This Privacy Policy applies to SupplyDesk’s website (supplydesk.ca), our web application and buyer portals, and related services (together, “the Service”). It explains what personal information we collect, why, and what rights you have over it. SupplyDesk is the provider of the Service. For legal entity details or privacy-related legal correspondence, contact legal@supplydesk.ca.
This policy covers personal information collected through supplydesk.ca and our web application. It does not cover third-party sites we link to, or services you connect to SupplyDesk (like QuickBooks Online), which have their own privacy policies.
Depending on how you use the Service, we collect:
On supplydesk.ca specifically (this marketing site), we collect what you submit through the contact form — name, company, email, phone, buyer count, current ordering method, and any notes — plus standard server request logs and Google Analytics traffic data (page views, general visitor patterns).
Directly from you (forms, account setup, support conversations), automatically (device and log data as you use the Service), and from integrations you choose to connect (QuickBooks, Stripe).
To create and secure your account; to provide the ordering, catalog, and invoicing functionality you sign up for; to process subscriptions and payments; to send transactional emails (order confirmations, receipts, password resets); to detect abuse and fraud; to respond to support requests; and to meet legal and tax obligations.
Where GDPR or UK GDPR applies, we rely on: performance of a contract (providing the Service you signed up for), legitimate interests (security, fraud prevention, service improvement), consent (optional analytics), and legal obligation (tax and accounting records).
We use a small number of trusted processors to run the Service, each receiving only what it needs to perform its function. Categories include: database, authentication, and file storage; hosting and content delivery; subscription billing and payment processing; transactional email delivery; invoice sync with QuickBooks Online, where you enable it; error diagnostics; optional, opt-in product analytics; bot and abuse protection; rate-limiting; and traffic analytics on supplydesk.ca. A full list of our current processors is available on request at legal@supplydesk.ca.
If you connect QuickBooks, we store only the account identifiers and OAuth tokens needed to authenticate that connection, encrypted at rest. We do not store a copy of your invoices or transactions — when an order syncs, the invoice is created directly in your own QuickBooks account, and QuickBooks Online, not SupplyDesk, is the system of record for that financial data.
Our service providers may process data in India, Canada, the United States, and the European Economic Area. Where we transfer personal information across borders, we rely on the transfer mechanisms those laws require, such as standard contractual clauses under GDPR.
We retain information only for as long as reasonably needed, based on your account lifecycle, data sensitivity, backup cycles, and tax or legal requirements. Records of Terms of Service acceptance are kept as evidence for as long as the applicable limitation period for legal claims. Specific timelines for exporting or deleting your account data after cancellation are set out in our Terms of Service.
We use encryption in transit and at rest, database-level row-level security to isolate each supplier’s data, and access controls scoped per account and per buyer. No system is completely secure, and we cannot guarantee against every possible incident.
Depending on where you live, you may have the right to access, correct, or delete your personal information, request a copy of it, restrict or object to certain processing, or withdraw consent. Canadian residents may raise concerns with the Office of the Privacy Commissioner of Canada. Residents of the EEA/UK may lodge a complaint with their local supervisory authority. Residents of India may exercise rights available under the Digital Personal Data Protection Act, 2023, including grievance redressal through the contact below. Residents of applicable US states may have additional rights under their state’s privacy law. To exercise any of these rights, contact us below.
supplydesk.ca (this site) uses Google Analytics to understand site traffic; it does not set advertising cookies. Our web application uses a small number of essential cookies for sign-in and security, plus optional analytics cookies you can decline. See our Cookie Policy for details.
The Service is intended for business use by adults. We do not knowingly collect personal information from children.
We will update the effective date above when this policy changes, and where changes are material, we will notify account holders directly.
Questions or requests about this policy: legal@supplydesk.ca