Skip to main content
Metro Toronto Convention Centre

Privacy Policy

Last updated: 2026-05-13

1. Overview

Print Stuff Inc. ("we," "us," "our") operates poster and large-format printing services at mtcc.print-stuff.ca and related subdomains. This Privacy Policy explains how we collect, use, and protect your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Law 25.

Print Stuff Inc. is an independent service provider and is not affiliated with, owned by, or endorsed by Metro Toronto Convention Centre or any other venue at which we operate.

2. Information We Collect

When you place an order or request a quote, we collect:

  • Contact details: full name, email address, phone number, company/organization (optional)
  • Order details: product type, dimensions, material, finishing, delivery date, delivery preference, event selection
  • Uploaded files: your print artwork (PDF, AI, EPS, PSD, PNG, JPG, TIFF, SVG, PPTX, INDD, and similar formats)
  • Delivery address: only if you select address delivery (not for venue pickup)
  • Payment information: processed securely by Stripe — we never see or store your credit card number
  • Quote request text: if you submit a quote request, the natural-language description you provide may be processed by an automated parser (see Section 5)

3. How We Use Your Information

Your information is used solely for:

  • Processing and fulfilling your order or quote
  • Communicating about your order status (confirmation, production updates, ready/delivered notifications)
  • Contacting you if there is an issue with your file or order
  • Improving our services and understanding customer needs
  • Sending promotional updates about upcoming events and offers only if you explicitly opted in (CASL-compliant)

4. Payment Processing

All payments are processed by Stripe, a PCI-DSS Level 1 certified payment processor. When you pay:

  • Your card details go directly to Stripe's servers — they never pass through our systems
  • We only receive confirmation that payment was successful, the transaction amount, and a reference ID
  • For more about how Stripe handles your data, see Stripe's Privacy Policy

5. Automated Decision-Making (Quebec Law 25)

If you submit a free-text quote request, we may use an automated language model to interpret the description (extracting dimensions, quantity, product type, etc.) and produce a draft quote. This is a convenience feature to speed up our internal workflow — a human team member always reviews the parsed quote before it is sent to you.

This automated processing does not produce decisions with legal or significant effects on you (it does not approve, deny, or price-discriminate based on personal characteristics). You may request that a human exclusively review your quote request by noting "no automated processing" in your message.

6. Data Storage and Security

  • Order data and uploaded files are stored on a secure hosted server in Canada
  • We use HTTPS/TLS encryption for all data transmitted between your browser and our server
  • Access to customer data is restricted to authorized team members who need it to fulfill orders
  • Uploaded files are stored securely and used only for printing your order
  • Email sending is handled by Microsoft 365 SMTP infrastructure

7. Data Retention

Per our internal data-retention policy:

  • Order records with personal information: 30 days after pickup or delivery, then anonymized
  • Anonymized order records: retained 6 years to satisfy Canada Revenue Agency tax-record requirements
  • Uploaded design files: 90 days after pickup or delivery, then deleted
  • Delivery photos / signatures: 90 days after delivery, then deleted
  • Payment records: managed by Stripe according to their retention policies

You may request earlier deletion of your data at any time by contacting our Privacy Officer (Section 12). Some records may be retained longer where required by law or for legitimate business purposes (e.g., active disputes, tax obligations).

8. Third-Party Services and Cross-Border Data Transfers

We use the following third-party services that may process your data:

We do not sell, rent, or trade your personal information to any third party.

Cross-border transfers: some of our third-party service providers (including Stripe, Microsoft, Google, and Anthropic) may process or store data on servers located outside of Canada, including in the United States. When your data is transferred outside of Canada, it remains subject to the privacy commitments outlined in this policy and the respective provider's privacy commitments.

9. Data Breach Notification

In the event of a data breach that creates a real risk of significant harm to you, we will notify affected individuals and the Office of the Privacy Commissioner of Canada (and the Commission d'accès à l'information du Québec, where applicable) as required by PIPEDA and Quebec Law 25. Notification will include a description of the breach, the types of information involved, and steps you can take to reduce the risk of harm.

10. Cookies

Our website uses minimal cookies:

  • Session cookies: required for order processing, form functionality, and CSRF protection
  • Local storage: used to save your form progress so you can resume if you accidentally close the page (expires after 24 hours)
  • Third-party cookies: Stripe may set cookies on its hosted checkout page for fraud prevention and functionality

We do not use analytics cookies (Google Analytics, Facebook Pixel, etc.) at this time. If we add them in the future, we will update this policy with notice.

11. Your Rights Under PIPEDA and Quebec Law 25

You have the right to:

  • Request access to the personal information we hold about you
  • Request correction of inaccurate information
  • Request deletion of your personal information
  • Withdraw consent for marketing communications at any time
  • Request a copy of your data in a structured, machine-readable format (data portability — Quebec Law 25)
  • Request that automated processing (Section 5) not be applied to your inquiry
  • File a complaint with the Office of the Privacy Commissioner of Canada or, for Quebec residents, the Commission d'accès à l'information

To exercise any of these rights, contact our Privacy Officer at the details below. We will respond to access and deletion requests within 30 days.

12. Privacy Officer

Print Stuff Inc.'s Privacy Officer is responsible for overseeing compliance with this policy, PIPEDA, and Quebec Law 25.

13. Governing Law

This Privacy Policy is governed by the laws of the Province of Ontario and the federal laws of Canada, including PIPEDA. For Quebec residents, Quebec Law 25 applies in addition.

14. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top indicates the most recent revision. Material changes will be communicated by email to customers with active orders.

← Return to Storefront
Note: this policy was prepared with reference to PIPEDA and Quebec Law 25. It is not legal advice. For questions about your specific circumstances, consult a Canadian privacy lawyer.