Privacy Policy: CAN (operated by Can Integrated Logistics Inc.)

Effective date: —
Organization: Can Integrated Logistics Inc. ("CIL", "we"), BC incorporation no. BC1286281, 1208–1124 Lonsdale Ave, North Vancouver, BC V7M 2H1.
Privacy Officer: Soud Taj, Privacy Officer, Phone: (236) 259-4600 · Email: privacy@canintegrated.ca

1. Scope

This policy explains how CIL collects, uses and discloses personal information through the CAN website and the CAN app (together, the "Platform"), and our dealings with personal and business customers and member carriers. It is governed by British Columbia's Personal Information Protection Act (PIPA). CIL serves both individuals booking for themselves and business customers. Everyone we deal with (personal customers, customer contacts, receivers, carrier owners, dispatchers and drivers) has privacy rights in their personal information.

2. What we collect

We collect only what we need for the purposes in section 3. - Customers (personal and business): name, business name (if any), email, phone, pickup and delivery addresses, site access notes, and job details (equipment make/model, weight, dimensions, value, timing). - Carrier members: business contact details; NSC number and safety certificate; operating authority; insurance certificates; WorkSafeBC account/clearance status; equipment details; payout details (collected by Stripe; see section 6). - Drivers (minimal): name, licence class, and, only where needed for vetting, licence number and abstract. We do not collect more driver information than vetting and the job require. - Job records: quotes, bookings, messages, proof-of-delivery (POD) photos, ratings and claims records. - Platform data: account sign-up details, forms and in-app messages, and basic server logs (IP address, browser, pages, time). See section 9 on cookies.

• Driver location (carrier drivers): when a driver is online or on a job, the app collects the device's location to dispatch jobs, show customers their ETA, calculate engaged time, distance and waiting time for pay, and for safety and disputes. It is not collected when the driver is offline. See section 4A.
• Customers' view of location: customers see the driver's live position only while the driver is heading to that customer's own stop or carrying that customer's goods; during other customers' stops customers see only an ETA or "On a stop before yours". A customer never sees another customer's address or location. For moves to or from a home, the address and access notes are shared only with the Carrier on that job.

• Chat messages and translation: in-app chat messages are automatically translated so each party can read them in their language. Translations are machine-generated and may contain errors; the original message is also kept.

• Company accounts: account users and roles, job sites, PO numbers, approvals and monthly statements.

• Not offered at launch: invoice/net terms, credit applications and credit checks. We don't collect credit information.

• Complaints and payments: complaint details and evidence (photos, messages, job status log), refund decisions and card-hold records. Payment card data is held by Stripe; CIL sees only limited details (e.g., last 4 digits).

• Job status evidence: status taps ("En route", "Arrived") with timestamps and site photos uploaded by carriers. These are not location tracking.

• Saved cards: your card is saved by Stripe at booking and, once a Carrier accepts, shared with that Carrier's Stripe account. Under your booking consent it is used for a hold (placed when the Carrier accepts or about 2 days before pickup, and re-placed if it is about to expire), a charge at signed POD, and any disclosed waiting-time charge after POD. CIL stores only a reference and the last 4 digits.

3. Why we collect it (purposes)

1. To operate the platform: match customer jobs with member carriers, show quotes and bookings, and share booking details between the customer and the selected carrier.
2. To vet and monitor member carriers (safety, insurance, WorkSafeBC standing).
3. To process payments through Stripe and to issue CIL's fee and membership invoices.
4. To support claims and disputes between customers and carriers (records only; see the Terms).
5. To respond to enquiries, provide support, and keep the platform secure and prevent fraud.
6. To meet legal, tax and accounting obligations.
7. To send marketing emails, only with consent (section 10).

4. Consent

We collect, use and disclose personal information with your consent, which may be express (e.g., you submit a form or sign up) or implied where the purpose is obvious and you provide the information voluntarily, as PIPA permits. You may withdraw consent on reasonable notice, subject to legal or contractual limits. Withdrawing may mean we cannot provide the service. We also collect, use or disclose without consent where PIPA authorizes or requires it.

If you give us information about another person (e.g., a carrier giving driver details, or a customer giving a site contact), you confirm you have their consent.

4A. Driver location consent

If you drive for a carrier on the Platform, the app collects your device's location only while you are online (available for jobs) or on a job (from accepting it until it is completed or cancelled), never when you are offline. We use it to offer and dispatch jobs, show customers your ETA and (only while you are heading to their stop or carrying their goods) your position, record engaged time, distance and waiting time for pay, and for safety and disputes. It is seen by CIL staff who need it, the customer on that job, and our maps provider. Detailed trails are kept for —, then reduced to a per-job summary kept as long as the law requires for pay and tax records. You can turn location off at any time; while it is off you can't go online or take jobs, which doesn't affect pay already earned.

5. Use and disclosure

We use personal information only for the purposes above. We disclose it: - Between customers and carriers for a booking (e.g., the customer's site contact goes to the carrier; the carrier's legal name, NSC number, and driver first name/vehicle go to the customer). - To service providers acting for us (section 6). - To insurers, adjusters or counsel in connection with a claim, with your consent or as PIPA permits. - Where required or authorized by law (e.g., a court order or law-enforcement request that PIPA permits). - In a business transaction (e.g., sale of CIL), under PIPA's business-transaction rules. We do not sell personal information.

6. Service providers and payment data

• Stripe (payments, including in the US): payments are processed by Stripe. Customers pay the carrier directly on the carrier's own Stripe account; CIL receives only its platform fee and does not hold carrier funds. Your card details are shared with the carrier's Stripe account for your booking. Stripe collects card and payout/bank details directly. CIL does not store full card numbers. Stripe processes payment data as an independent controller under its own privacy policy (https://stripe.com/privacy) and, for some functions, as a processor/service provider on our or the carrier's behalf. Stripe may store and process data outside Canada, including in the United States.
• Hosting (Canada): our database, file storage (documents, POD photos and signatures) and in-app messages are stored in Canada (Supabase, Montréal region), and our web application runs in Vercel's Montréal region. Our providers' account, log or content-delivery metadata may be processed outside Canada.
• Email (US): transactional email is sent through Resend, which processes email content and stores logs and metadata in the United States. We keep emails short and don't attach documents.
• SMS and masked calls (US): text alerts and masked phone calls are handled by Twilio, which processes phone numbers, messages and call logs in the United States.
• Push notifications (US): mobile push notifications go through Expo (US) to Apple or Google. They contain no personal information (e.g., "New job request: open the app").
• Carrier background and ID checks: Certn processes carrier applicants' criminal record and ID checks; for Canadian cases, Certn states data is stored in Canada and biometrics are deleted within 30 days.
• Maps and ETAs (US): driver and stop coordinates are sent to our mapping provider, which processes them in the United States, to calculate routes and ETAs.
• Analytics: we use no analytics tools at launch. If we add any, we will update this policy first and, where required, ask for consent.
• Service providers may only use personal information to provide services to us, under contracts requiring appropriate protection.
• Outside Canada: some of our service providers (Resend, Twilio, Stripe, Expo, our translation provider and our maps provider) store or process personal information in the United States. While there, it may be subject to US law, including lawful access by US authorities. We use these providers under contracts requiring them to protect the information and use it only to provide services to us. Contact our Privacy Officer for more information.

7. Retention

We keep personal information only as long as the law requires or as needed to deal with claims, then securely destroy or anonymize it. If information is needed for an open claim, complaint, audit or legal requirement, we keep it until that is resolved. - Payment, tax and GST records (bookings, receipts, invoices, payouts, refunds): 6 years after the end of the tax year they relate to. - Driver pay records and tax information (pay statements, engaged time, SIN for tax slips): 6 years after the end of the last tax year they relate to. - Job records (bill of lading, proof of delivery, status log): 6 years after the end of the tax year of the job. Job photos and in-app messages: 2 years after the job. - Complaints and claims: 2 years after they are resolved. - Accounts and contracts: while your account is open, then 2 years after your last job. - Carrier and driver documents (licence, insurance, abstract): while active, then 2 years after leaving. If an application is declined or an account is suspended: 1 year after that decision. - Live location during a job: detailed location trails are deleted 90 days after the job, except that a trail used to calculate pay, decide a dispute or claim, or suspend an account is kept for at least one year after that use (PIPA s.35(1)). - Account deletion: after an account deletion request, we delete account data within 90 days unless the law, an open dispute or safety reasons require us to keep it. - Marketing consent and unsubscribe records: while we rely on the consent, then 3 years after our last message. - Coming-soon waitlist: until we email you about launch in your province, or 1 year after you joined, whichever comes first. - Card details: we don't store card numbers. Stripe, our payment processor, holds them. If we use personal information to make a decision that directly affects you, we keep it for at least one year after that decision, as PIPA requires.

8. Safeguards

We use reasonable security arrangements: access limited to staff who need it, encryption in transit and at rest where available, strong authentication, and secure deletion. Driver licence information gets extra protection: collected only when needed, access restricted, and never sent by ordinary email.

9. Cookies

The Platform uses only cookies and similar storage needed for it to work (e.g., keeping you signed in and security). We do not use analytics or advertising cookies. If we add them, we will update this policy and, where required, ask for consent.

10. Marketing emails (CASL)

We send commercial electronic messages only with consent (express, or implied where Canada's Anti-Spam Legislation allows, e.g., an existing business relationship or a conspicuously published business email address relevant to our offer). Every message identifies CIL, includes our contact details and has a working unsubscribe link. We process unsubscribes within 10 business days.

11. Access and correction

You may ask for access to your personal information, how it has been used, and to whom it has been disclosed, and you may ask us to correct errors. Write to the Privacy Officer. We respond within 30 business days, as PIPA requires, unless an extension is permitted. A minimal fee may apply to access requests . If you're not satisfied, you may contact the Office of the Information and Privacy Commissioner for BC (https://www.oipc.bc.ca/).

12. Privacy breaches

If a privacy breach occurs, we will contain it, assess the risk, and, where there is a real risk of significant harm, notify affected individuals and the Office of the Information and Privacy Commissioner for BC without unreasonable delay. We make this commitment voluntarily: BC PIPA does not currently require breach notification for private organizations.

13. Changes

We may update this policy and will post the new version with a new effective date.

14. Contact

Soud Taj, Privacy Officer, Can Integrated Logistics Inc., 1208–1124 Lonsdale Ave, North Vancouver, BC V7M 2H1 · Phone: (236) 259-4600 · Email: privacy@canintegrated.ca · General enquiries: support@canintegrated.ca