Privacy policy

Grimaldi Tooling Ltd. (“Grimaldi”, “we”, “our”, “us”) is responsible for the personal information described in this Privacy Policy: what we collect through the Grimaldi storefront, how we use it, who we share it with, how long we keep it, and the rights you have.

This Policy applies to everyone we deal with through the Site: retail customers, whether they have an account or check out as a guest; people who buy for a business through a trade or dealer account; anyone who contacts us or uses live chat; and anyone who has agreed to hear from us. It does not apply to third-party sites that link to or from the Site, which have their own privacy notices.

Our Privacy Officer is Billy Ng, Co-founder and Privacy Officer, Grimaldi Tooling Ltd. The Privacy Officer is responsible for our compliance with this Policy and with privacy law. You can reach the Privacy Officer at info@grimalditools.com or by mail at 12160 103A Avenue, Surrey, BC V3V 3G7, Canada.

Where we handle personal information on behalf of another business, we act as its service provider and follow its instructions, in addition to our own safeguards.

We collect personal information in three ways:

Information you provide directly

• Accounts and checkout: for retail customers and guests, your name, email, phone number and billing and shipping addresses. For trade accounts, also the business name, jurisdiction, tax registration, named purchasing contacts and their roles.
• Orders and quotes: the products you request, quantities, references such as purchase-order numbers and project codes, and the addresses involved in fulfilment.
• Payment information: the limited information needed to authorise payment. Full card numbers are handled by our PCI-compliant payment service provider and are never stored on Grimaldi systems.
• Support contact: the messages, attachments, and context you share when you contact us through the Site, by email, or through other supported channels.

Information collected automatically

• Device and session signals: IP address, user-agent, language, time zone, and the events generated by your interaction with the Site, used to operate the storefront, secure sessions, and diagnose issues.
• Cookies and similar storage: first-party cookies and local storage keep you signed in, hold your cart and remember your preferences. Analytics are optional: they are off until you turn them on in Quebec, the European Union, the European Economic Area, the United Kingdom, anywhere else outside Canada and the United States, when we cannot tell where you are, or when your browser sends a Global Privacy Control signal; elsewhere in Canada and in the United States they are on and you can turn them off. See our Cookie Notice for the details and the controls available to you.

Information from other sources

• Public business records: we may verify business registration, tax-exemption status, or sanctions-screening results using authoritative public sources or screening providers.
• Trade references: where a trade account offers references in support of credit terms, we may contact those references to confirm the information provided.
• Carrier and warehouse partners: shipping status, delivery exceptions, and proof-of-delivery records are received from our carrier and warehouse partners and tied to the related order record.

We use personal information to:

• open and run your account, and assess and maintain trade accounts;
• resolve pricing, tier, and quoted pricing across the catalogue;
• process orders, payments, refunds, returns, and warranty claims;
• communicate transactional information such as order confirmations, shipment updates, and account notices;
• provide support, including the ability to associate a support request with the right order or business profile;
• secure the Site against fraud, abuse, and unauthorised access, including by maintaining audit logs of sensitive events;
• measure and improve the storefront, where permitted, using aggregate and pseudonymous usage data;
• comply with legal obligations, including tax, export-control, sanctions, accounting, and records-retention requirements; and
• send marketing emails where you have agreed to receive them, or where Canadian anti-spam law allows it because you have bought from us or contacted us recently. Every such email has an unsubscribe link, and you can withdraw consent at any time.

In Canada, our handling of personal information is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia’s Personal Information Protection Act (BC PIPA) and, for people in Quebec, the Act respecting the protection of personal information in the private sector (as amended by Law 25). Where you live somewhere whose privacy law gives you additional rights, we apply them.

We rely on the following bases:

• Performance of a contract: to operate the account, fulfil orders, and provide support.
• Legitimate business interest: to secure the Site, prevent fraud, maintain audit records, and improve our services, balanced against the privacy interests of the individual.
• Legal obligation: to satisfy tax, accounting, export, sanctions, and records-retention requirements.
• Consent: for optional uses such as marketing emails and analytics, which you can withdraw at any time.

We do not sell personal information. We share it only with:

• Service providers that operate the Site under written agreements (including hosting, database, email, payment, shipping, warehouse, observability, and customer-support providers), and only for the purposes described in those agreements.
• Shipping carriers that deliver your order, which receive the name, address and phone number on the shipment.
• Professional advisers such as our lawyers, accountants, and auditors, where reasonably required for our business.
• Government and regulatory bodies where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of Grimaldi, our buyers, or others.
• A successor entity in connection with a corporate transaction such as a merger, acquisition, or asset sale, subject to confidentiality obligations.

These are the service providers that handle personal information for us, and what each one receives. Each is bound by terms that limit its use of the information to providing its service to us.

• Stripe (payments, fraud screening and tax calculation): your name, email, billing and shipping addresses, order amounts and the card details you enter, which go directly to Stripe.
• Supabase (database, sign-in and file storage): your account, order, return and support records.
• Vercel (hosting and content delivery, plus Web Analytics and Speed Insights if you allow analytics): your IP address, browser and device information and the pages you request.
• Google Workspace and Microsoft 365 (our email): email addresses and the content of messages you exchange with us.
• Resend (marketing email delivery): your email address, name and the email sent to you.
• Sentry (error monitoring): technical details of errors, which can include your IP address and the page you were on.
• Upstash (rate limiting to stop abuse): your IP address, kept briefly.
• Cloudflare Turnstile (bot protection on some forms and on guest checkout, where enabled): browser and device signals and your IP address.
• Mapbox (the dealer map and address lookup): your IP address and the map or address requested.
• Trenvar and the shipping carriers it books (rates, labels and tracking): the ship-to name, address and phone number, and parcel details.
• Help Scout (customer support messaging, where enabled): your name, email and messages.
• Plausible and PostHog (analytics, only where enabled and only if you allow analytics): the pages you view and, for PostHog, events on the Site and a browser identifier.
• NarCom, operated by Naraz Promotion Ltd. (the operations dashboard our team works from): a short preview of new support messages and who sent them.

We do not sell personal information and we do not use advertising networks. If we add a provider that handles personal information, we will update this list.

Grimaldi is based in British Columbia, Canada. Several of the providers above store or process information in the United States or elsewhere outside Canada, and information about people in Quebec may therefore be stored outside Quebec. Before we use a provider, we assess whether it protects the information adequately, and our agreements with providers require security measures and limit use to the service provided. Information held in another country may be accessible to the authorities of that country under its law.

We keep personal information for as long as it is needed to operate the account, fulfil the order, meet our legal obligations, and resolve disputes. Typical retention windows include:

• Account records: for as long as the account is active and, after it closes, for the period our records-retention and tax obligations require.
• Order and invoice records: retained for the period required by applicable tax and accounting law, typically at least six (6) years.
• Support records: retained for the period needed to operate the support relationship and to identify recurring issues, then archived or anonymised.
• Security and audit logs: retained for the period needed to investigate incidents and demonstrate compliance, then rotated.

We apply administrative, technical, and physical safeguards designed to protect personal information against unauthorised access, use, disclosure, alteration, and loss. These include role-based access, principle-of-least-privilege, encryption in transit, encryption at rest for sensitive stores, monitored audit logs, vendor due diligence, and a documented incident-response process. No system is perfectly secure, and we encourage buyers to use strong, unique credentials and to notify us promptly of any suspected compromise.

Subject to applicable law, individuals whose information we process have the right to:

• Access the personal information we hold about them and ask for an explanation of how it is used and disclosed;
• Correct personal information that is inaccurate or out of date;
• Withdraw consent for processing that relies on consent, including opt-in marketing, on reasonable notice;
• Object to certain processing, including direct marketing;
• Complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia or, in Quebec, the Commission d’accès à l’information, where applicable.

Requests can be sent to info@grimalditools.com. We may need to verify the identity of the requester before acting on a request. Some information must be retained to meet our legal obligations, in which case we will explain the basis for retention and limit further use.

If you live in Quebec, you also have these rights under Quebec’s private sector privacy law:

• Access and correction: to see the personal information we hold about you and to have inaccurate, incomplete or out of date information corrected;
• De-indexing: to ask us to stop disseminating your personal information, or to de-index any link to your name, where its dissemination breaches the law or a court order, or causes you serious harm;
• Portability: to receive personal information you gave us in a structured, commonly used technological format, or to have it sent to a person or body you choose;
• Information about technology: to be told when we use technology that can identify, locate or profile you, and how to turn it off. Analytics on the Site are off for visitors in Quebec until you turn them on under Cookie preferences; see our Cookie Notice.

Your personal information may be stored outside Quebec, as described in section 8. To exercise any of these rights, contact our Privacy Officer at info@grimalditools.com. We respond in writing within thirty (30) days. If you are not satisfied, you can apply to the Commission d’accès à l’information du Québec.

The Site sells professional tools and is not directed at children. We do not knowingly collect personal information from anyone under the age of sixteen (16). If you believe a child has provided personal information through the Site, contact info@grimalditools.com and we will take reasonable steps to delete it.

We do not make decisions about trade-account approval, credit or order acceptance solely by automated means. Automated screening may flag an application or order for review (for example, where a fraud signal is raised), but a person at Grimaldi reviews the outcome before any adverse decision is made.

We may update this Policy to reflect changes to our operations, technology or the law. We will email account holders about material changes before they take effect. The “Last updated” date at the top of this page shows the latest revision.

To exercise a right or ask a privacy question, please contact:

We will acknowledge your request within thirty (30) days and respond on the timeline required by applicable privacy law.