Privacy Policy

Topping Courier Inc. ("Topping", "we", "us") respects your privacy. This policy explains what personal information we collect, why, how we use and protect it, and your rights. It follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's anti-spam law (CASL).

1. Who is responsible

Topping Courier Inc., 87 Windrow St, Richmond Hill, Ontario L4E 0Y1, is responsible for the personal information it collects. Our Privacy Officer oversees this policy. Contact them at info@toppingcourier.ca (subject line "Privacy") or +1 905 975 6362.

2. Information we collect

When you book or create an account: your name, email, phone number, business name, billing address, pickup and drop-off addresses, contact names and phone numbers at those addresses, delivery instructions, and the details of what you send (size, weight, declared value, references).

About people receiving deliveries: the name, address, phone number and (if given) email that the sender gives us, so we can deliver and send updates.

When you pay: card payments are handled by Stripe. We receive a confirmation and the last four digits of the card, never the full card number. For pre-authorized debit, our provider Rotessa handles your bank details; we keep only a reference.

During a delivery: pickup and delivery times, photos taken by the courier at the drop-off (couriers are asked to photograph the item and where it was left, and to avoid people's faces), the recipient's name and signature when one is collected, the place the delivery was confirmed, and delivery ratings and comments.

When you contact us: what you write to us and our replies.

Drivers: information about drivers and applicants is described in section 9.

On our website: technical information such as your IP address, browser type and pages visited, through cookies described in our Cookie Policy. Analytics cookies are used only with your consent.

3. Why we use it

We use personal information to:

• price, book, pick up and deliver Shipments, and confirm delivery;
• send booking confirmations, receipts, tracking updates and proof of delivery;
• process payments, invoices and refunds, and keep financial records;
• manage accounts, credit applications and customer support;
• handle claims and disputes;
• keep our services safe, prevent fraud and meet legal obligations;
• improve our services, using combined and de-identified information where possible;
• send marketing messages, only if you agreed to receive them.

We collect only what we need for these purposes, and we don't sell personal information.

4. Consent

By booking or creating an account, you consent to the uses described in this policy. When you give us someone else's information (for example a recipient's phone number), you confirm that you may share it with us for the delivery. You can withdraw consent to optional uses, such as marketing, at any time. Withdrawing consent to essential uses may mean we can't provide the service.

5. Text messages and emails

We send service messages needed for a delivery: confirmations, tracking updates and proof of delivery. Recipients can stop delivery text messages at any time by replying STOP. We send marketing emails only with consent, and each one includes an unsubscribe link.

6. Who we share information with

We share personal information only as needed to provide our services:

• Drivers see the pickup and drop-off details of jobs they accept.
• The sender and the recipient of a delivery can see its tracking page, including the proof of delivery.
• Service providers that work for us under contracts requiring them to protect the information and use it only for our purposes:
• Stripe (card payments)
• Rotessa (pre-authorized debit)
• Google (maps, address search and driving distances)
• Twilio (text messages)
• SMTP2GO (emails)
• Intuit QuickBooks (accounting)
• Expo (notifications to the driver app)
• Tawk.to (live chat on the website, when you use it)
• Our hosting and backup providers
• Google Analytics (website statistics, only with your consent)
• Authorities, when the law requires it, or to protect the rights, property or safety of people.
• A buyer or successor, if our business is sold or merged, under a confidentiality agreement.

Some of these providers store or process information outside Canada, including in the United States. Information processed in another country may be accessed by that country's authorities under its laws.

7. How long we keep it

We keep personal information only as long as needed for the purposes above or as the law requires:

• Booking, invoice and payment records: 6 years after the end of the tax year they relate to, as Canadian tax law requires.
• Delivery photos: 365 days after delivery, unless needed longer for a claim or dispute.
• Tracking links stop working 30 days after the delivery is finished.
• Driver records: 3 years after the driver stops working with us, as Ontario's Digital Platform Workers' Rights Act, 2022 requires, and longer where tax law requires.
• Driver applications we decline, or that are withdrawn: 1 year.
• Our log of the emails and text messages we sent you: about 13 months.
• Records of failed sign-in attempts (which can include the email address typed): 90 days.
• Contact messages: up to 2 years.

After these periods we delete or anonymize the information, automatically where our systems allow it. Backups are kept for 30 days, so deleted information can remain in a backup until it is replaced.

8. How we protect it

We protect personal information with safeguards suited to its sensitivity, including encrypted connections (HTTPS), encryption of stored service keys and bank details, access limited to staff who need it, two-step login for staff, activity logs, and regular backups. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify you and the Privacy Commissioner of Canada as the law requires.

9. Drivers and applicants

When you apply or work as a driver, we collect your contact details, licence and driving record (driver's abstract), vehicle and insurance details, background check results, bank and tax details for payment (including your HST number, if any), your location while you are online in the driver app, the jobs you were offered, accepted or declined, your work times and pay, proof of delivery, and customer ratings. We use this to review applications, offer jobs, pay you, meet our obligations under the Digital Platform Workers' Rights Act, 2022 and other laws, and keep customers and drivers safe. The driver app only shares your location while you are online.

10. Your rights

You can ask to see the personal information we hold about you, ask how it was used and who it was shared with, and ask us to correct it. You can also ask us to delete information we no longer need. Send your request to the Privacy Officer (section 1). We answer within 30 days. We may need to confirm your identity first, and some information may be held back where the law allows (for example, information about another person).

If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

11. Children

Our services are for adults and businesses. We don't knowingly collect personal information from children under 16.

12. Changes

We may update this policy. We will post the new version here with its effective date and, for significant changes, let account holders know by email.