Ontario Veggies is a small farm operating a greenhouse in Niagara-on-the-Lake and an open field in Hamilton, Ontario. We are committed to protecting the personal information of our customers, suppliers, and website visitors in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and the applicable laws of the Province of Ontario.
This policy explains what personal information we collect, why we collect it, how it is used and protected, and your rights regarding that information.
1. Who We Are
Trade name: Ontario Veggies
Legal entity: Ontario Veggies Inc.
Mailing address: 6 Footbridge Cres, Brampton, ON L6R 0K5
General enquiries: office@ontarioveggies.com
Privacy enquiries: privacy@ontarioveggies.com
Website: https://ontarioveggies.com
2. What Personal Information We Collect
We collect only the personal information reasonably necessary to carry out our farm business and serve our customers. This includes:
Contact-form and email submissions
- Name, email address, and any details you voluntarily include when contacting us through our website contact form or by emailing us directly.
WhatsApp Business and Facebook/Instagram Messenger
- Your messaging-platform username or phone number, and the content of messages exchanged with us through WhatsApp Business, Facebook Messenger, or Instagram Direct. These channels are operated by Meta Platforms, Inc. under their own terms; please review Meta’s Privacy Policy as well.
Orders and pre-orders
- Name, delivery or pick-up address, phone number, email address, and order details (items, quantities, amounts) when you place a farm-gate, wholesale, market, or online pre-order.
- Payment information is handled directly by our third-party payment processor Stripe / Square; we do not store full card numbers or payment credentials on our systems.
Analytics
- We use Matomo Analytics, self-hosted on our own servers and configured in cookieless mode. Matomo records anonymised aggregate data such as pages visited, approximate geographic region (country/province level), browser type, and referral source. Because it is cookieless, no persistent identifier is written to your device unless you accept analytics cookies through a consent banner (if one is presented). We do not use Google Analytics or any third-party advertising tracker on this site.
Automatically collected technical data
- Standard server-log data (IP address, browser user-agent, date/time of requests) retained for security and operational purposes.
3. Purposes of Collection
We collect and use personal information for the following purposes:
| Purpose | Examples |
|---|---|
| Processing orders and pre-orders | Confirming your order, arranging pick-up or delivery, issuing receipts |
| Customer communication | Responding to enquiries via email, WhatsApp, or Messenger |
| Commercial electronic messages | Sending order confirmations, newsletters, or seasonal updates (with consent; see our CASL Anti-Spam Policy) |
| Payment processing | Transmitting transaction details to our payment processor |
| Website improvement | Reviewing anonymised analytics to understand how visitors use our site |
| Legal and regulatory compliance | Retaining transaction records as required by tax and business law |
| Security and fraud prevention | Reviewing server logs for unauthorised access or abuse |
We will not use your personal information for purposes that are incompatible with those listed above without obtaining your further consent.
4. Legal Basis / Consent
Under PIPEDA, our primary legal bases for processing personal information are:
- Your knowledge and consent — for collecting contact details through our website form, adding you to our mailing list, or sending commercial electronic messages. You may withdraw consent at any time (see Section 9).
- Contractual necessity — for processing your order and arranging payment or delivery.
- Legitimate business interests — for maintaining server logs and anonymised analytics necessary for site security and operation, balanced against your privacy interests.
Where consent is the basis for processing, we will not make your provision of goods or services conditional on consent beyond what is reasonably necessary.
5. Who We Share Your Information With
We do not sell personal information. We share it only with the following service providers (data processors) acting on our instructions:
| Processor | Role | Location |
|---|---|---|
| Migadu | Email delivery infrastructure for our business email and mailing list | France (European Union) |
| Matomo (self-hosted) | Analytics — hosted on our own server; data stays within our infrastructure | Hamilton, Ontario / Canada |
| Meta Platforms, Inc. (WhatsApp Business, Facebook/Instagram Messenger) | Messaging platform for customer communications | United States (and Meta’s global infrastructure) |
| Square | Payment card processing | the United States |
We may also disclose personal information where required by law, court order, or a lawful request by a government authority, or to protect the rights, property, or safety of Ontario Veggies, our customers, or others.
6. Cross-Border Processing
Some of our service providers (notably Meta Platforms and Square) operate outside Canada. When your personal information is transferred to or processed in another country, it may be subject to the laws of that jurisdiction, including lawful access requests by foreign governments. We take reasonable contractual steps to require our processors to protect your information consistent with Canadian standards. By using our messaging services or website, you acknowledge that your information may be processed outside Canada.
7. Retention
We retain personal information only as long as necessary for the purposes described above or as required by law:
- Order and transaction records — 2 years years, as required by the Income Tax Act (Canada) and provincial tax requirements.
- Mailing-list subscriptions — until you unsubscribe or withdraw consent.
- Contact-form and email correspondence — two years from the date of last contact, unless a longer retention period is required.
- Server logs — 90 days.
- Analytics data — retained in anonymised aggregate form; no personal identifiers.
When personal information is no longer required, it is securely deleted or anonymised.
8. Safeguards
We use security measures appropriate to the sensitivity of the personal information we hold, including:
- Access controls and strong authentication for our email and business systems.
- Secure (TLS/HTTPS) transmission of data between your browser and our website.
- Reliance on reputable service providers with their own security programmes.
- Limiting access to personal information to staff and processors who need it to perform their functions.
No security measure is perfect. In the event of a material privacy breach that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada (OPC) as required under PIPEDA.
9. Your Rights
Under PIPEDA, you have the right to:
- Access — request access to the personal information we hold about you.
- Correct — ask us to correct inaccurate or incomplete personal information.
- Withdraw consent — withdraw consent to the use of your personal information for purposes beyond legal/contractual obligations. Note that withdrawing consent may mean we can no longer provide certain services to you.
- Complain — file a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated: https://www.priv.gc.ca or 1-800-282-1376.
To exercise any of these rights, contact us at privacy@ontarioveggies.com with sufficient detail to identify yourself and the information concerned. We will respond within 30 days, or notify you if more time is required.
10. Children
Our website and services are not directed at individuals under the age of 16, and we do not knowingly collect personal information from children without verified parental consent. If you believe a child has provided us with personal information, please contact us so we can delete it.
11. Note for Quebec Residents (Law 25)
Residents of Quebec have additional rights under An Act to modernize legislative provisions as regards the protection of personal information (Law 25 / Loi 25), including the right to be informed of and to refuse automated decision-making that produces legal or significant effects, and the right to data portability (to the extent applicable). Please contact us at privacy@ontarioveggies.com to exercise these rights.
12. Note for EU / EEA Visitors (GDPR)
If you are located in the European Union or European Economic Area, your personal data may be subject to the General Data Protection Regulation (GDPR). Our primary legal bases for processing are consent and performance of a contract. You have rights to erasure, restriction, portability, and objection. For GDPR enquiries, contact privacy@ontarioveggies.com. Note that our primary operations are in Canada and this site is not specifically directed at EU residents.
13. Cookies and Tracking
See our separate Cookie Policy for details on how we use cookies and tracking technologies on this site.
14. Changes to This Policy
We may update this policy from time to time to reflect changes in our practices or applicable law. We will post the revised policy on this page with an updated “Last updated” date. For material changes, we will notify registered customers or mailing-list subscribers by email where reasonably practical.
15. Contact Us
Questions or concerns about this privacy policy or our practices may be directed to:
Ontario Veggies — Privacy
6 Footbridge Cres, Brampton, ON L6R 0K5
Email: privacy@ontarioveggies.com
This policy is governed by the laws of the Province of Ontario and the applicable federal laws of Canada.