Privacy Policy

Effective Date: July 31, 2026

Operating Entity: 14172779 Canada Inc. d/b/a “Hi Class Cannabis”

Website: https://thehiclass.ca

1. Introduction & Overview

14172779 Canada Inc., operating as Hi Class Cannabis (“we,” “us,” or “our”), respects your privacy and is committed to protecting the personal information of our customers and website visitors. This Privacy Policy outlines how we collect, use, disclose, and safeguard your personal information when you visit our website, use our online contact form, place orders for click-and-collect or local delivery, or visit our physical retail location.

This policy is designed to comply with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s Anti-Spam Legislation (CASL), and applicable Ontario regulations governing legal cannabis retail established under the Cannabis Licence Act, 2018 and enforced by the Alcohol and Gaming Commission of Ontario (AGCO).

2. Information We Collect

A. Personal & Order Information

When you place an order on our e-commerce platform or submit an inquiry through our contact form, we collect personal information required to process and fulfill your order, including:

• Contact Information: First and last name, email address, and phone number.
• Billing & Delivery Details: Delivery address, city, postal code, and order notes.
• Transaction Identifiers: Order numbers, transaction status, order totals, and currency.

B. Payment & Credit Card Data

To ensure maximum cardholder security and maintain PCI-DSS compliance, we do not store or process raw credit card numbers, CVVs, or expiration dates on our web servers or within our database.

• Payment processing is facilitated using Clover.js (Clover Network, Inc.).
• Credit card details are tokenized directly through secure, client-side encrypted form fields hosted by Clover.
• Our system only receives and stores non-sensitive transaction metadata required for order reconciliation, such as the card brand (e.g., VISA) and the last 4 digits of the card number (e.g., 4444), alongside a secure payment token or transaction identifier.

C. Technical & Usage Data

When you navigate our website, we automatically collect basic browser information, IP addresses, and interaction data via Google Analytics to analyze traffic and improve site functionality. We enforce IP anonymization / masking within Google Analytics so that your full IP address is masked prior to storage, ensuring usage data remains aggregated and non-personally identifiable.

D. In-Store Video Surveillance (CCTV)

In compliance with AGCO Registrar Standards for Cannabis Retail Stores, our physical store location is monitored by 24/7 high-definition security camera surveillance.

• Scope: CCTV captures interior and exterior areas, including entrances/exits, point-of-sale registers, order pickup desks, and product display/storage areas.
• Purpose: Video surveillance is collected strictly for physical safety, crime prevention, loss prevention, and regulatory compliance.
• Retention: Security recordings are retained for a minimum of 30 days in accordance with AGCO mandates and are accessible only to authorized management and law enforcement or regulatory inspectors upon official request.

3. How We Use Your Information

We use your personal data strictly for reasonable commercial and regulatory purposes, including:

• Fulfilling Orders: Processing click-and-collect pickup and local delivery orders.
• Payment Authorization: Transmitting payment tokens to our retail point-of-sale system (Tendy POS) API for authorization and billing clearance.
• Customer Support: Responding to inquiries, feedback, or support requests submitted via our website or email.
• Legal & Regulatory Compliance: Complying with AGCO operational mandates, Canada Revenue Agency (CRA) tax obligations, and provincial cannabis sales reporting requirements.
• Commercial Communications: Sending order status notifications, receipts, or opt-in promotional messages in compliance with CASL.

4. Age Gate, ID Verification & Handover Rules

In accordance with Ontario law, access to cannabis products is strictly restricted to adults aged 19 or older.

• Website Age Gate: Our website uses a self-declaration age gate modal upon entry. Self-declaration does not constitute proof of age for purchasing or receiving products.
• Point-of-Handover Verification: For both In-Store Pickup and Local Delivery, valid government-issued photo ID showing proof of age (19+) must be physically presented at the time of handover. We visually inspect physical ID; we do not digitally scan, capture, or store copies of your physical ID during delivery or pickup verification.
• Delivery Refusal: Deliveries or pickups will be refused (and subject to cancellation) if the recipient cannot present valid 19+ photo ID matching the order name, appears intoxicated, or if the handover cannot be safely completed directly to the verified adult.

5. Middleware Data Flow, Storage & Retention

A. Data Residency & POS Architecture

To bridge our e-commerce platform with our physical store operations:

• Database Infrastructure: Order payloads, non-sensitive metadata, and transaction records are routed via Supabase.
• Data Residency: Our Supabase infrastructure is hosted in the AWS Canada Central (ca-central-1) region in Montreal, Quebec. Your personal data remains hosted entirely within Canadian borders.
• Point-of-Sale Integration: Order details and tokenized payment records are securely transmitted via API from our Supabase middleware to Tendy POS for real-time inventory management and payment settlement.

B. Data Retention & Destruction

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected or to satisfy statutory legal and tax requirements:

• AGCO Retail Records: Transaction and inventory logs are retained for a minimum of 3 years as mandated by AGCO Registrar Standard 8.1.
• Tax & Accounting Records: Transaction financial metadata is retained for up to 7 years to meet statutory CRA requirements.
• Surveillance Footage: CCTV footage is automatically overwritten after 30 days unless required for an active security investigation.
• Disposal: Once data exceeds its mandated retention period, digital records are permanently purged or anonymized, and physical records are securely destroyed.

6. Disclosure to Third Parties

We do not sell, rent, trade, or lease your personal information. We disclose data only to trusted service providers essential for operating our business under strict confidentiality standards:

Provider / Partner	Purpose	Data Handled
Clover Network, Inc.	Payment Tokenization & Processing	Encrypted payment details (processed client-side via Clover.js).
Tendy POS	Retail Point of Sale & Order Fulfillment	Name, phone, address, order items, transaction ID.
Supabase / AWS	Middleware Database & Infrastructure	Order payloads and metadata hosted strictly within Canada (ca-central-1).
Google Analytics	Site Performance & Usage Analytics	Masked/Anonymized IP addresses, browser specs, page interactions.

Note: We may disclose personal information without consent if required by law, subpoena, court order, or to authorized Canadian regulatory bodies (such as the AGCO or CRA).

7. Cookies & Tracking Technologies

We use essential session cookies for core website functionality (e.g., maintaining shopping cart items) and analytical cookies via Google Analytics to understand overall site performance. You can set your browser to refuse all cookies or notify you when a cookie is sent; however, disabling essential cookies may prevent shopping cart or order checkout features from functioning.

8. Anti-Spam Policy (CASL) & Marketing Communications

We adhere strictly to Canada’s Anti-Spam Legislation (CASL):

• We will only send you commercial electronic messages (such as promotional emails, newsletters, or SMS deals) if you have provided explicit opt-in consent.
• Transactional messages (e.g., order confirmation emails or delivery updates) are sent on an operational basis and do not contain marketing content.
• Every marketing email or SMS includes an immediate, single-click “Unsubscribe” link or opt-out mechanism. You may withdraw consent at any time.

9. Safeguards & Security

We implement technical, physical, and administrative measures designed to protect your personal data against loss, theft, unauthorized access, copying, or alteration:

• SSL/TLS encryption for all web traffic (https://).
• Client-side payment tokenization via Clover.js to keep credit card numbers off our systems.
• Database row-level security and restricted access controls for internal middleware records.

10. Access, Correction & Your Rights

Under PIPEDA, you have the right to:

• Request access to the personal information we hold about you.
• Request corrections to inaccurate, incomplete, or out-of-date information.
• Withdraw consent for optional processing (such as marketing lists).

To submit a privacy request or inquire about our data practices, contact our Privacy Officer:

• Legal Business Name: 14172779 Canada Inc.
• Operating Name: Hi Class Cannabis
• Attention: Privacy Officer
• Email: foresthill@thehiclass.ca
• Location: Toronto, Ontario, Canada

11. Policy Updates

We reserve the right to update this Privacy Policy to reflect changes in our technology, applicable legislation, or operational workflows. Updates will be published on this page with a revised “Effective Date.”