Under the Stoop Markets Inc.

Privacy Policy

Effective date: October 5, 2026

1 About Under the Stoop

Under the Stoop Markets Inc. operates Under the Stoop at 323 Cambie Street, Vancouver, British Columbia V6B 2N4. In this policy, “Under the Stoop,” “we,” “us” and “our” refer to Under the Stoop Markets Inc.

We provide retail display space, store support, a member vendor portal and payment facilitation for independent brands, artists and makers, who we call “member vendors.”

This policy explains how we handle personal information when you visit underthestoop.ca, shop in our store, contact us, subscribe to our communications, apply for a membership or use our member vendor services. It covers information under our control, including information processed for us by service providers. It does not cover employee personnel records.

We handle personal information in accordance with applicable Canadian privacy laws, including British Columbia’s Personal Information Protection Act and the federal Personal Information Protection and Electronic Documents Act where it applies. Our commercial electronic messages are subject to Canada’s Anti-Spam Legislation.

Personal information is information about an identifiable individual. Business contact information used solely to communicate with someone in their business role may be treated differently under applicable law.

2 Information we collect

The information we collect depends on the services you use and the information you choose to provide. We limit collection to what is reasonably needed for the purposes explained in this policy.

Customers and people who contact us

We may collect:

• Your name, email address, telephone number and the information you provide in an inquiry or support request.
• Purchase and receipt records, including the products purchased, supplying member vendor, transaction date, amount and details of any return, refund or product issue.
• Payment references and limited card information supplied by our payment processor, such as card type, last four digits and payment status.
• Your communication preferences and records of marketing consent or unsubscribe requests.

We do not ask for personal information that is unnecessary for an ordinary purchase. If you request an emailed receipt, we use your email address to deliver it. Providing an email address for a receipt does not, by itself, subscribe you to our mailing list.

Member vendors and membership applicants

We may collect:

• Your name, business name, contact details, website and social media links, and information about your products or business.
• Application answers, correspondence and information about an authorized business representative.
• Account and authentication information, sign-in activity and support requests associated with your member vendor portal.
• Membership selections, display space arrangements, billing records and any business or tax identifiers reasonably needed for membership administration or reporting.
• Product listings, photographs, prices, inventory records, sales records and payout information.
• Payment or payout account references and information needed to arrange or reconcile payments.
• Agreements you accept, including electronic signatures where used, acceptance dates and the applicable agreement version.

Information about a business or its products is personal information when it identifies an individual. Business and product information intended for a public listing may be displayed as part of that listing or associated promotion, as agreed with you.

Website visitors

Our website and account services may collect technical information such as IP address, browser or device type, access times, pages visited and security or error logs. Cookies and other website technologies are described in section 7.

3 How information reaches us

We collect information directly from you through our website, application forms, member vendor portal, store interactions, email and other communications.

We also receive information from service providers that process payments, manage accounts, deliver messages or support our systems. For example, a payment service may confirm whether a payment or payout succeeded.

If you give us another person’s information, such as a business partner’s contact details, please ensure you have appropriate permission to do so and tell them how we will use it. We collect any additional information from other sources only with consent or as otherwise permitted by law.

4 How we use information and obtain consent

We use personal information to:

• Facilitate purchases, issue receipts and respond to returns, refunds and product inquiries.
• Review membership applications and communicate with applicants.
• Administer memberships, display space, accounts, inventory, billing and vendor payouts.
• Provide support, communicate about services and keep records of agreements.
• Send permitted news, event announcements and promotional messages.
• Operate, secure, troubleshoot and improve our website and services.
• Prevent or investigate fraud and security incidents, and resolve disputes.
• Meet accounting, tax, recordkeeping and other legal obligations.

We obtain consent where required. Depending on the circumstances and sensitivity of the information, consent may be express or may be implied when you voluntarily provide information for an obvious purpose, such as asking us to reply to an inquiry. We may also collect, use or disclose information without consent where applicable law permits or requires it.

We do not require consent to an unrelated use of personal information as a condition of receiving a service. If we propose a new use that requires consent, we explain it and obtain the required consent before proceeding.

You may withdraw consent on reasonable notice, subject to applicable legal restrictions. We will explain if this affects a service you have requested. For example, we may be unable to administer an account or arrange payouts without the information necessary to do so. Withdrawal does not require us to erase records we must lawfully retain.

5 Payments and vendor payouts

Payment services process card payments and, where applicable, membership billing or vendor payouts through their payment systems. We receive the transaction, account-reference and status information needed to administer our services and reconcile payments.

We do not store complete payment card numbers or card security codes in our website or member vendor portal. Please do not send full card details or unnecessary identity documents by general email or through an ordinary contact form.

Where a payment or payout provider requires identity verification or banking information, it may collect that information directly through its secure onboarding process. Its privacy policy explains how it handles information for its own purposes, including verification, fraud prevention and regulatory requirements.

We remain responsible for personal information under our control, including information processed on our behalf. A payment provider’s separate privacy policy does not remove that responsibility.

6 Service messages and marketing

We use contact information to send requested receipts, reply to inquiries and deliver necessary account, membership, billing, payout and security notices. These communications are kept separate from optional marketing subscriptions.

We send promotional emails or other commercial electronic messages only when we have express consent, valid implied consent under Canada’s Anti-Spam Legislation, or another applicable legal permission. Any reliance on implied consent is limited to the circumstances and time period the law allows. An application, inquiry or purchase does not give us unlimited permission to send marketing.

We keep records of the permission we rely on. Our marketing messages identify us, provide contact information and include a way to unsubscribe. You can use that option or contact our Privacy Officer. We honour unsubscribe requests within 10 business days.

Unsubscribing from marketing does not stop communications necessary to provide a service you continue to use. We do not add another person to our marketing list simply because you give us their email address.

7 Cookies and other website technologies

Our website and member vendor portal use cookies, local storage or similar technologies where needed for functions such as authentication, security and maintaining account sessions. Blocking these technologies may affect those functions.

We also use Meta Pixel and PostHog on our website for the purposes below. The information collected depends on the events and settings enabled in our implementation.

Meta Pixel

We use Meta Pixel, an advertising tool provided by Meta, to measure the performance of our advertising and understand actions visitors take on our website. It may also help us show Under the Stoop advertisements on Facebook and Instagram to people who have visited our website.

Meta Pixel can receive information such as pages visited, website interaction events, IP address, browser or device information, and cookie or other identifiers. Meta may combine information it receives with other information it holds about you and use it in accordance with its own privacy policy. More information is available in Meta’s privacy policy.

PostHog

We use PostHog for website analytics to understand how visitors use our website, identify problems and improve our website and services. Depending on our configuration, analytics information can include page views, clicks or other interaction events, visit timestamps, referral information, browser and device details, and visitor or session identifiers. This information is processed through our PostHog analytics setup. More information about the provider is available in PostHog’s privacy policy.

We also use PostHog Session Replay to reconstruct visits to our website so we can identify usability problems and improve the website. Replays can show pages viewed, clicks, scrolling and navigation, together with visible page content and information entered into fields that are not masked or excluded. What appears in a replay depends on our recording and masking configuration. We keep session recordings for 30 days.

Tracking choices

These analytics and advertising tools are separate from technologies needed to provide account access. They may use cookies, local storage or similar technologies, depending on our configuration. We provide notice and obtain consent where required for optional tracking.

Our website consent banner lets you accept or decline optional analytics and advertising tracking. Meta Pixel and PostHog, including Session Replay, remain off unless you accept. Declining optional tracking does not prevent you from using our website. To make a new choice, clear the cookies and stored site data for underthestoop.ca in your browser, then revisit our website to see the banner again.

You can also manage cookies through your browser settings and adjust advertising preferences through Meta’s ad preferences. Browser settings and advertising preferences do not necessarily prevent every form of tracking or stop information already collected from being used. If you have questions about Meta Pixel, PostHog or available tracking choices, contact our Privacy Officer.

8 Store cameras and photographs

Where video surveillance is used in our store, it is for safety, security and loss prevention. Signs at the premises give notice of recording. Access to footage is restricted to people who need it for an authorized purpose.

Routine footage is normally overwritten or deleted after 14 days, unless a recording needs to be preserved for an incident, insurance matter, legal obligation or privacy request. Relevant footage may be shared with security service providers, insurers or law enforcement when reasonably necessary and permitted by law.

We do not use security footage for advertising. We seek appropriate permission before using identifiable photographs or videos of customers for promotion. Permission to photograph a vendor display does not automatically authorize promotional use of a person’s image.

9 When information is shared

We do not sell personal information. We do not provide customer or member vendor contact lists to third parties for their own marketing without consent. Sharing through any advertising tools is described in section 7.

We may share personal information with service providers that support website hosting, databases, account authentication, forms, payment processing, payouts, email delivery, business administration, security and technical support. We limit information shared to what is reasonably needed for the service and require appropriate confidentiality and privacy protections. Providers processing information on our behalf are authorized to use it for that service. Some providers, such as payment or advertising platforms, may also have independent purposes described in their own policies and in this policy.

Member vendors receive information about their own products, inventory, sales and payouts. We do not provide customer contact information to them for independent marketing without consent. Where a member vendor needs information to resolve a product issue, fulfil a request or address a safety concern, we share only the information reasonably necessary, with consent or another lawful basis. A member vendor’s own handling of information it receives is also subject to its privacy responsibilities.

We may also disclose information:

• To professional advisers, accountants or insurers where needed for their services.
• To comply with applicable law, a court order or another valid legal requirement.
• To investigate fraud, respond to an emergency or protect rights, property or safety where permitted by law.
• In connection with a sale, merger or reorganization of our business, subject to applicable legal safeguards and notification requirements.
• For another purpose you have authorized.

Links to member vendor websites, social media pages or other third-party services lead to services with their own privacy practices.

10 Processing outside Canada

Personal information may be stored or processed outside Canada. We use Supabase for database services and Netlify for website hosting, with these services hosted in the United States. Other providers, including those used for payments, email, analytics and advertising, may process information outside Canada in the countries where they or their subprocessors operate.

Information processed in another country may be subject to that country’s laws and lawful access by courts, regulators or government authorities. We use appropriate contractual or other safeguards for information processed on our behalf and remain accountable for information under our control. These safeguards cannot override the laws of another country.

Contact our Privacy Officer if you would like more information about the service providers or countries involved in handling your information.

11 Retention and protection

We keep personal information only for as long as reasonably needed to provide services, administer memberships, meet legal and accounting requirements, resolve disputes or fulfil another lawful purpose. We then securely delete it or remove the means of identifying individuals.

Transaction, billing, payout and agreement records may need to be kept after a purchase or membership ends. Where we use personal information to make a decision that directly affects an individual, we retain it for at least one year where BC privacy law requires. We keep limited consent and unsubscribe records as needed to demonstrate compliance and respect communication preferences.

Information relevant to an actual or reasonably anticipated dispute, investigation or legal obligation may be preserved for longer. Where information remains in backups pending their normal replacement cycle, it is protected and is not used for an unrelated purpose.

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information. These include limiting access to people who need information for their work and using account security measures and protections supplied by our service providers. No system can guarantee complete security. Please keep your account credentials private and report suspected misuse promptly.

We assess suspected privacy incidents and take appropriate response measures. We notify affected individuals and relevant authorities, and maintain incident records, where applicable law requires.

12 Your choices and privacy requests

Subject to applicable law, you can:

• Request access to personal information we hold about you and information about how it has been used or disclosed.
• Ask us to correct inaccurate or incomplete personal information.
• Withdraw consent where permitted and unsubscribe from marketing.
• Ask us to delete or de-identify information that no longer needs to be retained.
• Ask questions or make a complaint about our privacy practices.

Send a written request to our Privacy Officer using the contact details in section 15. Include enough information to identify the relevant records. We may take reasonable steps to verify your identity before disclosing or changing personal information.

We respond to access requests within the applicable legal time limit: normally 30 business days under BC’s Personal Information Protection Act, or 30 calendar days where the federal Personal Information Protection and Electronic Documents Act governs the request. If a lawful extension is needed, we notify you of the reason and revised response date as required.

Some access or deletion requests are subject to legal exceptions, including the protection of another person’s information and required record retention. We explain any limitation where the law allows. If a fee is legally permitted and proposed, we provide an estimate before proceeding.

We review privacy complaints and respond to the concerns raised. You may also contact the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca, or the Office of the Privacy Commissioner of Canada at priv.gc.ca where federal privacy law applies.

13 Children

Our store welcomes families. Our online forms, marketing subscriptions and member vendor accounts are intended for adults. We do not knowingly collect children’s personal information through these services or use it for targeted advertising.

If you believe a child has provided information to us through these services, contact our Privacy Officer so we can review the situation and take appropriate action.

14 Policy updates

We may update this policy as our services or practices change. The current version and its effective date will be available on our website.

If a change materially affects how we use or disclose personal information already collected, we provide appropriate notice and obtain any consent required by law before applying the change. Posting a revised policy does not, by itself, authorize an unrelated new use of your information.

15 Contact our Privacy Officer