Privacy Policy

Version 1.3.

Viking Media Labs Inc. is accountable for personal information handled through Glacier Pure Compounds under PIPEDA and applicable provincial law.

Stripe payments

When you choose Stripe, the payment link includes a unique order reference. You enter your email, order number and payment details on Stripe’s hosted page. Stripe handles the card details; GPC does not receive full card numbers. GPC receives payment identifiers, amounts, currency and payment status to verify payment and update your order. GPC continues to issue invoices and manage orders. Interac payments are verified separately against bank receipts.

Accountability and contact

GPC’s Privacy Officer is responsible for the protection of personal information, including for the purposes of Quebec law. Questions, privacy requests and complaints may be sent to the Privacy Officer at info@glacierpurecompounds.com or 72 Victoria Street South, Kitchener, Ontario N2G 4Y9, Canada. The identity of the person responsible is available on request.

Privacy governance

The Privacy Officer oversees privacy requests, complaints and incidents, approves GPC’s privacy policies and practices, and is responsible for retention rules and privacy assessments when systems or service providers change. These responsibilities apply to information throughout its collection, use, disclosure, retention and destruction.

Access is limited to people who need the information for their duties. Order support and fulfillment require customer and shipment details; accounting requires payment and financial records; technical support requires information needed to operate and secure the site. A person may carry out more than one role. Staff and service providers must respect confidentiality and use information only for authorized purposes.

Information collected

We collect information you provide through account registration, checkout, availability requests, the GPC Verification Program and correspondence. Payment services, carriers and other providers may also supply information needed to reconcile a payment, deliver an order or resolve a request.

Account, billing, shipping and order-contact details.
Order items, prices, taxes, payment references, payment reconciliation, refunds, shipment tracking and customer-service correspondence.
Research-access and checkout confirmations, including time, language, accepted policy versions and hashes, truncated IP address and browser information.
Availability requests, marketing-consent evidence, unsubscribe status and email-delivery records, including network information associated with consent.
Verification Program requests, laboratory reports, receipts, supporting documents and related credit or refund records. We do not publicly identify a customer in published verification results without permission or another lawful basis.
Qualification and research-use declarations, relevant correspondence, and records of suspected misuse, fraud or policy breach. No project description is required for catalogue access or checkout. Please do not send personal medical information, confidential research protocols or unrelated personal details.
Necessary account, security, session and cart information. Non-essential attribution tracking is disabled.

Cookies and similar technologies

The site uses first-party cookies for research access, account sign-in, cart and session functions, and language preferences. They recognize a browser or account so that the requested service can work.

To keep catalogue navigation smooth, the current tab temporarily remembers that an access check succeeded. This display preference contains no personal identifier, expires after 30 minutes without a successful check, and is cleared when the tab closes. It only avoids repeated loading screens; the server still verifies research access.

Research access (gpc_access): after you submit the research-use confirmation, a signed identifier links this browser to its confirmation record. By default this is a browser-session cookie. The separate, unchecked “Remember this browser for 30 days” option lets you keep access for up to 30 days. The choice and expiry are recorded with the confirmation. Session restoration in your browser may retain session cookies; access expires after 30 days at the latest and may require confirmation sooner if policies change.

You can return to the Research Access page and choose “Forget this browser”, or remove gpc_access in your browser settings. Removing this cookie means you must confirm again to access the catalogue. It does not sign you out of your account, clear your cart or erase the server-side confirmation record. Record retention is explained below.

Language (pll_language): Polylang remembers the site language, normally for one year. Cart cookies (woocommerce_cart_hash and woocommerce_items_in_cart) last for the browser session. The WooCommerce session identifier (wp_woocommerce_session_*) links the browser to its saved cart, normally for two days for guests or seven days when signed in; activity can renew it.

Account and security: WordPress uses wordpress_test_cookie to check cookie support and wordpress_logged_in_* and wordpress_sec_* or wordpress_* for authenticated access. Sign-in is session-based unless you choose the account’s separate remember-me option, normally 14 days. Administrative preferences and security controls may use additional cookies when those functions are used. These are separate from the research-access choice.

GPC does not use analytics, advertising or social-media tracking cookies. WooCommerce order-attribution tracking and usage reporting are disabled. We would explain any future optional tracking and provide a separate choice before activating it; research access does not require agreement to optional tracking. You can manage cookies in your browser, but blocking service cookies can prevent sign-in, research-access confirmation and checkout from working.

Checkout address and email assistance

When address suggestions are available at checkout, typing in the street-address field sends the address text through GPC’s server to Geoapify to retrieve Canadian address suggestions. You can choose “Enter manually” before typing to stop these requests. The lookup does not forward your IP address, name, email, telephone number, order items or separately entered suite or unit. Geoapify receives GPC’s server IP address. Geoapify and its infrastructure providers may process the lookup outside Canada or Quebec. Geoapify’s privacy policy explains its request logging and retention.

Mailcheck suggests possible email-domain typo corrections inside your browser; it does not send your email address to an email-verification provider. You decide whether to accept a suggestion. These checkout assistance features do not add analytics or advertising cookies, and GPC does not retain lookup histories. Suggestions do not guarantee postal delivery or that an email inbox exists. Manual entry remains available.

Information is used to evaluate eligibility, process and fulfil orders, reconcile payments, issue invoices and refunds, administer the Verification Program and account credits, provide lot documentation, send requested or otherwise permitted messages, prevent abuse, keep accounting and legal records, and respond to privacy rights. We do not sell personal information.

Consent is obtained in the form appropriate to the information and purpose, unless the law permits or requires processing without consent. Optional marketing consent is separate from the confirmations needed to place an order. Accepting this policy does not itself subscribe you to marketing. A new purpose that requires consent will be explained before the information is used for that purpose.

Automated order processing

The site automates some order steps, including payment-request expiry after the disclosed payment window and messages about order status. Contact order support or the Privacy Officer if you believe an automated outcome is incorrect or want a person to review it. Where applicable law governs a decision based exclusively on automated processing of personal information, GPC will provide the required notice and, on request, explain the personal information used and the principal factors behind the decision, allow corrections, and give you an opportunity to make observations to a person able to review the decision.

Service providers and location

Hosting, email, payment-notification, shipping, document and professional-service providers receive only the information needed for their work, subject to contractual or legal safeguards. Information may also be disclosed where required or permitted by law, including to respond to a valid legal demand or protect against fraud. Current provider details may be requested from the Privacy Officer.

Site hosting is located in Canada. Transactional and program email is delivered through Mailgun using United States infrastructure. This processing includes sender and recipient details, message contents, attachments when included, and delivery information. Depending on the message, this can include names, contact details, order or payment information and program correspondence. Information processed outside Canada or Quebec may be accessible to courts, law enforcement or national security authorities in that jurisdiction.

GPC requires providers to protect personal information to a standard comparable to this policy. Where Quebec law applies, a privacy impact assessment and appropriate written agreement are required before personal information is communicated or entrusted to a provider outside Quebec. The Privacy Officer is responsible for assessing the information, purpose, safeguards and applicable legal framework, and for authorizing a transfer only where the assessment establishes adequate protection.

Retention and destruction

Retention depends on the purpose of each record and applicable legal obligations. The Privacy Officer is responsible for reviewing retention needs and arranging secure destruction when those needs and any legal hold end. Removing a name or another identifier does not necessarily make a record anonymous: information that remains identifiable continues to receive privacy protection. Anonymization is used only where it meets applicable legal requirements.

Order, tax and accounting records are retained for at least six years from the end of the last tax year to which they relate, and longer when required for a legal obligation or legitimate dispute.
Accepted policy and checkout records are retained for the account relationship and applicable limitation periods to establish what was agreed.
The truncated IP address and browser information on research-access records are removed after 24 months from last activity under the site retention schedule. Acceptance dates and policy evidence remain.
For completed or withdrawn availability requests, associated IP addresses are removed after 36 months under the site schedule, or earlier through an applicable erasure request. Necessary consent and withdrawal evidence may remain.
Verification Program files, support correspondence and privacy-request records are retained for their stated purpose and applicable accounting, complaint or dispute needs. On request, GPC will explain the retention period or criteria for a particular record.
Deleting an account or unsubscribing does not automatically delete records that must be retained. GPC will explain any retained categories and the reasons when responding to an erasure request.

Access, correction and other privacy requests

Write to the Privacy Officer using the contact details above. Describe the information or account concerned and the action requested; an order reference or the email used with GPC can help locate records. No special form or project description is required. GPC may request proportionate information to verify identity or authority before disclosing or changing personal information. Do not send a password, payment credential or identity document unless a secure and necessary verification method has been agreed.

GPC responds to access requests within 30 days of receipt, subject to extensions permitted by the applicable law and notified within that period. Where information cannot be provided or a request cannot be granted in full, GPC explains the applicable reason and available review or complaint options. You may request correction of inaccurate information, withdrawal of consent subject to legal and contractual limits, or deletion where applicable. GPC explains any effect on an account or unfulfilled order before acting on a withdrawal of necessary consent. Quebec law also provides rights concerning cessation of dissemination and de-indexing in specified circumstances.

Some research-access records are associated with a browser identifier rather than an email address. If your request concerns those records, the Privacy Officer will explain how to help locate them without requesting unrelated information. Clearing a browser cookie does not itself delete the corresponding server record.

Quebec data portability

Where Quebec’s portability right applies, you may ask the Privacy Officer for eligible computerized personal information collected from you in a structured, commonly used technological format. You may also request its communication to a person or body legally authorized to collect it. This right is subject to the conditions and exceptions established by law, including the exclusion of information created or inferred from your information and the exception for serious practical difficulties. GPC will explain any applicable limitation and arrange an appropriate method of delivery after verifying the request.

Email preferences

Optional marketing choices can be withdrawn without closing your account. Marketing and availability messages provide an unsubscribe mechanism, and requests are honoured within 10 business days. You may also contact GPC for help changing these preferences. Necessary transactional messages, such as payment instructions, shipment updates and responses to your requests, may continue. Consent and withdrawal evidence may be retained to demonstrate compliance with anti-spam law.

Age and minors

The site and catalogue are offered to adults: every visitor confirms they are at least 21 years old before commerce access. GPC does not knowingly collect personal information from minors, and never from a Quebec minor under 14 without the consent of the holder of parental authority or tutor, unless a legal exception applies. Information found to have been collected contrary to this rule is deleted.

Safeguards and privacy complaints

Administrative, technical and physical safeguards must reflect the sensitivity of the information and the risks of its use. These include limiting access to authorized people, protecting records during storage and transfer, and requiring confidentiality from people handling them. No system can promise absolute security.

To complain, contact the Privacy Officer with a description of the concern, relevant dates and how GPC can respond. The Privacy Officer acknowledges receipt, reviews the relevant records and practices, seeks clarification when necessary, and provides a written outcome with any corrective measures or next steps. Only information needed to investigate and respond should be provided. Complaint records are subject to the same access and retention rules as other personal information.

You may also contact the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec where Quebec law applies, or another competent regulator. You do not have to complete GPC’s complaint process before contacting a regulator.

Privacy incidents

Report a suspected compromise of personal information promptly to the Privacy Officer. GPC’s response is to contain the incident, assess the information and people affected, document the risk of harm, take corrective measures and keep the incident records required by law.

Where PIPEDA requires it, GPC notifies the federal Privacy Commissioner and affected individuals of a breach creating a real risk of significant harm as soon as feasible. Where Quebec law requires it, GPC promptly notifies the Commission d’accès à l’information du Québec and affected individuals of an incident presenting a risk of serious injury. Other legally required notifications are also made. Incident records are retained for at least five years where Quebec law applies and at least 24 months where the federal breach-record rules apply, or longer where a legal hold requires it.

Policy changes

The version displayed on this page identifies the current policy. Changes are published in both English and French, and notices are provided as required by applicable law. Where a change materially affects how personal information is handled, GPC will draw attention to it through an appropriate site notice or direct communication. Fresh consent is requested when required. A later policy version does not retroactively authorize a new use of information collected under an earlier version.