Privacy Policy NOVA POST CA

TABLE OF CONTENTS

I. GENERAL INFORMATION
II. CONTACT INFORMATION
III. APPLICABLE LAW ON PERSONAL INFORMATION PROTECTION AND CONFIDENTIALITY OBLIGATIONS
IV. PERSONAL INFORMATION PROTECTION
V. RIGHTS OF INDIVIDUALS REGARDING THEIR PERSONAL INFORMATION AND HOW TO EXERCISE THEM
1. GENERAL LIST OF PRIVACY RIGHTS
A. Right to be informed
B. Right of access
C. Right to correction
D. Right to withdraw consent
E. Right to challenge compliance
2. HOW TO EXERCISE RIGHTS
3. HOW AND WHEN WE WILL HANDLE YOUR REQUEST
VI. CHILDREN’S PRIVACY
VII. PERSONAL INFORMATION CATEGORIES AND PURPOSES OF PROCESSING
VIII. DISCLOSURE OF PERSONAL INFORMATION
1. General rules on disclosure
A. Corporate group companies
B. Logistics and operational partners
C. Service providers and processors
D. Financial institutions and payment service providers
E. Legal and regulatory authorities
F. International service providers and cloud infrastructure
2. Disclosure of personal information for service and operational purposes
IX. STORAGE PERIOD AND DATA DELETION
1. Principles for determining retention periods
2. Archived data access and protection
3. Retention periods table
X. CROSS-BORDER DATA PROCESSING
XI. DISCLOSURE OF PERSONAL INFORMATION TO PUBLIC AUTHORITIES
XII. PRIVACY REQUESTS AND COMPLAINTS
XIII. CONTACT INFORMATION FOR PRIVACY MATTERS
XIV. CHANGES TO THIS PRIVACY POLICY

І. GENERAL INFORMATION

This Privacy and Cookies Policy (“Policy”) describes how Nova Global Logistics CA Ltd (“Company”, “we”, “us”, or “our”) collects, uses, discloses and protects personal information when providing its services.
This Policy applies to personal information collected and processed by the Company:

on the Company’s website (“Website”);
through any digital platforms, applications or services provided by the Company;
through communications with the Company via email, telephone, social media platforms, or other communication channels; and
in connection with the provision of the Company’s services and other business activities,
(together – the “Services”).

The purpose of this Policy is to inform individuals about:

what personal information the Company collects;
the purposes for which personal information is collected, used, and disclosed;
how personal information is protected; and
how individuals may exercise their privacy rights.

For the purposes of this Policy, “personal information” means information about an identifiable individual, as defined under applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA).

This Policy applies to individuals who interact with the Company, including:

visitors of the Website;
customers and recipients of services;
individuals contacting the Company through communication channels;
representatives of the Company’s business partners and contractors; and
candidates applying for employment with the Company, (together referred to as “Users”).

By using the Services or interacting with the Company, Users acknowledge that their personal information may be collected, used and disclosed in accordance with this Policy and applicable privacy laws.

The Company is responsible for personal information under its control and processes such information in accordance with applicable Canadian privacy legislation and the principles of fair information practices.

II. CONTACT INFORMATION

1
Users may contact Nova Global Logistics CA Ltd regarding questions related to this Policy or the processing of personal information using the following contact details:
- by mail: 120 Adelaide W St, Suite 2500 Toronto ON M5H 1T1
- by email: dpo@novapost.com

The Company has designated a Privacy Officer responsible for overseeing compliance with applicable privacy legislation and for responding to inquiries or requests related to personal information.

For the purposes of this Policy, “personal information” means information about an identifiable individual, as defined under applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act.
This may include, among other things, a person’s name, postal address, telephone number, email address, Internet Protocol (IP) address, or other information that can be used to identify an individual.
Information that does not relate to an identifiable individual, such as aggregated or statistical data, is not considered personal information. De-identified information and publicly available information may also fall outside the scope of personal information, depending on applicable law.

Before using the Services, Users are encouraged to review this Policy. The purpose of this document is to inform Users about how the Company collects, uses, discloses, and protects personal information in accordance with applicable privacy laws.

If a User has concerns about how the Company handles personal information, the User is encouraged to contact the Company using the contact details provided above so that the matter may be addressed.
If the User is not satisfied with the Company’s response, the User may have the right to submit a complaint to the Office of the Privacy Commissioner of Canada, which oversees compliance with the Personal Information Protection and Electronic Documents Act.
Additional information about how to submit a complaint is available on the website of the Office of the Privacy Commissioner of Canada.

III. APPLICABLE LAW ON PERSONAL INFORMATION PROTECTION AND CONFIDENTIALITY OBLIGATIONS

The Company processes personal information in accordance with applicable privacy and data protection laws of Canada.
In particular, the Company is subject to the provisions of the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how private sector organizations collect, use, and disclose personal information in the course of commercial activities.
Where applicable, the Company may also be subject to provincial privacy legislation, including but not limited to:
a. the Personal Information Protection Act (PIPA) of Alberta;
b. the Personal Information Protection Act (PIPA) of British Columbia;
c. the Act Respecting the Protection of Personal Information in the Private Sector of Québec.
These laws establish rules governing the collection, use, disclosure, retention, and protection of personal information by private sector organizations operating in Canada.
In accordance with applicable privacy legislation, the Company implements appropriate organizational, technical, and administrative measures to ensure the confidentiality, integrity, and security of personal information under its control.
Employees, contractors, and other persons acting on behalf of the Company who have access to personal information are required to maintain the confidentiality of such information and to process it only for authorized purposes.

IV. PERSONAL INFORMATION PROTECTION

The Company takes reasonable administrative, technical, and physical measures to establish, implement, and maintain appropriate safeguards designed to protect the confidentiality, integrity, and availability of personal information under its control.
These safeguards are intended to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification. The level of protection applied is appropriate to the sensitivity of the personal information and the nature of the Company’s activities.
Any incidents, complaints, or notifications relating to the protection of personal information are documented, reviewed, and addressed in accordance with applicable privacy legislation and the Company’s internal procedures.
Where required by applicable law, the Company may take additional steps to investigate incidents and implement corrective measures to prevent similar occurrences in the future.

V. RIGHTS OF INDIVIDUALS REGARDING THEIR PERSONAL INFORMATION AND HOW TO EXERCISE THEM

GENERAL LIST OF PRIVACY RIGHTS

Under applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act, individuals have certain rights regarding their personal information. The Company is committed to respecting these rights and facilitating their exercise in accordance with applicable law.
Please note that in certain circumstances the Company may not be able to fully comply with a request, for example where disclosure would reveal confidential commercial information, where it would violate legal obligations, or where the rights of other individuals would be affected.

Individuals may exercise the following rights:

A.
Right to be informed

Individuals have the right to be informed about how their personal information is collected, used, and disclosed. This includes information about:
- the categories of personal information collected;
- the purposes for which personal information is collected, used, or disclosed;
- the types of third parties with whom personal information may be shared; and
- the general practices relating to the retention and protection of personal information.

This information is provided through this Policy and other privacy notices made available through the Company’s Services.

B.
Right of access

Individuals have the right to request confirmation of whether the Company holds personal information about them and to obtain access to that information.
Upon request, the Company will provide information about:
- the existence, use, and disclosure of personal information; and
- access to that information, subject to limitations permitted by applicable law.

Right to correction

Individuals have the right to request correction of personal information that is inaccurate, incomplete, or outdated. Where appropriate, the Company will amend the information and communicate the correction to third parties where required by law.

Right to challenge compliance

Individuals have the right to challenge the Company’s compliance with applicable privacy legislation. Questions, concerns, or complaints regarding the handling of personal information may be directed to the Company using the contact details provided in Section CONTACT INFORMATION.
If an individual is not satisfied with the Company’s response, they may submit a complaint to the Office of the Privacy Commissioner of Canada.
Information on how to submit a complaint is available on the website of the Office of the Privacy Commissioner of Canada.

HOW TO EXERCISE RIGHTS

In connection with submitted requests, Nova Global Logistics CA Ltd may request additional information to verify your identity or authority to make the request. Personal information provided for verification will only be used for this purpose.
You may designate an authorized agent to exercise your rights on your behalf. For authorized agents, please provide evidence of authorization when contacting the Company.
If the Company cannot comply fully with a request - for example, due to legal obligations, confidentiality requirements, or other legitimate reasons - the Company will explain the reason to the requester.

HOW AND WHEN WE WILL HANDLE YOUR REQUEST

The Company will respond to requests without undue delay and in any case within 30 days of receiving the request, as required under Canadian law. If additional time is required, the Company will notify the requester and explain the reasons for the delay.
The Company does not charge a fee for processing requests unless the request is manifestly unfounded or excessive. In such cases, a reasonable fee may be charged, and the requester will be informed in advance.
If a request is denied, the Company will provide an explanation. Individuals who are not satisfied with the Company’s response have the right to submit a complaint to the Office of the Privacy Commissioner of Canada, which oversees compliance with the Personal Information Protection and Electronic Documents Act.
Additional information about submitting a complaint is available on the website of the Office of the Privacy Commissioner of Canada.

VI. CHILDREN’S PRIVACY

The Company’s Services are not intended for children. The Company does not knowingly collect personal information directly from children without appropriate consent.
Where personal information relates to a child who does not have the capacity to provide meaningful consent, such consent must be provided by a parent or legal guardian.
If the Company becomes aware that personal information of a child has been collected without appropriate consent, the Company will take reasonable steps to delete such information as soon as practicable.
If you believe that a child has provided personal information to the Company without appropriate consent, please contact us using the contact details provided in the section CONTACT INFORMATION of this Policy.

VII. PERSONAL INFORMATION CATEGORIES AND PURPOSES OF PROCESSING

See below the categories of personal information that may be collected and the purposes for which such information may be used.

Purpose of processing

Collection and delivery of parcels, including shipment tracking and parcel redirection

Placing orders and execution of contracts

Customs administration (where applicable)

Processing payments and maintaining accounting records

Direct marketing and customer communications

Managing the Company’s social media accounts

Processing inquiries, complaints and requests

Recording telephone conversations for service quality and legal protection

Ensuring safety and security (including video surveillance)

Website operation and service improvement

Recruitment and candidate selection

Compliance with legal and privacy obligations

Types of personal information processed

Sender and recipient first name and surname, delivery address, phone number, email address, parcel description, and other information provided by the sender; signature of the recipient at the time of delivery. Data created by the Company: parcel number, delivery confirmation, GPS data related to parcel receipt and delivery.

For individuals: first name, surname, address, phone number, email address. For representatives of legal entities: first name, surname, position, company name, phone number, email address, signature, and contractual documentation.

First name, surname, phone number, email address, parcel number, parcel content description, value of goods, customs-related documentation, and other information required by customs regulations. This may include government-issued identification numbers where required by law.

Information contained in accounting or payment documents, including name, contact information, payment details, bank account information, services provided, transaction details, and tax identification numbers where required by law.

Name, surname, email address, phone number. Marketing communications may include SMS, email, push notifications, or customer satisfaction surveys. Individuals may opt out of such communications at any time.

First name, surname, account name, country, profile photo, comments, reactions, reviews or ratings, information about interactions with Company posts, and messages sent to the Company through social media platforms.

Name, contact details, and any other information provided by individuals when submitting inquiries, complaints or requests via contact forms, phone calls, emails, or other communication channels; communication history.

Audio recordings of calls, subscriber phone number, call date and time, operator name, and related call metadata. Individuals will be notified at the beginning of the call where recording takes place.

Video recordings, date and time of recording, and other relevant security-related information necessary to ensure safety of employees, customers, and Company property.

Technical information such as IP address, device or browser information, operating system, user ID (if applicable), and information about activity on the Company’s website. This information may be collected through log files or cookies.

Applicant data including name, contact details, resume, cover letter, references, interview notes, professional qualifications, employment history, citizenship or work authorization where required, and publicly available professional information (e.g., professional networking platforms).

Name, contact details, IP address, jurisdiction of residence, and any information provided in requests related to privacy rights or regulatory obligations.

2
In certain cases, personal information may also be processed for additional purposes such as:
- fraud prevention and detection;
- compliance with applicable legal or regulatory obligations;
- internal compliance and audit programs;
- risk management and financial control;
- compliance with sanctions or other legal requirements.

VIII. DISCLOSURE OF PERSONAL INFORMATION

General rules on disclosure
NOVA POST may disclose personal information to third parties only where it is necessary for the purposes described in this Policy or where required by applicable law. When disclosing personal information, the Company takes reasonable measures to ensure that such information is protected and used only for the purposes for which it was disclosed.
Personal information may be disclosed in the following cases:

Corporate group companies
to companies that are directly or indirectly owned or controlled by the same ultimate beneficial owners as NOVA POST, within Ukraine, the European Union, Canada, or other jurisdictions, where such disclosure is necessary for the provision, operation, or support of the Services.

Logistics and operational partners
to contractors and service providers involved in logistics operations (for example transport partners, parcel collection points, or parcel locker operators) where such disclosure is necessary to deliver parcels from the sender to the recipient.

Service providers and processors
to companies that provide services to NOVA POST or on its behalf, including IT service providers, hosting providers, cloud service providers, and other technical partners involved in operating the Company’s systems and services.

Financial institutions and payment service providers
to banks, payment processors, and other financial institutions where disclosure is required to process payments or complete financial transactions related to the Services.

Legal and regulatory authorities
to courts, regulators, law enforcement authorities, or other governmental bodies where disclosure is required by applicable law, court order, legal process, or where it is necessary to protect the rights, property, or security of the Company, its users, or third parties.

International service providers and cloud infrastructure
Personal information may also be processed by service providers located outside Canada, including providers of cloud infrastructure, IT services, and technical support used by the Company to operate its services.
In particular, certain personal information may be stored or processed in Ukraine or other jurisdictions where the Company or its service providers operate.
When personal information is processed outside Canada, it may be accessible to courts, law enforcement authorities, or national security authorities of those jurisdictions in accordance with their laws.
NOVA POST takes reasonable contractual, administrative, and technical measures to ensure that service providers processing personal information on its behalf provide a comparable level of protection for such information.

2
DISCLOSURE OF PERSONAL INFORMATION FOR SERVICE AND OPERATIONAL PURPOSES
NOVA POST may disclose personal information where such disclosure is necessary to provide the Services, operate its business, or comply with applicable legal obligations.
In particular, personal information may be disclosed for the following purposes:
- to perform and manage parcel delivery services, including transportation, parcel collection points, parcel locker operations, and related logistics activities;
- to process payments and complete financial transactions related to the Services;
- to operate, maintain, monitor, and improve the Company’s digital services and infrastructure, including analytics, system administration, troubleshooting, and service security;
- to detect, prevent, and investigate fraud, security incidents, or unauthorized access to the Company’s systems;
- to comply with applicable legal, regulatory, accounting, or contractual obligations.

Personal information may also be shared within the NOVA POST corporate group, including with affiliated companies that are directly or indirectly owned or controlled by the same ultimate beneficial owners, where such sharing is necessary for the provision, administration, security, or support of the Services.
Where personal information is disclosed to service providers or affiliated companies, such entities are required to process personal information only for the purposes for which it was disclosed and to implement appropriate technical and organizational safeguards to protect such information.

IX. STORAGE PERIOD AND DATA DELETION

1
NOVA POST retains personal information only for as long as necessary to fulfill the purposes for which it was collected.
The period of personal information retention is determined based on the following criteria:
1. Operational requirements - the period during which the information is necessary to provide and maintain the Services;
2. Legal and regulatory requirements - the period during which NOVA POST is required to retain personal information in order to comply with applicable laws, accounting rules, or regulatory obligations;
3. Business and security purposes - the period during which personal information may be necessary to resolve disputes, enforce agreements, prevent fraud, or protect the security and integrity of the Services.

Archived personal information is accessible only to authorized personnel who require such access for legitimate operational purposes. Appropriate technical and organizational safeguards are implemented to protect archived information.
Once the applicable retention period expires, personal information is securely deleted, anonymized, or otherwise irreversibly destroyed in accordance with NOVA POST’s data retention and disposal procedures.

Detailed retention periods for specific categories of personal information are provided in the table below.

Goal

Collection and delivery of parcels, including shipment tracking and parcel redirection

Placing an order and execution of contracts (offer)

Customs administration

Making payments and maintaining accounting records

Direct marketing (informing about services via SMS, e-mail, push messages and conducting service quality surveys)

Service quality surveys

Managing company social media accounts

Processing inquiries, complaints and requests

Recording of telephone conversations for service quality, complaint handling and security purposes

Ensuring safety and security of employees, customers and property (video surveillance)

Analyzing user experience and improving services

Selection of candidates

Employment records

Storage period

Personal information is stored for 3 (three) months in the active system. After this period, the data is anonymized and stored for up to 3 (three) years in archive systems for operational and analytical purposes.

Personal information is stored for 3 (three) months, after which it is anonymized and retained for up to 3 (three) years in archive systems.

Personal information is stored in the active database for 6 (six) months, after which it is anonymized and stored for up to 3 (three) years in archive systems.

Personal information is retained for 10 (ten) years, unless a longer retention period is required to comply with legal obligations or to resolve disputes or legal claims.

Personal information is processed during the duration of the contractual relationship. Where consent has been provided for direct marketing communications, personal information may be processed for up to 5 (five) years from the date consent was obtained, unless the individual withdraws consent earlier.

Personal information used for conducting surveys is retained for 3 (three) months from the date the service was provided.

Personal information is retained for 3 (three) years.

Personal information is retained for 3 (three) years after the matter is resolved, unless a longer retention period is required to address legal claims or disputes.

Recordings are retained for no more than 6 (six) months, unless a longer retention period is necessary for investigating incidents, handling complaints, or addressing legal claims.

Video recordings are retained for no more than 30 (thirty) calendar days, unless there are reasonable grounds to believe the recordings may be required for investigation of an incident, legal proceedings, or upon receipt of a lawful request for access before the deletion deadline. In such cases, recordings are retained only for as long as necessary for those purposes.

Personal information used for analytics and service improvement is retained between 6 (six) months and 2 (two) years, depending on the type of technology used (for example cookies or analytics tools). Users may opt out where such options are available.

Personal information of unsuccessful candidates is retained for 6 (six) months after the final hiring decision.

Personal information necessary for employment purposes is retained for the duration of employment and thereafter in accordance with applicable employment and labour legislation.

X. CROSS-BORDER DATA PROCESSING

Personal information collected by NOVA POST may be processed or stored in jurisdictions outside Canada, including in countries where the Company or its service providers maintain operations or technical infrastructure.
When personal information is transferred to another jurisdiction for processing, it may be subject to the laws of that jurisdiction and may be accessible to courts, law enforcement, or national security authorities in accordance with applicable legislation.
NOVA POST implements contractual, organizational, and technical safeguards designed to ensure that personal information remains protected in accordance with this Policy and applicable privacy laws.

XI. DISCLOSURE OF PERSONAL INFORMATION TO PUBLIC AUTHORITIES

NOVA POST may disclose personal information to public authorities where such disclosure is required or permitted under applicable laws.
In particular, personal information related to shipments may be provided to customs authorities, border control agencies, tax authorities, or other competent government bodies where such disclosure is necessary to comply with customs regulations, import or export requirements, or other legal obligations associated with the provision of delivery services.
Personal information may also be disclosed to courts, law enforcement agencies, or other competent authorities where required by law, legal process, or valid governmental request.
Where permitted by law, NOVA POST takes reasonable steps to ensure that requests for disclosure are lawful and limited to the information necessary to fulfill the specific legal requirement.

XII. PRIVACY REQUESTS AND COMPLAINTS

NOVA POST is committed to protecting personal information and ensuring that individuals are able to exercise their privacy rights.
Individuals may submit requests regarding their personal information, including requests to access, correct, or update personal information held by NOVA POST.
If an individual has concerns about how their personal information has been handled, they may submit a privacy complaint to the Company. NOVA POST will review such complaints and respond within a reasonable period of time.
If the individual is not satisfied with the response provided by NOVA POST, they may submit a complaint to the competent privacy authority in Canada.
Complaints related to privacy matters may be submitted to:
Office of the Privacy Commissioner of Canada
Website: https://www.priv.gc.ca

XIII. CONTACT INFORMATION FOR PRIVACY MATTERS

If you have questions about this Privacy Policy or about how NOVA POST processes personal information, you may contact the Company using the contact details provided below.
Requests related to access, correction, or deletion of personal information, as well as privacy complaints, may also be submitted through these contact channels.
NOVA POST has designated a person responsible for overseeing compliance with applicable data protection laws and for handling privacy-related inquiries.
Contact details for privacy matters:
Email: dpo@novapost.com
Address: 120 Adelaide W St, Suite 2500 Toronto ON M5H 1T1

XIV. CHANGES TO THIS PRIVACY POLICY

NOVA POST may update or amend this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or technological developments.
Where material changes are made to this Privacy Policy, the updated version will be published on the relevant website or digital service, and the effective date of the update will be indicated in the document.
Users are encouraged to review this Privacy Policy periodically to remain informed about how their personal information is processed and protected.

Additional information