发现疑似滥用时及时联系我们。
发生隐私事件时，我们将调查、控制影响并采取适当纠正措施，保存法律要求的泄露记录，并在法律要求时通知受影响个人及主管机关，包括在PIPEDA适用且达到“造成重大伤害的真实风险”标准时履行通知义务。我们将提供规定信息及有助于受影响个人自我保护的实际建议。
13 访问更正与隐私请求
您可询问我们是否持有您的个人信息、申请访问、了解使用及披露情况，并对不准确或不完整资料提出更正。您也可申请注销、删除或撤回同意，但须遵守适用法律和必要保留要求。加拿大法律并非赋予无条件删除全部记录的权利。
请向第16条的联系人提交请求。我们可能通过最低必要资料合理核验您的身份，或代理人的授权。除非我们说明必要性并提供适当提交方式，否则请勿发送身份证件。
对于PIPEDA项下的访问请求，我们通常在30个自然日内答复。如适用合法延长或例外，我们会按要求说明期限、理由和投诉途径。访问通常免费或仅收取最低费用；任何依法允许的收费会事先说明。在法律允许时，我们将分离受例外保护的信息，而非拒绝提供整份记录。如对更正存在争议，我们将按要求记录未解决的异议。
14 未成年人及公开内容
我们的购物及账户服务面向已达到所在省或地区法定成年年龄的人士。我们不会明知而邀请儿童独立注册或提供资料。如您认为儿童在未经适当授权的情况下提交个人信息，请联系我们调查并作出适当处理。
当您主动发布公开评价或使用公开资料功能时，该功能所说明的内容、显示名称或头像可能被他人看到。提交前请确认展示对象，勿加入私人联系方式。私人账户头像不会仅因已上传而自动公开。
15 政策更新与语言
本政策将注明生效日期，重大变更会以适当方式告知。如新用途或披露需要重新取得同意，我们将在实施前取得；仅发布新版政策不能替代所需同意。
英文和中文版本旨在表达相同含义。如有不一致，应依适用法律及强制性隐私权利解释。强制性语言要求优先适用。
16 联系与投诉
隐私事务联系人或负责人：Nelson L. 总经理
运营主体法定名称：DIGIWORLDMEDIA
隐私事务邮箱：service@canawa.ca
邮寄地址：68 Cairns Dr, Markham, ON L3P 6J2
联系电话：+1-878-888-2528
有关隐私问题、请求或投诉，请联系我们，我们将调查并作出适当回应。您也可向加拿大隐私专员办公室投诉：https://www.priv.gc.ca/en/report-a-concern/，或向具有管辖权的省级隐私监管机构投诉。建议先联系我们不影响您直接向监管机构反映问题的权利。