Privacy Statement
OUR COMMITMENT TO PROTECTING YOUR PERSONAL INFORMATION AND PRIVACY
Since our inception, OCS has been committed to protecting customers’ privacy and ensuring the confidentiality of the personal information (PI) we collect. This commitment is part of our mandate, allowing us to provide transparency and accountability as a Crown Agency in Ontario while maintaining the trust of our customers.
We take pride in protecting the privacy and security of your PI and continuously improve our Privacy Program to serve you better. We strive to clearly communicate to you when and why we collect your information and ensure that access to your PI is limited and secure. By using the OCS.ca website and engaging with our services and offerings, you accept this Privacy Statement and the Terms and Conditions.
WHAT IS PI?
PI is recorded information about an identifiable individual in a personal capacity. It reveals something of a personal nature about you, and it could reasonably identify you if disclosed.
Examples of information that could be PI include, but is not limited to, your name, address, gender, date of birth, email address, telephone number, credit card information, purchases and personal opinions. It may also, in certain circumstances, include information about your device, such as Internet Protocol (IP) addresses and browser information, or your browsing data.
WHAT PI DO WE COLLECT?
OCS may collect the following PI when you make an online purchase or engage with us:
- Your name, phone number and e-mail address;
- Your home and delivery address;
- Your order information;
- Your signature at the time of delivery;
- Your ID type at the time of delivery;
- Your marketing preferences if you choose to opt in; and
- Your complaints or inquiries when you contact us.
HOW DO WE PROTECT YOUR PI?
We take the protection of your PI seriously and employ organizational, contractual, technical, security and privacy measures to protect your information. The OCS Privacy Office embeds privacy design in the systems that hold your PI and conducts Privacy Impact Assessments (PIAs), that identify risks and provide recommendations on mitigating controls. Privacy assessments allow us to look at system integrity and are required for all systems and initiatives that involve the collection, access, use, disclosure, storage or deletion of PI. We also require that our contracted partners uphold the same strong standards throughout our relationship.
By proactively identifying privacy risks we prevent unauthorized collection and disclosure of your PI as we work to continuously improve your access to products and services.
Should an unauthorized access occur, we have a robust breach protocol in place that triggers immediate action ensuring containment, investigation, notification and remediation activities are executed with outmost care.
CONTACT US
If you have any questions or concerns about the privacy of your PI, or if you wish to make a request for general records or your own personal information, or to make a correction to your own personal information, held by us, please contact the customer service line at 1-888-910-0627.
PRIVACY FAQS
What is OCS’s statutory authority for collecting PI?
The Ontario government has established OCS as the province’s exclusive legal online retailer for the sale of recreational cannabis under the Ontario Cannabis Retail Corporation Act, 2017, S.O. 2017. All purchases from OCS.ca are governed by this Act. As a Crown Agency in Ontario, OCS is subject to the Freedom of Information and Protection of Privacy Act.
When does OCS collect, use and share PI?
OCS, including its service providers (third parties that we have engaged to help us conduct our business, including Shopify Inc.), may collect PI from customers electronically when they interact with OCS.ca, over the telephone, email, and text messaging for the purposes of service delivery.
OCS, and its service providers on behalf of OCS, use PI about you, including your use of OCS.ca, for various purposes, including to:
- process, assist with, verify, and deliver your orders;
- better understand your product preferences, if signed into your account;
- improve your customer experience including by sending and displaying content, products, search results, and offers based on your browsing and purchase history as well as your profile if you are signed in;
- track and analyze trends and patterns;
- comply with legal and regulatory requirements;
- send you email communications and updates regarding your orders or your account;
- send communications, including promotional campaigns informing you about products and/or services if you have consented to receiving marketing emails from OCS;
- tailor our online content to you based on your interactions with OCS.ca and your preferences if signed into your account;
- to promote social responsibility and support research; and
- protect our customers and OCS from fraud.
We will never sell your PI.
What PI is needed for product purchase and delivery on OCS.ca?
Transactions on OCS.ca are processed by Shopify Inc. and fulfilled by OCS and our delivery partners. When you place an order, Shopify will collect your PI to facilitate the transaction. Information such as your name, address and email address are stored by Shopify outside of Canada. Shopify does not store your payment information.
If you choose to create a user account, Shopify may store additional information, such as your transaction history. More information on Shopify’s privacy and security policies can be found on Shopify’s website (Shopify Privacy Policy - Shopify Canada, Shopify Consumer Terms of Service), which is updated from time to time.
After your PI is collected by Shopify it is transferred to OCSs system for processing and is then shared with our supply chain partners in order to facilitate the delivery to you. Any information collected in the course of delivery is also collected by our partners on our behalf and is securely stored in their systems in accordance with their contractual obligations.
How long do you keep my PI?
Your PI is kept for only as long as necessary to fulfill the purposes for which it was collected and for any legal requirements, after which it is destroyed in a timely and secure manner.
Some additional PI may be collected while delivering your order and is kept for 30 days.
If you have chosen to create an OCS.ca account, your information will be kept for as long as the account remains active, and in accordance with our legal obligations.
Can I deactivate my OCS.ca Account?
If you wish to deactivate your OCS.ca Account, please contact the customer service line at 1-888-910-0627 for assistance. Once deactivated, OCS retains your PI as long as required by law.
Does OCS use Third-Party Service Providers?
PI will be provided to our third-party service providers to fulfill services you have requested, such as payment facilitation and delivery of ordered products. Our service providers may not otherwise use your PI and are required to comply with strict privacy standards.
Our websites may contain links to other sites that we do not own or operate. We provide links to third party websites as a convenience to you. We are not responsible for the content, privacy practices or security of these third-party sites. We encourage you to examine each site’s privacy policy and disclaimers to understand how they use your PI and to make your own decisions regarding the accuracy, reliability and completeness of material and information found there.
Does OCS use my PI for Market Research and Analysis?
OCS uses web analytics services, including Google Analytics, to help us understand how people use the site. OCS does not disclose any PI for research purposes.
Cookies allow web analytics services to recognize your browser or device and, for example, identify whether you have visited our websites before, what you have previously viewed or clicked on, and how you found us. The information is anonymous and only used for statistical purposes. It helps us to analyze patterns of user activity and to develop a better user experience. The web analytics service does not allow us or our analytics service providers to identify individuals.
You can find more information about how Google Analytics collects and processes data at the following link: https://policies.google.com/technologies/partner-sites
You can opt out of analytics activity by setting your browser to refuse to accept cookies from our websites. Google also offers a free Google Analytics opt-out tool for certain browsers. However, the browser deactivation add-on offered by Google Analytics does not prevent information from being transmitted to us. You can find additional information on how to install the browser add-on at the following link: https://tools.google.com/dlpage/gaoptout?hl=en
