Norpex Marketplace — marketplace.norpex.ca A separate service operated by Norpex (Canada). This Privacy Policy governs the Norpex Marketplace only and is distinct from the privacy policy that applies to first-party equipment sales on norpex.ca.

Norpex Marketplace Privacy Policy

Last updated: June 14, 2026

---

1. Introduction and scope

1.1. Norpex ("Norpex", "we", "us", "our") operates the Norpex Marketplace at marketplace.norpex.ca (the "Marketplace"), an online venue that connects independent third-party sellers of used commercial, restaurant, and industrial equipment with buyers. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use the Marketplace as a buyer, a seller, or a visitor.

1.2. The Marketplace is a venue. Norpex is not the buyer or seller of equipment listed on the Marketplace and does not own, inspect, or take possession of marketplace goods. We facilitate transactions, including escrow-style payment holding through Stripe and freight booking through ClickShip. This Privacy Policy addresses the personal information Norpex handles in operating the Marketplace. Each independent seller is responsible for its own handling of any personal information it collects directly from a buyer.

1.3. This Privacy Policy is governed by Canadian privacy law, including the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act respecting the protection of personal information in the private sector (Law 25). Where there is a conflict, the law that grants the individual greater protection applies to that individual.

1.4. By creating a Marketplace account or otherwise using the Marketplace, you acknowledge that you have read this Privacy Policy. Where the law requires consent, we obtain it as described in Section 5.

1.5. This Privacy Policy is available in English and French. In the event of any inconsistency, the French version prevails for users in Quebec.

---

2. Definitions

2.1. "Personal information" means information about an identifiable individual, as defined under PIPEDA and Law 25. It does not include the business contact information of an individual that is collected, used, or disclosed solely to communicate with that individual in relation to their employment or profession, except where Quebec law provides otherwise.

2.2. "Sensitive information" includes financial account and payout details, government-issued identifiers, and any other information that, by reason of its nature or context, gives rise to a high reasonable expectation of privacy.

2.3. "Service providers" and "third parties" are described in Section 7.

---

3. The personal information we collect

We collect only the personal information we reasonably need for the purposes described in Section 4. The categories below depend on how you use the Marketplace.

3.1. Information all users provide

• Account credentials: name, email address, password (stored in hashed form), and account type (buyer, seller, or both).
• Contact details: phone number and mailing/business address.
• Communications: messages you send through the Marketplace, dispute submissions, support requests, and related attachments (for example, photos submitted as evidence during the inspection window).

3.2. Buyer information

• Billing name and contact information.
• Shipping/delivery address for freight.
• Payment information processed for escrow. Card and bank details are collected and stored by Stripe, our payment processor; Norpex itself does not store full card numbers (see Sections 7 and 9).
• Order, transaction, dispute, and inspection-window history.
• If financing is requested, information needed to refer you to Econolease; financing decisions and the personal information you provide to Econolease are governed by Econolease's own privacy practices.

3.3. Seller information

• Business/legal name, the name of an authorized representative, contact details, and business address.
• Payout details, including bank account information and the details required to set up and operate a Stripe Connect payout account. This is sensitive information.
• Identity and tax-reporting information that Norpex is legally required to collect and verify as a reporting digital platform operator — for example, name, address, date of birth (for individuals), and your Tax Identification Number / business number (see Sections 4 and 5.4). Government-issued identifiers are sensitive information.
• Listing content you create (which may incidentally contain personal information you choose to include).
• Transaction, payout, dispute, and performance history.

3.4. Information we collect automatically

• Device and connection data: IP address, browser type, operating system, and device identifiers.
• Usage data: pages viewed, listings viewed, searches, clicks, and timestamps.
• Cookies and similar technologies (see Section 11).

3.5. Information from the Norpex AI assistant

If you use the AI assistant feature, the questions, prompts, and conversation content you submit are processed to generate responses. These interactions are transmitted to our AI provider, OpenRouter (and the underlying model providers it routes to), as described in Sections 7 and 8. Do not enter sensitive personal information, banking details, or government identifiers into the AI assistant.

---

4. Why we collect and use personal information (purposes)

We identify the purposes for which we collect personal information at or before the time of collection. We use personal information to:

4.1. Operate the Marketplace — create and manage accounts, authenticate users, display and manage listings, and connect buyers and sellers.

4.2. Process transactions and payments — facilitate escrow-style payment holding through Stripe, hold buyer funds pending delivery and the 3-day inspection window, and release funds to (or refund from) the appropriate party. Norpex acts as the seller's payment agent; Stripe holds and moves the funds.

4.3. Arrange freight — share the delivery and pickup information needed for ClickShip to quote and book LTL freight.

4.4. Administer disputes and the inspection window — receive, mediate, and resolve disputes filed during the inspection window, including evaluating evidence and deciding on full/partial refunds or release to the seller.

4.5. Process seller payouts — set up and operate Stripe Connect payout accounts and pay sellers their net proceeds after commission and card fees.

4.6. Meet legal and regulatory obligations, including:

• CRA digital-platform-operator reporting — collecting and verifying seller identity, address, TIN/business number, and financial-account information, and filing the required annual information return to the Canada Revenue Agency.
• Tax collection and remittance as a marketplace facilitator (GST/HST, QST, and applicable PST), where required.
• Anti-fraud, anti-money-laundering, and record-keeping obligations associated with payment facilitation.

4.7. Provide customer support and respond to your inquiries, including operating the AI assistant.

4.8. Maintain security and integrity — detect, prevent, and investigate fraud, abuse, prohibited listings, chargeback circumvention, and violations of our Terms.

4.9. Improve the Marketplace — analyze usage to improve features, performance, and user experience.

4.10. Communicate with you, including transactional messages (which are necessary to provide the service) and, with consent where required, marketing messages compliant with Canada's Anti-Spam Legislation (CASL). You can unsubscribe from marketing messages at any time.

We do not use personal information for new purposes that are incompatible with those above without obtaining further consent or as permitted by law.

---

5. Legal basis and consent

5.1. Consent. We collect, use, and disclose personal information with your knowledge and consent, except where the law permits or requires otherwise. By providing information and using the Marketplace, you consent to the handling described in this Policy for the purposes in Section 4.

5.2. Express consent for sensitive information. We obtain express consent for the collection and use of sensitive information, including seller banking/payout details and government-issued identifiers collected for tax reporting.

5.3. Implied consent. For non-sensitive information necessary to provide a service you have requested (for example, sharing your shipping address with ClickShip to book the freight you ordered), consent may be implied from the context.

5.4. Legal requirement. Some collection is required by law and is a condition of using the Marketplace — in particular, the seller identity, address, TIN/business number, and financial-account information we must collect and verify to comply with CRA digital-platform-operator reporting and tax obligations. If you do not provide this information, you may not be able to sell on, or receive payouts through, the Marketplace.

5.5. Withdrawing consent. You may withdraw your consent at any time, subject to legal and contractual restrictions and reasonable notice (see Section 12). Withdrawing consent for processing that is essential to providing the Marketplace may mean we can no longer provide some or all of the service to you. Withdrawal does not affect processing that already occurred, nor information we are legally required to retain.

---

6. The Norpex group: relationship with norpex.ca

6.1. The Marketplace is operated by Norpex and is separate from the first-party equipment sales business at norpex.ca, even though both are part of the Norpex group.

6.2. We may disclose personal information to norpex.ca (the group operator) for defined purposes such as shared operational, administrative, fraud-prevention, and support functions. norpex.ca is a related but separate entity; we do not treat the Marketplace and the first-party equipment business as a single, combined data pool, and we do not share your Marketplace information with norpex.ca for unrelated first-party marketing without an appropriate legal basis or your consent where required.

---

7. Who we share personal information with

We do not sell your personal information. We disclose it only as described below.

7.1. Service providers (sub-processors)

We share personal information with service providers who process it on our behalf, under contract, and only for the purposes we specify:

Service provider	Purpose	Information shared
Stripe (incl. Stripe Connect)	Payment processing, escrow-style holding of buyer funds, and seller payouts	Buyer billing and payment data; seller payout/bank and identity data
ClickShip	LTL freight quoting and booking	Buyer and seller names, contact details, pickup and delivery addresses
OpenRouter (and the model providers it routes to)	Powering the AI assistant	The prompts, questions, and conversation content you submit to the assistant
norpex.ca (group operator)	Shared operational, administrative, fraud-prevention, and support functions	Account, transaction, and support information as needed for the stated purpose

We may also use other infrastructure, hosting, analytics, email-delivery, and security providers. A current list of material sub-processors is available on request from the Privacy Officer (Section 13).

7.2. Between buyers and sellers

To complete a transaction, certain information is necessarily shared between the parties — for example, a buyer's delivery address is made available so the seller can arrange shipment, and a seller's relevant contact details are shared with the buyer. Each independent seller is a separate party responsible for its own handling of any personal information it receives.

7.3. Legal and regulatory disclosures

We disclose personal information where required or permitted by law, including:

• to the Canada Revenue Agency under digital-platform-operator reporting and tax rules;
• to tax authorities for GST/HST, QST, and PST as a marketplace facilitator;
• to comply with a subpoena, warrant, court order, or other lawful request;
• to detect, prevent, or investigate fraud, security incidents, or breaches of our Terms; and
• to protect the rights, property, or safety of Norpex, our users, or others.

7.4. Business transfers

If Norpex is involved in a merger, acquisition, financing, or sale of assets, personal information may be disclosed or transferred as part of that transaction, subject to appropriate confidentiality protections and applicable law.

---

8. Cross-border and out-of-province transfers

8.1. Some of our service providers — including Stripe, OpenRouter and the model providers it routes to, and certain infrastructure providers — may store or process personal information outside Canada, including in the United States. ClickShip and group-operator processing may also involve transfers across provincial or national borders.

8.2. When personal information is transferred to a jurisdiction outside Canada or outside Quebec, it may be accessible to courts, law enforcement, and government authorities of that jurisdiction under that jurisdiction's laws.

8.3. For individuals in Quebec (Law 25): before transferring personal information outside Quebec, Norpex conducts a privacy impact assessment and takes steps to ensure the information receives adequate protection, including through contractual safeguards with our service providers. By using the Marketplace, you are informed that your personal information may be communicated outside Quebec for the purposes described in this Policy.

8.4. We require our service providers, by contract, to protect personal information at a standard comparable to that required under applicable Canadian law and to use it only for the purposes we specify.

---

9. How we protect personal information (security safeguards)

9.1. We maintain physical, organizational, and technological safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls, authentication requirements, logging, and least-privilege access for staff.

9.2. Payment data minimization. Full payment card and bank details are handled within Stripe's PCI-DSS-compliant environment. Norpex minimizes the payment data it stores directly and relies on Stripe as the system of record for card/bank data.

9.3. No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for the security of information you choose to include in listings or messages.

9.4. We retain personal information only as long as necessary (Section 10) and dispose of it securely when it is no longer required.

---

10. How long we keep personal information (retention)

10.1. We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to provide the Marketplace, to resolve disputes, to enforce our agreements, and to meet legal, tax, accounting, and regulatory requirements.

10.2. Certain records are subject to minimum legal retention periods — for example, transaction, payment, and tax records (including information used for CRA reporting and tax remittance) are retained for the periods required by Canadian tax and financial record-keeping law, which may extend several years beyond the closing of your account.

10.3. AI-assistant interaction logs are retained only as long as needed to operate, secure, and improve the assistant, and are subject to the retention practices of our AI provider.

10.4. When personal information is no longer required and no legal retention obligation applies, we securely destroy, erase, or anonymize it.

10.5. For individuals in Quebec: specific retention periods are determined according to our retention schedule and applicable law; you may contact the Privacy Officer for more information about the criteria we use.

---

11. Cookies, analytics, and tracking technologies

11.1. We use cookies and similar technologies to keep you signed in, remember preferences, secure the service, measure usage, and improve the Marketplace.

11.2. We use strictly necessary cookies (required for the service to function) and analytics/performance cookies (to understand how the Marketplace is used). Where required by law, non-essential cookies are used only with your consent, and privacy-protective settings are applied by default as required under Law 25.

11.3. You can control cookies through your browser settings. Disabling some cookies may affect how the Marketplace functions.

11.4. We do not use the Marketplace to engage in automated decision-making that produces legal or similarly significant effects about you without appropriate transparency. If we ever introduce automated processing to make a decision about a user based solely on automated processing of personal information, we will inform affected individuals and provide the rights required by Law 25 (including the right to be informed of the information used, the reasons and main factors, and to request review).

---

12. Your privacy rights

Subject to legal limits and verification of your identity, you have the right to:

12.1. Access — request access to the personal information we hold about you and information about how it has been used and disclosed.

12.2. Correction — request correction of inaccurate, incomplete, or out-of-date information.

12.3. Withdraw consent — withdraw your consent to certain processing, subject to legal and contractual restrictions (see Section 5.5).

12.4. De-indexing / cessation of dissemination (Quebec) — in the circumstances provided by Law 25, request that we cease disseminating your personal information or de-index a hyperlink.

12.5. Data portability (Quebec) — where applicable under Law 25, request that the computerized personal information you provided to us be communicated to you in a structured, commonly used technological format.

12.6. Withdraw / delete account — request closure of your account, subject to the retention obligations in Section 10.

To exercise any right, contact our Privacy Officer (Section 13). We will respond within the timeframes required by applicable law (generally within 30 days under PIPEDA and Law 25). We may need to verify your identity before acting. There is generally no fee, though a minimal cost-based fee may apply in limited circumstances permitted by law, with advance notice.

If you are dissatisfied with our response, you may escalate as described in Section 14.

---

13. Privacy Officer and how to contact us

We have designated a Privacy Officer who is accountable for our compliance with this Policy and applicable privacy law (as required under PIPEDA's accountability principle and Law 25).

• Privacy Officer — Norpex Marketplace
• Email: [privacy@norpex.ca — CONFIRM]
• Mail: [Norpex legal entity name and mailing address — CONFIRM]
• Attention: Privacy Officer

You may contact the Privacy Officer to ask questions, exercise your rights, request our current sub-processor list, or raise a concern.

---

14. Breach and confidentiality-incident notification

14.1. We maintain procedures to detect, contain, assess, and respond to security incidents involving personal information.

14.2. Under PIPEDA, if we determine that a breach of security safeguards poses a real risk of significant harm to an individual, we will notify the affected individual(s) and report to the Office of the Privacy Commissioner of Canada (OPC) as soon as feasible, and we will keep records of breaches as required.

14.3. Under Quebec Law 25, if a confidentiality incident presents a risk of serious injury, we will notify the affected individual(s) and the Commission d'accès à l'information du Québec (CAI) with reasonable diligence, and we will maintain a register of confidentiality incidents.

14.4. We will also notify other regulators or parties where required by law.

---

15. Children and minors

15.1. The Marketplace is a business-to-business venue intended for use by adults acting in a commercial capacity. It is not directed to children, and we do not knowingly collect personal information from individuals under the age of majority in their province or territory of residence.

15.2. If we learn that we have collected personal information from a minor without appropriate authority, we will take reasonable steps to delete it. If you believe a minor has provided us with personal information, contact the Privacy Officer.

---

16. Third-party links and sellers

The Marketplace may contain links to third-party websites and services (including Stripe, ClickShip, Econolease, and independent seller content). This Policy does not apply to those third parties. We encourage you to review the privacy policies of any third party before providing personal information.

---

17. Changes to this Privacy Policy

17.1. We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision.

17.2. If we make material changes, we will provide notice through the Marketplace or by other reasonable means before the changes take effect, and, where required by law, we will obtain your consent. Your continued use of the Marketplace after the effective date constitutes acceptance of the updated Policy to the extent permitted by law.

---

18. Governing law and complaints

18.1. This Privacy Policy is governed by the laws of [Norpex's home province — CONFIRM] and the federal laws of Canada applicable therein.

18.2. If you have a privacy concern, please contact our Privacy Officer first (Section 13). If your concern is not resolved to your satisfaction, you may contact:

• the Office of the Privacy Commissioner of Canada — www.priv.gc.ca; or
• for Quebec residents, the Commission d'accès à l'information du Québec (CAI) — www.cai.gouv.qc.ca.

---

This document is a strong draft prepared for review by qualified Canadian privacy counsel. It is not legal advice and should not be published until reviewed and approved.