Privacy Policy

This privacy policy explains how Purovitalis collects and uses personal data through its wholesale website, and what rights you have. It applies to visitors to this site and to the contact persons of our wholesale customers.

1. Who is responsible for your data

The controller is:

Purovitalis Inc.
181 Bay Street, STE 1800, Toronto, Ontario, Canada M5J 2T9
Company number: 1000964956 — EU VAT: NL828231710B01
Email: wholesale@purovitalis.com

Purovitalis Inc. is established in Canada and registered for VAT in the Netherlands. Where we offer goods to customers in the European Union, the GDPR applies to that processing.

2. What data we process, and why

Purpose	Data	Legal basis
Reviewing a wholesale account application	Name, business email, telephone, company name, company registration, VAT number, address	Steps prior to entering a contract (Art. 6(1)(b) GDPR)
Operating your account and processing orders	Account details, order history, delivery and invoice address, VAT number	Performance of a contract (Art. 6(1)(b))
Taking payment	Payment method and transaction data (card details are handled by the payment provider, not by us)	Performance of a contract (Art. 6(1)(b))
Shipping your order and providing tracking	Name, delivery address, email, telephone	Performance of a contract (Art. 6(1)(b))
Invoicing and statutory record-keeping	Invoice and transaction data	Legal obligation (Art. 6(1)(c)) — Dutch tax law
Answering enquiries sent through our contact or registration forms	The details you submit in the form	Consent, or steps prior to a contract (Art. 6(1)(a)/(b))
Managing the customer relationship in our CRM, and contacting you about your account and our range	Contact details, company details, correspondence, order history	Legitimate interests (Art. 6(1)(f)) — business-to-business relationship management
Internal sales reporting and analysis	Order and customer data	Legitimate interests (Art. 6(1)(f)) — understanding and running our business
Measuring website use in aggregate	Page views and referrer, without cookies and without an identifier that singles you out	Legitimate interests (Art. 6(1)(f))
Product safety, traceability and recall	Order and batch data	Legal obligation (Art. 6(1)(c)) — food safety legislation

Where we rely on legitimate interests, we have weighed those interests against your rights. You may object at any time — see section 7.

3. Who receives your data

We share personal data only with parties that need it in order to provide a service to us. They act as our processors under a data processing agreement, or as independent controllers where the law makes them so.

Recipient	Purpose
Hoasted (Netherlands)	Website and database hosting
WooCommerce Payments / Stripe	Card payment processing
Mollie (Netherlands)	iDEAL and other European payment methods
PayPal	PayPal payment processing
Pipedrive	Customer relationship management
Metorik	Internal sales and order reporting
Plausible Analytics	Cookieless, aggregated website statistics (EU-hosted)
Gravity Forms	Contact and registration forms (hosted on our own site)
WP Mail SMTP	Delivery of transactional email
Carriers and fulfilment partners	Delivering your order and providing track-and-trace
Accountants, auditors and advisers	Statutory accounting and advice

Payment providers act as independent controllers for the payment data they process, under their own privacy policies. We never receive or store your full card number.

We do not sell personal data, and we do not share it for third-party advertising.

4. Transfers outside the European Economic Area

Purovitalis Inc. is established in Canada. The European Commission has adopted an adequacy decision for Canadian commercial organisations subject to PIPEDA, which permits transfers of personal data from the EEA to those organisations without further safeguards.

Where a service provider processes data outside the EEA in a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses together with any additional measures required.

5. Cookies and website measurement

This site uses a deliberately small number of cookies:

• Strictly necessary cookies — to keep you logged in, remember the contents of your cart, and complete checkout securely. These are required for the site to work and cannot be switched off.
• Analytics — we use Plausible Analytics, which is cookieless: it does not set cookies, does not track you across websites, and does not collect data that identifies you personally. It reports aggregate figures such as page views and referrers.

Because we set no tracking or advertising cookies, we do not show a consent banner for them. You can block or delete cookies in your browser, but the site will not function correctly without the strictly necessary ones.

6. How long we keep your data

• Invoices and transaction records: 7 years, as required by Dutch tax law.
• Account data: for as long as your wholesale account is active, and up to 2 years after the last order, after which it is deleted or anonymised.
• Declined account applications: up to 12 months.
• Enquiries through our forms: up to 2 years after the last contact.
• Batch and traceability records: for the period required by food-safety legislation.
• Aggregated website statistics: retained indefinitely, as they do not identify you.

7. Your rights

Under the GDPR you have the right to:

• request access to the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, where the law allows;
• ask us to restrict processing;
• receive your data in a portable format;
• object to processing based on legitimate interests, including direct marketing — if you object to direct marketing we will stop;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email wholesale@purovitalis.com. We respond within one month. We may ask you to confirm your identity first.

If you believe we are not handling your data properly, you may lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in your own country.

8. Security

We apply appropriate technical and organisational measures to protect personal data, including encrypted connections (TLS) across the site, access control on the administration environment, and hosting in the Netherlands. Payment card data is handled entirely by our payment providers under their PCI DSS obligations and never reaches our servers.

9. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects for you. Wholesale account applications are reviewed by a person.

10. Changes to this policy

We may update this policy, for example when we start or stop using a service. The date at the top of this page shows when it was last changed. Material changes affecting existing customers will be communicated by email.