Effective date: [DATE]
Last updated: [DATE]

This Privacy Policy explains how [FULL LEGAL COMPANY NAME], carrying on business as StataChain (“StataChain,” “we,” “us” or “our”), collects, uses, discloses, stores and protects personal information.

It applies to the StataChain website, accounts, Listings, forms, communications and related marketplace services.

1. Privacy contact

StataChain has designated the following person to handle privacy questions, access requests and complaints:

Privacy Officer: [NAME OR TITLE]
Email: [PRIVACY EMAIL]
Address: [BUSINESS ADDRESS]

2. Information we collect

Account information

When you register or sign in, we may collect:

• email address;
• username or display name;
• authentication credentials;
• account type;
• company name;
• business role; and
• agreement acceptance date and version.

Capacity Provider information

From Capacity Providers, we may collect:

• legal business name;
• trade name;
• registered and business addresses;
• contact names, emails and telephone numbers;
• company-registration information;
• vessel and operational information;
• evidence of authority to offer capacity;
• insurance or compliance documents; and
• other verification information.

Listings

Listings may contain:

• vessel or ship name;
• commodity or cargo type;
• origin and destination;
• available capacity;
• earliest and latest departure;
• freight rates;
• currency;
• restrictions; and
• notes supplied by the Capacity Provider.

Capacity requests

From Cargo Customers, we may collect:

• legal company name;
• contact name;
• email address;
• telephone number;
• billing or business address;
• country;
• requested Listing or route;
• requested capacity or quantity;
• preferred currency; and
• additional commercial or operational requirements.

Transaction and payment-administration information

We may collect:

• Booking IDs;
• invoice numbers;
• agreed quantities and rates;
• freight and facilitation-fee amounts;
• currencies;
• payment dates and status;
• refund or cancellation information;
• payment-confirmation documents;
• uploaded proof of payment; and
• communications concerning a transaction.

StataChain does not collect or hold the Capacity Provider’s freight payment under the current payment structure.

Tax and reporting information

Where required for digital-platform reporting, we may collect from Capacity Providers:

• legal name;
• primary address;
• tax-residence jurisdictions;
• tax-identification numbers;
• jurisdiction issuing each tax number;
• business-registration number;
• date of birth where the provider is an individual;
• available financial-account identifiers and account-holder information;
• amounts paid or credited;
• transaction counts;
• fees, commissions or taxes charged;
• refunds and cancellations; and
• quarterly transaction information.

These categories reflect information CRA may require from reporting platform operators.

Technical information

When you use the website, we or our service providers may collect:

• IP address;
• browser and device information;
• access times;
• pages viewed;
• login and security logs;
• referring pages;
• error information; and
• cookies or similar technologies.

3. How we use information

We may use information to:

• create and administer accounts;
• publish and manage Listings;
• connect Capacity Providers with Cargo Customers;
• process capacity requests;
• communicate about potential and confirmed bookings;
• prepare and reconcile StataChain invoices;
• maintain transaction records;
• verify businesses and authority to post capacity;
• prevent fraud, abuse and security incidents;
• enforce our agreements;
• respond to questions and disputes;
• comply with tax, accounting, sanctions and legal requirements;
• file required digital-platform reports;
• improve website reliability and usability; and
• send marketing communications where legally permitted.

We will not use personal information for an unrelated new purpose without obtaining consent where required.

4. How we disclose information

Between marketplace users

We may share information necessary to evaluate or complete a transaction between the relevant Capacity Provider and Cargo Customer.

For example, a capacity request may be shared with the Capacity Provider, and relevant provider contact and Listing information may be shared with the Cargo Customer.

Tax-identification numbers and confidential verification documents are not shared with ordinary marketplace users.

Service providers

We may use service providers for:

• website hosting and WordPress administration;
• form processing;
• Google Sheets, Google Drive or other cloud storage;
• email delivery;
• security and spam prevention;
• legal-page or cookie-management tools;
• banking and payment administration;
• accounting, tax and legal services; and
• technical support.

Service providers receive only the information reasonably required to perform their services.

StataChain remains accountable for personal information transferred to third parties for processing and should use contractual or other safeguards providing comparable protection.

Legal and regulatory disclosures

We may disclose information:

• to the Canada Revenue Agency or another tax authority;
• to courts, regulators or law-enforcement authorities;
• to comply with a subpoena, court order or legal duty;
• to investigate fraud or protect users;
• to establish or defend legal claims; or
• as part of a legitimate corporate restructuring, subject to appropriate protections.

5. Processing outside Canada

Some service providers may process or store information outside Canada.

Information processed in another jurisdiction may be subject to that jurisdiction’s laws and may be accessible to its courts, law-enforcement or national-security authorities.

StataChain remains responsible for using reasonable contractual and security measures when information is processed by service providers outside Canada.

6. Consent

By providing information and using StataChain, you consent to collection, use and disclosure for the purposes explained at or before collection.

You may withdraw consent where legally and contractually permitted. Withdrawal may prevent StataChain from providing an account, processing a request or satisfying legal obligations.

Acceptance of this Privacy Policy does not constitute consent to receive optional marketing. Marketing consent will be requested separately where required.

Canadian commercial email rules generally require consent, sender identification and an unsubscribe mechanism for promotional messages.

7. Cookies

StataChain may use essential cookies required for:

• account login;
• security;
• form operation;
• preferences; and
• website functionality.

Where analytics or non-essential cookies are enabled, additional notice or consent may be provided through a cookie banner or Cookie Policy.

Do not include analytics or advertising-cookie wording here unless those tools are actually active.

8. Retention

We retain information only for as long as reasonably necessary to:

• operate accounts and bookings;
• complete transactions;
• resolve disputes;
• enforce agreements;
• maintain accounting and tax records; and
• comply with legal obligations.

Records required under Canada’s digital-platform reporting rules may need to be retained in electronically readable form for at least six years following the end of the last relevant calendar year.

When information is no longer required, we will delete it, anonymize it or securely dispose of it, subject to legal retention obligations.

9. Security

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information.

These may include:

• access restrictions;
• strong account authentication;
• software updates;
• secure backups;
• encryption where appropriate;
• restricted access to tax and payment records; and
• separation of sensitive provider-verification information from public profiles.

No internet system is completely secure, but PIPEDA requires safeguards appropriate to the sensitivity and risks associated with the information.

10. Privacy breaches

StataChain will investigate suspected privacy breaches and take reasonable containment and corrective measures.

Where a breach creates a real risk of significant harm, PIPEDA may require notification to affected individuals and reporting to the Office of the Privacy Commissioner of Canada.

11. Access and correction

You may request:

• confirmation of whether StataChain holds personal information about you;
• access to that information;
• an explanation of how it has been used or disclosed; and
• correction of inaccurate or incomplete information.

Some information may be withheld where permitted or required by law.

Send requests to the Privacy Officer using the contact information above. PIPEDA includes rights relating to openness, individual access and correction.

12. Account closure

You may request account closure.

StataChain may retain transaction, tax, legal, security and agreement-acceptance records after closure where reasonably necessary or legally required.

Closing an account does not automatically erase information contained in completed transaction records.

13. Children

StataChain is a business-to-business service and is not intended for anyone under 18.

We do not knowingly create accounts for children.

14. Changes to this Policy

We may update this Privacy Policy when our services, providers or legal obligations change.

The revised version will display a new “Last updated” date. Material changes may be communicated directly or require renewed acknowledgment.

15. Complaints

Privacy questions or complaints should first be directed to StataChain’s Privacy Officer.

You may also have the right to contact the Office of the Privacy Commissioner of Canada.

16. Contact

[FULL LEGAL COMPANY NAME]
[BUSINESS ADDRESS]
[PRIVACY EMAIL]
[TELEPHONE NUMBER]