Shop Makers Privacy Policy (Canada)

Effective date: September 8, 2026

1. Who we are and what this policy covers

This policy is issued by Shop Makers Marketplace Inc. & Shop Makers Marketplace Vancouver Inc., 1208 West Pender Street, 3rd Floor, Vancouver BC V6E 2S8 ("Makers", "Shop Makers", "we", "us"). We operate 27 Makers retail stores across British Columbia, Alberta, Saskatchewan, Manitoba and Ontario, where independent makers rent display space and sell their goods.

This policy explains how we collect, use, share, store and protect personal information when you:

  • shop in a Makers store or buy or receive a Makers gift card;

  • sell your goods at Makers as a vendor (we call vendors "makers" in our stores);

  • apply to become a vendor, join a space waitlist, or apply for a job with us;

  • visit www.shopmakers.ca or our help centre at docs.shopmakers.ca, or subscribe to our newsletter;

  • use MakersPOS, our vendor portal and point-of-sale system at pos.shopmakers.ca.

If you work for us, our Employee Privacy Notice explains how we handle your information as an employee. This policy does not cover it.

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), the British Columbia Personal Information Protection Act, the Alberta Personal Information Protection Act, and Canada's Anti-Spam Legislation (CASL), as they apply to us.

"Personal information" means information about an identifiable individual. Business contact information used to communicate with you in your business role, and information that cannot be linked back to you, are treated as personal information only where the law requires it.

2. Personal information we collect

We collect only what we need for the purposes described in section 4. What we collect depends on how you interact with us.

Customers

  • Email address, so we can send your receipt or deliver a gift card. We do not currently offer paper receipts, so we ask for an email at the register.

  • Purchase history: what you bought, where, when, and for how much, plus any returns or exchanges.

  • Payment details limited to the card brand and last four digits. We never see or store your full card number.

  • Gift card details: the card code, balance, and the email address of the recipient if you send a card to someone else.

  • Your marketing preference: whether you have unsubscribed from marketing email, or asked to stay on our list.

Vendors and makers

  • Business name and your personal first and last name.

  • Email address, a backup email address, phone number and mailing address.

  • Tax number, such as your GST/HST or business number.

  • Your Stripe Connect account identifier, which links your MakersPOS account to the Stripe account you use to receive payouts.

  • Membership and billing history, including plan, location, fees paid and any refunds.

  • An image of your handwritten electronic signature and a record of the agreements you accepted, with the date and version.

  • Product listings, product photos and pricing you enter into MakersPOS.

  • Sales and payout history.

Vendor applicants and waitlist prospects

  • Name, email address, business details and your answers to our application questions, collected through our application form (hosted by Paperform) and, for space waitlists, through MakersPOS.

Job applicants

  • Resume, contact details and anything else you send us through our careers form (hosted by Paperform) or through a LinkedIn posting.

Website visitors and newsletter subscribers

  • Email address if you subscribe to our newsletter.

  • Technical information sent by your browser, such as IP address, device type and pages visited, collected through cookies and similar technologies described in section 7.

3. How we collect it

Most of the information we hold comes directly from you: at the register, in MakersPOS, through our forms, or by email.

We also receive information from:

  • Stripe, our payment processor, which sends us payment confirmations, card brand and last four digits, and payout status. Stripe collects vendor identity documents and bank details directly; we do not receive copies.

  • Squarespace, Paperform and Zapier, which run our websites, forms and online gift card orders and pass the details you enter to us.

  • Cookies and pixels on our websites, described in section 7.

  • In-store cameras, described in section 8.

Where a vendor or customer gives us information about another person (for example, a gift card recipient's email or a business partner's contact details), we rely on you to have that person's permission.

4. Why we use your information and our legal basis

Under Canadian privacy law we need your consent to collect, use or disclose personal information, unless an exception applies. Your consent may be express (you tick a box or tell us yes) or implied (you give us your email so we can send a receipt). We also rely on the fact that some uses are necessary to perform a contract with you, or are required by law.

PurposeWho it applies toBasisComplete a sale, send a receipt, process returns and exchangesCustomersImplied consent; contractIssue, deliver and redeem gift cardsCustomers and recipientsImplied consent; contractSend marketing email about products, events and promotionsCustomers, subscribers, vendorsImplied consent from your purchase or membership, or express consent (CASL)Run your vendor membership: onboarding, billing, payouts, notifications, supportVendorsContract; implied consentVerify identity and prevent fraud in payouts and paymentsVendorsContract; legal obligation; Stripe's own requirementsKeep records of agreements you acceptedVendorsContract; legal obligationReview your application or hold your place on a waitlistApplicants, prospectsConsentConsider you for a jobJob applicantsConsentOperate, secure and improve our websites and MakersPOSEveryoneImplied consent; our legitimate operational needsMeet tax, accounting and legal requirementsEveryoneLegal obligationRespond to legal requests and protect our rightsEveryoneLegal obligation

We do not sell personal information. We do not use automated decision-making that produces legal or similarly significant effects about you.

5. Payments and Stripe

All card payments are processed by Stripe. In store, your card is read by a Stripe Terminal device. Vendor membership fees are collected through Stripe Checkout and Stripe Subscriptions and are charged automatically each month, seven days before your renewal date.

Makers never stores full card numbers. We keep only the card brand and last four digits so you can identify a payment on your receipt or account.

Vendor payouts are sent through Stripe Connect Express. When you set up payouts, Stripe collects your identity documents and bank account details directly. That information is governed by Stripe's privacy policy, available at stripe.com/privacy, not by this policy.

6. Email, receipts and marketing

Transactional email

We send receipts, gift card deliveries, membership notices, payout notices and account alerts by email through Postmark. These messages are part of the service you asked for and do not require separate consent.

Marketing email and CASL

We send marketing email in accordance with Canada's Anti-Spam Legislation (CASL), which allows us to email you on the basis of an existing business relationship or your express consent.

  • If you buy from us and give us your email address at the register, we may send you marketing email for up to two years after your most recent purchase, unless you unsubscribe sooner.

  • If you subscribe to our newsletter at www.shopmakers.ca, or tell us at the register that you want to stay on our list, we will keep sending until you unsubscribe.

  • If you are a vendor, we may send you vendor news and promotions during your membership and for up to two years after it ends, unless you unsubscribe sooner.

  • If you receive a gift card from someone else, we do not send you marketing email unless you buy from us or subscribe.

We record the basis and date of our permission to email you. Every marketing message identifies Shop Makers Marketplace Inc., includes our mailing address, and includes an unsubscribe link. We process unsubscribe requests within 10 business days, and usually immediately.

You can unsubscribe at any time by clicking the link in any marketing email. Unsubscribing does not affect transactional email you need to receive, such as receipts.

Open tracking

Our email service currently records whether an email was opened, using a small image (a "tracking pixel") in the message. This applies to receipts and other transactional email as well as marketing email. We use this information to confirm delivery and troubleshoot problems.

7. Cookies and tracking

MakersPOS

MakersPOS sets one strictly necessary cookie that keeps you signed in for up to 12 hours, and one cookie that remembers your display preferences. Neither is used for advertising or analytics.

Our websites

www.shopmakers.ca and www.shopmakers.us are built on Squarespace and set Squarespace's standard cookies for site function and basic visitor statistics. Squarespace's cookie policy is at squarespace.com/cookie-policy.

www.shopmakers.ca also uses the Meta Pixel, an advertising tool from Meta Platforms, Inc. The pixel tells Meta that your browser visited our site so we can measure our advertising and show Makers ads to people who have visited. Meta may combine this with information it already holds about you under Meta's own privacy policy. You can opt out of interest-based advertising through your Meta ad settings and through the Digital Advertising Alliance of Canada at youradchoices.ca.

We do not use Google Analytics.

You can block or delete cookies in your browser settings. Blocking the MakersPOS session cookie will prevent you from signing in.

8. In-store cameras

Our stores may use video cameras for safety and loss prevention. Signs at store entrances tell you when cameras are in use. Footage is kept for 14 days unless it is needed to investigate an incident, and is shared only with law enforcement or insurers where necessary.

9. Who we share your information with

We share personal information with service providers who help us run our business. They may use it only to provide services to us. We do not sell personal information and we do not share it with third parties for their own marketing.

ProviderWhat they do for usWhere they process dataVercelHosts MakersPOSUnited StatesUpstash (Vercel KV)Rate limiting; briefly stores IP addressesUnited StatesNeonHosts our databases on Amazon Web ServicesUnited States (Ohio and Oregon)StripeCard payments, membership billing, vendor payouts, identity verificationUnited StatesPostmarkSends transactional emailUnited StatesEmailOctopusSends vendor marketing emailUnited KingdomArchbeeHosts our help centresUnited States and European UnionWhen I WorkStaff scheduling (employee data only)United StatesGoogleWorkspace email and documents, Drive folders, Cloud Storage backups, Google Reviews link on receiptsUnited StatesSquarespaceWebsites, forms, newsletter signup, online gift card ordersUnited StatesZapierPasses online gift card orders to MakersPOSUnited StatesPaperformVendor application, support and careers formsAustralia and United StatesGitHubCode hosting and backup automationUnited StatesMetaAdvertising pixel on www.shopmakers.caUnited StatesLinkedInJob postingsUnited States

We may also disclose personal information:

  • to our professional advisers, insurers and auditors;

  • to law enforcement, regulators or courts where required by law or a valid legal process;

  • to a buyer or successor if we sell or reorganize our business, subject to this policy;

  • to protect the rights, property or safety of Makers, our vendors, our customers or others.

Vendors can see sales data for their own products, including the date, location and amount of each sale. Vendors do not see customer names or email addresses.

10. Where your information is stored

Our systems are hosted in the United States. Your personal information is stored and processed on servers operated by Neon (Amazon Web Services, Ohio and Oregon regions), Vercel and the other providers listed above, and backed up nightly to Google Cloud Storage.

This means your personal information is transferred outside Canada. While it is in the United States, it is subject to United States law and may be accessed by US courts, law enforcement and national security authorities under that law. We require our providers to protect personal information through contracts, but we cannot guarantee that foreign authorities will not access it.

By providing us with personal information, you consent to its storage and processing in the United States. If you have questions about our transfers, contact our Privacy Officer.

11. How long we keep it

We keep personal information only as long as needed for the purposes in this policy and to meet legal obligations, then delete or anonymize it.

RecordRetention periodTransaction, receipt and tax records7 yearsVendor agreements and signatures7 years after membership endsCustomer recordsUntil you ask us to delete them, or after 3 years of inactivityMarketing consentUntil you withdraw it, plus a record that you withdrewVendor applications and waitlist entries24 monthsJob applications12 monthsEmail delivery logs24 monthsSecurity and access logs12 monthsDatabase backups30 days rollingCamera footage14 days

Some information, such as transaction records, must be kept for tax purposes even if you ask us to delete your account. In that case we restrict its use to record-keeping.

12. How we protect it

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including:

  • encryption of data in transit and at rest with our hosting providers;

  • passwords stored only as salted hashes;

  • role-based access so staff see only what their job requires;

  • rate limiting and monitoring on sign-in and password reset;

  • contracts with service providers requiring them to protect personal information;

  • payment card data handled entirely by Stripe, a PCI DSS Level 1 provider.

No system is perfectly secure. If we learn of a breach that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada (and the Alberta Information and Privacy Commissioner where required) as the law requires, and we keep a record of every breach.

13. Your rights and choices

You have the right to:

  • Access the personal information we hold about you and learn how we have used and shared it.

  • Correct information that is inaccurate or incomplete.

  • Withdraw consent to our collection, use or disclosure, subject to legal and contractual limits. Withdrawing consent may mean we cannot provide a service, such as a vendor membership.

  • Ask us to delete your information where we are not legally required to keep it.

  • Opt out of marketing at any time using the unsubscribe link or by contacting us.

  • Ask questions or complain about our handling of your information.

To exercise any of these rights, email privacy@shopmakers.ca or write to our Privacy Officer at the address in section 16. We may need to verify your identity first. We respond within 30 days, and we will tell you if we need more time as the law allows. There is no fee for a reasonable request.

If you are not satisfied with our response, you may complain to:

  • the Office of the Privacy Commissioner of Canada (priv.gc.ca);

  • the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca);

  • the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca).

14. Children

Our stores welcome families, but our websites, newsletter, MakersPOS and vendor program are not directed at children under 13, and we do not knowingly collect personal information from them online. If you believe a child has given us personal information, contact us and we will delete it.

15. Changes to this policy

We may update this policy from time to time. We will post the new version at www.shopmakers.ca/privacy-policy with a new effective date. If a change materially affects how we use information we already hold, we will tell you by email or by a notice in MakersPOS before it takes effect.

16. Contact us

Shop Makers Marketplace Inc. & Shop Makers Marketplace Vancouver Inc.
1208 West Pender Street, 3rd Floor, Vancouver BC V6E 2S8
Email: privacy@shopmakers.ca