Privacy Policy

Loyalty Source (a division of KLF Group Inc.) and its affiliated businesses strongly advocate the responsible protection of the privacy of their members, Clients and affiliates. KLF Group Inc. endeavours to maintain an appropriate balance between the rights and expectations of individuals and the reasonable needs of our business. In so doing, we engage all our customers, Clients and partners in the evolving discussion about data privacy, protection and security.

Because this Website collects certain information about its visitors, we have developed this Policy to inform you of Loyalty Source's practices concerning the information that we collect, how it is used and the choices available to you. To make this Policy easy to find, it is available in the footer of every page of the Website and at every point where personal information may be collected. This Policy does not apply to information collected offline or to websites found at other locations, including those of Loyalty Source's affiliated lines of business. We encourage you to read this Policy before using our Website. Capitalized terms have the same meaning as in the Website Terms and Conditions.

This Policy is published in accordance with the Act respecting the protection of personal information in the private sector (Québec), as amended by Law 25, and the Personal Information Protection and Electronic Documents Act (PIPEDA). Where the law requires your consent, we ask for it expressly and separately for each purpose, and you may withdraw it at any time. Non-essential cookies and similar technologies are deactivated until you accept them (see section 2).

You can review or change your cookie choices at any time by selecting Cookie settings in the footer of every page.

This Website is intended for businesses and their representatives. We do not knowingly collect personal information from minors.

Loyaltysource.com collects personal information about its visitors in the following situations: when you send us an email, complete one of our online forms (account request, contact or sample request), chat with us, or use a Client account. Depending on the situation, this information may include your name, employer name, business email address and telephone number, job title and function, business location, and the content of your messages.

When you use a Client account, we also process your login credentials, the Orders, quotes, shopping lists and delivery details you submit (which may include the names and addresses of the End Users who receive your shipments), and your account preferences. An 8-hour session cookie keeps you signed in. If you choose "Remember this device" during two-step verification, a cookie (LsUserToken) lets you skip the verification code on that browser for the period configured for your account.

Our servers automatically record technical information such as your IP address, browser type, the pages you request and the date and time of each request. This information is used for security, troubleshooting and capacity planning.

Information you provide through our HubSpot-powered contact forms and live chat is received by HubSpot on our behalf. Visitor tracking by HubSpot is only activated if you accept Marketing cookies (see section 2).

A cookie is a small text file that a website stores in your browser. Similar technologies include pixels, local storage and scripts provided by third parties. Some of them can identify you, locate you or build a profile of your interests. In accordance with Québec law, these functions are deactivated by default: when you first visit our Website, only essential cookies are used until you make a choice in the cookie banner.

We group cookies and similar technologies into three categories:

1. Essential: required for the Website to function and to keep it secure (signing in, your language, your shopping cart, protection against automated abuse and remembering your cookie choices). They do not require your consent.
2. Analytics (statistics): Google Analytics 4 helps us measure visits and understand which pages are most useful, so we can improve the Website. Used only with your consent.
3. Marketing and third-party integrations: LinkedIn Insight Tag, Meta (Facebook) pixel, Google Ads, HubSpot (visitor tracking and live chat) and the ZoomCatalog catalogue viewer. They may measure the performance of our campaigns, personalize advertising and track your activity across websites. Used only with your consent.

You may accept all categories, keep only the essential ones, or choose category by category. Your choice is stored in a cookie named ls_cookie_consent for 12 months, after which we will ask you again. We will also ask you again if we add a new category, or a new third party for analytics or marketing.

You can change or withdraw your consent at any time by selecting Cookie settings in the footer of every page. Withdrawing consent stops the technologies concerned from being loaded and deletes the related cookies that we are able to delete on our domain; the page reloads to apply your new choice. Cookies placed by third parties on their own domains (for example Google, LinkedIn or ZoomCatalog) can only be deleted through your browser settings or the tools offered by those providers.

You can also block or delete cookies through your browser settings. If you block essential cookies, some parts of the Website, such as signing in or ordering, will not work.

The third parties named above process data under their own privacy policies: https://policies.google.com/privacy (Google), https://legal.hubspot.com/privacy-policy (HubSpot), https://www.linkedin.com/legal/privacy-policy (LinkedIn), https://www.facebook.com/privacy/policy (Meta) and https://www.zoomcatalog.com/content/privacy-policy (ZoomCatalog).

Some third-party content, such as the ZoomCatalog catalogues on our Corporate Gifting page, is only displayed if you have accepted Marketing cookies or if you choose to display it by clicking the button shown in its place. Displaying it loads content from that provider, which may set its own cookies for that visit.

The table below lists every cookie and storage item used on this Website, with its provider, purpose, duration and category.

We use the information provided through our online forms, live chat and email to facilitate your engagement with Loyalty Source and to:

1. respond to your requests for information, quotes, samples or a Client account;
2. create and manage your Client account, process your Orders and quotes, and deliver your shipments;
3. send you our eNewsletter and information about our products and services where you have agreed to receive them (you can unsubscribe at any time);
4. understand and analyze your needs and preferences in order to improve our products, services and Website;
5. ensure the security of the Website and prevent fraud and abuse;
6. comply with our legal and regulatory obligations.

We may also aggregate user data which is deemed "non-personal" for various system administration purposes and to monitor website usage. The aggregated data measures site visit information such as number of visits, number of pages viewed and other site statistics, and diagnoses of server requirements. This monitoring process enables us to continuously improve our content and ultimately our service.

Loyalty Source may also disclose personal or business contact information provided to it to comply with legal and regulatory requirements or to ensure compliance with the terms and conditions of this Website. We do not sell personal information.

Where we rely on your consent, you may withdraw it at any time, subject to legal or contractual restrictions and reasonable notice, by contacting us as indicated in section 5.

Loyalty Source takes physical, electronic and procedural measures to prevent unauthorized access to our Website and to the personal and business contact information it collects. Data is transmitted over encrypted connections (TLS/HTTPS) and stored on systems hosted in AWS data centres located in Canada, and access to personal information is restricted to staff who need it to perform their duties. We review our security practices regularly.

No method of transmission over the Internet or of electronic storage is completely secure. If we become aware of a confidentiality incident involving your personal information, we act as described in section 10.

KLF Group Inc. has designated a person in charge of the protection of personal information, who oversees compliance with this Policy and with applicable privacy laws and who handles access requests, rectification requests, complaints and withdrawals of consent.

Privacy Officer (Responsable de la protection des renseignements personnels), KLF Group Inc. / Loyalty Source, 8010 Devonshire, Mount-Royal (Québec) H4P 2K3, Canada. Email: privacy@loyaltysource.com.

Please include enough information for us to identify you and the account or request concerned. We may need to verify your identity before acting on a request.

Subject to applicable law, you have the following rights regarding the personal information we hold about you:

1. Access: to be informed of the personal information we hold about you, how it is used and to whom it has been communicated, and to obtain a copy.
2. Rectification: to have inaccurate, incomplete or ambiguous information corrected or completed.
3. Withdrawal of consent: to withdraw your consent to the use or communication of your information at any time, including for cookies and marketing communications.
4. De-indexing and cessation of dissemination: to ask us to stop disseminating your personal information or to de-index a hyperlink attached to your name, where dissemination contravenes the law or a court order or causes you serious injury.
5. Portability: to receive the computerized personal information you provided to us in a structured, commonly used technological format, or to have it transferred to another person or organization you designate.

To exercise these rights, contact the person in charge of the protection of personal information (section 5). We respond in writing within 30 days of receiving your request. If we refuse a request in whole or in part, we will give you the reasons and inform you of your recourses.

If you are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec (https://www.cai.gouv.qc.ca/) or, where PIPEDA applies, with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/en/).

You may also unsubscribe from our marketing emails at any time by using the link included in each message.

We keep personal information only for as long as necessary to fulfil the purposes for which it was collected, and thereafter for as long as the law requires (for example accounting and tax record-keeping obligations). In particular:

1. Client account and Order information is kept for the duration of our business relationship and for the applicable legal retention period after it ends.
2. The names and delivery details of End Users appearing on Orders are anonymized 12 months after the Order, or sooner where a Client program requires it.
3. Information submitted through our contact forms and live chat is kept for as long as needed to handle your request and maintain our business relationship, or until you ask us to delete it.
4. Your signed-in session ends after 8 hours; your cookie choice is kept for 12 months.
5. Technical server logs are kept for a limited period for security and troubleshooting purposes and are then deleted.

When personal information is no longer required, it is securely destroyed or anonymized in accordance with applicable law.

We use service providers to operate the Website and our business. They may access personal information only to perform services on our behalf and are bound by contractual confidentiality and security obligations. Our main providers are:

1. Amazon Web Services (hosting of the Website and our systems, Canada (Montréal) region);
2. Google (Tag Manager, Analytics, Ads and reCAPTCHA);
3. HubSpot (contact forms, live chat and customer relationship management);
4. LinkedIn and Meta (advertising measurement, only with your consent);
5. ZoomCatalog (interactive catalogue viewer);
6. shipping carriers and our suppliers, for the delivery of your Orders.

Some of these providers process information outside Québec, notably in the United States, where it is subject to the laws of those jurisdictions. Before communicating personal information outside Québec, we assess the privacy factors involved, including the sensitivity of the information, the purposes of its use and the protection measures that apply, and we rely on contractual safeguards. For optional technologies (analytics and marketing), nothing is communicated to these providers until you have given your consent; information you submit through a form or live chat is communicated when you send it, and the reCAPTCHA security check and HubSpot's bot protection (Cloudflare) run on our forms regardless of your cookie choices.

We may also disclose personal information where required or permitted by law, for example to comply with a subpoena, a court order or a request from a competent authority, or to protect our rights.

We do not make decisions based exclusively on automated processing of personal information that would produce legal or similarly significant effects on you.

Technologies capable of identifying, locating or profiling you (analytics and marketing cookies) are deactivated by default and are only activated with your consent, which you may withdraw at any time (section 2).

We maintain a register of confidentiality incidents involving personal information. If an incident presents a risk of serious injury to the persons concerned, we notify the Commission d'accès à l'information du Québec and the persons concerned, and we take reasonable measures to reduce the risk of injury and to prevent new incidents of the same nature.

If you believe your personal information has been compromised, please contact us immediately (section 5).

We may update this Policy from time to time to reflect changes in our practices, in the technologies we use or in the law. The date of the latest update is shown at the top of this page.

Material changes will be announced on the Website and, where required, we will ask for your consent again.