CANADIAN GROCERY INSIDERS CANADA TOOLKIT PRIVACY POLICY

Effective Date: November 1, 2025 Last Updated: November 1, 2025

This Privacy Policy is provided in English only. By using our website or purchasing our products, you confirm you understand English or have accessed translation services.

1. INTRODUCTION

Ingredients Communications and Training S.L. (“Company,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website www.ingredients.agency or www.canadiangroceryinsiders.com (the “Sites”) and when you purchase our Canadian Grocery Insiders Canada Toolkit (the “Toolkit”).

As a Spanish company (Sociedad Limitada) based in the European Union, we comply with the General Data Protection Regulation (GDPR) for all customers globally, regardless of location.

Data Controller: Ingredients Communications and Training S.L. Carrer Catalunya 9, Llambilles, 17243 Girona, Spain Tax ID (NIF): B22735799 Email: admin@ingredients.agency Phone: +34 651 571 045

2. INFORMATION WE COLLECT

2.1 Information You Provide to Us

Purchase Information: When you purchase the Toolkit, we collect:

Full name
Email address
Billing address
Company name (if applicable)
Phone number (optional)

Platform Access Information:

When you purchase the Toolkit, you will create an account on Thinkific, our learning management platform, to access your Materials. The following information is collected and processed through the Thinkific platform:

Account username and email address
Course enrollment records
Course progress and completion data
Login dates and times
Device and browser information used to access the platform
IP addresses from which you access your account

This information is necessary to provide you with access to the Materials you have purchased and to maintain the security of your account. You set your own password directly with Thinkific; we do not have access to your password.

Contact Form Information: When you submit our contact form, we collect:

Name
Email address
Message content
Any other information you choose to provide

Payment Information: Payment processing is handled by Stripe, Inc. We do NOT collect, store, or have access to your complete credit card numbers. Stripe processes all payment information securely according to PCI-DSS standards. We receive only:

Transaction confirmation
Last 4 digits of card number (for your reference)
Transaction amount and date

2.2 Information Collected Automatically

Website Usage Information: When you visit our Sites, we automatically collect certain information through Google Analytics, including:

IP address
Browser type and version
Device type and operating system
Pages visited and time spent on pages
Referring website
Date and time of visit
Geographic location (country/region level only)

Cookies: We use cookies and similar tracking technologies. See our Cookie Policy for details.

2.3 Information We Do Not Collect

We do NOT collect:

Complete credit card numbers (Thinkific Payments, our payment processor, processes all payment information securely according to PCI-DSS standards. We receive only transaction confirmations and the last 4 digits of card numbers for your reference. We never have access to your complete credit card details.)
Social security numbers or national ID numbers
Health information
Sensitive personal data (racial/ethnic origin, political opinions, religious beliefs, etc.)
Information from children under 18 years of age

3. HOW WE USE YOUR INFORMATION

We use your personal information for the following purposes under GDPR Article 6:

3.1 Contract Performance (Legal Basis: Article 6(1)(b))

To fulfill our contractual obligations to you:

Process and deliver your Toolkit purchase
Generate and send download links for purchased Materials
Provide customer support
Respond to your inquiries
Manage your account and licensing

3.2 Legal Obligations (Legal Basis: Article 6(1)(c))

To comply with legal requirements:

Maintain transaction records for tax and accounting purposes (Spanish law requires 7-year retention)
Comply with Spanish commercial and tax regulations
Respond to lawful requests from authorities

3.3 Legitimate Interests (Legal Basis: Article 6(1)(f))

For our legitimate business interests:

Prevent fraud and abuse
Protect our intellectual property rights
Improve our Sites and Toolkit
Analyze website traffic and user behavior
Maintain security of our systems
Enforce our Terms of Use

3.4 Consent (Legal Basis: Article 6(1)(a))

With your explicit consent (which you may withdraw at any time):

Send marketing communications (future – not currently active)
Use your feedback or testimonials

4. HOW WE SHARE YOUR INFORMATION

We do not sell, rent, or trade your personal information. We share your information only in the following limited circumstances:

4.1 Service Providers

We share information with trusted third-party service providers who process data on our behalf:

Payment Processing and Learning Management System:

Thinkific Labs Inc. (course delivery platform and payment processor)
Purpose: Process payments through Thinkific Payments, host and deliver course Materials, manage user accounts and course access, track course progress and completion, provide secure platform functionality
Data shared: Name, email, billing address, transaction data, course enrollment information, account access records, course progress data, device information, IP addresses
Location: Canada (company headquarters); United States (data storage on Amazon Web Services and Google Cloud Platform infrastructure)
Payment Processing: Thinkific Payments is our integrated payment processor, built on Stripe’s infrastructure. All credit card transactions are processed securely in compliance with PCI-DSS standards. We do not store or have access to complete credit card numbers.
GDPR Compliance: Thinkific acts as our data processor. Our data processing relationship with Thinkific is governed by a Data Processing Addendum incorporating Standard Contractual Clauses for GDPR-compliant EU-US data transfers. Thinkific DPA: https://www.thinkific.com/dpa/
Thinkific Privacy Policy: https://www.thinkific.com/privacy-policy/

E-Commerce Platform:

WooCommerce (WordPress plugin)
Purpose: Manage initial product selection and checkout process on our website
Data shared: Product selection, initial customer contact information Note: Upon checkout completion, customers are automatically enrolled in Thinkific where all course delivery and ongoing account management occurs. Purchase records are maintained in both WooCommerce (for our records) and Thinkific (for course access management).
Data stored: On our WordPress hosting provider’s servers in Canada

Web Hosting:

Hosting provider based in Ontario, Canada
Purpose: Host our website and store customer data
Data shared: All website and customer information
Security: Standard hosting security measures

Analytics:

Google Analytics (Google LLC)
Purpose: Website traffic analysis and improvement
Data shared: Anonymous usage data, IP addresses (anonymized)
Location: United States (EU-US Data Privacy Framework participant)
Privacy Policy: https://policies.google.com/privacy

All service providers are contractually obligated to protect your data and use it only for the purposes we specify.

4.2 Legal Requirements

We may disclose your information when required by law:

To comply with court orders, subpoenas, or legal process
To respond to lawful requests from government authorities
To protect our rights, property, or safety
To enforce our Terms of Use
To investigate fraud or security issues

4.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. You will be notified of any such change via email or prominent notice on our Sites.

5. INTERNATIONAL DATA TRANSFERS

We are based in Spain (European Economic Area). If you are located outside the EEA, your personal information will be transferred to and processed in Spain.

Some of our service providers are located outside the EEA:

United States: Stripe and Google Analytics are based in the US and participate in the EU-US Data Privacy Framework, which provides adequate data protection as recognized by the European Commission.
Canada: Our web hosting is in Ontario, Canada. While Canada is not covered by an EU adequacy decision, we ensure appropriate safeguards are in place through contractual provisions.
Thinkific: Our course delivery platform and payment processor is operated by Thinkific Labs Inc., a Canadian company that stores all customer and course data on servers located in the United States using Amazon Web Services (AWS) and Google Cloud Platform (GCP) infrastructure. As our data processor, Thinkific processes personal data on our behalf under a Data Processing Addendum that incorporates Standard Contractual Clauses (SCCs) approved by the European Commission. These SCCs ensure appropriate data protection safeguards for transfers of personal data from the European Economic Area to the United States in compliance with GDPR Article 46. Thinkific implements comprehensive security measures including encryption of data in transit and at rest, access controls, regular backups, and incident response procedures. While the United States does not have a general adequacy decision from the European Commission, the Standard Contractual Clauses provide the legally required level of protection for international data transfers under GDPR. Thinkific’s Data Processing Addendum: https://www.thinkific.com/dpa/

Your information is protected by:

Standard Contractual Clauses (where applicable)
EU-US Data Privacy Framework participation (Stripe, Google)
Technical and organizational security measures

6. DATA SECURITY

We implement appropriate technical and organizational measures to protect your personal information:

Technical Measures:

SSL/TLS encryption for data transmission
Secure payment processing through PCI-DSS compliant providers (Stripe)
Regular security assessments
Access controls and authentication
Encrypted data storage

Organizational Measures:

Limited access to personal data (need-to-know basis)
Confidentiality agreements with personnel
Data protection training
Incident response procedures

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. DATA RETENTION

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law.

Retention Periods:

– Purchase and payment records: 7 years from transaction date (Article 30 of the Spanish Commercial Code)

– Thinkific account and course access logs: Duration of active license plus 2 years

– Customer support communications: 3 years after last interaction

– Contact form inquiries: 2 years or until resolved

– Website analytics data: 26 months (Google Analytics default)

– Marketing consent records: Until consent is withdrawn

After the retention period expires, we securely delete or anonymize your personal information.

8. YOUR RIGHTS UNDER GDPR

As a data subject, you have the following rights under GDPR:

8.1 Right of Access (Article 15) You have the right to request confirmation of whether we process your personal data and obtain a copy of your data.

8.2 Right to Rectification (Article 16) You have the right to request correction of inaccurate or incomplete personal data.

8.3 Right to Erasure / “Right to be Forgotten” (Article 17) You have the right to request deletion of your personal data when:

The data is no longer necessary for its original purpose
You withdraw consent and there is no other legal basis for processing
You object to processing and there are no overriding legitimate grounds
The data has been unlawfully processed

Note: We may retain certain information where required by law (e.g., tax records for 7 years).

8.4 Right to Restriction of Processing (Article 18) You have the right to request that we limit processing of your data in certain circumstances.

8.5 Right to Data Portability (Article 20) You have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

8.6 Right to Object (Article 21) You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

8.7 Right to Withdraw Consent Where processing is based on consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

8.8 Right to Lodge a Complaint You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated.

Spanish Supervisory Authority: Agencia Española de Protección de Datos (AEPD) Website: www.aepd.es Email: internacional@aepd.es

9. HOW TO EXERCISE YOUR RIGHTS

To exercise any of your data protection rights, contact us at:

Email: admin@ingredients.agency

Email Subject: Privacy Policy Question or Data Protection Request

Please include in your request:

Your full name and email address used for purchase
Specific right(s) you wish to exercise
Any relevant details or documentation

Response Time: We will respond to your request within 30 days as required by GDPR. If we need additional time, we will notify you and explain the reason for the delay.

Verification: To protect your privacy, we may request additional information to verify your identity before processing your request.

No Fee: We do not charge a fee to exercise your rights unless your request is clearly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or refuse the request.

10. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies on our Sites. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy at www.ingredients.agency/cookie-policy.

Essential Cookies: These cookies are necessary for the Sites to function and cannot be disabled. They include cookies for:

Shopping cart functionality (WooCommerce)
Secure payment processing
Session management

Analytics Cookies: We use Google Analytics cookies to understand how visitors use our Sites. These cookies collect anonymous information about:

Pages visited
Time spent on site
Traffic sources
Geographic location (country/region)

You can opt out of Google Analytics by:

Using browser settings to block cookies
Installing the Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout

11. DO NOT TRACK SIGNALS

Some browsers include a “Do Not Track” (DNT) feature. Our Sites do not currently respond to DNT signals because there is no industry standard for how to interpret these signals.

12. LINKS TO THIRD-PARTY WEBSITES

Our Sites may contain links to third-party websites, including:

Canadian government regulatory sites (CFIA, Health Canada, CBSA, OQLF)
Industry resources
Payment processors

We are not responsible for the privacy practices of these third-party sites. We encourage you to review their privacy policies before providing any personal information.

13. CHILDREN’S PRIVACY

Our Sites and Toolkit are intended for business use only. We do not knowingly collect personal information from individuals under 18 years of age.

If we become aware that we have collected personal information from someone under 18, we will delete that information promptly.

If you believe we have collected information from a child under 18, please contact us immediately at admin@ingredients.agency.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

Changes in our data practices
New legal requirements
Technological developments
Business changes

Notice of Changes: We will notify you of material changes by:

Posting the updated Privacy Policy on our Sites with a new “Last Updated” date
Sending an email to your registered email address (for significant changes)

Your Continued Use: Your continued use of our Sites or Toolkit after changes are posted constitutes acceptance of the updated Privacy Policy.

Review Recommendation: We recommend reviewing this Privacy Policy periodically at www.ingredients.agency/privacy-policy.

15. CONTACT INFORMATION

If you have questions about this Privacy Policy or our data practices, please contact us:

Data Controller: Ingredients Communications and Training S.L. Carrer Catalunya 9 Llambilles, 17243 Girona, Spain

Email: admin@ingredients.agency

Phone: +34 657 322 233

Website: www.ingredients.agency

For Data Protection Inquiries: Email subject line: “Privacy Policy Question” or “Data Protection Request”

We will respond to all inquiries within 30 days.

16. LEGAL BASIS SUMMARY

This section summarizes the legal bases under GDPR Article 6 for our data processing activities:

Processing purchases and delivering Toolkit – Contract Performance – Article 6(1)(b) Customer support – Contract Performance – Article 6(1)(b) Tax and accounting records – Legal Obligation – Article 6(1)(c) Fraud prevention – Legitimate Interests – Article 6(1)(f) Website analytics – Legitimate Interests – Article 6(1)(f) Security and IP protection – Legitimate Interests – Article 6(1)(f) Marketing communications (future) – Consent – Article 6(1)(a)

Course delivery through Thinkific – Contract Performance – Article 6(1)(b)

Course progress tracking – Legitimate Interests – Article 6(1)(f)

Platform access management – Contract Performance – Article 6(1)(b)