PRIVACY / PILOT DRAFT

Privacy, without the fog.

A plain-language record of what enters the wholesale desk, why it is needed, where it goes, and how an authorized person can challenge it.

Engineering complete · Counsel and privacy-officer approval required
01

This notice describes how BC Direct Delivery handles information for its licensed business-to-business wholesale platform. Each participating grower, supplier, and retailer remains responsible for the records and legal obligations that apply to its own operations.

Questions, access requests, corrections, or complaints can be directed to privacy@bcdirectdelivery.ca. A named privacy officer and alternate must be appointed before the production pilot opens.

02
  • Work identity and account information, including name, work email, organization, role, sessions, invitations, and authentication events.
  • Licensed business details, catalogues, products, lots, wholesale orders, shipments, receiving, returns, credits, invoices, and payment obligations.
  • Source documents and integration records submitted for review, including spreadsheets, purchase orders, and business email attachments.
  • Security and operational metadata such as timestamps, request identifiers, permission decisions, job status, and redacted service logs.
03

The pilot is not designed to collect consumer cannabis purchase histories, health information, government identification numbers, payment-card data, or autonomous AI profiles. Unexpected sensitive information in a submitted document must be quarantined, reviewed, and removed under the approved retention procedure.

04
  • Provide authenticated wholesale workspaces and enforce organization permissions.
  • Create, review, route, fulfill, receive, reconcile, and audit wholesale records.
  • Detect duplicates, recover failed jobs, protect the service, investigate incidents, and support customers.
  • Generate extraction or reorder suggestions that remain subject to human review before they affect an order or ledger.
05

The pilot systems of record are intended to remain in Canada. Private documents are not placed in public asset storage. Service providers may process only the information required for their contracted function and must be reviewed for location, retention, security, breach notice, deletion, and government-access terms.

Information may be disclosed when instructed by an authorized organization, required by applicable law, needed to protect the service or its users, or necessary to investigate a security or privacy incident. BC Direct Delivery does not sell personal information.

06

Records are retained according to their business, contractual, financial, regulatory, and evidentiary purpose. Original intake documents should be deleted after review and reconciliation unless an approved evidence requirement or legal hold applies. Safeguards include tenant isolation, least privilege, encrypted transport and backups, private storage, malware scanning, immutable audit events, rate limits, and tested recovery procedures.

07

Authorized users can request access to or correction of their account information. An organization can request an export, correction, restriction, or deletion review for information it controls. Some records may need to be preserved for legal, financial, security, or cannabis traceability reasons; any refusal should identify the reason and available recourse.

Official guidance is available from the Office of the Privacy Commissioner of Canada and the Office of the Information and Privacy Commissioner for British Columbia. The law that applies depends on the organization, information, activity, and jurisdiction.