North Specs Labs ("North Specs Labs", "we", "us", "our") respects the privacy of the researchers and institutions we supply. This Privacy Policy explains what personal information we collect through northspecs.ca (the "Site"), why we collect it, how we use and share it, how long we keep it, and the rights available to you.
We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Where we offer goods to individuals in the United Kingdom or the European Economic Area, we also apply the UK GDPR and EU GDPR to that processing.
This policy forms part of our Terms of Use.
1. Who is responsible
North Specs Labs is the organisation responsible for the personal information described here (the "controller" for GDPR purposes). Contact our privacy team at [email protected].
2. Information we collect
2.1 Information you give us
- Account details: name, email address, password (stored hashed, never in plain text), and account type.
- Institutional details: laboratory, university, company or institution name, department, role, and where you provide it, an institutional identifier or purchase-order authority.
- Order details: billing and delivery address, contact telephone number, purchase order number, and the products ordered.
- Research-use attestation: the confirmation you make at checkout that you are a qualified researcher, laboratory or research institution, together with the date and time it was made and, where provided, your stated research application.
- Correspondence: the content of enquiries, support requests, batch documentation requests and compliance correspondence.
2.2 Information collected automatically
- Technical data: IP address, browser type and version, device type, operating system, language and referring URL.
- Usage data: pages viewed, products viewed, search terms used on the Site, time on page and navigation paths.
- Cookies and similar technologies: as described in our Cookie Policy.
2.3 Information from third parties
- Payment confirmation from our payment processors, including the outcome of the transaction, the card type and the last four digits. We never receive or store your full card number, expiry date or security code.
- Delivery status from our carriers.
- Fraud and risk signals from our payment and fraud-prevention providers.
2.4 Information we do not want
Do not send us health information, clinical data about identifiable individuals, or any special category personal data. Our products are Research Use Only and we have no need for such information. If you send it, we may delete it.
3. Why we use your information, and our lawful basis
| Purpose | Lawful basis (GDPR) |
|---|---|
| Creating and administering your account | Performance of a contract |
| Processing, dispatching and invoicing orders | Performance of a contract |
| Verifying research-use eligibility and reviewing orders before dispatch | Legal obligation; legitimate interests (regulatory compliance, product stewardship) |
| Providing customer and scientific support | Performance of a contract; legitimate interests |
| Preventing fraud, misuse and unauthorised access | Legitimate interests; legal obligation |
| Maintaining transaction, tax and compliance records | Legal obligation |
| Improving the Site and our catalogue | Legitimate interests |
| Sending service messages about your order | Performance of a contract |
| Sending research updates and product announcements | Consent (withdrawable at any time) |
| Establishing, exercising or defending legal claims | Legitimate interests; legal obligation |
Under PIPEDA we rely on your consent, which may be express or implied depending on the sensitivity of the information and the purpose, together with the statutory exceptions that permit collection, use and disclosure without consent, including for the investigation of a breach of an agreement or a contravention of law.
Where we rely on legitimate interests, we have assessed that our interest in operating a compliant research-supply business does not override your privacy rights.
4. Marketing
We send research updates and product announcements only where you have opted in, or where you are an existing customer and the message concerns similar products and you have not opted out. Every marketing email carries an unsubscribe link. Withdrawing consent does not affect service messages about an order you have placed, which we must send to perform the contract.
5. Sharing your information
We do not sell your personal information, and we do not rent or trade mailing lists.
We share personal information only with:
- Payment processors, to take payment and screen for fraud.
- Shipping carriers and customs brokers, to deliver your order and complete customs formalities. International shipments require us to disclose consignee details to customs authorities.
- IT, hosting, email and analytics providers who process data on our instructions under written contract.
- Professional advisers, including lawyers, auditors and insurers, where necessary.
- Regulators, law enforcement and courts, where we are legally required to disclose, where disclosure is necessary to investigate a suspected breach of our Research Use Only Policy or an unlawful act, or to establish, exercise or defend legal claims.
- A purchaser or successor, in connection with a merger, acquisition or sale of assets, subject to this policy continuing to apply.
Service providers act as processors and may not use your information for their own purposes.
6. International transfers
We are based in Canada and our service providers may be located in Canada, the United States and the European Economic Area. Personal information held by a service provider in another country may be accessible to the courts, law enforcement and national security authorities of that country.
Where we transfer personal information out of the UK or EEA, we rely on an adequacy decision where one applies, or otherwise on the UK Addendum and the European Commission's Standard Contractual Clauses, together with any additional safeguards the transfer requires.
7. Retention
We keep personal information only as long as necessary for the purpose it was collected, and to meet legal and accounting obligations.
- Order and transaction records, including the research-use attestation: seven years from the end of the relevant tax year, reflecting Canadian record-keeping requirements and our need to evidence compliance.
- Account records: for the life of the account, then up to two years after closure.
- Support and compliance correspondence: up to three years, or longer where it relates to an ongoing or anticipated dispute or investigation.
- Marketing preferences: until you withdraw consent, plus a suppression record kept indefinitely so we can honour your opt-out.
- Server and security logs: typically twelve months.
At the end of the applicable period we delete the information or irreversibly anonymise it.
8. Security
We apply technical and organisational measures appropriate to the risk, including encryption of data in transit (TLS), hashed password storage, role-based access control limiting staff access to those who need it, network and application access logging, and contractual security obligations on our processors. Payment card data is handled entirely by PCI-DSS compliant processors and does not reach our systems.
No method of transmission or storage is completely secure. We cannot guarantee absolute security, and you are responsible for keeping your account credentials confidential. Where a breach of security is likely to create a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada, and any other regulator as required.
9. Your rights
Subject to the conditions and exemptions in applicable law, you may:
- Access the personal information we hold about you, and be told how it has been used and to whom it has been disclosed.
- Correct information that is inaccurate or incomplete.
- Withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice.
- Delete information, where we no longer have a lawful basis to keep it. Note that we cannot delete order records or the research-use attestation within their statutory retention period.
- Restrict or object to processing, including direct marketing, which you may object to at any time without giving reasons.
- Port information you provided to us, in a structured, commonly used, machine-readable format, where the processing is based on consent or contract and carried out by automated means.
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions; order review always involves a human.
To exercise a right, email [email protected]. We may need to verify your identity before acting. We respond within thirty days under PIPEDA, and within one month under GDPR, and will tell you if we need an extension.
If you are dissatisfied, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), to your provincial privacy regulator, or, if you are in the UK or EEA, to the Information Commissioner's Office or your local supervisory authority.
10. Cookies
We use strictly necessary cookies to operate the Site, including session, cart and security cookies, and, with your consent, analytics cookies to understand how the catalogue is used. Full detail, including how to manage your preferences, is in our Cookie Policy.
11. Children
The Site is directed at qualified researchers and institutions and is not intended for anyone under the age of majority. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact [email protected] and we will delete it.
12. Changes to this policy
We may update this policy. Material changes will be notified on the Site and, where the change is significant and we hold your contact details, by email. The "last updated" date below shows when this version took effect.
13. Contact
Privacy enquiries and rights requests: [email protected] Compliance and legal notices: [email protected]