Privacy Policy

Last updated: October 8, 2026

Scenic Floral Inc. (“Scenic Floral”, “we”, “us”) is a wholesale floral distributor based in Beamsville, Ontario. This policy explains what personal information we collect through this website and our online trade portal, why we collect it, how we protect it, who we share it with, and the choices and rights you have. We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and its fair information principles.

Our website and portal are for businesses — florists, retailers and other trade customers. We don't sell to the public online, and we don't take payments on this website.

1. Who is responsible

Scenic Floral is responsible for the personal information under our control, including information handled for us by our service providers. Our Privacy Officer is accountable for our compliance with this policy. You can reach them using the details in section 12.

2. What we collect

We only collect what we need for the purposes described in section 3.

  • Trade account applications: business name, contact name, email, phone number, business type, location, website or social media, resale/tax number, any message you include, and answers to any other questions on the application form.
  • Client accounts: your login email, business and contact name, phone number, and a scrambled (hashed) version of your password — we never store or see your actual password.
  • Orders: the products, quantities and options you request, notes you add, delivery dates, saved orders and any automatic repeat schedule you set, and the status of each order.
  • Newsletter / follow-up requests: the email address you enter in the website footer.
  • Security and technical information: when you log in, request a password reset or make account changes, we record the date and time, the IP address used, and whether it succeeded. Our hosting provider also keeps standard server logs (such as IP address, browser type and pages requested) for a short period for security and troubleshooting.
  • Communications: emails, phone calls or WhatsApp messages you exchange with our sales team.

Please don't send us sensitive personal information we haven't asked for (for example, health or banking details) through the website.

3. Why we use it

  • To review trade account applications and decide whether to open an account.
  • To set up and secure your account, and to let you log in, reset your password and manage your details.
  • To show you the catalogue and pricing available to your business.
  • To receive, process, fulfil and follow up on your order requests — including automatic repeat orders you set up — and to keep business and tax records.
  • To respond to your questions and contact you about your account or orders.
  • To send you information about becoming or being a Scenic Floral customer, if you've asked us to (see section 4).
  • To protect our website, our customers and our business against fraud, misuse and security threats.
  • To meet our legal and regulatory obligations.

We don't use your personal information for any other purpose without telling you and, where required, getting your consent first.

4. Consent

By applying for an account, using the trade portal or placing an order request, you consent to us using your information as described in this policy. Where we rely on implied consent — for example, using your contact details to follow up on an order — it's limited to what you'd reasonably expect.

We only send promotional emails with your consent, as required by Canada's Anti-Spam Legislation (CASL). Every promotional email tells you who it's from and how to unsubscribe, and we act on unsubscribe requests within 10 business days. Messages about your account, orders or password are not promotional and will still be sent while you're a customer.

You can withdraw your consent at any time, subject to legal or contractual limits, by contacting us. If you withdraw consent we need to operate your account (for example, to process orders), we may not be able to keep providing that service — we'll explain what it means for you.

5. Who we share it with

We don't sell, rent or trade your personal information, and we don't use advertising trackers on this website. We share personal information only with:

  • Service providers who run parts of our website and business for us, under agreements that require them to protect it and use it only to provide their service to us:
    • Vercel Inc. — hosts this website and stores uploaded images (United States).
    • Turso (ChiselStrike Inc.) — hosts our website database (United States).
    • Resend — sends our emails, such as order notifications and password links (United States).
    • Our point-of-sale and order-management system provider, which receives your orders so we can fulfil them.
  • WhatsApp (Meta Platforms) — if you choose to send your order to our sales team by WhatsApp, the order details go through WhatsApp under its own terms and privacy policy.
  • Others when the law requires or allows it — for example, to comply with a court order or to protect against fraud — or, if our business is sold or reorganized, to the parties involved, who must protect it in line with this policy.

When you choose a password, we check it against a public list of passwords exposed in past data breaches. Only a short, anonymous fragment of a scrambled version of the password is sent for that check — never the password itself, your email or anything that identifies you.

6. Storage outside Canada

Some of our service providers store or process information in the United States. While it's there, it's protected by our agreements with those providers, but it may be accessible to courts, law enforcement and national security authorities of that country under its laws.

7. How long we keep it

We keep personal information only as long as we need it, and our systems delete it automatically when that time is up:

  • Orders are business records. We keep them for six years after the end of the tax year they were placed in, as Canadian tax law requires, and then delete them.
  • Client accounts: while your account is open. When an account is closed — by you, from the Account page in the trade portal, or by us — we keep its details for two years (in case you return, or a question comes up about an order), then delete them. Orders from that time are kept for their own six-year period, with your business and contact name so they remain complete records.
  • Applications that don't lead to an account: 12 months after you apply.
  • Footer email sign-ups: until you ask us to remove you.
  • Security logs: two years. Records of login attempts used to block password-guessing: 24 hours.

We may keep information longer only where the law requires it, or where it's needed for an ongoing legal matter or an access request you've made.

8. How we protect it

We use safeguards appropriate to the sensitivity of the information, including:

  • Encrypted connections (HTTPS) for everything on this website.
  • Passwords stored only as one-way hashes, minimum password lengths, checks against known-breached passwords, and automatic blocking of repeated failed login attempts.
  • Two-step login for all staff accounts: a one-time code sent by email, or from an authenticator app.
  • Role-based access, so staff can only see what their job needs, and a security log of logins and account changes.
  • Password reset links that expire after one hour and work only once.

No method of storage or transmission is completely secure. Please keep your password private, use one you don't use elsewhere, and tell us right away if you think your account has been misused.

9. If there's a breach

If a breach of security safeguards involving your personal information creates a real risk of significant harm to you, we'll notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, and tell you what you can do to reduce the risk. We keep a record of every breach, as the law requires.

10. Your rights

You can ask us to:

  • tell you whether we hold personal information about you, how we've used it, and who we've shared it with;
  • give you access to it;
  • correct it if it's inaccurate or incomplete;
  • stop sending you promotional emails, or delete information we no longer need to keep.

If you're a client, you can download a copy of your account information, application and order history, or close your account, at any time from the Account page in the trade portal. For anything else, send your request to our Privacy Officer (section 12). We may need to confirm your identity first. We'll respond within 30 days, and tell you if we need more time, as the law allows. Access is free of charge in most cases; if there's a cost, we'll tell you first. If we can't give you access to something, we'll explain why, unless the law prevents us.

11. Cookies and similar technologies

We use only the cookies needed for the website to work: a login cookie that keeps you signed in, and short-lived cookies used during staff login and staff previews. Your browser also stores your in-progress order on your own device, so it isn't lost when you change pages. We don't use advertising or third-party tracking cookies. If you block cookies, you won't be able to log in to the trade portal.

12. Contact us or make a complaint

Questions, requests or concerns about privacy can go to:

Privacy Officer, Scenic Floral Inc.
4524 John St, Beamsville, ON L3J 1C4
Phone: (289) 566-8835
Email: sales@scenicfloral.ca

We'll look into every complaint. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada (1-800-282-1376).

13. Changes to this policy

We'll update this policy when our practices change. The “Last updated” date above shows when it last changed. If we make a significant change to how we use your information, we'll tell clients by email or on the portal before it takes effect.

← Back to Scenic Floral