Privacy Policy

PLEASE READ THIS PRIVACY POLICY (THE “POLICY”) CAREFULLY. THIS WEBSITE AND ITS SUBDOMAINS (COLLECTIVELY, THE “WEBSITE”), THE PKUP MOBILE APPLICATION (“MOBILE APP,” AND TOGETHER WITH THE WEBSITE, THE “PLATFORM”), AND THE SERVICES AND RESOURCES AVAILABLE OR ENABLED VIA THE WEBSITE OR THE PLATFORM (COLLECTIVELY AND EACH INDIVIDUALLY, THE “SERVICES”), ARE CONTROLLED BY PKUP LOGISTIC SOLUTIONS LIMITED (“PKUP”, “WE”, “US” OR “OUR”).

THIS POLICY DESCRIBES HOW WE COLLECT, USE, DISCLOSE, RETAIN, AND PROTECT PERSONAL INFORMATION WHEN YOU ACCESS OR USE THE PLATFORM OR SERVICES.

CONSENT

By accessing or using the Services, you consent to the collection, use, and disclosure of your Personal Information for the essential purposes described in this Policy, which include:

• account creation and management;
• service delivery (processing and facilitating delivery requests, matching Customers with Couriers, calculating fees, and processing payments);
• payment processing;
• safety, security, and fraud prevention;
• legal and regulatory compliance; and
• communicating with you about your Account and deliveries.

Consent to these essential purposes is required to use the Services. If you do not agree to the collection, use, and disclosure of your Personal Information for these essential purposes, you may not access or use the Services.

The following purposes are optional and require your separate, affirmative consent:

• (a) Marketing and Promotional Communications. Sending you promotional materials, personalized offers, and marketing communications about our Services or those of third parties.
• (b) Analytics and Service Improvement. Using your Personal Information for analytics, user research, surveys, and profiling to improve and personalize the Services beyond what is necessary for service delivery.
• (c) Interest-Based Advertising. Sharing your Personal Information with advertising partners and social media platforms for targeted or personalized advertising.
• (d) Third-Party Data Sharing for Advertising. Disclosing your Personal Information to third parties for their own marketing or advertising purposes.

You may provide or withhold consent to each optional purpose independently through the consent controls in your Account settings. You may withdraw consent to any optional purpose at any time without affecting your access to the core Services. Withdrawal of optional consent does not affect the lawfulness of processing based on consent before withdrawal. For instructions on managing your consent preferences, see Section 5 (Your Privacy Rights and Choices).

PLEASE BE AWARE THAT SECTION 10 (INTERNATIONAL DATA TRANSFERS) OF THIS POLICY CONTAINS IMPORTANT INFORMATION ABOUT THE TRANSFER OF YOUR PERSONAL INFORMATION TO JURISDICTIONS OUTSIDE OF CANADA THAT MAY NOT PROVIDE THE SAME LEVEL OF PRIVACY PROTECTION AS YOUR HOME JURISDICTION.

1. DEFINITIONS AND INTERPRETATION

In this Policy, the following terms shall have the meanings set forth below:

“Account” means a registered account created by you to access and use the Platform and Services.

“Applicable Privacy Laws” means all applicable federal, provincial, territorial, and municipal laws, regulations, directives, and regulatory requirements relating to privacy and the protection of Personal Information, including without limitation the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 (“PIPEDA”), the Personal Information Protection Act, SBC 2003, c 63 (“BC PIPA”), the Personal Information Protection Act, SA 2003, c P-6.5 (“Alberta PIPA”), An Act respecting the protection of personal information in the private sector, CQLR c P-39.1 (“Quebec Private Sector Act”), Canada’s Anti-Spam Legislation, SC 2010, c 23 (“CASL”), and any other applicable privacy, data protection, or anti-spam legislation, each as amended from time to time.

“Business Partners” means third parties with whom PKUP has entered into agreements or arrangements for business purposes, including without limitation payment processors, identity verification providers, marketing partners, technology service providers, and other service providers or business partners.

“Communications Data” means all communications between you and PKUP or between users through the Platform, including without limitation messages, emails, phone calls, in-app communications, and any recordings thereof.

“Cookies” means small text files that are stored on your browser or device by websites, apps, online media, and advertisements.

“Courier” means any individual who provides delivery services through the Platform as an independent contractor, also referred to as a “Delivery Professional.”

“Customer” means any individual or entity that requests delivery services through the Platform.

“Device Information” means information about the device you use to access the Platform, including without limitation device type, operating system, unique device identifiers, mobile network information, and IP address.

“Location Data” means information about your geographic location, including without limitation GPS coordinates, IP address-based location, and location history.

“Material Change” means any change to this Policy that: (a) expands the categories of Personal Information collected; (b) introduces new purposes for which Personal Information is used or disclosed; (c) permits the sharing of Personal Information with new categories of third parties; (d) reduces the privacy rights or protections available to you under this Policy; (e) changes the legal basis on which Personal Information is processed; or (f) materially alters the cross-border transfer arrangements described in this Policy.

“Personal Information” means any information about an identifiable individual, as such term is defined under Applicable Privacy Laws, but does not include aggregate, anonymous, or de-identified information that cannot reasonably be used to identify you.

“Recipient” means any individual who receives a delivery arranged through the Platform.

“Registered User” means a user who has registered an Account with PKUP through the Services.

“Services” has the meaning set forth in the preamble.

“Usage Data” means information about how you interact with the Platform, including without limitation pages viewed, features accessed, search queries, and session duration.

2. WHAT PERSONAL INFORMATION WE COLLECT

PKUP collects Personal Information when you interact with our Platform and Services. The types of Personal Information we collect depend on how you interact with us and which Services you use. We collect the following categories of Personal Information:

2.1. Information You Provide

The Information you provide to us includes:

Account Information. When you create or update your Account, we collect your name, email address, phone number, password (which we store in encrypted format), date of birth (which we use to verify your eligibility to use our Services and for age-restricted deliveries), profile picture (if you choose to upload one), preferred language, and any other information you choose to provide. If you register using a third-party service such as Facebook, Apple, or Google, we collect information from that service as permitted by your privacy settings on that service, which may include your name, email address, and profile picture.

Identity Verification Information. To verify your identity, prevent fraud, and comply with legal requirements, we may collect government-issued identification documents (such as driver’s licences or passports), which may include your photograph, identification number, date of birth, and other information contained in such documents. We may also collect photographs or selfies for identity verification purposes, and with your explicit consent where required by law, we may use facial recognition technology to verify your identity. For certain deliveries, we collect your signature or electronic signature.

Payment Information. We collect payment method information (such as credit or debit card details), billing name and address, and transaction history. Payment card information is processed by our third-party payment processors and we do not store complete payment card numbers in our systems. We maintain records of your transaction history for tax, accounting, and legal compliance purposes.

Delivery Information. For each delivery transaction, we collect pickup and delivery addresses, recipient name and contact information, package details (including size, weight, and contents description), special delivery instructions, delivery confirmation information (which may include photographs, signatures, or PIN codes), and the date and time of delivery request and completion.

Communications. We collect and maintain records of all communications you have with us or through our Platform, including customer service inquiries, feedback, ratings and reviews of Couriers or delivery services, complaints, dispute-related communications, survey responses, and any other communications you send to us or through our Platform. We may record phone calls for quality assurance and training purposes, where permitted by law and with appropriate notice.

Earnings Data (Couriers). For Couriers, we collect and maintain records of compensation per delivery, tips, bonuses, deductions, pay adjustments (where applicable), tax-related information (including T4A and other tax slips), and payment history. We retain Earnings Data for seven (7) years following the end of the calendar year in which the earnings were received, to comply with tax, accounting, and legal requirements. Couriers have the right to access their complete earnings records by submitting a request in accordance with Section 5 of this Policy.

Inferences. We derive inferences from the Personal Information described above, including reliability scores, behaviour patterns, risk assessments, and fraud indicators. These inferences are generated from Account activity, delivery history, transaction patterns, communications, Location Data, and other Personal Information we collect. We use inferences to improve service matching, detect and prevent fraud, assess platform risk, optimize delivery operations, and personalize the Services. Inferences that affect service availability or account standing may be reviewed upon request; see Section 5 (Your Privacy Rights and Choices).

2.2. Information We Collect Automatically

When you access or use our Platform, we automatically collect certain information, including:

Device Information. We collect information about the device you use to access our Platform, including hardware model, operating system and version, unique device identifiers, mobile network information, IP address, browser type and version, and other technical information about your device.

Location Data. When you use our Services, we collect location information from your mobile device as follows:

• Approximate Location. We collect approximate location information based on your IP address. This information is used to display available services and provide general service functionality, and does not require separate consent beyond your agreement to this Policy.
• Precise Location (Foreground). When the PKUP app is open and on-screen, we collect precise GPS location data if you have granted location permission. Precise foreground location is required for the following functions: (a) for Customers, to provide accurate delivery address suggestions, enable real-time delivery tracking, and match you with nearby Couriers; and (b) for Couriers, to receive and accept delivery requests, provide navigation to pickup and delivery locations, and enable Customers to track active deliveries in real time.
• Precise Location (Background — Couriers Only). For Couriers, we may collect precise location data when the PKUP app is open but not on-screen (background collection). Background location collection is used to: (a) track delivery progress during active deliveries; (b) optimize delivery routing and provide accurate estimated arrival times; and (c) verify delivery completion and resolve delivery disputes. Background location collection requires separate, explicit consent from Couriers, which is obtained through the device operating system permission prompt. You may disable background location collection at any time through your device settings without losing access to core Platform features. When background location is disabled, you will still be able to accept and complete deliveries, though certain features (such as automatic delivery status updates and route optimization) may function with reduced accuracy.
• Retention. We retain precise location data for 90 days after a delivery is completed, for customer service, safety, dispute resolution, and analytical purposes. After this period, location data is anonymized or deleted.

You may use our Services without enabling precise location collection; however, this may require you to manually enter addresses and may affect the accuracy of delivery estimates and the availability of certain features.

Usage Data. We collect information about your interactions with our Platform, including the pages or features you access, the time and date of your visits, the time spent on pages, search queries, app crashes and error reports, and other usage patterns and preferences.

Cookie and Tracking Technology Data. We use cookies, web beacons, mobile analytics software, and similar tracking technologies to collect information about your use of our Platform. This includes information about your browsing behavior, referring and exit pages, and conversion information. For more information about our use of cookies and similar technologies, see Section 6.

2.3. Information We Receive from Other Sources

We may receive Personal Information about you from other sources, including:

Social Media Services. If you create or log into your Account through a social media service, we will receive information from that service as permitted by your settings on that service and the service’s privacy policy.

Other Users. We may receive information about you from other users, such as when a Customer provides delivery recipient information, when users submit ratings or feedback about you, or when safety incidents or complaints are reported.

Business Partners. We receive information from Business Partners who provide services to us, such as identity verification providers who help us verify your identity, background check providers (for Couriers), payment processors who help us process payments, and marketing partners who help us understand our users and improve our Services.

We receive information from Business Partners who provide services to us, including identity verification and background check providers. For Couriers, we work with third-party providers to verify identity using government-issued identification, conduct criminal background checks where permitted by law, verify driving records and licence status, check for relevant safety-related information, and confirm work authorization status in Canada.

Background checks conducted on Couriers may include criminal record searches at local, provincial, and national levels, driving record abstracts from provincial motor vehicle authorities, identity verification against government databases, and sex offender registry checks where applicable and permitted by law. This information is used solely to determine eligibility to provide delivery services on our Platform, maintain platform safety and security, comply with our insurance requirements, and meet regulatory obligations.

Couriers have the right to be informed before a background check is conducted, know the scope and nature of the background check, receive a copy of any background check report upon request, and dispute inaccurate information in accordance with applicable law. All background check information is handled in strict confidence and retained only as long as necessary for safety, legal, and regulatory compliance purposes. We do not use background check information for any purpose other than those stated above.

Public Sources. We may collect information from publicly available sources to verify information you provide to us or for fraud prevention purposes.

2.4. Special Categories of Personal Information

In certain circumstances, we may collect special categories of Personal Information as defined under Applicable Privacy Laws. This may include:

Health Information. You may provide health-related information in delivery instructions, such as allergies or dietary restrictions. We collect this information only as necessary to fulfill your delivery request and share it only with the Courier and merchant as needed to complete your order.

Biometric Information. Where permitted by law and with your explicit consent, we may collect biometric information derived from photographs for identity verification purposes. This may include using facial recognition technology to compare a selfie you provide with the photo on your government-issued ID.

Precise Location Data. We collect precise GPS location data when you have enabled location services for our app. This sensitive location data is essential for providing our real-time delivery services. See Section 2.2 for details on how location data is collected and used.

We collect these special categories of Personal Information only with your explicit consent where required by law, and we use appropriate security measures to protect this sensitive information.

2.5. Referral Program Information 

If you participate in our referral program, we collect additional information to administer the program. This includes your referral code and associated Account information, name and contact information of individuals you refer (including email address or phone number), and your preferred payment method for referral rewards.

When individuals you refer to our Services create an Account using your referral code, we collect confirmation that they used your referral code, their Account creation and first delivery completion status, and information necessary to calculate and distribute referral rewards.

Before sharing someone’s contact information through our referral program, you represent and warrant that you have obtained their permission to do so. We will only use referred individuals’ contact information to send a single invitation to try our Services, track referral program participation if they create an Account, and comply with legal obligations. We will not sell or use referral contact information for any purpose other than administering the referral program.

Referred individuals may opt out of future referral invitations by contacting us at privacy@pkup.ca. Participation in the referral program is subject to our Referral Program Terms and Conditions, which may include additional privacy-related provisions.

2.6. Data Minimization and Purpose Limitation

We are committed to collecting only the minimum amount of Personal Information necessary to provide our Services. We do not collect Personal Information for purposes that are incompatible with those identified in this Policy. When we identify opportunities to reduce the amount of Personal Information we collect or the length of time we retain it, we will implement such changes as part of our privacy-by-design approach.

We regularly review our data collection practices to ensure that we are not collecting excessive Personal Information. If we determine that certain Personal Information is no longer necessary for the purposes for which it was collected, we will securely delete or anonymize such information in accordance with our retention policies.

3. HOW WE USE PERSONAL INFORMATION

We use the Personal Information we collect for the following purposes:

3.1. To Provide Our Services

We use your Personal Information to provide, maintain, and improve our Services, including to create and manage your Account; process and facilitate delivery requests; match Customers with Couriers; calculate delivery fees and process payments; provide real-time tracking of deliveries; communicate with you about your deliveries; verify age for restricted deliveries; generate receipts and transaction records; personalize your experience on our Platform; and otherwise provide the Services you request.

3.2. For Safety and Security

We use Personal Information to maintain the safety, security, and integrity of our Platform and Services, including to verify user identities; detect, investigate, and prevent fraud and unauthorized access; monitor for safety incidents and inappropriate behavior; investigate complaints and disputes; enforce our Terms of Service and other policies; protect against malware and security threats; and protect the rights, property, and safety of PKUP, our users, and the public.

3.3. To Communicate with You

We use your Personal Information to communicate with you about our Services, including to send service-related announcements and updates; respond to your inquiries and provide customer support; send you technical notices, security alerts, and support messages; inform you about changes to our Services, policies, or terms; and with your consent, send you marketing communications about our Services, promotions, and offers.

3.4. For Legal and Compliance Purposes

We use Personal Information as necessary to comply with legal obligations and protect our legal interests, including to comply with applicable laws, regulations, and legal process; respond to lawful requests from law enforcement, courts, and regulatory authorities; establish, exercise, or defend legal claims; maintain records as required by law; meet tax, accounting, and financial reporting obligations; and conduct audits and compliance reviews.

3.5. To Improve and Develop Our Services

We use Personal Information for research, analysis, and development purposes to enhance our Services and create innovative features. Our research and development activities include analyzing delivery patterns to optimize routes and reduce delivery times, studying user behavior to improve app design and functionality, identifying common customer service issues to develop better solutions, and testing new features with select user groups before general release.

We employ machine learning and artificial intelligence technologies to enhance our Services, including training algorithms to improve delivery time predictions, developing models to better match Customers with Couriers, enhancing fraud detection capabilities, and improving address recognition and navigation accuracy. Where Personal Information is used to train machine learning or artificial intelligence models, we anonymize or de-identify such information before it is used for training purposes. These technologies process Personal Information in accordance with privacy-by-design principles and appropriate safeguards.

Our market research activities involve understanding delivery trends in different neighbourhoods, analyzing peak demand periods to ensure adequate service coverage, studying user preferences to develop new service offerings, and conducting surveys and user interviews to gather feedback. We may also engage in academic and industry research, including collaborating with universities on transportation and logistics research, participating in industry studies on gig economy trends, contributing anonymized and aggregated data to urban planning initiatives, and supporting research on sustainable delivery methods.

We pursue innovation projects focused on exploring new delivery technologies and methods, developing features for accessibility and inclusion, creating tools to reduce environmental impact, and testing integration with emerging technologies. All research and development activities employ appropriate safeguards, including data minimization techniques, anonymization and aggregation where possible, secure testing environments, and ethical review processes for research projects.

Participation in user research, surveys, focus groups, or beta testing programs is always voluntary. You may opt out of being contacted for research purposes by adjusting your preferences in your Account settings or by contacting us at privacy@pkup.ca. If you participate in research activities, we may provide additional information about how your data will be used for the specific research project.

3.6. For Marketing and Advertising

With your consent where required, we use Personal Information for marketing purposes, including to send you promotional communications about our Services; provide you with personalized offers and recommendations; conduct market research and surveys; measure the effectiveness of our marketing campaigns; and display targeted advertising.

3.7. For Business Operations

We use Personal Information for our internal business operations, including for business planning and analysis, financial reporting and forecasting, risk assessment and management, workforce planning and management, and other legitimate business purposes.

3.8. With Your Consent

We may use your Personal Information for other purposes with your specific consent.

3.9. Automated Decision-Making and Profiling

We use automated processes and algorithms to enable essential parts of our Services and enhance your experience on our Platform. These automated processes help us provide efficient, safe, and reliable delivery services. Our primary automated processes include matching Customers with Couriers, calculating pricing, preventing fraud, and optimizing our Services.

When you request a delivery, our automated matching systems evaluate various factors to determine the best available Courier, including your location and delivery destination, proximity and availability of Couriers, current traffic conditions and estimated delivery times, vehicle capacity requirements based on package size, historical performance data and user ratings, and previous interactions between specific Customers and Couriers. The matching process is designed to minimize wait times while ensuring efficient service delivery.

We use automated pricing systems to calculate delivery fees based on distance between pickup and delivery locations, estimated time for delivery completion, current demand and supply conditions, package size and weight categories, time of day and day of week, weather conditions and seasonal factors, and applicable taxes and regulatory fees. Our pricing algorithms ensure fair and transparent pricing while maintaining service availability.

We employ machine learning models and automated processes for fraud prevention and security purposes. These systems detect and prevent fraudulent activities, identify suspicious account behavior or unauthorized access attempts, monitor for safety incidents or policy violations, verify user identities and payment methods, and flag potentially problematic delivery requests. These automated security measures are essential for maintaining the integrity and safety of our Platform.

We also use automated analysis for service optimization, including predicting delivery demand patterns, optimizing delivery routes, personalizing your experience based on past orders, recommending nearby Couriers, and estimating accurate delivery times. These optimizations improve service quality and user experience.

You have the right to request human review of any automated decision that significantly affects you. If you have concerns about an automated decision, please contact us using the information provided in Section 13 of this Policy.

3.10. Age Verification for Restricted Deliveries

For deliveries involving age-restricted items such as alcohol, cannabis, tobacco products, or certain medications, we implement additional verification procedures to ensure compliance with applicable laws and regulations. These procedures involve collecting and verifying government-issued photo identification to confirm that recipients meet minimum age requirements.

When you first order age-restricted items, we collect images of your government-issued photo identification (driver’s licence or passport), extract and verify your date of birth, verify the authenticity of the identification document, and record the time and location of age verification. For each delivery of age-restricted items, our Couriers must verify that the recipient’s identification matches our records, the person is of legal age for the specific product, the recipient matches the identification presented, and the delivery address matches order requirements.

Age-restricted items cannot be left unattended and must be delivered directly to the person who placed the order or an authorized recipient of legal age. Couriers are required to refuse delivery if valid identification cannot be produced, the recipient appears intoxicated or impaired, the identification appears fraudulent or altered, or the recipient is not the intended person or authorized recipient.

We implement appropriate security measures for age verification data, including encrypting identification images during transmission and storage, limiting access to authorized personnel for verification purposes only, retaining identification data only as long as legally required, and prohibiting the use of identification information for marketing purposes. These measures ensure compliance with legal requirements while protecting the privacy and security of your identification documents.

You have the right to request information about our age verification process, access records of when your identification was verified, and request correction of any errors in age verification data. Failure to provide valid age verification will result in cancellation of the order for age-restricted items, and you may still be charged applicable cancellation fees as set forth in our Terms of Service.

4. HOW WE SHARE PERSONAL INFORMATION

We share Personal Information in the following circumstances:

4.1. With Other Users

We share certain information between users as necessary to facilitate deliveries:

With Couriers. When you request a delivery, we share your name, contact information, pickup and delivery addresses, delivery instructions, and real-time location (if you have enabled location sharing) with the Courier who accepts your delivery request. This information is necessary for the Courier to complete your delivery.

With Customers. When you accept a delivery request as a Courier, we share your name, photo, vehicle information, ratings, and real-time location with the Customer to enable them to track their delivery and communicate with you if necessary.

With Recipients. We share delivery status information and Courier details with the recipient of a delivery to enable them to track and receive their delivery.

4.2. With Service Providers

We share Personal Information with third-party service providers who perform services on our behalf, including companies that provide payment processing, cloud hosting and data storage, identity verification and background checks, fraud prevention and security services, customer support tools, analytics and data analysis, marketing and advertising services, and other services necessary for our operations. These service providers are contractually required to protect your Personal Information and use it only for the purposes we specify.

4.3. With Business Partners

We may share Personal Information with business partners, including companies with whom we partner to offer co-branded services, promotions, or loyalty programs; businesses that use our Services for their delivery needs; and other partners with whom we collaborate to provide or improve our Services. When we share Personal Information with business partners, we require them to protect your information and use it only for authorized purposes.

4.4. For Legal Reasons

We may disclose Personal Information when we believe it is necessary to comply with applicable law, regulation, legal process, or governmental request; enforce our Terms of Service and other agreements; protect the rights, property, or safety of PKUP, our users, or others; detect, prevent, or address fraud, security, or technical issues; or respond to emergencies where we believe physical safety is at risk.

4.5. In Connection with Business Transfers

If PKUP is involved in a merger, acquisition, asset sale, corporate reorganization, bankruptcy, or other business transaction (a “Business Transaction”), we may disclose Personal Information as part of that transaction, subject to the following conditions:

(a) Before Personal Information is disclosed in connection with a Business Transaction, PKUP will enter into a data protection agreement with the receiving party that requires the receiving party to protect the Personal Information in a manner consistent with this Policy and Applicable Privacy Laws.

(b) Personal Information disclosed in connection with a Business Transaction may be used by the receiving party solely for purposes related to evaluating, completing, or integrating the Business Transaction. The receiving party may not use such Personal Information for unrelated purposes, including marketing to you or contacting you for purposes other than those directly connected to the Business Transaction.

(c) If a Business Transaction is completed, the successor entity may use the Personal Information only for the purposes for which it was originally collected as described in this Policy, unless it obtains your separate consent for new purposes.

(d) Following completion of a Business Transaction, PKUP (or its successor) will notify affected individuals of the transaction and any material changes to the handling of their Personal Information within a reasonable time.

4.6. With Your Consent

We may share your Personal Information in other ways when you provide your explicit consent or direct us to do so.

4.7. For Custom Audience and Social Media Advertising

We may share certain information with social media platforms and advertising partners to deliver targeted advertisements and measure their effectiveness. This practice, commonly known as “Custom Audience” advertising, involves sharing hashed or encrypted identifiers with platforms such as Facebook, Instagram, Google, and others.

The purposes of such sharing include showing you relevant PKUP advertisements when you use third-party services, excluding existing customers from certain promotional campaigns, finding similar audiences who may be interested in our Services, and measuring the effectiveness of our advertising campaigns. The information shared typically includes hashed email addresses, phone numbers, or device identifiers, which the platforms match against their user databases without revealing your identity to us.

When you interact with our social media pages or use social login features, the social media platform may share information with us as permitted by your privacy settings on that platform. We may receive your name, email address, profile picture, and friends list if permitted by your settings. Your interactions with our content on social media platforms may be visible to others on those platforms according to their privacy policies.

To opt out of Custom Audience advertising, you may contact us at privacy@pkup.ca to request that we exclude your information from custom audience creation. You may also adjust your advertising preferences directly on each social media platform through their privacy or advertising settings. Opting out of custom audiences will not affect advertisements you see based on your activity on the social media platforms themselves, only those resulting from our sharing of information with those platforms.

4.8. Aggregated or De-identified Information

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you for any purpose, including business development, research, marketing, and analytics.

4.9. Public Information

Certain information you provide through our Services may be visible to other users or the public. This includes ratings and written reviews you provide about Couriers, which may be visible to those Couriers and to other Customers considering using their services. When you submit a review, your first name and last initial may be displayed with your review. Any photos you upload of delivered items may be shared with merchants and other users as necessary for service-related purposes.

For Couriers, certain profile information is necessarily public to enable Customers to make informed decisions. This includes the Courier’s first name, profile photo, vehicle information, aggregate rating, and general statistics about delivery history. During active deliveries, Customers can see their assigned Courier’s real-time location if location sharing is enabled.

Customers’ names and delivery addresses are visible to Couriers during active deliveries to enable successful completion of the service. This information is only accessible for the duration necessary to complete the delivery and for a limited time thereafter for customer service purposes.

We may publicly share aggregated statistics about deliveries, popular delivery areas, service trends, and other analytical information. This information is anonymized and aggregated in a manner that cannot be used to identify any individual user.

You may control what information becomes public by choosing not to upload photos or write reviews, using initials or a nickname in your Account settings where permitted, or contacting us at privacy@pkup.ca to request removal of content you have posted. Once information has been made public, we cannot control how others may use or share that information.

4.10. Emergency Situations

In emergency situations, we may share information with emergency services, law enforcement, or other relevant authorities to protect safety and respond to emergencies. This includes situations where we believe there is an imminent risk of death or serious physical injury to any person, when a user contacts emergency services through our Platform, or when we detect a serious safety incident during a delivery.

The information we may share in emergency situations includes user name and contact information, real-time location data if available, delivery details and route information, vehicle information for Couriers, and relevant communication records that may assist emergency responders. We may share this information without your consent when we believe in good faith that disclosure is necessary to protect the safety of any person.

Our Platform may include emergency features such as in-app emergency assistance buttons that connect directly to 911, automatic location sharing with emergency responders when emergency features are activated, and safety check-ins for deliveries in progress. Use of these features constitutes consent to share relevant information with emergency services.

You may manage certain emergency contact preferences in your Account settings. We reserve the right to share information with authorities regardless of your preferences if we believe it is necessary to prevent serious harm, respond to an emergency, or comply with legal obligations. Our emergency response procedures are designed to prioritize user safety while respecting privacy to the greatest extent possible under the circumstances.

5.  YOUR PRIVACY RIGHTS AND CHOICES

Depending on your jurisdiction and subject to certain exceptions and limitations under Applicable Privacy Laws, you have certain rights regarding your Personal Information:

5.1. Access and Portability

You have the right to request access to the Personal Information we hold about you and to receive a copy of such information in a structured, commonly used, and machine-readable format. You may also request information about the categories of Personal Information we collect, the purposes for which we use it, and the categories of third parties with whom we share it.

5.2. Correction

You have the right to request that we correct or update any Personal Information that is inaccurate, incomplete, or outdated. You can update much of your information directly through your Account settings.

5.3. Deletion

You have the right to request deletion of your Personal Information, subject to certain exceptions. We may retain certain information as required by law, to complete transactions you initiated, for fraud prevention and security purposes, to enforce our agreements, or for other legitimate business purposes.

5.4. Withdrawal of Consent

Where we process your Personal Information based on your consent, you have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of processing based on consent before withdrawal. You may withdraw consent to optional purposes (marketing, analytics, interest-based advertising, and third-party data sharing for advertising) through your Account settings at any time without affecting your access to the core Services. If you withdraw consent for essential purposes, you may no longer be able to use the Services.

5.5. Marketing Communications

You can opt out of receiving marketing communications from us by clicking the “unsubscribe” link in our marketing emails, replying “STOP” to marketing text messages, adjusting your notification preferences in your Account settings, or contacting us using the information in Section 13. Even if you opt out of marketing communications, we may still send you transactional or service-related communications.

5.6. Location Information

You can control the collection of precise location information through your device settings and in-app permissions. For details on how foreground and background location data is collected, the specific functions that require it, and how to disable background location collection without losing core service access, see Section 2.2 (Location Data). Disabling precise location services may require you to manually enter delivery addresses and may reduce the accuracy of certain features.

5.7. Cookies and Tracking Technologies

You can manage your cookie preferences through your browser settings. For more information about controlling cookies and tracking technologies, see Section 6.

5.8. How to Exercise Your Rights

To exercise any of these rights, you may:

Log into your Account and access the relevant settings or privacy controls; Email us at privacy@pkup.ca; Call us at [Phone Number]; or Write to us at the address provided in Section 13.

When you make a request, we may ask you to provide information to verify your identity. We will respond to your request within the time period required by Applicable Privacy Laws, typically within 30 days. If we need more time, we will inform you of the reason and extension period.

5.9. No Discrimination

We will not discriminate against you for exercising your privacy rights, including by denying you Services, charging different prices, or providing a different level of service.

5.10. Consent Management

We maintain comprehensive records of consent to demonstrate compliance with Applicable Privacy Laws. Our consent management practices include:

Consent Records. We record when and how consent was obtained, what you were told at the time consent was requested, whether consent was explicit or implied, any conditions or limitations on consent, and when consent was withdrawn (if applicable).

Granular Consent Options. We provide granular consent options that allow you to consent to or withhold consent from each optional purpose described in the Consent section of this Policy independently. You are not required to consent to all optional purposes in order to access the core Services.

Consent Refresh. We periodically review and refresh consent for marketing communications and other optional processing activities to ensure that consent remains current and valid.

Withdrawal Mechanisms. We provide easy-to-use mechanisms for withdrawing consent, including in-app controls, unsubscribe links, and customer service channels. When you withdraw consent, we process your request promptly and update our records accordingly.

6. COOKIES AND TRACKING TECHNOLOGIES

6.1. Technologies We Use

We and our service providers use cookies and similar tracking technologies to collect information about your use of our Platform. These technologies include:

Cookies. Small data files placed on your browser or device that allow us to recognize your device and remember information about your visit.

Web Beacons. Small electronic images embedded in web pages and emails that allow us to count visitors and understand usage patterns.

Mobile SDKs. Software development kits integrated into our mobile apps that enable analytics and advertising functionality.

Local Storage. Technologies that allow us to store information locally on your device, similar to cookies but with enhanced capabilities.

Device Fingerprinting. Techniques to identify unique devices based on combinations of information such as operating system, browser version, and hardware configurations.

6.2. How We Use These Technologies

We use cookies and similar technologies for several purposes:

We use cookies and similar technologies for several purposes:

Essential Operations. To enable basic Platform functionality, maintain your session, remember your preferences, and ensure security.

Performance and Analytics. To understand how users interact with our Platform, identify technical issues, measure performance, and improve our Services.

Personalization. To remember your preferences, customize your experience, and provide relevant content and recommendations.

Advertising and Marketing. To deliver targeted advertising, measure ad effectiveness, and understand the success of marketing campaigns.

6.3. Your Choices

You have several options for managing cookies and tracking technologies:

Browser Settings. Most browsers allow you to block or delete cookies. Please note that blocking all cookies may affect Platform functionality.

Mobile Device Settings. Your mobile device may offer settings to limit ad tracking or reset advertising identifiers.

Third-Party Tools. You can opt out of interest-based advertising from participating companies through industry tools such as the Digital Advertising Alliance of Canada’s opt-out page at youradchoices.ca.

Platform Controls. We provide controls within your Account settings to manage certain tracking preferences.

6.4. Do Not Track

Some browsers offer a “Do Not Track” setting. Our Platform does not currently respond to Do Not Track signals, but we provide other ways for you to manage tracking as described above.

6.5. Interest-Based Advertising

We and our advertising partners use cookies and similar technologies to deliver personalized advertising about our Services on our Platform and third-party websites and applications. Interest-based advertising, also known as targeted advertising or online behavioural advertising, uses information collected across multiple websites, apps, and other online services to predict your preferences and show you ads that are more relevant to you.

We may share certain information with advertising partners to display personalized ads about PKUP services on other platforms, measure the effectiveness of our advertising campaigns, understand how you interact with our ads, prevent showing you the same ad repeatedly, and provide aggregate reporting to advertisers. The information shared may include device identifiers, hashed email addresses, and usage data. We require our advertising partners to protect your information and use it only for authorized advertising purposes.

6.6. Your Advertising Choices

You have several options to control interest-based advertising. You may visit the Digital Advertising Alliance of Canada (DAAC) at youradchoices.ca/choices to opt out of interest-based advertising from participating companies. You may download the DAAC’s AppChoices mobile app at youradchoices.ca/appchoices to manage mobile app advertising. Additional opt-out options are available through the Network Advertising Initiative at networkadvertising.org/choices.

For device-specific controls, iOS users may go to Settings > Privacy & Security > Tracking and turn off “Allow Apps to Request to Track.” Android users may go to Settings > Privacy > Ads and enable “Opt out of Ads Personalization.” We respect Global Privacy Control (GPC) signals where technically feasible. You may enable GPC in supported browsers to automatically communicate your opt-out preference.

Within your PKUP Account, you may log in and navigate to Privacy Settings > Advertising Preferences to manage personalized advertising from PKUP. Toggle “Personalized Ads” off to opt out of PKUP’s interest-based advertising. For email marketing, you may click “Unsubscribe” in any marketing email, reply “STOP” to marketing SMS messages, or manage preferences in your Account notification settings.

Opting out of interest-based advertising does not mean you will stop seeing ads from us. You will continue to see generic ads that are not based on your specific interests or activities. Your opt-out preferences are specific to each device and browser, so you must repeat this process on each device and browser you use.

7. DATA RETENTION

7.1. Retention Periods.

We retain Personal Information for as long as necessary to fulfill the purposes for which it was collected, including to provide our Services, comply with legal obligations, resolve disputes, and enforce our agreements. Our typical retention periods are:

Account Information. We retain your Account information for the life of your Account plus seven years after Account closure to comply with tax and legal requirements.

Transaction Records. We retain transaction records for seven years to meet tax, accounting, and legal obligations.

Location Data. We retain precise location data for 90 days after a delivery is completed for customer service, safety, and analytical purposes.

Communications. We retain customer service communications for two years or as required for legal purposes.

Marketing Preferences. We retain your marketing preferences until you change them or withdraw consent.

Earnings Data (Couriers). We retain Courier earnings records for seven years following the end of the calendar year in which the earnings were received.

Breach Records. We maintain records of Personal Information breaches for a minimum of 24 months from the date of the breach, as required under Applicable Privacy Laws.

7.2. Criteria for Retention

We determine appropriate retention periods based on the amount, nature, and sensitivity of the Personal Information; the purposes for which we process it; applicable legal requirements; and our legitimate business needs.

7.3. Deletion

When Personal Information is no longer needed for the purposes outlined in this Policy or required by law, we securely delete or anonymize it. Upon Account deletion, we will delete your Personal Information within a reasonable time period, except as necessary to comply with legal obligations, resolve disputes, or enforce our agreements.

8. SECURITY

8.1. Security Measures

We implement appropriate technical and organizational measures designed to protect Personal Information against unauthorized or unlawful processing and against accidental loss, destruction, or damage. These measures include:

Technical Safeguards. We use encryption to protect data in transit and at rest, maintain firewalls and intrusion detection systems, implement access controls and authentication mechanisms, conduct regular security assessments and penetration testing, and maintain secure coding practices.

Organizational Safeguards. We conduct employee background checks and require confidentiality agreements, provide regular privacy and security training, implement role-based access controls, maintain comprehensive security policies and procedures, and conduct vendor due diligence.

Physical Safeguards. We restrict physical access to facilities where Personal Information is processed, maintain environmental controls in data centres, and implement secure disposal procedures for hardware and documents.

8.2. Breach Notification

Despite our security measures, no method of transmission over the internet or electronic storage is completely secure. In the event of a breach of security safeguards involving Personal Information, PKUP will respond as follows:

(a) Reporting to the Office of the Privacy Commissioner. Where a breach of security safeguards creates a real risk of significant harm to any individual, PKUP will report the breach to the Office of the Privacy Commissioner of Canada (and any other applicable provincial privacy commissioner) as soon as feasible after determining that the breach has occurred.

(b) Notification to Affected Individuals. Where a breach creates a real risk of significant harm, PKUP will notify the affected individuals as soon as feasible. Notification will include:

• a description of the breach;
• the types of Personal Information involved in the breach;
• a description of the steps PKUP has taken or intends to take to reduce the risk of harm or to mitigate the harm;
• steps that affected individuals can take to reduce or mitigate the risk of harm to themselves; and
• contact information for PKUP’s Privacy Officer, who can answer questions about the breach.

(c) Notification to Third-Party Organizations. Where PKUP determines that notification to another organization or government institution may reduce the risk of harm resulting from the breach, PKUP will notify that organization or institution.

(d) Breach Records. PKUP maintains a record of every breach of security safeguards involving Personal Information under its control for a minimum of 24 months from the date PKUP determines the breach has occurred. These records are available to the Office of the Privacy Commissioner upon request.

8.3. Your Role in Security

You play an important role in maintaining security by using strong, unique passwords; keeping your Account credentials confidential; logging out of your Account when finished; keeping your devices and apps updated; and promptly notifying us of any suspected unauthorized access to your Account.

9. CHILDREN’S PRIVACY

The Platform and Services are not intended for use by children under the age of 18. We do not knowingly collect Personal Information from children. If we become aware that we have collected Personal Information from a child without appropriate consent, we will take steps to delete that information. If you believe we have collected Personal Information from a child, please contact us immediately using the information in Section 13.

10. INTERNATIONAL DATA TRANSFERS

Your Personal Information may be stored and processed in Canada and the United States. Our servers are located in Canada, and certain of our service providers maintain servers and operations in the United States.

PKUP remains responsible for your Personal Information regardless of where it is processed. When your Personal Information is transferred outside of Canada, we take the following safeguards to ensure its protection:

(a) Contractual Protections. We enter into data protection agreements with our service providers and Business Partners that require them to protect Personal Information to a standard consistent with this Policy and Applicable Privacy Laws. These agreements restrict the use and disclosure of Personal Information to the purposes for which it was transferred and require the recipient to implement appropriate security measures.

(b) Foreign Government Access. While your Personal Information is outside of Canada, it is subject to the laws of the country in which it is held and may be subject to disclosure to the governments, courts, law enforcement, or regulatory agencies of such country pursuant to the laws of such country.

(c) Legal Mechanism. Cross-border transfers of Personal Information are conducted in reliance on consent (as described in this Policy), contractual safeguards, and, where applicable, other transfer mechanisms recognized under Applicable Privacy Laws.

By using our Services, you acknowledge and consent to the transfer, storage, and processing of your Personal Information in Canada and the United States as described in this Policy.

11.  THIRD-PARTY SERVICES

Our Platform may contain links to third-party websites, applications, or services that are not owned or controlled by PKUP. This Policy applies only to Personal Information collected by PKUP. We are not responsible for the privacy practices of third parties, and we recommend that you review the privacy policies of any third-party services you access through or in connection with our Platform.

If you choose to connect your Account with third-party services (such as social media accounts), you authorize us to access and use certain information from those services as permitted by your settings and their privacy policies. You can manage these connections through your Account settings.

12.  COURIER PERSONAL INFORMATION OBLIGATIONS

Couriers agree not to record, copy, photograph, screenshot, or otherwise capture any Personal Information of Customers, Recipients, or other users outside of the PKUP app, except where necessary in connection with an active dispute, legal proceeding, or regulatory complaint in which the Courier is directly involved. Personal Information and photographs related to deliveries are stored and managed within the PKUP app in accordance with this Policy. This obligation is in addition to the obligations set out in the PKUP Courier Agreement, which Couriers should review for further details.

13.  CONTACT US

If you have questions, concerns, or complaints about this Policy or our privacy practices, or if you would like to exercise your privacy rights, please contact us at:

Privacy Officer
PKUP Logistic Solutions Limited
1629 Foster’s Way, 2nd Floor Delta, BC V3M 6S7
Email: info@pkupcanada.ca
Phone: 778-504-7587

We will investigate and attempt to resolve complaints and disputes regarding our use or disclosure of Personal Information in accordance with this Policy and Applicable Privacy Laws.

If you are not satisfied with our response, you have the right to contact the applicable privacy regulator:

For Federal privacy matters:
Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
Toll-free: 1-800-282-1376
Website: www.priv.gc.ca

For British Columbia privacy matters:
Office of the Information and Privacy Commissioner for British Columbia
PO Box 9038 Stn Prov Govt
Victoria, BC V8W 9A4
Phone: 250-387-5629
Toll-free in BC: 1-800-663-7867
Website: www.oipc.bc.ca

14.  CHANGES TO THIS POLICY

(a) Non-Material Changes. We may update this Policy from time to time to reflect operational, technical, or legal developments that do not constitute a Material Change. Non-material updates will be posted on the Website and in the Mobile App, and will take effect on the date posted. We encourage you to review this Policy periodically.

(b) Material Changes. If we make a Material Change to this Policy (as defined in Section 1), we will:

1. provide you with at least thirty (30) days’ advance written notice of the Material Change, delivered by email to the address associated with your Account and by prominent notice on the Website and in the Mobile App;
2. clearly describe the Material Change, the reasons for it, and its effect on how your Personal Information is collected, used, or disclosed;
3. require your affirmative consent (such as a click-through acceptance or similar mechanism) before the Material Change takes effect — continued use of the Services alone does not constitute acceptance of a Material Change; and
4. provide you with the option to terminate your Account without penalty before the Material Change takes effect, if you do not agree to the Material Change.

If you do not provide affirmative consent to a Material Change within the notice period, the prior version of this Policy will continue to govern the collection, use, and disclosure of your Personal Information until such time as you provide consent or terminate your Account.

15.  LANGUAGE

This Policy has been drafted in the English language. If this Policy is translated into any other language, the English language version shall prevail in the event of any inconsistency. The parties confirm that they have requested that this Policy be drafted in English. Les parties aux présentes confirment qu’elles ont exigé que la présente politique soit rédigée en anglais.