Privacy Policy

HeavyRentals.ca ("HeavyRentals", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you use our Platform at heavyrentals.ca and its subdomains. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. By using the Platform, you consent to the practices described here.

1. Information We Collect

Information you provide directly:

• Account information: name, email address, phone number, password, job title, and language preference.
• Business information (Owners and Service Providers): company name, business address, service area, company description, business registration number, and verification documents.
• Equipment listings: descriptions, specifications, serial or VIN numbers, photographs, video links, pricing, availability, and location (including latitude and longitude).
• Rental activity: rental requests, quotes, confirmations, rental dates, extensions, condition reports, and logbook entries.
• Communications: messages and attachments exchanged through the Platform, and support correspondence.
• Contracts and signatures: rental-agreement data, electronic signatures, and the date, time, and IP address recorded at signing.
• Documents: insurance certificates, credentials, business-verification documents, and related files you upload to the document vault.
• Reviews and ratings: feedback you submit about other Users.
• Payment information (Owners only): billing details are handled by our payment processor, Stripe. We do not receive or store full payment-card numbers.
• Referrals and preferences: referral activity, saved searches, and notification settings.

Information collected automatically: IP address, browser and device information, approximate location derived from your IP (used to pre-select your province), pages viewed, search terms, referring URLs, and interaction data, collected through cookies and similar technologies.

Information from third parties: where you connect an integration (for example, an accounting service), or where a service provider supplies data such as geolocation or fraud signals, we may receive information from those sources.

2. Why We Collect It

We use personal information to:

• Create and manage accounts and authenticate Users.
• Operate the marketplace — display listings, run search, and connect Renters with rental companies.
• Facilitate rental requests, quotes, messaging, contract generation, and electronic signing.
• Provide the business and record-keeping tools we offer, including analytics, logbooks, condition reports, document storage, team management, and accounting integrations.
• Calculate and invoice Commission and process optional product and subscription payments.
• Send transactional notifications (for example, new messages, rental updates, contract and payment notices) by email and, where you opt in, by SMS or web push.
• Send platform announcements and, with your consent where required, marketing communications you can opt out of at any time.
• Detect, investigate, and prevent fraud, abuse, circumvention, and violations of our Terms, including automated screening of messages for prohibited content and contact information.
• Maintain security, keep audit logs, back up data, and comply with legal obligations.

3. How Information Is Shared

We do not sell your personal information. We share it only as follows:

• Between the parties to a rental: to let an Owner and a Renter do business, relevant information — such as company name, service area, and, once a rental proceeds, the contact and contract details each party needs — is shared between them. Contact information is generally withheld until a rental is underway, to support our anti-circumvention measures.
• Publicly: equipment listings, company profiles, service-provider profiles, ratings, and reviews are displayed publicly on the Platform and may appear in search engines. Do not include information in these fields that you do not want to be public.
• With service providers (subprocessors): we use trusted third parties to run the Platform, listed in Section 4. They may process personal information only on our instructions and are bound to protect it.
• For legal reasons: we may disclose information if required by law, regulation, subpoena, court order, or government request, or where we believe in good faith it is necessary to enforce our Terms, protect our rights or property, or protect the safety of any person.
• In a business transfer: if HeavyRentals is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

4. Service Providers and International Transfers

We rely on the following categories of service providers, who may process personal information on our behalf. Some are located outside Canada (for example, in the United States), which means your information may be stored or processed in, and subject to the laws of, other countries.

• Hosting and file storage — cloud infrastructure and object storage for the application, photos, logos, documents, and signed contracts.
• Content delivery and security — a CDN and edge-security provider that speeds up the site, mitigates attacks, and supplies coarse geolocation.
• Payment processing — Stripe, for Owner commission and product payments.
• Email delivery — to send transactional and account emails.
• SMS and web-push delivery — where you opt in to those notification channels.
• Accounting integration — Intuit QuickBooks, only where an Owner chooses to connect it.
• IP geolocation — to detect your approximate province and pre-select it in search.
• Analytics, fonts, and error monitoring — to understand and improve the Platform and to diagnose faults.
• Real-time messaging — infrastructure that powers live message delivery.

We use contractual and technical safeguards to require comparable protection of your information by these providers. You may contact our Privacy Officer for more detail about our subprocessors.

5. Data Security

We use safeguards appropriate to the sensitivity of the information, including:

• Encryption of data in transit using TLS/HTTPS, with HTTP Strict Transport Security.
• Field-level encryption at rest for the most sensitive data, including phone numbers, business registration numbers, equipment serial numbers, insurance policy numbers, two-factor secrets, and integration tokens.
• Passwords stored only as salted, one-way hashes — never in plain text.
• Private, access-controlled storage for contracts and documents, served only through time-limited signed links.
• Automated screening that removes contact details from messages before storage where our anti-circumvention rules apply.
• Virus scanning of uploaded files, role-based access controls, administrator audit logging, rate limiting, security headers, and regular backups.
• Optional two-factor authentication for your account.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at [email protected].

6. Data Retention

We retain personal information for as long as your account is active and as needed to provide the Platform. We also retain certain information after account closure where necessary to complete transactions, resolve disputes, enforce our Terms (including anti-circumvention and unpaid-Commission obligations), maintain records of signed contracts and commissions, and comply with legal, tax, and accounting requirements. When information is no longer required, we take steps to securely delete or de-identify it.

7. Cookies and Tracking

We use cookies and similar technologies to operate and improve the Platform:

• Essential cookies — required for the Platform to function, including session management, authentication, and security tokens (such as CSRF protection).
• Preference cookies — remember settings such as your language and region.
• Analytics cookies — help us understand how the Platform is used so we can improve it.

You can control or block cookies through your browser settings, but disabling essential cookies may prevent parts of the Platform from working.

8. Your Privacy Rights

Subject to PIPEDA and applicable provincial law, you have the right to:

• Access the personal information we hold about you and be told how it is used and disclosed.
• Request correction of inaccurate or incomplete information.
• Withdraw consent for non-essential uses, including marketing, at any time (this may limit some features).
• Request deletion or closure of your account and associated personal data, subject to the retention obligations in Section 6.
• Ask questions or make a complaint about our handling of your information.

To exercise these rights, contact our Privacy Officer at [email protected]. We will respond within 30 days. You may also update much of your information directly in your account settings. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

9. Children

The Platform is intended for businesses and adults. It is not directed to individuals under 18, and we do not knowingly collect personal information from anyone under 18. If we learn that we have done so, we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the date above and may notify you through the Platform or by email. Your continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.

11. Contact Us

For questions, concerns, or requests about this Privacy Policy or how we handle your personal information, contact our Privacy Officer:

HeavyRentals.ca — Privacy Officer
Email: [email protected]
Security matters: [email protected]
Website: heavyrentals.ca