1. Legal Basis & Consent (PIPEDA)

Under PIPEDA, we obtain your informed consent before collecting, using, or disclosing your personal information, except where permitted without consent (e.g., legal obligations, fraud prevention). You may withdraw consent at any time, subject to legal or contractual restrictions.

• Express Consent: For sensitive data, marketing communications, and account creation.
• Implied Consent: For service delivery where reasonable expectations apply.
• Withdrawal of Consent: You may opt out of non-essential processing by updating account preferences or contacting us.

2. Your Rights Under PIPEDA & Provincial Laws

Canadian residents have the following rights regarding their personal information:

Right of Access

You may request access to the personal information we hold about you, including how it has been used and disclosed.

Right to Correction

If your personal information is inaccurate or incomplete, you may request correction. We will amend records and notify third parties where appropriate.

Right to Withdraw Consent

You can withdraw consent for certain processing activities (e.g., marketing emails) at any time. Withdrawal may affect service availability.

Right to Challenge Compliance

You have the right to challenge our compliance with PIPEDA or applicable provincial laws. We will investigate and respond to all privacy complaints.

3. How We Collect, Use & Disclose Personal Information

We collect information necessary to operate the Xaysi marketplace, including:

• Identifiers: name, email, shipping address, phone number.
• Commercial data: purchase history, seller listings, transaction details.
• Technical data: IP address, device identifiers, cookies, usage analytics.

We use this information to:

• Process orders, payments, and deliveries.
• Provide customer and vendor support.
• Detect and prevent fraud or security incidents.
• Improve our platform and personalize your experience.

We do not sell personal information to third parties. We may share data with service providers (payment processors, shipping partners) under strict confidentiality agreements.

4. Cross-Border Data Transfers

As a global marketplace, your personal information may be stored or processed outside of Canada (including in the United States). When we transfer data internationally, we ensure an adequate level of protection through contractual safeguards, standard contractual clauses, or reliance on recognized adequacy mechanisms. By using Xaysi, you acknowledge that your information may be accessed by foreign courts, law enforcement, or regulatory authorities.

5. Quebec Specific Provisions (Law 25)

For residents of Québec, additional obligations under Law 25 (formerly Bill 64) apply:

• Privacy Officer: Xaysi has designated a Privacy Officer responsible for compliance. You may contact them using the details below.
• Automated Decision-Making: Where we use automated processing that significantly affects you, we will notify you and provide an explanation.
• Data Portability: Upon request, you may receive your personal information in a structured, commonly used format.
• Right to De-indexing: In certain circumstances, you may request that search engines stop indexing links containing your information.

Quebec residents also have enhanced consent rights regarding sensitive information and the right to request deletion when consent is withdrawn.

6. Retention & Safeguards

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations (e.g., tax records for 7 years), resolve disputes, and enforce agreements. We employ industry-standard security measures including encryption, access controls, and regular audits.

7. Alberta & British Columbia (PIPA)

Residents of Alberta and British Columbia benefit from their respective Personal Information Protection Acts (PIPA). These laws provide additional rights regarding employee information (for vendors operating as sole proprietors) and enhanced complaint mechanisms through provincial privacy commissioners. Xaysi complies with the substantive requirements of both statutes.

8. Cookies & Online Tracking (CASL Compliance)

We use cookies, pixels, and similar technologies for analytics, personalization, and advertising. Under Canada’s Anti-Spam Legislation (CASL), we obtain consent before installing certain tracking technologies. You can manage cookie preferences through our cookie banner or browser settings.

9. Exercising Your Rights & Contact Information

To exercise your privacy rights (access, correction, deletion, consent withdrawal), please:

• Email our Privacy Officer at: privacy@xaysi.ca
• Submit a request through our Help Centre Privacy Request Form
• Mail us at: Xaysi Privacy Office, 123 Marketplace Avenue, Toronto, ON M5V 2T6, Canada

We will respond to verified requests within 30 days (extendable to 45 days for complex requests). If you are unsatisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPC) or your provincial privacy commissioner (e.g., CAI in Québec).

10. Updates to This Canada Notice

We may update this Canada Regional Privacy Policy from time to time to reflect changes in legal requirements or our practices. The “Last Updated” date will be revised accordingly. Continued use of Xaysi after changes constitutes acceptance of the updated notice.

Last Updated: June 9, 2026