Privacy Policy

This Privacy Policy explains how A2Z Software Solutions collects, uses, discloses, retains, protects, and otherwise handles personal information in connection with the A2Z website, onboarding flow, hosted workspaces, desktop software, support services, and POS features.

A2Z intends to follow Canada's private-sector privacy requirements, including the Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies, and substantially similar provincial private-sector laws in Alberta, British Columbia, and Quebec where those laws apply to the handling of personal information within those provinces.

This policy is written to be strict: A2Z collects only what it has a defined business purpose to collect, uses personal information only for identified purposes, restricts access, requires safeguards, limits retention, and treats privacy incidents as reportable when the legal threshold is met.

A2Z is accountable for personal information under its control. A2Z must assign responsibility for privacy compliance to a privacy lead or Privacy Officer, maintain internal privacy practices, and make a privacy contact available through onboarding, workspace, support, or written account channels.

For Quebec activities subject to Quebec private-sector privacy law, A2Z must identify the person responsible for the protection of personal information or otherwise make the required privacy contact information available before collecting personal information from Quebec individuals through the service.

Customers remain responsible for privacy compliance in their own retail operations, including notices, consents, employment privacy requirements, customer-facing collection practices, retention rules, and lawful use of POS records.

A2Z may collect account and business contact information such as name, business name, store name, role, email address, phone number, billing contact, business address, workspace login slug, province, onboarding details, implementation notes, support messages, and administrator records.

A2Z may process POS and workspace information submitted by customers, including product records, category records, inventory records, transaction records, receipts, customer profiles, staff profiles, role permissions, audit logs, delivery or pickup details, notes, configuration settings, uploaded files, and support attachments.

A2Z may collect technical and security information such as IP address, device identifiers, browser type, operating system, login events, session events, cookie identifiers, local storage identifiers, crash reports, error logs, diagnostic records, approximate network-derived location, and usage activity needed to operate and secure the service.

A2Z does not intentionally collect full payment card numbers, card verification codes, bank credentials, government identity documents, health records, biometric identifiers, or information about children through the POS service unless a specific feature, written agreement, and legally compliant process expressly allows it.

A2Z collects, uses, and discloses personal information only for identified purposes that a reasonable person would consider appropriate in the circumstances, including account creation, workspace provisioning, authentication, role management, POS operation, inventory workflows, transaction records, support, billing, security, debugging, backups, service improvement, legal compliance, and enforcement of agreements.

A2Z may use business contact information to send service notices, security alerts, billing messages, implementation messages, support responses, administrative updates, and product changes. Marketing messages must be handled only where permitted by applicable law and must include available unsubscribe or opt-out options where required.

A2Z does not sell customer POS records or customer workspace data. A2Z does not use customer POS records for third-party advertising profiles.

A2Z relies on consent, contract necessity, legitimate service administration, legal obligations, and other grounds permitted by applicable Canadian privacy law. Consent must be meaningful: individuals must be able to understand what information is collected, why it is collected, how it is used, who receives it, and the reasonably foreseeable consequences.

Customers using A2Z to collect personal information from their shoppers, staff, contractors, or business contacts must provide their own legally required notices and obtain their own legally required consents before entering that information into A2Z.

Where express consent is required because information is sensitive, the use is unexpected, or disclosure creates meaningful risk, the customer must obtain express consent before using A2Z for that information. A2Z may refuse or restrict processing that appears unnecessary, unlawful, excessive, or inconsistent with this policy.

A2Z limits collection to information needed for defined service, security, support, billing, legal, and operational purposes. A2Z should not ask for or require personal information beyond what is necessary for the applicable feature or business purpose.

Customers must not use free-text notes, uploads, support messages, product fields, customer profiles, or staff profiles to store sensitive information unless the information is necessary, lawful, disclosed to the individual, and supported by appropriate safeguards.

A2Z may delete, restrict, redact, or request removal of information that is excessive, sensitive, unlawful, unsafe, or outside the intended POS software scope.

A2Z may use cookies, local storage, session identifiers, and similar technologies to keep users signed in, remember preferences, route workspaces, prevent fraud, secure sessions, measure service performance, and diagnose errors.

Non-essential analytics, advertising, cross-site tracking, or behavioural profiling tools must not be added unless A2Z discloses the tool, purpose, provider, retention, and available consent or opt-out choices before using it for non-essential tracking.

A2Z may disclose personal information to service providers that host, store, secure, monitor, support, bill, communicate, analyze, back up, and maintain the service. These providers may access personal information only as needed to perform services for A2Z and must be subject to confidentiality and security obligations appropriate to the information.

Personal information may be processed or stored in Canada, the United States, or other jurisdictions where A2Z or its providers operate. Information handled outside Canada may be subject to lawful access by courts, law enforcement, national security authorities, or regulators in those jurisdictions.

For Quebec activities subject to Quebec private-sector privacy law, A2Z must complete required privacy impact assessments before communicating personal information outside Quebec where the law requires that assessment.

A2Z uses administrative, technical, and organizational safeguards appropriate to the sensitivity, amount, distribution, format, and storage of personal information. Safeguards may include encryption in transit, role-based access, authentication, access logging, least-privilege controls, backup controls, vendor review, secure development practices, and incident response procedures.

A2Z restricts access to personal information to personnel and providers who need it for authorized purposes. Customers must also protect local devices, passwords, administrator accounts, networks, exported files, receipt printers, payment terminals, and other systems connected to the POS environment.

No online, desktop, or connected system is perfectly secure. A2Z will treat suspected unauthorized access, disclosure, loss, copying, modification, or misuse of personal information as a security incident requiring investigation.

A2Z will investigate suspected breaches of security safeguards involving personal information under A2Z's control. A2Z will keep records of privacy breaches where required by law and will use those records to assess risk, notification obligations, containment, remediation, and prevention.

Under PIPEDA, A2Z must report a breach of security safeguards to the Office of the Privacy Commissioner of Canada and notify affected individuals when it is reasonable to believe the breach creates a real risk of significant harm. A2Z must also keep records of breaches as required by PIPEDA.

Where Alberta private-sector privacy law applies, reportable breaches must be reported to the Alberta Information and Privacy Commissioner where the legal threshold is met. Where Quebec private-sector privacy law applies, confidentiality incidents presenting a risk of serious injury must be reported to the Commission d'accès à l'information du Québec and affected individuals, and incident registers must be maintained as required.

Customers must promptly notify A2Z of suspected unauthorized access, exposed credentials, lost devices, staff misuse, improper exports, or local POS incidents that may affect personal information handled through A2Z.

A2Z retains personal information only as long as necessary for the purposes described in this policy, including service delivery, customer administration, billing, tax records, dispute resolution, security, audit logs, backups, legal obligations, and legitimate business records.

When information is no longer needed, A2Z will delete, de-identify, aggregate, archive, or securely dispose of it according to applicable law, operational requirements, backup cycles, and written customer terms. Backup copies may remain for a limited period before normal deletion cycles remove them.

Customers are responsible for configuring their own retention practices for customer, staff, transaction, inventory, accounting, tax, and audit records stored in or exported from A2Z.

Individuals may request access to personal information, correction of inaccurate information, withdrawal of consent, deletion where applicable, information about use or disclosure, and other rights available under applicable Canadian, Alberta, British Columbia, or Quebec privacy law.

A2Z may need to verify identity and authority before acting on a request. Some requests may be limited by legal obligations, transaction integrity, security needs, backup systems, tax or accounting records, employment obligations, fraud prevention, dispute records, or the rights of another person or business.

Where a request concerns personal information controlled by an A2Z customer, A2Z may direct the requester to that customer or assist the customer in responding according to applicable law and written customer terms.

A2Z is business POS software and is not directed to children. A2Z does not knowingly collect personal information from children through the public website or service except where a customer lawfully enters information for a legitimate retail business purpose and has provided all required notices and consents.

Customers must not use A2Z to collect personal information from minors unless the collection is lawful, necessary, properly disclosed, and supported by appropriate consent and safeguards.

Privacy questions, access requests, correction requests, deletion requests, consent withdrawal requests, and complaints should be sent through the support, workspace, onboarding, or written account contact channel provided by A2Z Software Solutions.

If a privacy concern is not resolved, individuals may contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy commissioner, including the Alberta OIPC, the Office of the Information and Privacy Commissioner for British Columbia, or Quebec's Commission d'accès à l'information where those laws apply.

A2Z may update this Privacy Policy when the service, privacy practices, vendors, legal requirements, or business operations change. Material changes will be communicated through the website, workspace, onboarding flow, email, invoice, or another reasonable business contact channel.

Continued use of the service after an updated policy takes effect means the service will be handled under the updated policy from that date forward, subject to applicable law and any signed written agreement.