Privacy Policy

Effective: June 5, 2026 · Last updated: September 28, 2026

1. Introduction

1472777 Alberta Ltd., operating as Stock & Sauce (“we”, “us”, “our”) is committed to safeguarding the personal information entrusted to us by our customers and visitors. We manage your personal information in accordance with Alberta’s Personal Information Protection Act (PIPA) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA). This policy outlines the principles and practices we follow in protecting your personal information, and applies to Stock & Sauce and to any person providing services on our behalf. A copy of this policy is provided to any customer on request.

2. What is personal information?

Personal information means information about an identifiable individual. This includes your name, home or delivery address, phone number, email address, order history, and an IP address when combined with other identifying data.

3. Accountability & our Privacy Officer

We have designated a Privacy Officer: an individual at Stock & Sauce who is responsible for our compliance with PIPA and PIPEDA, and who can answer your questions about how we collect, use, disclose and store personal information. The Privacy Officer can be reached at:

• Email: inquiries@stockandsauce.ca
• Mailing address: Stock & Sauce, 23 Signature Mews SW, Calgary, Alberta T3H 2V6, Canada

4. Purposes of collection

We collect personal information only for purposes a reasonable person would consider appropriate in the circumstances, including: responding to inquiries submitted through our website; taking, preparing and fulfilling orders for delivery or market pickup; arranging and processing payment; sending order-related communications; sending our news, specials and offers by email, only to people who have asked for them (section 5); and complying with legal obligations.

Gift orders

If you choose Send as a gift at checkout, we collect the recipient’s name and delivery address, and the gift message if you write one. We understand that this is personal information about someone who is not the person giving it to us, so we limit what we do with it:

• We use it only to deliver that order and, if something goes wrong with the delivery, to sort it out.
• We never add a gift recipient to a mailing list, and we do not contact them for any marketing purpose. Our news and offers go only to people who have asked for them themselves (section 5).
• We do not use it to build a profile of the recipient or link it to any other order.
• It is kept with the record of that order and deleted on the same schedule set out in section 6.

Please only give us a recipient’s address if you are comfortable that they would expect a delivery from you. A recipient may contact our Privacy Officer at the details in section 3 to ask what we hold about them, to correct it, or to ask us to delete it.

Allergy and dietary information

Our order form has a notes box, and you may use it to tell us about a food allergy or a dietary need. Anything you write there about your health, we treat as sensitive: we use it only to prepare your order safely and to talk to you about that order, we use it for nothing else, and it is kept and deleted with the rest of that order’s record (section 6). When you pay by card, your notes are sent to us separately and never to our payment processor. You never have to write it down. If you would rather not, telephone us or speak to us at the market before you order.

How you found us, and promo codes

Our checkout asks where you heard about us. Answering is optional, and you can order without it. If you arrived by a link in one of our emails, the answer starts as “Newsletter email” and you can change it. We also record which of our email campaigns, if any, brought you to the site (from the link you followed, remembered in your own browser for up to 14 days) and any promo code you used. We use this only to learn how customers find us and which of our offers are used, it is kept with that order’s record (section 6), and it is never used to decide what you pay beyond the code you entered yourself.

5. Consent

We obtain your consent to collect, use, or disclose your personal information except where required or permitted by law. Consent may be express (for example, when you submit a form) or implied (for example, when the purpose is obvious from the context of an order). You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting our Privacy Officer.

News, specials and offers by email

We send news, specials and offers by email only to people who have said yes, by ticking the optional box on our contact form. That box is never ticked for you, and you can send us a message without it. Placing an order does not sign you up, and we do not add anyone to our mailing list on any other basis. Replying to a message you sent us is not marketing and never needs that box.

When you say yes, we keep a record of the date, how you said yes, and the exact wording you agreed to, because Canada’s Anti-Spam Legislation (CASL) asks us to be able to show it. Every such email says it is from Stock & Sauce, gives our mailing address and a way to reach us, and carries a working unsubscribe link. You can also unsubscribe by replying to any of them, by emailing inquiries@stockandsauce.ca, or by telling us at the market. We act on an unsubscribe within 10 business days, as CASL requires, and usually much sooner.

6. Limiting collection, use, disclosure & retention

We collect only the personal information necessary for the purposes identified. We do not sell your personal information. We do not use or disclose it for purposes other than those for which it was collected, except with your consent or as required by law. We retain personal information only as long as necessary to fulfil those purposes. In practice:

• Contact form submissions and general inquiries that do not lead to an order are retained for 24 months from our last contact with you, and are then deleted.
• Records relating to an order or transaction are retained for 7 years, to meet Canadian tax and business-record obligations, and are then deleted.
• Your yes to our news and offers is kept for as long as you stay subscribed. If you unsubscribe, your address comes off our mailing list, and the record of when you said yes and when you unsubscribed is kept for 3 years, so that we can show we respected your choice, and is then deleted.
• Website analytics, if you accept them, are held by Google for 2 months from your visit — the shortest period Google Analytics allows — after which only aggregate totals containing no personal information remain. If you decline, nothing is recorded at all.

7. Cookies and Analytics

Nothing is recorded about your visit for analytics unless you say yes. The first time you arrive, this website asks whether you are willing to let us use Google Analytics. Until you answer, and for as long as your answer is no, no analytics cookies are set and the analytics script is never loaded.

If you accept, we use Google Analytics 4 to understand, in aggregate, how our website is used. It stores cookies in your browser, named _ga and _ga_ followed by a code for our account, which give your browser a random identifier so that several visits can be counted as one person rather than several people. Through it, Google collects:

• the pages you visit, the page that referred you to them, and how long you stay;
• browser, operating system, device type and screen size;
• an approximate location at the country, region or city level, worked out from your IP address. Google states that it does not store IP addresses in Analytics.

We have turned Google Signals and advertising personalisation off on our Analytics account. That means this information is not joined to anyone’s Google account, is not used to build an advertising profile, and is not shared with Google’s advertising products. We run no advertising pixels and we do not track you across other websites.

You can change your mind at any time. “Cookie settings” at the bottom of every page reopens the choice, and choosing no deletes the analytics cookies this website has set. Google processes and stores this analytics information in the United States — see section 8.

Our home page embeds two Google Maps showing where our market stalls are. This is a functional map, not analytics or advertising: it loads only when you scroll down to it, and we do not use it to profile you or follow you across other websites. Google may set its own cookies within that map frame; if you would rather it did not load at all, blocking third-party frames or cookies in your browser will prevent it, and every address and set of directions on this website is also written out in plain text.

Your cart is kept on your own device. When you add something to your cart, your browser remembers it (using a feature called local storage) so that it is still there if you close the page and come back. It holds only the products, prices and quantities you chose, never your name, address or contact details. Nothing in it reaches us until you place an order, and it stays on your device until you place that order, empty the cart, or clear your browser’s data. On some pages we also remember, for the length of your visit only, that you have already seen our current offer, so that it does not slide out again.

Paying by card. When card payment is switched on, our checkout page loads Stripe’s payment script so that you can pay there. Stripe sets its own cookies (such as __stripe_mid and __stripe_sid) to prevent fraud and to process the payment you asked for. They are strictly necessary for paying by card, are not used for analytics or advertising, and are governed by Stripe’s cookie policy. They are not set on any other page of this website.

You can block or delete cookies and stored site data at any time through your browser settings. Doing so does not stop any part of this website from working: it empties your cart, and it stops the analytics described above.

8. Service providers, including providers outside Canada

We keep the number of people and companies who can see your information as small as we can. The list below is all of them.

The company that builds and maintains this website

Beacon Studios, a web design studio in Calgary, Alberta, built this website and maintains it for us. To do that, its staff can reach the hosting account where messages and orders submitted through our forms are stored, and may see the contents of a submission while fixing a fault with a form or setting up where those submissions are delivered.

Beacon Studios acts only on our instructions. It is not permitted to use your information for its own purposes, to disclose it to anyone else, or to send you marketing of any kind, and it is required to tell us promptly if it becomes aware of any breach affecting your information. Under section 5 of Alberta’s PIPA, engaging someone to handle personal information on our behalf does not transfer our responsibility for it: Stock & Sauce remains accountable to you, whoever is processing it.

Providers in Canada

Nucleus Information Service Inc. — Calgary, Alberta. Our email hosting. The messages you send us through this website are delivered to an inbox held on Nucleus’s servers in Canada, and our email correspondence with you is stored there. This information does not leave Canada.

Providers outside Canada

In accordance with sections 13.1 and 13.2 of Alberta’s PIPA, we disclose that we use service providers located outside Canada to collect, use, disclose, or store personal information on our behalf. The countries involved, and the purposes each provider is authorized for, are:

• Netlify — United States. Website hosting, and the storage of messages and orders submitted through our forms. Netlify screens every form submission for spam using Akismet, a service run by Automattic, also in the United States.
• Stripe — United States. Payment processing and fraud prevention for orders paid by card online. You type your card details into Stripe’s secure payment form, which appears on our checkout page but is run by Stripe: your card number goes straight to Stripe and never reaches us or our website. Stripe receives your card and billing details, your name, email address and phone number, the delivery or pickup details you gave, and the items and total of your order. It never receives your order notes: those go only to Netlify, as described in section 4. Stripe processes the payment for us, and also acts partly on its own behalf — to prevent fraud and to meet its own legal obligations — and for that part its own privacy policy applies.
• Google Analytics — United States. Aggregate website statistics, as described in section 7, and only if you have accepted them. Google processes this information on our behalf, under our instructions, and we have turned off the settings that would let it be used for advertising.
• Google Maps — United States. Displaying the interactive maps of our two market locations on our home page. These maps load only when you scroll to them, and we do not send Google any information about you; your browser requests the map directly, which means Google receives your IP address and browser information as it would for any website you visit.

While personal information is outside Canada, it is subject to the laws of that jurisdiction, which may permit access by foreign courts, law enforcement agencies, and national security authorities. No contract we enter into can override those foreign laws.

To obtain written information about our policies and practices regarding service providers outside Canada, or to ask questions about the collection, use, disclosure, or storage of personal information by those service providers, contact our Privacy Officer at the details in section 3.

9. Safeguards & security

We protect personal information with security safeguards appropriate to its sensitivity. In practical terms, this is what that means on this website:

• Everything you send is encrypted in transit. The whole site is served over HTTPS, and browsers are instructed to refuse an unencrypted connection to it.
• Your card number never touches this website. When you pay by card online you enter it into Stripe’s secure payment form on our checkout page. That form is served by Stripe, so your card number goes directly to Stripe; we never see, receive or store it. When card payment online is switched off, we arrange payment with you separately.
• The browser is restricted in what it may load and do on our pages, which limits the damage any injected or third-party code could cause. Our pages also cannot be embedded inside another website.
• Our forms carry spam and abuse controls, so that the inbox receiving your message stays usable and your submission is not buried or lost.
• Access is limited to the people who need it — our Privacy Officer, and the staff of the website provider named in section 8 while they are maintaining the site. Not everyone at Stock & Sauce can read form submissions.
• Our service providers are bound by written obligations covering purpose limitation, confidentiality, security and breach notification, as described in sections 8 and 12.

No website or system can be guaranteed perfectly secure, and we would rather say so than imply otherwise. If you have information you consider especially sensitive, please telephone us (our number is on our Delivery & Refunds page) or speak to us at the market rather than sending it through a form.

10. Accuracy, access & correction

You have the right to request access to your personal information and to challenge its accuracy and request correction. We will respond to access requests within 45 calendar days as required by PIPA. To make a request, contact our Privacy Officer.

11. Children’s privacy

Our website and online ordering are intended for adults. We do not knowingly collect personal information from children under 13 (or minors under the age of majority in Alberta) without the consent of a parent or guardian. If you believe a child has provided us with personal information, please contact our Privacy Officer and we will delete it.

12. Breach notification

If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify the Office of the Information and Privacy Commissioner of Alberta without unreasonable delay, and we will notify you in accordance with applicable law.

That duty under PIPA section 34.1 sits on us, not on the companies working for us — so we have not left it to chance. Our website provider is required by written agreement to tell us within 72 hours of becoming aware of any breach affecting personal information it handles on our behalf, and to give us the detail we need to make our own report. Without that agreement nothing would oblige them to tell us at all.

13. Questions & complaints

If you have a question or concern, please contact our Privacy Officer. If you are not satisfied with our response, you may contact:

Office of the Information and Privacy Commissioner of Alberta (OIPC)
410-9925 109 Street NW, Edmonton, AB T5K 2J8
Phone: 780‑422‑6860 · Toll Free: 1‑888‑878‑4044
Email: generalinfo@oipc.ab.ca · oipc.ab.ca

Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, QC K1A 1H3
Toll Free: 1‑800‑282‑1376 · priv.gc.ca

14. Changes to this policy

We may update this policy from time to time. We will revise the “Last updated” date above when changes are made. Your continued use of our website after changes are posted constitutes acceptance of the updated policy.