Legal

Data Protection Policy

Effective date: June 24, 2026

This policy describes the principles and practices Petriko Inc. ("Petriko," "we," "us") follows to protect the personal and business information entrusted to us. It complements our Privacy Policy and reflects the fair information principles set out in Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Our commitment

As an authorized reseller, brands share commercial and contact information with us in confidence. We treat that information as a responsibility, not just a record. We are accountable for the personal information in our custody and apply the principles below across our operations.

2. The principles we follow

• Accountability — a designated contact at Petriko is responsible for our handling of personal information and for responding to questions and requests.
• Limiting collection — we collect only the information we genuinely need for a clear, identified purpose, and by fair and lawful means.
• Limiting use and disclosure — we use information only for the purpose it was collected, and retain it only as long as that purpose requires.
• Accuracy — we keep information as accurate, complete, and up to date as is necessary, and correct it promptly when notified.
• Safeguards — we protect information with measures appropriate to its sensitivity.
• Openness — our policies are published and available to anyone who asks.
• Individual access — individuals can ask what information we hold and request corrections.

3. How we safeguard information

• access to personal and brand information is limited to those who need it to do their work;
• accounts and systems are protected with strong, unique credentials and, where available, multi-factor authentication;
• we rely on reputable service providers (for hosting, forms, and email) and review their security practices before sharing data with them;
• information no longer needed is securely deleted or anonymized.

4. Working with service providers

When we use third parties to process information on our behalf — such as our website platform and transactional email provider — we share only what is necessary and expect them to protect it to a standard consistent with this policy. Some providers operate outside Canada; where that is the case, information may be subject to the laws of those jurisdictions.

5. Retention and disposal

We keep information only for as long as needed to fulfil the purpose for which it was collected, to maintain an active relationship, or to meet legal and accounting obligations. When information is no longer required, it is securely destroyed or anonymized.

6. If something goes wrong

If a security incident affects personal information in our care, we will act promptly to contain it, assess the risk, and — where the incident creates a real risk of significant harm — notify affected individuals and the appropriate authorities as required by law.

7. Brand confidentiality

Commercial information that brands share with us during a partnership discussion — pricing, plans, and product details — is treated as confidential and used only to evaluate and operate the partnership. We do not disclose it to competitors or unrelated third parties.

8. Questions, access, and complaints

To ask about our data practices, request access to or correction of your information, or raise a concern, contact us using the details below. You may also contact the Office of the Privacy Commissioner of Canada.

See also our Privacy Policy.