Privacy Policy
ECS Coffee Inc.
How we collect, use, protect, and share your personal information
Effective Date: April 2026
Last Updated: April 2026
1. Introduction
ECS Coffee Inc. ("ECS Coffee", "we", "our", or "us") is a Canadian corporation with its head office in Ontario, Canada. We operate three retail locations in Burlington, Ancaster, and Toronto (Etobicoke), a wholesale and office coffee (OCS) division, an authorized service department, and the ecscoffee.com online store.
We respect your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, who we share it with, how long we keep it, and the rights and choices you have.
This Policy applies to personal information we handle in connection with ecscoffee.com and any regional or replacement site (including any United States site), our mobile experiences, our email and SMS communications, in-store shopping at our Ontario locations, our wholesale and office coffee services, our service and repair centre, our Brew Bucks Rewards Program, our marketing, and our recruiting.
We comply with Canadian privacy law, including the federal Personal Information Protection and Electronic Documents Act (PIPEDA), and, for Quebec residents, the Act respecting the protection of personal information in the private sector (Law 25). Where applicable, we also observe the requirements of other privacy laws that apply to us (see Sections 20 and 21).
2. Who We Are and How to Contact Us
ECS Coffee Inc. is the controller of the personal information described in this Policy. We are responsible for how your personal information is handled.
Privacy Officer / Person in Charge of the Protection of Personal Information
As required by PIPEDA and Quebec Law 25, we have designated a Privacy Officer who is responsible for ECS Coffee's compliance with this Policy and applicable privacy law. You can contact our Privacy Officer at any time with questions, requests, or complaints:
Privacy Officer, ECS Coffee Inc.
Email: crossan@ecscoffee.com (or webdesk@ecscoffee.com with subject line "Privacy")
Phone: (800) 263-3890 — ask for the Privacy Officer
Mail: ECS Coffee Inc., Attention: Privacy Officer, Head Office, 3100 Harvester Rd Unit 6 Burlington, Ontario, L&N 3W8, Canada
For technical or account questions, please continue to use webdesk@ecscoffee.com.
3. Personal Information We Collect
The categories of personal information we collect depend on how you interact with us. We collect only what we need for the purposes described in Section 5.
3.1 Information you give us
• Contact and identity: name, email address, phone number, shipping address, billing address.
• Account: username, password (encrypted), account preferences, wish lists, saved addresses.
• Order and payment: products purchased, order history, payment method and the last four digits of your card (full card details are handled by our payment processors — see Section 7); billing address; tax and duty information; gift-message content.
• Brew Bucks Rewards: enrolment information, points balance, transaction history, reviews and review activity, referral information.
• Wholesale and Office Coffee (OCS): business name, business address, contact person, purchase requirements, service and delivery preferences, and any credit-application information you choose to provide.
• Service and repair: product make/model/serial, purchase date, description of issue, and any diagnostic notes.
• Communications: emails, chat transcripts, phone calls, SMS, contact-form submissions, and reviews.
• Marketing preferences: email and SMS subscription status and category preferences.
• Job applications: resumé, cover letter, references, and interview notes (see Section 18).
3.2 Information we collect automatically
• Device and browser: IP address, general geographic location derived from IP, device type, operating system, browser type and version, screen size, language.
• Usage: pages viewed, products viewed, searches, referring URL, time on page, click-stream, cart activity, abandoned carts.
• Cookies and identifiers: as described in Section 9.
3.3 Information from third parties
• Payment processors (Shopify Payments, PayPal, Sezzle, Apple Pay, Google Pay, Shop Pay) provide payment confirmation and fraud signals; we do not receive full card numbers.
• Shipping carriers provide delivery status.
• Loyalty platform (Smile.io) provides points and redemption data.
• Marketing and analytics platforms (such as Meta, Google, TikTok) may share campaign performance and audience-matching signals; see Section 9.
• Publicly available or authorized sources for business customers (for example, for credit or business verification).
3.4 In-store information
• Purchase records processed through our point-of-sale system.
• Video surveillance (CCTV) recorded at each retail location for security and loss prevention (see Section 19).
• Loyalty look-up when you provide your email, phone, or name at the counter.
4. How We Collect Your Information
We collect personal information directly from you when you shop, register, subscribe, contact us, or apply for a job; automatically when you use our Site or open our emails (through cookies and similar technologies — see Section 9); and from the third-party sources described in Section 3.3.
We collect only what is necessary for the purposes identified at or before the time of collection.
5. Why We Collect and Use Your Information
We use your personal information for the following purposes:
• To take and fulfil your Orders, process payments, arrange shipping, provide invoices and receipts, and handle returns and exchanges;
• To create and administer your account, including authentication, password reset, saved addresses, wish lists, and account security;
• To operate the Brew Bucks Rewards Program (enrolment, point accrual, notifications, redemption, dispute resolution);
• To provide customer service — including responding to your questions and complaints through email, chat, SMS, and phone;
• To provide service, repair, warranty, and installation services;
• To send transactional messages such as Order confirmations, shipping notifications, service updates, back-in-stock alerts you have subscribed to, and account and security notices;
• To send marketing communications you have consented to (email newsletters, SMS offers, event invitations, new-product announcements), and to measure their effectiveness;
• To personalize your experience, including product recommendations and relevant content;
• To operate, maintain, secure, and improve the Site, our systems, and our services (including analytics, error monitoring, and A/B testing);
• To detect, investigate, and prevent fraud, unauthorized use, abuse of promotions, and other unlawful activity;
• To recruit for open positions and to evaluate job applicants (see Section 18);
• To meet legal, tax, regulatory, and record-keeping obligations, including under Ontario and federal consumer-protection, tax, and accessibility legislation;
• To exercise or defend legal claims and to enforce our Terms and Conditions.
If we intend to use your information for a purpose that is materially different from those listed above, we will notify you and, where required by law, obtain your consent.
6. Legal Basis and Your Consent
Under Canadian privacy law, we rely on your consent to collect, use, and disclose your personal information. Consent may be express (for example, when you actively opt in to our newsletter or check a box at checkout) or implied (for example, when you place an Order — your consent to use your address to ship it is implied by the transaction). Some processing is also permitted or required by law without consent (for example, tax records and fraud prevention).
You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may affect our ability to provide certain services (for example, we cannot process an Order without your shipping address). Withdrawing consent to marketing communications does not stop transactional communications related to your Orders or account.
To withdraw consent, use the unsubscribe link in any marketing email, reply STOP to any marketing SMS, log in to your account to update your marketing preferences, or contact our Privacy Officer.
7. Sharing With Service Providers and Third Parties
We do not sell your personal information. We share personal information only as described below.
7.1 Service providers
We use trusted service providers who process personal information on our behalf to help us run our business. Each is contractually required to use the information only for the purposes we specify, to protect it with appropriate safeguards, and to comply with applicable privacy law. Categories of service providers include:
• E-commerce platform: Shopify Inc. — hosts our Site, processes Orders, and provides checkout and payment infrastructure. Shopify complies with the highest level of Payment Card Industry (PCI) standards.
• Payment processors: Shopify Payments, PayPal, Sezzle, Apple Pay, Google Pay, Shop Pay, and card issuers. Full card numbers are handled by these processors, not stored by us.
• Loyalty platform: Smile.io — operates the technical layer of Brew Bucks.
• Email and SMS marketing: our email service provider (e.g., Klaviyo) and SMS aggregator send messages you have consented to.
• Shipping and delivery: Canada Post, UPS, FedEx, Purolator, Kwik Save Courier, and other carriers we use to fulfil your Order.
• Analytics: Shopify Analytics, Google Analytics, and similar tools that help us understand Site usage.
• Advertising platforms: Meta (Facebook, Instagram), Google Ads, TikTok, Pinterest, and similar platforms, for measurement and audience-matching.
• Customer service tools: chat, help-desk, and review-management platforms.
• Fraud prevention: Shopify's built-in fraud tools and third-party fraud-detection services.
• Professional advisors: lawyers, accountants, auditors, and insurers, on a confidential basis.
• IT service providers: hosting, security, backup, and support vendors.
7.2 Business partners
We may share limited personal information with our wholesale and office coffee customers (for example, contact person and delivery instructions) and with manufacturers or authorized warranty providers where you have purchased their product from us and warranty service is required.
7.3 Legal and safety
We may disclose your personal information without your consent where permitted or required by law, including to comply with a subpoena, court order, or other legal process; to cooperate with law enforcement, regulators, or a privacy authority; to enforce our Terms and Conditions; to prevent fraud; and to protect the rights, property, or safety of ECS Coffee, our employees, our customers, or the public.
7.4 Corporate transactions
If ECS Coffee is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, personal information may be transferred as part of the transaction. Any successor will be bound by this Policy or an equivalent policy for the personal information transferred.
8. International Transfers of Personal Information
Some of our service providers — including Shopify, Smile.io, Klaviyo, Google, Meta, TikTok, and various shipping carriers — process personal information outside of Canada, including in the United States and other jurisdictions. When personal information is processed outside Canada, it may be subject to the laws of the country in which it is processed, including lawful requests by government or regulatory authorities.
We take reasonable steps — including contractual measures such as data processing agreements — to ensure that personal information transferred outside Canada is given a comparable level of protection to that required under Canadian law.
If you would like more information about our cross-border transfers, contact our Privacy Officer.
9. Cookies, Tracking Technologies and Advertising
We and our service providers use cookies and similar technologies (such as pixels, SDKs, and local storage) on our Site and in our emails. Cookies are small text files that a website places on your device to remember information about you.
9.1 Categories of cookies we use
• Strictly necessary — required for the Site to function, including for security, load balancing, cart, and checkout. These cannot be disabled through our cookie controls.
• Functional — remember your preferences (language, location, saved addresses) and enhance the experience.
• Analytics and performance — help us understand how the Site is used so we can improve it (for example, Shopify Analytics, Google Analytics).
• Advertising and marketing — used with our advertising partners (for example, Meta, Google, TikTok, Pinterest) for interest-based advertising, retargeting, and measurement.
9.2 How you can control cookies
Most browsers let you refuse or delete cookies. If you disable cookies, some parts of the Site may not work correctly. Where required by law, we present a cookie banner that lets you accept, reject, or manage non-essential cookies.
Interest-based advertising opt-out. You can also opt out of interest-based advertising from participating companies through the Digital Advertising Alliance of Canada at https://youradchoices.ca, the Digital Advertising Alliance at https://optout.aboutads.info, or the Network Advertising Initiative at https://optout.networkadvertising.org.
You can adjust ad personalization directly with:
• Google — https://myaccount.google.com/data-and-privacy
• Meta (Facebook and Instagram) — through your Ad Preferences on those platforms
• TikTok — through your Ad Preferences on that platform
• Pinterest — through your Ad Preferences on that platform
You can also opt out through your device settings (Apple's App Tracking Transparency, Google Android privacy controls). We recognize the Global Privacy Control browser signal where applicable (see Section 22).
10. Your Choices About Ads, Analytics and Communications
You have choices about how we and our partners communicate with you and use your information:
• Email newsletters: click the unsubscribe link at the bottom of any marketing email, or update preferences in your account.
• SMS: text STOP to any ECS Coffee promotional SMS or +1-844-969-2598. Text HELP for support.
• Push notifications: adjust in your device or browser settings.
• Cookies and ads: see Section 9.
• Account preferences: update marketing and communication preferences in your ecscoffee.com account.
Transactional communications about your Orders, service requests, or account will continue even after you unsubscribe from marketing.
11. Automated Decision-Making and Artificial Intelligence
From time to time we use automated tools, including artificial intelligence ("AI"), to help operate our business. Examples include:
• Fraud and abuse detection on Orders and Site activity;
• Product recommendations and site search;
• Automated chat, email triage, translation, and drafting;
• Review moderation and content classification;
• Analytics, marketing measurement, and audience segmentation.
We do not make decisions about you that produce legal or similarly significant effects on you solely on the basis of automated processing without meaningful human involvement, except where permitted or required by law. For example, our fraud tools may flag an Order for review, but a person makes the final decision to cancel or hold an Order for verification.
Your rights. If an automated decision is made about you that has a significant effect on you, you have the right, on request, to be informed of the main factors and parameters that led to the decision, and to submit observations. See Section 15 for how to exercise your rights. Quebec residents have specific rights under Law 25 — see Section 20.
Do not use ECS Coffee data to train AI. As set out in our Terms and Conditions, Content on our Site — including product descriptions, images, editorial copy, and reviews — may not be used to train or evaluate AI models or for text and data mining, except with our prior written permission.
12. How Long We Keep Your Information (Retention)
We keep personal information only as long as necessary for the purposes for which it was collected, or as required by law. Once we no longer need it, we securely destroy, delete, or anonymize it. Typical retention periods include:
• Order and payment records: at least seven (7) years, to meet Canadian tax and record-keeping requirements.
• Account information: for as long as your account is active, and for a reasonable period after closure for legal, security, or fraud-prevention purposes.
• Brew Bucks Rewards data: as described in the Program terms — accounts inactive for more than twenty-four (24) months may be deactivated (see Terms & Conditions, Section 11).
• Marketing lists: until you unsubscribe or your consent otherwise ends, plus a short suppression period so we do not accidentally re-contact you.
• Customer service records: typically two (2) to three (3) years after the last interaction.
• Service and repair records: through the warranty period plus a reasonable period afterward.
• Job applications: up to two (2) years after the application, unless you ask us to delete them sooner.
• CCTV footage: typically thirty (30) to sixty (60) days, unless retained for a specific security or legal purpose.
• Cookies and analytics identifiers: as set out in Section 9; typically up to 24 months.
Actual retention may vary based on legal requirements and business needs. Where possible, we anonymize personal information rather than delete it, so it can no longer be linked back to you.
13. How We Protect Your Information (Safeguards)
We maintain physical, technical, and administrative safeguards designed to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification. These include:
• Transport encryption (HTTPS/TLS) on ecscoffee.com;
• Encryption of payment card data by our PCI-DSS-compliant payment processors;
• Access controls, unique user accounts, and multi-factor authentication for administrative access to our systems;
• Regular software updates and vulnerability monitoring;
• Employee training on privacy and security, and confidentiality obligations in employment agreements;
• Vendor risk review and contractual data-protection commitments with service providers;
• Physical security controls at our head office and retail locations.
No method of transmission or storage is completely secure. While we work hard to protect your personal information, we cannot guarantee absolute security. If you believe your account or personal information has been compromised, contact us immediately at webdesk@ecscoffee.com.
14. Data Breach Notification
If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as required by PIPEDA, and any provincial privacy authority (including the Commission d'accès à l'information du Québec, where applicable). We will also keep records of breaches as required by law.
Notifications will describe the nature of the breach, the personal information involved, the steps we have taken to reduce the risk of harm, and steps you can take to protect yourself.
15. Your Privacy Rights
Subject to applicable law and reasonable verification of your identity, you have the following rights with respect to your personal information:
• Access: to be informed of the existence, use, and disclosure of your personal information, and to be given access to it.
• Correction: to challenge the accuracy and completeness of your information and have it amended as appropriate.
• Withdraw consent: to withdraw your consent, subject to legal or contractual restrictions and reasonable notice (see Section 6).
• Deletion: to request that we delete personal information that we no longer need for the purposes for which it was collected, subject to legal retention obligations.
• Portability (where applicable): to request a copy of information you have provided to us in a structured, commonly used electronic format.
• Object to certain processing: including direct marketing, and to be informed about automated decision-making that significantly affects you (see Section 11).
• Complaint: to complain to our Privacy Officer or to the relevant privacy regulator (see Section 26).
Additional rights for Quebec residents are described in Section 20. Additional rights for California residents are described in Section 21.
16. How to Exercise Your Rights
To exercise any of the rights described in Section 15, contact our Privacy Officer using the details in Section 2. To protect your information, we will need to verify your identity before responding. If you make a request on behalf of another person, we will need proof of your authority to do so.
We will respond within thirty (30) days of receiving a complete request. In some cases we may extend this time period as permitted by law and will notify you if we do. Access to your personal information is generally provided at no cost; where a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline to act, as permitted by law.
If we decline your request in whole or in part, we will explain the reasons and tell you how to escalate the matter.
17. Children's Privacy
Our Site and services are intended for adults. We do not knowingly collect personal information from children under the age of majority in the customer's province, state, or country without the consent of a parent or legal guardian, and in any event we do not knowingly collect personal information from children under the age of thirteen (13) (or under the age of fourteen (14) for Quebec residents).
If you believe that a child has provided personal information to us without appropriate consent, please contact our Privacy Officer and we will take reasonable steps to delete it.
18. Job Applicants
If you apply for a job with ECS Coffee, we collect the information in your application (resumé, cover letter, contact information, references, right to work), notes from any interview or assessment, and any information provided by references or third parties you authorize us to contact.
We use this information to evaluate your application, to communicate with you about the role and future opportunities, and to meet our legal obligations. If you are hired, this information becomes part of your employment file. If you are not hired, we may keep your application for up to two (2) years in case a suitable position opens up, unless you ask us to delete it sooner.
19. In-Store Privacy (CCTV, In-Store Loyalty)
CCTV. Our retail locations use video surveillance for the purposes of security, loss prevention, and employee and customer safety. Signs are posted at entrances to notify you of recording. Recordings are held in secure storage, accessed only by authorized personnel, and typically retained for thirty (30) to sixty (60) days, unless retained for a specific security or legal purpose.
In-store point of sale and loyalty. When you shop in-store, we may ask for your Brew Bucks email, phone, or name to look up your rewards account. We may also ask for your postal code for reporting purposes. Providing this information is optional; you can decline and still complete your purchase.
In-store payment. Payment card data is processed through our terminals by our payment processors and is not stored by ECS Coffee.
20. Quebec Residents — Additional Rights Under Law 25
If you reside in Quebec, the Act respecting the protection of personal information in the private sector (Law 25) gives you additional rights and imposes additional obligations on us:
• Designated person in charge: Our Privacy Officer is the person in charge of the protection of personal information for the purposes of Law 25 and can be reached at privacy@ecscoffee.com.
• Automated decision-making: If we use personal information to make a decision about you that is based exclusively on automated processing, we will inform you at or before the time of the decision and, on request, tell you: the personal information used, the reasons and principal factors that led to the decision, and your right to have the information corrected. You have the right to have the decision reviewed by an individual.
• Data portability: You have the right to receive personal information you have provided to us in a structured, commonly used technological format, and to have that information transferred to another organization, where technically feasible.
• Transfers outside Quebec: Before disclosing personal information outside Quebec, we conduct a privacy impact assessment where required, and we take reasonable steps to ensure the information receives adequate protection.
• Confidentiality by default: Any technological product or service we offer to Quebec residents that collects personal information provides the highest level of confidentiality by default, without any intervention by you.
• Right to de-indexing ("right to be forgotten"): You may request that we cease disseminating personal information about you or de-index a hyperlink allowing access to it, where dissemination contravenes law or a court order or causes you serious injury to your reputation or privacy that outweighs the public interest.
French-language service. Le présent Politique de confidentialité est disponible en français sur demande auprès de notre responsable de la protection des renseignements personnels.
21. California Residents
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), gives you additional rights, including the right to know what personal information we collect and how we use it, the right to request deletion, the right to correct inaccurate information, the right to opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising your rights.
We do not sell your personal information for money. We may "share" personal information for cross-context behavioural advertising, as defined by the CPRA, through advertising cookies and pixels (see Section 9). You can opt out through our cookie banner or by sending a Global Privacy Control signal (see Section 22).
To exercise your California rights, contact our Privacy Officer using the details in Section 2 and identify yourself as a California resident. We will verify your identity before responding.
22. Do Not Track and Global Privacy Control
Some browsers offer a "Do Not Track" (DNT) setting. There is no accepted industry standard for how businesses should respond to DNT signals, and we currently do not respond to DNT signals.
Where legally required, we recognize the Global Privacy Control (GPC) browser signal as a request to opt out of the sale or sharing of personal information for cross-context behavioural advertising (see Section 21).
23. Third-Party Websites and Services
Our Site contains links to third-party websites, applications, and social media platforms, and integrates with third-party services (for example, delivery tracking at https://kwiksavecourier.com/tracking/). These third parties operate independently of ECS Coffee and have their own privacy policies. We are not responsible for the practices of any third-party website or service. Please review their privacy policies before providing personal information.
24. Business Transactions
If ECS Coffee is involved in a merger, acquisition, financing, reorganization, sale of all or part of its business or assets, bankruptcy, or similar event, personal information may be transferred as part of the transaction. Any successor will be bound by this Policy or a substantially equivalent policy for the personal information transferred. Where required by law, we will notify you of any such transfer.
25. Changes to This Privacy Policy
We may update this Policy from time to time. When we do, we will change the "Last Updated" date at the top and post the updated Policy on the Site. Material changes will be notified through the Site or, where appropriate, by email. Your continued use of the Site after an update constitutes acceptance of the updated Policy, to the extent permitted by law.
26. Complaints and Regulator Escalation
If you have a complaint about how we handle your personal information, please contact our Privacy Officer first (Section 2). We will investigate and respond.
If you are not satisfied with our response, you have the right to contact the appropriate privacy regulator:
• Office of the Privacy Commissioner of Canada — https://www.priv.gc.ca — for complaints under PIPEDA.
• Commission d'accès à l'information du Québec — https://www.cai.gouv.qc.ca — for complaints from Quebec residents.
• Information and Privacy Commissioner of Ontario — https://www.ipc.on.ca — for provincial matters, where applicable.
• California Privacy Protection Agency — https://cppa.ca.gov — for California residents.
© 2026 ECS Coffee Inc. All rights reserved.
