Privacy Policy

Effective date: August 5, 2026
Last updated: August 5, 2026

Toronto Surplus & Scientific Inc., also referred to as "Toronto Surplus," "TSS," "we," "us," or "our," respects your privacy and is committed to handling personal information responsibly.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you:

  • Visit https://www.torontosurplus.com;
  • Create or use an account;
  • Contact us or book an appointment;
  • Request a quote;
  • Purchase, return, or inquire about equipment;
  • Arrange a prop rental;
  • Communicate or otherwise interact with us online or offline.

Toronto Surplus buys and sells used surplus, scientific, and electronic equipment. We also rent equipment and other items as props for film, television, movie, and video productions.

1. Toronto Surplus's Role

Toronto Surplus & Scientific Inc. is responsible for the personal information under its control.

Our Privacy Officer oversees compliance with this Privacy Policy and handles privacy questions and requests.

Privacy Officer
Toronto Surplus & Scientific Inc.
3622B Vivian Rd.
Whitchurch-Stouffville, Ontario L4A 2M4
Canada

Email: [email protected]
Telephone: 905-853-0078
Toll-free: 866-376-0078
Contact form: https://www.torontosurplus.com/contact

2. Scope of This Policy

This Policy applies to personal information collected through our website and through related business interactions, including telephone, email, in-person, order, payment, shipping, accounting, and prop-rental activities.

It does not apply to the independent privacy practices of third-party websites, payment services, shipping carriers, or other services that are not controlled by Toronto Surplus. When you use a third-party service, that organization may process your information under its own privacy policy.

3. Personal Information We Collect

The information we collect depends on how you interact with us.

3.1 Account information

When you create or manage an account, we may collect:

  • First and last name;
  • Email address;
  • Login credentials;
  • IP address;
  • Age;
  • Account creation and verification information;
  • Account status;
  • Authentication and account activity records;
  • Information submitted when correcting or updating your account.

Passwords are stored using cryptographic hashing and are not stored in readable form.

You do not need an account merely to browse our inventory. An account may be required to place certain contactless online orders or make payments through the website. Customers may also contact us by telephone or through our contact form to discuss other ordering arrangements.

3.2 Order and transaction information

When you request a quote, place an order, make a payment, request a refund, or complete another transaction, we may collect:

  • Name;
  • Company or organization name;
  • Email address;
  • Telephone number;
  • Billing address;
  • Mailing or shipping address;
  • Products or services requested or purchased;
  • Order and invoice details;
  • Prices, taxes, shipping charges, and totals;
  • Payment status;
  • Payment processor transaction identifiers;
  • Purchase, return, and refund history;
  • Shipping and delivery information;
  • Customs or import information where required;
  • Communications concerning the transaction.

Toronto Surplus does not directly collect or store complete credit card numbers. Payments are processed by Stripe or PayPal. Those providers collect and process payment information under their own terms and privacy policies.

We may receive payment confirmation, transaction identifiers, payment status, refund information, and limited billing details from those providers.

3.3 Contact forms, inquiries, and appointments

When you contact us or book an appointment, we may collect:

  • Name;
  • Email address;
  • Telephone number;
  • Company name, if provided;
  • Appointment date and time;
  • Information about the item, order, service, or subject of your inquiry;
  • The contents of your message;
  • Files or other information you voluntarily submit;
  • Our response and subsequent communications.

Please do not include unnecessary sensitive personal information in a contact form or message.

Our contact form is not a public forum. Messages and submitted information are not made publicly available.

3.4 Prop-rental information

When you inquire about or enter into a prop-rental arrangement, we may collect information online or offline, including:

  • Your name and contact information;
  • Production-company or organization information;
  • Names and contact details of authorized representatives;
  • Rental inquiries and requested dates;
  • Rental agreements;
  • Identification where reasonably necessary;
  • Deposit and payment information;
  • Insurance certificates;
  • Pickup and return information;
  • Equipment condition and inspection records;
  • Records concerning damage, loss, late return, or non-return;
  • Communications related to the rental.

We collect and retain information necessary to evaluate, establish, administer, secure, and enforce a rental arrangement. Where we request information for an additional optional purpose, or where applicable law requires additional consent, we will provide an appropriate notice and request consent.

We will seek to limit identification collection to what is reasonably necessary. Where viewing identification is sufficient, we may verify it without retaining a copy. If a copy must be retained, its purpose and applicable retention period will be communicated at the time of collection, and the copy will be securely destroyed once no longer required.

3.5 Technical, security, and activity information

When you use the website, we may automatically collect limited technical and security information, including:

  • IP address;
  • Browser and user-agent information;
  • Device and operating-system information derived from request data;
  • HTTP request headers;
  • Date and time of requests;
  • Pages or website functions requested;
  • Authentication and account activity;
  • Security events;
  • Rate-limiting information;
  • Cloudflare Turnstile verification and related security results;
  • Information used to identify bots, fraud, abuse, or suspicious activity;
  • Server, application, and error logs.

We do not currently create persistent device fingerprints for advertising or behavioral profiling.

Technical information is used to operate and secure the website, distinguish legitimate customers from automated traffic, troubleshoot errors, enforce our terms, and prevent fraud, abuse, and unauthorized access.

3.6 Embedded video content

Our homepage may display an embedded video hosted on YouTube, a service provided by Google. We embed this video using YouTube's privacy-enhanced mode, which is designed not to set advertising or tracking cookies on your device unless you play the video.

If you play the embedded video, YouTube and Google may collect information such as your IP address, device and browser information, and viewing interactions, and may set cookies or use similar technologies, in accordance with Google's own privacy policy. Toronto Surplus does not receive individualized viewing data from YouTube through this embed.

3.7 Information associated with inventory acquisitions

Toronto Surplus does not currently purchase equipment through an automated website purchasing process.

If you contact us about equipment that you wish to sell, we may process the contact information and message you voluntarily provide. Any potential acquisition is evaluated separately and does not constitute an accepted purchase merely because you contacted us through the website.

3.8 Information we do not intentionally collect

Through the website, we do not intentionally collect:

  • Social Insurance Numbers;
  • Social Security Numbers;
  • Passport or driver's licence numbers, except where identification may be reasonably necessary for a separately arranged rental or transaction;
  • Health or medical information;
  • Genetic information;
  • Biometric identifiers;
  • Racial or ethnic origin;
  • Religious or philosophical beliefs;
  • Sexual orientation;
  • Precise GPS location;
  • Education records;
  • Employment history;
  • Information for targeted advertising.

Please do not submit this information unless we specifically request it for a legitimate and clearly explained purpose.

4. How We Collect Information

We may collect personal information:

Directly from you

This includes information you provide through:

  • Account registration and account settings;
  • Checkout and order forms;
  • Quote requests;
  • Contact forms;
  • Appointment bookings;
  • Telephone calls;
  • Emails;
  • Returns and refund requests;
  • Rental agreements;
  • In-person transactions;
  • Other communications with us.

Automatically from the website

Our website and security systems may automatically collect IP addresses, request headers, user-agent data, activity records, and server or security logs. We and certain service providers also use cookies and similar browser technologies as described in Section 8.

From service providers

We may receive limited information from organizations assisting with a transaction, such as:

  • Payment status and transaction identifiers from Stripe or PayPal;
  • Shipping status from a carrier;
  • Security information from Cloudflare;
  • Email transmission or delivery information from our email service provider;
  • Accounting and transaction records maintained through our accounting software.

5. How We Use Personal Information

We may use personal information to:

  • Create, verify, secure, and administer accounts;
  • Respond to inquiries;
  • Schedule appointments;
  • Prepare quotes and invoices;
  • Process and fulfill orders;
  • Arrange shipping and delivery;
  • Process payments, returns, and refunds;
  • Administer prop rentals;
  • Verify customer or representative authority where necessary;
  • Communicate essential information about accounts, orders, quotes, invoices, rentals, and policy changes;
  • Maintain accounting, tax, and transaction records;
  • Provide customer service;
  • Diagnose technical problems;
  • Improve the functionality and reliability of our website and services;
  • Detect and prevent bots, fraud, abuse, unauthorized access, and security incidents;
  • Protect customers, Toronto Surplus, its property, and its systems;
  • Enforce our agreements and website terms;
  • Manage legal claims, disputes, chargebacks, investigations, or insurance matters;
  • Comply with tax, accounting, customs, regulatory, court, and other legal obligations;
  • Complete a corporate transaction such as a merger, financing, restructuring, or sale of assets;
  • Carry out another purpose explained when the information is collected;
  • Carry out another purpose with consent or as otherwise permitted by law.

We do not use customer information for third-party targeted advertising or AI model training.

6. Consent and Required Information

Depending on the circumstances and applicable law, consent may be express or implied.

For example, when you provide information to request a quote or fulfill an order, you consent to our processing the information reasonably necessary to respond and complete the requested transaction.

Some information is required to provide a requested service. For example, we cannot ordinarily ship an order without a recipient name and delivery address. If you do not provide required information, we may be unable to create an account, respond to a request, process a transaction, deliver an item, or enter into a rental arrangement.

Where we rely on consent, you may withdraw it subject to reasonable notice and applicable legal or contractual restrictions. Withdrawing consent does not require us to delete information that we are legally required or otherwise permitted to retain.

7. Essential Communications and Anti-Spam Compliance

Toronto Surplus does not currently send marketing emails, marketing text messages, or targeted advertising communications.

We may send essential service-related communications, including:

  • Email verification messages;
  • Password and account-security messages;
  • Account-change notifications;
  • Quotes and invoices;
  • Order confirmations and updates;
  • Payment and refund information;
  • Shipping information;
  • Appointment communications;
  • Rental communications;
  • Responses to inquiries;
  • Important legal, security, or Privacy Policy notices.

These communications are necessary to provide or administer the relevant service. You may not be able to opt out of essential messages while maintaining an account or active transaction.

Toronto Surplus does not currently send SMS or text-message marketing.

7.1 Canada's Anti-Spam Legislation (CASL)

Toronto Surplus conducts its electronic messaging in a manner consistent with Canada's Anti-Spam Legislation (CASL).

The messages we send are transactional and service-related — they facilitate, complete, or confirm a transaction or relationship that you have requested, or provide information you are entitled to receive (such as account, quote, invoice, order, payment, shipping, appointment, rental, security, or legal notices). Under CASL, these messages are treated differently from commercial electronic messages sent for marketing purposes, and generally do not require separate marketing consent.

Regardless of message type, our communications identify Toronto Surplus as the sender and provide a means of contacting us, consistent with CASL's identification requirements. Because we do not currently send marketing or promotional electronic messages, we do not maintain a marketing mailing list. If we introduce optional marketing communications in the future, we will obtain any consent required under CASL and provide a clear and functioning unsubscribe mechanism in each such message.

8. Cookies and Similar Technologies

Toronto Surplus uses only strictly necessary (essential) and functional cookies and similar technologies, including limited use of browser storage. We do not use cookies or browser storage for analytics, marketing, targeted advertising, or cross-site behavioral tracking. Our custom website is not designed to set first-party advertising or analytics cookies.

8.1 Essential cookies we use

Our website relies on a small number of first-party cookies that are necessary for core functionality and security, including:

  • Authentication and session cookies — set by our sign-in system to keep you securely logged in, maintain your session, and protect against cross-site request forgery. Most of these are session cookies removed when your session ends; some are short-lived secured cookies used only for authentication and session integrity.
  • Security cookies — associated with Cloudflare and Cloudflare Turnstile, used to distinguish legitimate visitors from automated traffic, protect forms and requests, support rate limiting, and defend the website against bots, fraud, and denial-of-service attacks.

Because these cookies are strictly necessary to deliver functions you have requested (such as signing in, submitting a protected form, or completing checkout), we do not display a consent banner for them. You can control or delete cookies through your browser settings, but disabling essential cookies may prevent you from signing in, submitting forms, or completing a purchase.

8.2 Browser storage for functional preferences

To provide certain website features, we store a limited amount of information in your browser using local storage and session storage. This information generally stays on your device and is not used to track you across other websites. It includes:

  • Currency display preference — remembers the currency you choose to view prices in.
  • Interface preferences and page state — such as remembering minor display settings and preserving your place as you navigate, so the site behaves consistently during and between visits.

Session storage is cleared when you close your browser tab. Local-storage preferences remain until you or your browser clear them. If you are signed in as an administrator, additional local-storage entries may be used to remember interface settings within the administrative area; these are functional only and are not used for tracking.

8.3 Third-party cookies and embedded content

Some third-party services we rely on may set their own cookies or use similar technologies when you interact with their functionality:

  • Cloudflare — for security, bot detection, and denial-of-service protection.
  • Stripe and PayPal — when you access payment functionality or their hosted checkout pages, in order to process payments securely and prevent fraud.
  • YouTube (Google) — our homepage may embed a video using YouTube's privacy-enhanced mode. In this mode, YouTube is designed not to set cookies until you play the video. If you play the video, YouTube and Google may set cookies and collect information under Google's own privacy policy.

The information collected by these providers is governed by their respective privacy notices and service terms. We do not control the cookies or technologies set by these third parties.

9. Analytics and Advertising

Toronto Surplus does not currently use:

  • Google Analytics or comparable third-party audience analytics;
  • Advertising pixels;
  • Retargeting services;
  • Cross-context behavioral advertising;
  • Session-replay software;
  • Heatmaps;
  • Affiliate tracking;
  • Browser fingerprinting for advertising;
  • Email tracking pixels for marketing.

If these practices change, we will update this Policy and provide any required notice or consent mechanism before using the relevant technology.

10. How We Disclose Personal Information

We do not sell or rent personal information.

We may disclose personal information to the following categories of recipients where reasonably necessary.

10.1 Hosting and infrastructure providers

Our website, application, and database are hosted using DigitalOcean infrastructure in the United States. DigitalOcean may process stored information and technical records as necessary to provide hosting, storage, backup, network, and infrastructure services.

10.2 Security providers

Cloudflare provides content-delivery, Turnstile, denial-of-service protection, rate-limiting, bot-detection, and related website-security services. Cloudflare may process IP addresses, request headers, device and browser information, security events, and other technical information.

10.3 Payment processors

Stripe and PayPal process payments and may collect payment, billing, device, transaction, and fraud-prevention information.

Toronto Surplus does not directly receive or store complete payment-card numbers. We may receive transaction identifiers, payment confirmation, limited billing information, payment status, and refund information.

10.4 Email and communication providers

We send transactional and service-related emails (such as email verification, account-security, quote, invoice, order, payment, shipping, and appointment messages) from [email protected], an address under the torontosurplus.com domain.

We send these transactional emails using the Microsoft Graph API and Microsoft Azure services. Microsoft, as our email service provider, may process recipient names, email addresses, email contents, attachments, quotes, invoices, order information, delivery metadata, and other information contained in outgoing emails as necessary to transmit, deliver, and secure those messages. We will update this Policy if the email provider we rely on changes materially.

10.5 Accounting providers and professional advisers

Relevant customer and transaction information may be manually entered into our accounting software (QuickBooks Online). This may include:

  • Customer and company names;
  • Addresses;
  • Email addresses;
  • Invoice details;
  • Products;
  • Transaction totals;
  • Payment status;
  • Refund information;
  • Transaction identifiers.

Our accountants may access or receive relevant financial records to prepare financial statements, tax filings, and reports required by government authorities.

We may also disclose relevant information to lawyers, insurers, auditors, or other professional advisers where reasonably necessary to receive advice, manage risks, resolve disputes, or comply with legal obligations.

10.6 Shipping and logistics providers

We may disclose information necessary to calculate shipping rates, prepare customs documentation, deliver an order, provide delivery updates, or handle a return to carriers and logistics providers. We currently use Canada Post for shipping and rate calculation, and may use other carriers or customs and logistics providers selected for a particular transaction.

The information disclosed may include the recipient's name, company, shipping address, postal code, email address, telephone number, package details, declared value, and information required for customs, insurance, tracking, or delivery.

10.7 Embedded content providers

When our homepage displays an embedded YouTube video and you choose to play it, Google (which operates YouTube) may receive your IP address, device and browser information, and viewing interactions, and may process that information under its own privacy policy. We use YouTube's privacy-enhanced embed to limit this data collection unless you play the video.

10.8 Legal authorities and protection of rights

We may disclose personal information where we reasonably believe disclosure is necessary to:

  • Comply with a law, regulation, subpoena, warrant, court order, or lawful government request;
  • Cooperate with law enforcement or a regulator;
  • Establish, exercise, or defend legal claims;
  • Investigate or prevent fraud, theft, abuse, or a security incident;
  • Protect the rights, safety, systems, equipment, or property of Toronto Surplus, our customers, or others;
  • Enforce our agreements.

10.9 Business transactions

Personal information may be disclosed as part of a proposed or completed merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction.

Where required, we will take reasonable steps to require that the information be protected and used only for purposes associated with the transaction or as otherwise permitted by law.

11. No Sale or Behavioral Advertising Sharing

Toronto Surplus does not:

  • Sell personal information for money or other valuable consideration;
  • Share personal information for cross-context behavioral advertising;
  • Use personal information for third-party targeted advertising;
  • Permit advertisers to build advertising profiles through our website.

Because we do not engage in these practices, there is no sale or behavioral-advertising sharing from which users need to opt out.

If our practices change, we will update this Policy and implement legally required privacy controls before beginning the new practice.

12. International Orders and Currency Displays

Toronto Surplus primarily operates from Canada. Products may not be available for sale or delivery in every country.

International orders require manual review for matters such as:

  • Product eligibility;
  • Shipping availability;
  • Insurance;
  • Customs requirements;
  • Tariffs and duties;
  • Import and export restrictions;
  • Border-control requirements;
  • Product-safety requirements;
  • Payment and fraud risks.

Displayed currency conversions are estimates provided for informational convenience. Transactions are completed only in Canadian or United States dollars. Displaying a converted price does not guarantee that a product is available for purchase or delivery in a particular country.

Toronto Surplus may decline an international order that cannot lawfully or practicably be fulfilled.

13. Cross-Border Processing

Toronto Surplus operates in Canada, but some of our service providers process or store information outside Canada, particularly in the United States.

For example:

  • DigitalOcean hosts our website and database in the United States;
  • Cloudflare may process technical and security information through its global network;
  • Microsoft may process transactional email information in the jurisdictions where its services operate;
  • Stripe and PayPal may process payment and fraud-prevention information internationally;
  • QuickBooks Online may process accounting information outside Canada;
  • Google may process information relating to an embedded YouTube video you choose to play;
  • International carriers may process information in the destination or transit countries.

When personal information is processed outside your province or country, it may be subject to the laws of the jurisdiction where it is processed and may be accessible to courts, law-enforcement agencies, or government authorities under those laws.

We use service providers for legitimate business purposes and take reasonable measures appropriate to the sensitivity of the information to require that service providers protect information entrusted to them.

14. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including business, tax, accounting, security, dispute-resolution, and legal purposes.

14.1 Accounts

We generally retain account information while the account remains active.

An account may be considered inactive when there has been no successful login, order, quote, rental, account update, or customer-initiated service interaction for two consecutive years.

We may delete or deactivate an inactive account after providing approximately 60 days' advance notice to the email address associated with the account. Logging into the account or otherwise completing a qualifying activity during the notice period may prevent inactivity deletion.

Automated messages, bot activity, attempted unauthorized logins, and background system events do not count as customer activity.

When an account is deleted, we delete or deactivate its login credentials and remove profile information that is no longer needed. Information independently required for an order, invoice, payment, refund, shipment, security matter, dispute, or legal obligation may be retained separately.

14.2 Financial and transaction records

We generally retain orders, invoices, payment transaction identifiers, refunds, shipment records, and supporting tax and accounting information for seven years.

Because eligible records are reviewed and deleted in annual batches, some records may remain for up to eight years. Information may be kept longer if required by law or reasonably necessary for:

  • An audit;
  • A chargeback;
  • A dispute;
  • An investigation;
  • Fraud prevention;
  • An insurance matter;
  • Litigation or another legal claim;
  • A preservation or legal-hold obligation.

14.3 Contact and support records

Contact-form submissions, appointment information, inquiries, and customer-service communications are kept for as long as reasonably necessary to respond, maintain an appropriate business record, protect security, administer a transaction, or address a legal issue.

14.4 Technical and security records

IP addresses, request data, activity records, and security logs are retained for a period reasonably necessary to operate and protect the website, investigate suspicious activity, prevent fraud or abuse, troubleshoot errors, and enforce our agreements.

Records associated with a confirmed security, fraud, legal, or dispute matter may be retained longer than routine logs.

14.5 Prop-rental records

Prop-rental information is retained for the period reasonably necessary to administer and enforce the rental, document item condition, resolve damage or non-return issues, satisfy insurance requirements, and meet tax, accounting, and legal obligations.

Where additional consent or a specific retention notice is required for particular rental information, we will provide that information during the rental process.

14.6 Backups

Information removed from active systems may remain in access-restricted backups for up to six months under our backup-retention schedule.

Backups are maintained for disaster recovery and business continuity and are not intended for ordinary business use. If a backup is restored, we will take reasonable steps to reapply applicable account deletions and privacy requests.

Ordinary retention periods may be suspended where information is subject to a documented legal hold.

15. Security Safeguards

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, misuse, or destruction.

Depending on the system and circumstances, these safeguards include:

  • HTTPS encryption for information transmitted through the website;
  • Cryptographic hashing of account passwords;
  • Role-based access controls;
  • Multi-factor authentication for administrative access;
  • Email verification;
  • Secrets-management controls;
  • Rate limiting;
  • Bot detection;
  • Cloudflare denial-of-service protection;
  • Logging and security monitoring;
  • Restricted administrative access;
  • Secure payment processing through Stripe and PayPal;
  • Regular backups;
  • Procedures intended to respond to suspected security incidents.

No electronic transmission or storage system is completely secure. We cannot guarantee that unauthorized access, loss, or disclosure will never occur.

You are responsible for maintaining the confidentiality of your login credentials and should notify us promptly if you believe your account or personal information has been compromised.

15.1 Breach notification

If we become aware of a breach of security safeguards involving personal information under our control that creates a real risk of significant harm to an affected individual, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada as required under applicable law. Notification will be provided as soon as feasible in the circumstances and will describe, to the extent known, the nature of the breach, the information involved, and the steps individuals can take to reduce their risk of harm. We will maintain records of security breaches as required by law and will notify other organizations or government institutions where doing so may reduce the risk of harm.

16. Your Privacy Rights and Choices

Depending on where you live and which laws apply, you may have rights concerning your personal information.

Toronto Surplus voluntarily permits individuals to request:

  • Confirmation of whether we hold personal information about them;
  • Access to eligible personal information;
  • A portable or exportable copy of eligible information;
  • Correction of inaccurate or incomplete information;
  • Deletion of an account;
  • Deletion of eligible personal information;
  • Information about how personal information has been used or disclosed;
  • Withdrawal of consent where processing relies on consent.

You may also update certain information or delete your account through account settings.

These rights are not absolute. For example, we may retain information needed to:

  • Comply with tax, accounting, or legal requirements;
  • Complete or document a transaction;
  • Protect against fraud or security threats;
  • Establish, exercise, or defend legal claims;
  • Resolve a dispute;
  • Enforce an agreement;
  • Protect the rights and safety of Toronto Surplus or others.

If information cannot be deleted, we may restrict it to the purposes that justify its continued retention.

17. Submitting a Privacy Request

You may submit a privacy request through:

  • Email: [email protected];
  • Contact form: https://www.torontosurplus.com/contact;
  • Telephone: 905-853-0078;
  • Toll-free telephone: 866-376-0078;
  • Mail to our Privacy Officer at the address provided above;
  • Account settings, where the requested function is available.

Please clearly describe your request and provide enough information for us to identify the relevant account or transaction.

We may need to verify your identity before providing access to, changing, exporting, or deleting information. Verification may include:

  • Confirming control of the account email address;
  • Asking for information associated with an order or invoice;
  • Confirming transaction details;
  • Requesting other reasonable verification information.

We will not request more verification information than is reasonably necessary.

We aim to respond within 30 days. Where applicable law provides a different deadline or permits an extension, we will follow that law and notify you when required.

Authorized representatives

An authorized representative may submit a request on your behalf. We may require:

  • Written proof of authorization;
  • Verification of the representative's identity;
  • Verification of your identity;
  • Direct confirmation from you that the representative is authorized to act.

We may decline a representative's request where authorization or identity cannot reasonably be verified.

18. Children's Privacy

The website and our services are not directed to children under 13.

We do not knowingly collect personal information directly from children under 13 without appropriate parental or guardian involvement or consent where required. Because we do not routinely collect dates of birth, we may not always know a user's age.

If you believe a child under 13 has provided personal information without appropriate authorization, please contact our Privacy Officer. We will review the matter and take reasonable steps to delete or otherwise lawfully address the information.

Parents and guardians should supervise children's internet use and should not permit a child to create an account, place an order, or enter into a rental arrangement without appropriate involvement.

19. Artificial Intelligence

Toronto Surplus does not currently use customer personal information or submitted content to train artificial-intelligence models.

The website does not currently provide an AI chatbot or AI-generated customer service. Toronto Surplus cannot control whether unrelated third parties independently collect publicly available website content for their own purposes, but we do not authorize such activity merely by operating a public website.

20. Canadian Privacy Rights and Applicable Law

Toronto Surplus handles personal information in accordance with applicable Canadian privacy law. At the effective date of this Policy, the primary federal law governing our handling of personal information in the course of commercial activity is the Personal Information Protection and Electronic Documents Act (PIPEDA).

We are aware that federal privacy law in Canada is under active reform. Following the end of the previous reform effort (former Bill C-27), Parliament is currently considering Bill C-36, the Protecting Privacy and Consumer Data Act (PPCDA), which proposes to amend PIPEDA and modernize Canada's federal private-sector privacy framework. As of the effective date of this Policy, that bill has not become law, and PIPEDA continues to govern. We monitor these developments and will update this Policy and our practices as needed if the PPCDA, or other reforms, come into force.

Subject to lawful exceptions, individuals may request access to personal information under our control and ask us to correct inaccurate or incomplete information. If we refuse all or part of a request, we will provide an explanation where required by law.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada:

https://www.priv.gc.ca

Residents of Quebec may also have rights under Quebec's Act respecting the protection of personal information in the private sector, as amended. Questions and requests may be directed to our Privacy Officer. Where applicable, a concern may also be submitted to the Commission d'accès à l'information du Québec:

https://www.cai.gouv.qc.ca

We also send electronic messages in a manner consistent with Canada's Anti-Spam Legislation (CASL), as described in Section 7.1.

21. California Privacy Disclosures

21.1 CalOPPA disclosures

During the preceding 12 months, Toronto Surplus may have collected the following categories of personal information:

  • Names and contact information;
  • Account and authentication information;
  • Billing and shipping addresses;
  • Commercial and transaction information;
  • Payment transaction identifiers and status;
  • Internet, network, device, and security information;
  • Contact-form and customer-service communications;
  • Rental and appointment information;
  • Other information voluntarily provided by an individual.

We may disclose these categories of information for operational business purposes to:

  • Hosting and infrastructure providers;
  • Security providers;
  • Payment processors;
  • Email and communication providers;
  • Accounting providers;
  • Accountants, lawyers, insurers, and other professional advisers;
  • Shipping and logistics providers;
  • Embedded-content providers, where you interact with embedded content;
  • Government, regulatory, judicial, or law-enforcement authorities where required;
  • Parties involved in a business transaction.

California residents may review and update certain account information through account settings or may contact us using the methods in Section 17.

21.2 Do Not Track

Some browsers provide a "Do Not Track" setting. There is no universally accepted technical standard governing how websites should respond to every Do Not Track signal.

Toronto Surplus does not use behavioral advertising or cross-site advertising tracking and therefore does not change its practices in response to a browser Do Not Track setting.

Third-party payment, security, and embedded-content providers may independently process technical information under their own privacy policies.

21.3 Global Privacy Control

Toronto Surplus does not sell personal information or share it for cross-context behavioral advertising. Because we do not engage in the practices addressed by an opt-out preference signal, a Global Privacy Control signal does not result in a different sale or advertising-sharing setting on our website.

21.4 CCPA/CPRA status

Based on our current business practices and scale, Toronto Surplus does not presently believe it meets the statutory applicability thresholds for a covered business under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

Nevertheless, we voluntarily provide the access, correction, export, and deletion processes described in this Policy, subject to identity verification, legal exceptions, and record-retention requirements.

Nothing in this section limits any right that applies to an individual under applicable law.

22. External Links and Third-Party Services

Our website may link or redirect you to third-party websites or services, or embed third-party content, including Stripe, PayPal, shipping carriers, YouTube, or other external resources.

We do not control the privacy, security, or content practices of independent third parties. You should review their privacy policies before submitting personal information or interacting with their content.

The presence of a link or embedded content does not necessarily mean that Toronto Surplus endorses every practice of the linked or embedded service.

23. Changes to This Policy

We may update this Privacy Policy to reflect changes to:

  • Our website or services;
  • Our information-handling practices;
  • Our service providers;
  • Legal or regulatory requirements;
  • Security or operational needs.

When we update this Policy, we will post the revised version on our website and update the "Last updated" date.

If changes are material, we may also provide notice by email, through an account notification, through a website banner, or by another method appropriate to the circumstances. Email notice may be sent to the address associated with an active account.

Your continued use of the website does not override any consent requirement imposed by applicable law.

24. Language

This Privacy Policy may be made available in French or other languages for convenience.

The English version is intended to be the controlling version to the extent permitted by applicable law. Where applicable law requires another version to govern or requires that language rights be respected differently, applicable law will control.

25. Contact the Privacy Officer

For questions, complaints, consent withdrawals, or requests concerning personal information, contact:

Privacy Officer
Toronto Surplus & Scientific Inc.
3622B Vivian Rd.
Whitchurch-Stouffville, Ontario L4A 2M4
Canada

Email: [email protected]
Telephone: 905-853-0078
Toll-free: 866-376-0078
Contact form: https://www.torontosurplus.com/contact

We will investigate privacy complaints and take appropriate steps where a complaint is justified.

Other Legal Documents

This page is publicly archived for compliance purposes. To contact us about this policy, see our Privacy Policy.
Privacy Policy