Introduction
Roots Corporation ("Roots," "we," "us," or "our") takes our relationship with our business partners seriously, and that includes how we handle personal information. Roots is committed to respecting applicable privacy laws, including Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA").
This Privacy Policy (this "Policy") explains how we collect, use, and share personal information when you access or use the Roots B2B Portal at [b2b.roots.com[HB1] ] (the "Portal"). The Portal is a closed, invitation-only platform available exclusively to authorized business customers and commercial partners of Roots.
Please read this Policy carefully. If you do not agree with our practices, you should not use the Portal. By accessing or using the Portal, you acknowledge that you have read and understood this Policy on behalf of yourself and, where applicable, the individuals at your organization whose information you provide to us.
We review and update this Policy from time to time. The current version will always be posted on the Portal.
1. What Personal Information Do We Collect?
"Personal information" is information about an identifiable individual. We collect personal information from and about the authorized representatives, employees, and contacts of our business customers and partners who access or use the Portal. This may include:
· Full name, business title, and role;
· Business email address, telephone number, and mailing address;
· Login credentials and account activity associated with your Portal account;
· Order and transaction history, including purchasing activity and account preferences;
· Correspondence and communications with Roots, including via email and Portal messaging;
· Technical information such as your IP address, browser type and version, operating system, and device identifiers;
· Usage details such as pages viewed, links clicked, time spent on the Portal, and other Portal interaction data; and
· Any other information you voluntarily provide to us through the Portal.
We do not collect sensitive personal information (such as health, financial account, or government identification information) through the Portal.
Note: Under PIPEDA and some provincial laws, "business contact information" — meaning the name, title, business address, telephone number, and email address of an employee used to communicate with that person in their business capacity — is not considered personal information in the context of commercial activities. We nonetheless handle all such information with care and transparency, as described in this Policy.
2. How Do We Collect Personal Information?
Directly from you
We collect most personal information directly from you or your organization, including when:
· You register for or are onboarded to a Portal account;
· You place or manage orders through the Portal;
· You contact us with questions or requests; or
· You fill in forms or update your account profile on the Portal.
Automatically through the Portal
When you access and navigate the Portal, we may automatically collect certain technical and usage information through cookies and similar technologies. See Section 5 (Cookies and Website Analytics) for more information.
From your organization
We may receive personal information about Portal users from their employing organization, for example when your organization's designated account administrator sets up user accounts or provides us with a list of authorized contacts.
From third parties
We may obtain personal information from our corporate affiliates, subsidiaries, or authorized third-party service providers in connection with onboarding or account management activities.
3. How Do We Use Personal Information?
Roots uses personal information for the purposes described in this Policy or explained to you at the time it is collected. We will only use personal information for a new purpose if we provide notice and, where required by law, obtain your consent.
We use personal information to:
· Administer and manage your Portal account, including verifying your identity and authorization;
· Facilitate and process orders, transactions, and related fulfilment activities;
· Respond to your inquiries, requests, and correspondence;
· Communicate with you about your account, orders, product updates, and relevant commercial opportunities;
· Maintain and improve the Portal's performance, security, and functionality;
· Conduct internal analytics and reporting to understand how the Portal is used;
· Comply with our legal obligations, enforce our rights under the Terms of Use and your commercial agreement, and protect Roots' interests;
· Detect, prevent, and respond to fraud, security incidents, and other harmful or unauthorized activity; and
· De-identify or aggregate data for internal business analysis and improvement purposes.
We may also use personal information as required or permitted by applicable law, including in response to government, regulatory, or law enforcement requests or court orders.
4. With Whom Do We Share Personal Information?
Roots does not sell personal information. We may share personal information with the following parties, as necessary:
Affiliates and Subsidiaries
We may share personal information with Roots' corporate affiliates and subsidiaries for the purposes described in this Policy.
Service Providers
We engage third-party service providers to perform services on our behalf, including cloud hosting and IT infrastructure, order and payment processing, customer support, and analytics. These service providers may access personal information as necessary to perform their services. We require service providers to keep personal information confidential, use it only for the purposes for which it was disclosed, and apply security and privacy standards equivalent to those described in this Policy.
Other Third Parties
We may also share personal information:
· With your consent;
· To comply with applicable law or respond to valid legal process, including government, regulatory, or law enforcement requests;
· To enforce or apply our Terms of Use, your commercial agreement, or other contractual rights;
· To protect the rights, property, or safety of Roots, our business partners, or others; and
· In connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, in which personal information may be among the assets transferred, subject to the receiving party agreeing to handle such information consistently with this Policy.
We do not share personal information of Portal users with third parties for those parties' own marketing or advertising purposes.
5. Cookies and Website Analytics
When you access the Portal, we use cookies and similar technologies to support Portal functionality and to understand how the Portal is used. The Portal uses cookies for the following purposes:
· Essential / session cookies: Required to operate the Portal, including to authenticate your login session and maintain security. These cannot be disabled without impairing Portal functionality.
· Analytics cookies: We may use tools such as Google Analytics to collect anonymous, aggregated data about how the Portal is used (e.g., pages visited, session duration). This data helps us improve the Portal. You can opt out of Google Analytics data collection by adjusting your browser settings.
We do not use advertising, tracking, or behavioural profiling cookies on the Portal. The Portal does not serve targeted or interest-based advertising.
You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, some parts of the Portal may not be accessible or may not function properly.
6. How Do We Safeguard Personal Information?
Roots takes the security of personal information seriously. We use administrative, technical, and physical safeguards to protect personal information against accidental loss and unauthorized access, use, alteration, and disclosure.
You are responsible for keeping your Portal login credentials confidential. We ask that you use a strong, unique password, do not reuse passwords across different accounts, and notify us immediately at b2bsales@roots.com if you believe your account has been compromised.
Unfortunately, no method of transmitting or storing data is completely secure. Although we take appropriate measures to protect personal information, we cannot guarantee the security of any information transmitted to or through the Portal. Any transmission is at your own risk.
7. Storage and Cross-Border Transfers
Roots and its service providers may store and process personal information outside of Canada, including in the United States and other jurisdictions. When personal information is transferred outside of Canada, it may be subject to the laws of the receiving jurisdiction, including laws that may permit government authorities to access the information.
We take steps to ensure that any cross-border transfers are made in compliance with applicable Canadian privacy laws, including requiring our service providers to adhere to privacy and security standards equivalent to those described in this Policy.
If you would like more information about how we manage cross-border transfers of personal information, please contact us using the details in Section 13.
8. How Long Do We Retain Personal Information?
We retain personal information for as long as necessary to fulfil the purposes for which it was collected, including for the duration of your organization's commercial relationship with Roots and for such additional period as may be required or permitted by applicable law (e.g., for tax, audit, or legal purposes).
When personal information is no longer required for these purposes, we will securely delete or anonymize it. Where permitted by law, we may retain anonymized or aggregated data for longer for business analysis purposes.
9. Links to Other Websites
The Portal may contain links to third-party websites or services. Roots is not responsible for the privacy practices or content of those third-party sites. We encourage you to review the privacy policies of any third-party websites you visit.
10. Your Rights and Choices
Subject to applicable law, you may have the right to:
· Access: Request access to the personal information Roots holds about you.
· Correction: Request that we correct inaccurate or incomplete personal information.
· Deletion: Request that we delete personal information in certain circumstances, subject to legal and contractual retention requirements.
To submit a request regarding your personal information, please contact our Privacy Officer using the information in Section 13. We may ask you to verify your identity before processing your request. If we cannot fulfill your request, we will explain the reasons, subject to any legal restrictions.
Please keep your account profile information current. You can update some personal information directly through your Portal account settings.
11. Withdrawing Consent
Where we rely on your consent to collect, use, or disclose personal information, you may withdraw that consent at any time, subject to legal or contractual restrictions. Please note that withdrawing consent may affect our ability to continue providing you with access to the Portal or to maintain our commercial relationship with your organization.
To withdraw consent, please contact our Privacy Officer using the information in Section 13.
12. Changes to This Policy
We review and update this Policy as required to reflect changes in our practices, applicable law, or technology. The current version will always be posted on the Portal, along with the effective date. If we make a material change to how we handle personal information, we will notify you in advance by posting a prominent notice on the Portal or by contacting you directly.
13. Questions and Contact Information
If you have any questions, concerns, or requests about this Policy or our privacy practices, please contact our Privacy Officer:
Roots Corporation
Attention: Privacy Officer
Email: b2bsales@roots.com
1400 Castlefield Avenue, Toronto, ON, Canada M6B 4C4