Privacy Policy
Effective Date: January 15, 2025 · Version 1.0
PIPEDA Compliant · Quebec Law 25 Compliant
Related Document: Terms of Service
Your Privacy Matters: Here's What We Do
What We Collect
Your name, contact info, and purchase details—only what's needed to complete your car purchase safely.
How We Protect It
Bank-level 256-bit encryption, secure servers, and strict access controls. We never sell your data.
Your Rights
Access your data, request corrections, or delete it anytime. Contact our Privacy Officer easily.
✅ Fully compliant with: PIPEDA (federal law) · Quebec Law 25 · Alberta/BC PIPA · All provincial privacy laws
1. Our Commitment to Privacy
MonsterAuto.ca Inc. complies with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Quebec's Law 25, Alberta's PIPA, and British Columbia's PIPA.
This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Platform to browse, purchase, or finance a vehicle.
This Privacy Policy should be read together with our Terms of Service, which govern your use of the Platform.
2. Information We Collect
| Category | Examples | Purpose |
|---|---|---|
| Personal Identifiers | Name, address, email, phone | Create accounts and contact you about your transaction |
| Government ID | Driver's licence, province | Required by dealers for purchase documents and identity verification |
| Financial Information | Deposit payments, credit data | Process payments and financing applications |
| Vehicle Data | Trade-in VIN, mileage, photos | Complete sale or valuation |
| Usage Data | IP address, device ID, cookies | Security, fraud prevention, and analytics |
3. How We Use Your Information
We use personal information to:
- Create and manage your MonsterAuto.ca account
- Facilitate communication between you and Dealer Partners
- Process deposits and financing applications
- Generate digital contracts and legal documents
- Coordinate delivery updates and support
- Conduct fraud prevention and security monitoring
- Improve our Platform through analytics and user research
- Comply with legal and regulatory obligations
We do not sell your personal information to third parties.
4. How We Share Information
We share data only as necessary to complete your transaction:
| Recipient | Purpose |
|---|---|
| Dealer Partners | Complete vehicle purchase, delivery, registration |
| Third-Party Lenders | Assess and process financing applications |
| Payment Processors (Stripe) | Process secure deposits and payments |
| Service Providers | Host servers, verify identity, generate documents, provide customer support |
| Regulators / Law Enforcement | When required by law or regulation |
All recipients must handle your data in compliance with PIPEDA or equivalent provincial standards and maintain appropriate security safeguards.
5. Consent
By submitting information through the Platform, you consent to its collection, use, and disclosure as described. Consent is obtained via explicit acceptance (checkbox or digital signature) at checkout or account creation.
You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting privacy@monsterauto.ca.
Please note that withdrawing consent may limit your ability to use certain Platform features or complete vehicle transactions, and we may be required to retain certain information for legal compliance.
6. Cookies and Tracking Technologies
We use cookies, web beacons, and similar tracking technologies to enhance your experience, analyze usage patterns, and deliver personalized content.
Cookie Types:
- Essential Cookies: Required for Platform functionality, security, and authentication
- Performance Cookies: Help us analyze how visitors use our Platform
- Functional Cookies: Remember your preferences and personalize your experience
- Marketing Cookies: Track visits for advertising and marketing purposes
Your Choices: You can manage cookie preferences through your browser settings. For users in Quebec, non-essential cookies require explicit opt-in consent and will not activate until you provide that consent.
Note: Disabling certain cookies may limit Platform functionality, such as saved preferences or streamlined checkout.
7. Data Security
We employ industry-standard safeguards including:
- TLS 1.3 encryption for data in transit
- Encryption at rest for sensitive records
- Strict access controls and role-based permissions
- Regular security testing and vulnerability assessments
- Audit logs and monitoring for suspicious activity
- Employee training on privacy and security best practices
Third-Party Security: We require all third-party service providers (including payment processors like Stripe) to maintain equivalent security standards and to notify us promptly of any security incidents.
8. Data Breach Notification
Our Commitment:
In the event of a data breach resulting in unauthorized access to personal information and posing a real risk of significant harm, we shall:
- Notify affected individuals without undue delay (typically within 72 hours of discovery)
- Notify the Privacy Commissioner of Canada and relevant provincial authorities as required by law
- Provide clear information about:
- The nature of the breach
- The personal information affected
- The steps we are taking to mitigate harm
- Contact information for further inquiries
- Actions you can take to protect yourself
- Maintain a record of all breaches, whether or not notification was required
Third-Party Breaches: If a data breach occurs at a third-party service provider (such as Stripe), we will work with that provider to assess the impact and fulfill our notification obligations as required by law.
9. Data Retention
We retain personal information only as long as necessary to fulfill the purposes described or as required by law (e.g., dealer record-keeping regulations, tax documentation requirements).
Retention Periods:
- Account Information: Retained while your account is active plus 7 years after closure
- Transaction Records: Retained for 7 years as required by provincial dealer regulations
- Financial Records: Retained for 7 years as required by tax law
- Marketing Communications: Retained until you withdraw consent or opt-out
- Usage Data / Analytics: Typically aggregated and anonymized within 24 months
📋 Why These Retention Periods?
The 7-year retention period reflects:
- Provincial Dealer Regulations: Licensed dealers must retain vehicle sales records for 7 years (OMVIC, AMVIC, etc.)
- Canada Revenue Agency (CRA) Requirements: Tax documents must be retained for 6-7 years
- Limitation Periods: Most civil claims in Canada have 2-6 year limitation periods; 7 years provides prudent coverage
- Warranty & Consumer Protection: Vehicle warranty claims and consumer protection disputes may arise years after purchase
💰 Financial Transaction Records - PIPEDA Disclosure
We retain all financial transaction records, including vehicle purchase agreements, financing contracts, payment records, and related documentation for a minimum of 7 years from the date of the transaction, as required by:
- Canada Revenue Agency (CRA) tax documentation requirements
- Provincial motor vehicle dealer licensing regulations (OMVIC, AMVIC, VSABC, etc.)
- Financial record-keeping obligations under federal and provincial law
- Consumer protection and warranty claim documentation requirements
This retention period ensures we can provide you with copies of your purchase records, respond to warranty claims, resolve disputes, and comply with tax audits or regulatory investigations. After the 7-year retention period expires, records are securely deleted or anonymized in accordance with industry best practices.
Your Rights: You may request access to your retained financial records at any time by contacting our Privacy Officer at privacy@monsterauto.ca.
When retention is no longer required, data is securely deleted or anonymized in accordance with industry best practices.
10. Your Rights Under PIPEDA
You have the following rights regarding your personal information:
- Access: Request access to the information we hold about you
- Correction: Request correction of inaccurate or incomplete data
- Withdraw Consent: Withdraw consent for future use or sharing (subject to legal obligations)
- Deletion: Request deletion, subject to legal retention requirements
- Data Portability: Request a copy of your data in a structured, commonly used format
- Restriction: Request that we restrict processing in certain circumstances
- Object: Object to processing based on legitimate interests
To exercise these rights, contact privacy@monsterauto.ca. We will respond within 30 days of receiving your request.
11. Cross-Border Data Transfers
Some data may be processed or stored outside Canada (e.g., cloud hosting on AWS or Azure, payment processing through Stripe's international infrastructure).
When this occurs:
- Data remains subject to comparable contractual and technical safeguards
- Service providers must comply with PIPEDA-equivalent standards
- Data may be accessible to foreign authorities under applicable law (e.g., U.S. CLOUD Act)
- For Quebec residents: We conduct Privacy Impact Assessments before transferring data outside Quebec
We will notify you at the point of collection if your data will be transferred outside Canada.
12. Quebec Law 25 - Enhanced Requirements
For residents of Quebec, we comply with enhanced requirements under Law 25:
📋 Privacy Impact Assessments (PIAs)
We conduct PIAs before implementing new data processing activities, technologies, or third-party integrations that may pose privacy risks.
🎯 Privacy by Design & Default
Our systems are designed to collect only the minimum necessary data, with privacy-protective settings enabled by default (e.g., marketing cookies off until opt-in).
⚖️ Automated Decision-Making Transparency
If we use automated systems to make decisions affecting you (e.g., preliminary trade-in valuations), you have the right to request human review and an explanation of the decision logic.
📞 Designated Privacy Officer
Our Privacy Officer oversees compliance, handles complaints, and serves as the primary contact for privacy matters.
💰 Enhanced Penalties & Punitive Damages
Quebec residents may claim punitive damages for intentional or grossly negligent privacy violations. We take these obligations seriously and maintain comprehensive governance policies to prevent violations.
13. Provincial Privacy Notes
Alberta & British Columbia:
We comply with their Personal Information Protection Acts (PIPA), which provide similar rights to PIPEDA.
Ontario:
For businesses operating in Ontario, PIPEDA applies. Residents have rights to access, correction, and to challenge compliance with the Privacy Commissioner of Canada.
14. Governance and Accountability
MonsterAuto.ca maintains a comprehensive privacy governance program including:
- Privacy Policies & Procedures: Internal policies governing data handling, access controls, and breach response
- Employee Training: Regular privacy and security training for all personnel
- Third-Party Due Diligence: Vetting and monitoring of service providers for privacy compliance
- Privacy Impact Assessments: Conducted before launching new features or processing activities
- Complaint Handling: Documented procedures for investigating and resolving privacy complaints
- Regular Audits: Periodic reviews of privacy practices and compliance
15. Updates to This Policy
We may update this Privacy Policy periodically to reflect legal or business changes. The latest version will always be posted at MonsterAuto.ca/privacy with the effective date shown.
Material changes will be communicated via email to registered users at least 30 days before taking effect. For Quebec residents, we will obtain renewed consent if required under Law 25.
16. Contact Our Privacy Officer
Privacy Officer – MonsterAuto.ca Inc.
Our Privacy Officer is responsible for overseeing compliance with this Privacy Policy and applicable privacy laws. You may contact our Privacy Officer to:
- Exercise your privacy rights
- File a privacy complaint
- Request information about our privacy practices
- Report a suspected data breach
17. Document Archive and Version Control
MonsterAuto.ca maintains archived versions of this Privacy Policy for a minimum of 2 years to demonstrate compliance history and notice practices, as required under Quebec Law 25 and PIPEDA accountability principles.
If you need access to a previous version of this Privacy Policy, contact our Privacy Officer at privacy@monsterauto.ca.
18. Filing a Complaint
If you believe your privacy rights have been violated, you have the right to file a complaint with the Privacy Commissioner of Canada:
For Quebec Residents: You may also file a complaint with the Commission d'accès à l'information du Québec (CAI):
© 2026 MonsterAuto.ca® · Version 1.0 · PIPEDA Compliant · Quebec Law 25 Compliant · All rights reserved