1.  Introduction

Winaf African Supermarket ("Winaf", "we", "us", or "our") is a Canadian grocery retailer headquartered in Winnipeg, Manitoba, specializing in African groceries and food products. We operate two physical store locations — 2987 Pembina Hwy and 3259 Portage Ave, Winnipeg, MB — and we provide online shopping services through our website at winafca.com.

We are committed to protecting the privacy and personal information of all individuals who interact with us, whether in-store, online, or through any other channel. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, and its ten fair information principles, as well as applicable privacy standards relevant to Manitoba residents.

Although Manitoba does not currently have a provincial private-sector privacy statute that has been declared substantially similar to PIPEDA, residents of Manitoba are fully protected by PIPEDA in the context of commercial activity, and we honour those protections in all aspects of our operations. We also comply with all applicable federal and provincial consumer protection, food safety, and regulatory requirements to the extent they bear on the handling of personal information.

1.1  Scope of This Policy

This Privacy Policy applies to:

• Our website, winafca.com, including all pages, online order forms, contact forms, and account registration pages;
• Our online grocery ordering and delivery services;
• Our Winaf Loyalty Card program, including enrolment, redemption, and account management;
• Personal information collected at our physical store locations through digital means (e.g., loyalty card sign-up terminals, receipt email requests); and
• Any other interaction you have with us in connection with our commercial activities, including telephone and email communications.

This Policy does not govern information that has been aggregated or anonymized in a manner that no longer identifies any individual. It also does not apply to the privacy practices of third-party websites or platforms that may be linked from our website.

By using our website, placing an order, enrolling in our Loyalty Card program, or otherwise providing us with your personal information, you acknowledge that you have read and understood this Privacy Policy.

2.  What Personal Information We Collect

For the purposes of this Policy, "personal information" means any information about an identifiable individual, as defined under PIPEDA. We collect the following categories of personal information:

2.1  Identity Data

• Full name;
• Email address;
• Phone number; and
• Mailing address and/or delivery address.

2.2  Transaction Data

• Purchase history and order details, including the items purchased, quantities, and order totals;
• Payment method type (e.g., credit card, debit card, or digital wallet) — we do not collect or store full payment card numbers, CVV codes, or online banking credentials; and
• Delivery instructions and order status records.

2.3  Loyalty Program Data

• Winaf Loyalty Card number;
• Points balance and points-earning history; and
• Points redemption history and associated transactions.

2.4  Technical Data

• Internet Protocol (IP) address;
• Browser type and version;
• Device type and operating system;
• Referring URLs (i.e., the page or platform from which you arrived at our website); and
• Time zone setting and language preference.

2.5  Usage Data

• Pages visited on winafca.com and the sequence in which they were visited;
• Time spent on individual pages;
• Search terms entered on our website; and
• Clickstream data and interaction records (e.g., clicks, scrolling behaviour).

2.6  Communications Data

• Content of messages submitted through our website contact form;
• Email correspondence with our team; and
• Records of telephone inquiries, including the nature of your inquiry.

2.7  Sensitive Information — What We Do Not Collect

3.  How We Collect Your Information

We collect personal information through the following means:

3.1  Directly From You

We collect personal information that you voluntarily provide when you:

• Place an order on winafca.com or through an integrated third-party ordering channel;
• Register for or use the Winaf Loyalty Card program;
• Complete a contact or inquiry form on our website;
• Send us an email or call us at our published telephone number;
• Opt in to receive marketing communications, newsletters, or promotional offers; or
• Interact with us at our physical store locations through digital sign-up terminals or receipt-by-email requests.

3.2  Automatically, Through Digital Means

When you visit winafca.com, we and our authorized service providers may automatically collect technical and usage data through:

• Cookies and similar tracking technologies embedded in our website (see Section 7 for full details);
• Web beacons and server log files that record your interaction with our pages; and
• Analytics tools that aggregate and analyze website traffic and user behaviour patterns.

This automatic collection does not require you to take any action and occurs as a standard feature of internet browsing. Where such data is linked or linkable to an identified individual, it is treated as personal information and handled in accordance with this Policy.

3.3  From Third Parties

We may receive personal information about you from third parties in limited circumstances, including:

• Online ordering platforms and delivery channels: Where you place an order through a third-party platform that integrates with our operations, that platform may share your order and contact details with us for fulfillment purposes;
• Payment processors: Payment service providers may confirm transaction completion and provide summary transaction data (but never your full card details); and
• Analytics and advertising partners: Service providers that assist us in understanding how our website is used and how our marketing performs may share aggregated or pseudonymous insights with us.

We require all third parties from whom we receive your personal information to have lawfully obtained and shared that information, and we use such information only for the purposes described in Section 4 of this Policy.

4.  Why We Collect Your Information
Identifying Purposes — PIPEDA Principle 2

Under PIPEDA's Principle of Identifying Purposes, we are required to identify the reasons for which we collect personal information at or before the time of collection. We collect and use your personal information only for the following identified purposes:

We will not use your personal information for a purpose that is materially different from those identified above without first notifying you and, where required by law, obtaining your consent.

5.  Consent
PIPEDA Principle 3

PIPEDA requires that we obtain your knowledge and consent for the collection, use, and disclosure of your personal information, except where the law provides otherwise. The form of consent we seek will depend on the sensitivity of the information and the circumstances of the collection.

5.1  Express Consent

Express consent is an affirmative, deliberate act by which you clearly communicate agreement to a specific use or disclosure of your personal information. We seek express consent in the following circumstances:

• Marketing communications: We will only send you promotional emails, newsletters, or offers if you have expressly opted in by ticking a clearly labelled opt-in checkbox during the checkout process, the loyalty card sign-up process, or another designated sign-up form. We will not pre-tick marketing consent boxes on your behalf.
• Loyalty Card enrolment: Your signature or electronic confirmation on the Loyalty Card sign-up form constitutes express consent to the collection and use of your information for program administration purposes.
• Sensitive uses: Any proposed use of your personal information that goes beyond the purposes identified in Section 4 will require fresh express consent from you before we proceed.

5.2  Implied Consent

Implied consent arises where the purpose for collection is obvious, and you voluntarily provide your information with reasonable knowledge of that purpose. For example:

• When you place an order on winafca.com and provide your delivery address, you are impliedly consenting to our use of that address to deliver your order;
• When you submit a contact inquiry form, you are impliedly consenting to our use of your contact details to respond to your inquiry; and
• When you call our store, you are impliedly consenting to our use of the information you share during that call to address your reason for contacting us.

5.3  Withdrawal of Consent

You have the right to withdraw your consent to certain uses of your personal information at any time, subject to legal and contractual restrictions and reasonable notice. Specifically:

• To opt out of marketing and promotional emails, click the "Unsubscribe" link in any email we send you, or send a written request to [email protected] with the subject line "Unsubscribe";
• To withdraw consent to other non-essential data uses, send a written request to [email protected] with the subject line "Privacy Request"; and
• We will process your withdrawal request within a reasonable time, not to exceed 10 business days for marketing opt-outs.

Please be aware that withdrawing consent for certain essential data uses — such as the collection of your delivery address for order fulfillment — may mean we are unable to provide you with certain services. We will inform you of the implications of withdrawal before processing your request.

5.4  Parental Consent for Minors

Our website and services are not intended for use by children under the age of 13. If you are under 13, you must not provide us with any personal information unless a parent or legal guardian has reviewed this Privacy Policy and provided consent on your behalf. Please refer to Section 14 (Children's Privacy) for full details.

6.  Limiting Collection
PIPEDA Principle 4

In accordance with PIPEDA's Principle of Limiting Collection, we collect only the personal information that is reasonably necessary to fulfill the identified purposes described in Section 4 of this Policy. We do not collect personal information indiscriminately or beyond what is required to serve you.

Specifically, we are guided by the following practices:

• We design our data collection forms — including order forms, loyalty card sign-up forms, and contact forms — to request only the fields that are necessary for the relevant purpose. Optional fields are clearly identified as such.
• We do not require customers to provide personal information as a condition of general website browsing, where such information is not necessary for that purpose.
• We periodically review our data collection practices to ensure they remain proportionate to our current business needs, and we discontinue collection of any information that no longer serves an identified purpose.
• We do not collect or attempt to infer personal information that you have not deliberately chosen to provide to us.

7.  Cookies and Tracking Technologies

When you visit winafca.com, we and our authorized service providers may place small data files known as cookies on your device. Cookies help us recognize your browser, remember your preferences, and understand how visitors use our website. In addition to cookies, we may use related tracking technologies such as web beacons and pixel tags.

7.1  Types of Cookies We Use

7.2  Analytics Tools

We use analytics platforms (such as Google Analytics or similar services) to help us understand website traffic patterns, user behaviour, and the effectiveness of our content and promotions. These tools may collect your IP address and browsing activity on our site in an aggregated or pseudonymized form. The data is used solely to improve our website and services and is not used to personally identify individual users in the normal course of operations.

7.3  Web Beacons and Pixel Tags

Our website and marketing emails may contain small electronic images known as web beacons or pixel tags. These are used to count users who have visited particular pages or opened particular emails, and to gather related browsing statistics. They do not collect or store personal information beyond what is described in this Policy.

7.4  Managing and Disabling Cookies

You may control the use of cookies through your web browser settings. Most browsers allow you to:

• View and delete cookies already stored on your device;
• Block third-party cookies;
• Block cookies from particular websites; and
• Block all cookies from being set.

Instructions for managing cookie settings are typically found in your browser's "Help," "Settings," or "Privacy" menus. Please note that disabling certain cookies — particularly strictly necessary cookies — may affect the functionality of our website, including your ability to add items to your cart, complete a purchase, or access your account.

7.5  Do Not Track Signals

Our website does not currently respond to "Do Not Track" (DNT) browser signals, as there is no universally accepted standard for how websites should respond to such signals. However, you may manage your cookie preferences manually through your browser settings as described in Section 7.4 above.

8.  How We Use and Disclose Your Information
PIPEDA Principles 5 & 8

We use your personal information only for the purposes identified in Section 4 of this Policy. We do not sell, rent, or trade your personal information to any third party for commercial purposes. The following sets out the limited circumstances in which your information may be shared with others:

8.1  Internal Use

Your personal information is accessed internally only by employees, managers, and authorized personnel who require it to perform their duties in connection with the purposes described in this Policy. Access is governed by role-based permissions and confidentiality obligations.

8.2  Service Providers

We engage trusted third-party service providers to assist us in operating our business. These providers may have access to your personal information only to the extent necessary to perform their functions, and they are contractually prohibited from using your information for any other purpose. Our service providers include:

• Payment processors: To securely process your payments. These providers comply with PCI-DSS (Payment Card Industry Data Security Standard) requirements.
• Delivery and ordering platforms: Third-party platforms through which online orders may be received or fulfilled.
• Email marketing tools: Platforms that help us send transactional and, with your consent, promotional emails.
• Website hosting and IT providers: Companies that host our website, manage our servers, and provide cybersecurity and technical support services.
• Analytics providers: Services that help us analyze website usage and marketing performance.

All service providers are selected with due care, and we require them to maintain appropriate confidentiality and data security standards consistent with PIPEDA.

8.3  Legal Disclosure

We may disclose your personal information without your consent where we are required or permitted to do so by law, including:

• In response to a valid court order, subpoena, or other legal process;
• To comply with a lawful demand from a government agency, regulatory authority, or law enforcement body with jurisdiction over us;
• To investigate or prevent a suspected offence, fraud, or breach of our terms and conditions; or
• To protect the rights, property, or safety of Winaf African Supermarket, our customers, or the public.

Where permitted by law, we will notify you of such a disclosure unless prohibited from doing so by the applicable legal process or authority.

8.4  Business Transfers

In the event that Winaf African Supermarket undergoes a merger, acquisition, restructuring, sale of assets, or similar business transaction, your personal information may be disclosed to the prospective or succeeding party as part of that transaction. In such cases, we will take reasonable steps to ensure that the recipient agrees to protect your personal information in a manner consistent with this Privacy Policy and with PIPEDA, and we will notify you of any material change in how your information is handled as a result.

8.5  Aggregated and Anonymized Data

We may compile and share aggregated, de-identified data — such as general shopping trends, category sales volumes, or regional traffic statistics — with business partners, researchers, or in public-facing materials. Such data does not identify any individual, and its use is not subject to the terms of this Policy.

9.  Data Retention
PIPEDA Principle 5

We retain personal information only as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following table sets out our standard retention periods by data category:

9.1  Deletion and Anonymization

When personal information is no longer required for its identified purposes and no legal retention obligation applies, we will securely delete or anonymize it using industry-standard procedures. Secure deletion includes the use of data-wiping methods for digital files and secure shredding for any physical records. Anonymized data — which can no longer be linked to any identifiable individual — may be retained indefinitely for statistical or analytical purposes.

10.  Accuracy
PIPEDA Principle 6

We are committed to ensuring that the personal information we hold about you is as accurate, complete, and up-to-date as is necessary for the purposes for which it is used. We will not routinely update your personal information unless it is necessary to fulfill those purposes.

10.1  Keeping Your Information Current

We encourage you to keep your information current by:

• Logging in to your account on winafca.com and updating your profile details, including your name, delivery address, email address, and phone number; or
• Contacting us directly at [email protected] or by telephone at +1 (204) 977-2045 to request a correction.

10.2  Requests for Correction

If you believe that any personal information we hold about you is inaccurate, incomplete, or outdated, you have the right to request that we correct it. To make a correction request, please send a written request to [email protected] with the subject line "Privacy Request – Correction." We will review your request and respond within 30 calendar days. If we are unable to make the requested correction — for example, because the information is required to remain in its original form for legal purposes — we will inform you in writing and note your disagreement in our records.

11.  Security Safeguards
PIPEDA Principle 7

We use physical, technical, and organizational safeguards appropriate to the sensitivity of the personal information we hold to protect it against loss, theft, unauthorized access, disclosure, copying, use, or modification. The safeguards we currently maintain include the following:

11.1  Physical Safeguards

• Locked offices, server rooms, and filing areas with restricted key or access-card entry;
• Secure disposal of physical documents containing personal information (cross-cut shredding);
• Visitor sign-in requirements at business premises; and
• Restricted access to areas where personal information is stored or processed.

11.2  Technical Safeguards

• SSL/TLS encryption on winafca.com for all data transmitted between your browser and our servers;
• Secure payment processing managed by PCI-DSS-compliant third-party processors, ensuring that we never store raw payment card data on our systems;
• Role-based access controls limiting employee access to personal information to those with a legitimate need;
• Network firewalls and intrusion detection systems to monitor and protect against unauthorized access; and
• Regular software updates and security patches applied to all systems storing or processing personal information.

11.3  Organizational Safeguards

• Staff training on privacy obligations, data handling best practices, and our internal privacy policies;
• Confidentiality agreements with employees, contractors, and service providers who handle personal information; and
• A documented privacy breach response procedure, which includes identification, containment, assessment, notification, and remediation steps.

11.4  Mandatory Breach Notification

11.5  Limitation of Liability

While we employ all reasonable measures to protect your personal information, no method of electronic transmission or storage is completely secure. We cannot guarantee the absolute security of your information transmitted to or from our website over the internet. In the event of an unauthorized breach, we will act promptly to minimize its impact and will notify you in accordance with our legal obligations.

12.  Your Rights as an Individual
PIPEDA Principles 9 & 10

Under PIPEDA, you have the right to access and challenge the accuracy of personal information that we hold about you. The following describes your rights in full and explains how to exercise them.

12.1  Right of Access

You have the right to request access to the personal information we hold about you. Upon receiving a valid access request, we will:

• Confirm whether we hold personal information about you;
• Provide you with a description of the information we hold and the purposes for which it is being used; and
• Provide you with a copy of the information, subject to any applicable legal exceptions (for example, information that would reveal confidential commercial information or information about a third party).

12.2  Right to Correction

You have the right to request that we correct any personal information we hold about you that is inaccurate, incomplete, or misleading. See Section 10.2 for the correction request procedure.

12.3  Right to Withdraw Consent

You have the right to withdraw your consent to non-essential uses of your personal information at any time, as described in Section 5.3. Withdrawal of consent does not affect the lawfulness of any processing that occurred prior to withdrawal.

12.4  Right to Lodge a Complaint

If you are not satisfied with how we have handled your personal information, you have the right to complain to us directly, and thereafter to escalate your complaint to the Office of the Privacy Commissioner of Canada. See Section 17 for full contact details.

12.5  How to Exercise Your Rights

To exercise any of the rights described in this Section, please submit a written request to:

Email: [email protected]
Subject Line: Privacy Request
Phone: +1 (204) 977-2045

We will acknowledge receipt of your request within 5 business days and will respond in full within 30 calendar days of receiving a complete request. If we require additional time to fulfill your request, we will notify you within the initial 30-day period and provide a revised estimated response date, not to exceed an additional 30 days.

12.6  Limitations on Deletion

Please note that in some circumstances we may be legally unable to delete your personal information — for example, where we are required to retain it for tax, regulatory, or dispute-resolution purposes. In such cases, we will inform you of the applicable legal requirement and retain the information only for as long as the law requires.

13.  Third-Party Links

Our website, winafca.com, may contain links to third-party websites, platforms, or online ordering channels that are not owned or operated by Winaf African Supermarket. These links are provided for your convenience only. When you click on a third-party link, you will leave our website and be directed to a site governed by the privacy practices and policies of that third party.

We are not responsible for the privacy practices, content, or security of any third-party website or platform. The inclusion of a link on our website does not constitute our endorsement of that site's privacy practices or any products or services offered thereon. We encourage you to review the privacy policy of any third-party website you visit before providing personal information to that site.

14.  Children's Privacy

Our website and services are not directed at, designed for, or intended to be used by children under the age of 13. We do not knowingly solicit or collect personal information from children under 13 without the prior verifiable consent of a parent or legal guardian.

If we become aware that we have inadvertently collected personal information from a child under the age of 13 without appropriate parental consent, we will take prompt steps to delete that information from our records. If you are a parent or guardian and you believe your child has provided us with personal information without your consent, please contact us immediately at [email protected] or by telephone at +1 (204) 977-2045, and we will take appropriate action.

15.  Cross-Border Data Transfers

Some of the third-party service providers we engage — including payment processors, email marketing platforms, and analytics tools — may store or process personal information on servers located outside of Canada, including in the United States or other jurisdictions. By using our website or providing us with your personal information, you acknowledge that your information may be transferred to and processed in a jurisdiction other than Canada.

When we transfer personal information outside Canada, we take the following steps to protect it:

• We enter into data processing agreements with our service providers that impose contractual obligations to protect your personal information to a standard consistent with PIPEDA;
• We select service providers in jurisdictions with established privacy frameworks wherever reasonably practicable; and
• We conduct due diligence on service providers' privacy and security practices prior to engagement.

Please be aware that personal information transferred to and stored in a foreign jurisdiction is subject to the laws of that jurisdiction, including any laws that may permit government or law enforcement access to personal information without notice. We cannot guarantee that foreign laws will provide the same level of protection as Canadian privacy law. If you have concerns about cross-border data transfers, please contact us before using our services.

16.  Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, legal obligations, or the applicable regulatory environment. All changes will take effect upon posting of the updated Privacy Policy on our website at winafca.com, unless a later effective date is specified.

Where we make material changes to this Policy — including changes that affect how we collect, use, or disclose your personal information — we will provide notice by one or more of the following means:

• Posting a prominent notice on the home page of winafca.com for a period of no less than 30 days following the effective date of the change;
• Sending a notification email to customers for whom we have a current email address on file; or
• Displaying a notification within your account on our website, if applicable.

Your continued use of our website or services following the effective date of any amended Privacy Policy will constitute your acknowledgment of the changes and your agreement to be bound by the updated terms. If you do not agree to the updated Policy, you should discontinue your use of our website and services and contact us to arrange deletion of your account where applicable.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information. The "Last Updated" date at the top of this document will always reflect the date of the most recent revision.

17.  How to Contact Us & File a Complaint
PIPEDA Principle 10

We have designated a Privacy Officer who is accountable for our compliance with this Privacy Policy and with PIPEDA. If you have any questions, concerns, or complaints about how we handle your personal information, or if you wish to exercise any of your rights described in Section 12, please contact our Privacy Officer using the details below.

17.1  Winaf African Supermarket — Privacy Officer

We will acknowledge your complaint within 5 business days and will investigate and respond in full within 30 calendar days. If we require additional time to investigate a complex complaint, we will notify you and provide an estimated resolution date.

17.2  Office of the Privacy Commissioner of Canada

If you are not satisfied with our response to your complaint or inquiry, or if you wish to obtain information about your rights under PIPEDA, you may contact the Office of the Privacy Commissioner of Canada:

The Office of the Privacy Commissioner of Canada is an independent officer of Parliament with the mandate to oversee compliance with PIPEDA and to investigate complaints from individuals who believe their privacy rights under federal law have been violated. You may file a complaint with the Commissioner at any time, but we encourage you to contact us first so that we have an opportunity to resolve your concern directly.