Privacy Policy

1. Who We Are

True Truck Parts ("we", "us", "our") is a heavy-duty truck parts supplier based in Vaughan, Ontario, Canada. We operate the website at truetruckparts.com and supply cooling system and A/C components for Class 8 semi trucks to customers across the Greater Toronto Area and Canada.

This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal private-sector privacy law, and Canada's Anti-Spam Legislation (CASL).

2. Information We Collect

We collect personal information only when you voluntarily provide it to us or when it is generated automatically as part of operating the website. We collect the minimum amount necessary for the stated purpose.

2.1 Information You Provide Directly

• Account registration: When you create a wholesale or retail account, we collect your name, email address, phone number, company name, and account type (retail / mechanic / fleet). Your password is stored as a one-way cryptographic hash — we cannot read or recover it.
• Contact and quote requests: When you submit our contact form or request a parts quote, we collect your name, email address, phone number, company name, the truck make/model/year, and the message or parts inquiry you submit.
• VIN lookups: If you use our VIN decoder tool, your VIN is transmitted to our server and forwarded to a third-party vehicle database (NHTSA VPIC). We do not store the VINs you look up in our database. The decoded vehicle information is returned to your browser session and is not retained.

2.2 Information Collected Automatically

• Server logs: Our web server automatically records standard technical information including your IP address, browser type, operating system, referring URL, pages visited, and timestamps. These logs are used for security monitoring and troubleshooting.
• Session data: We use a short-lived session token stored in your browser to keep you logged in to your account. This token expires when you log out or when the session times out.

2.3 Information We Do Not Collect

• We do not collect payment card numbers. If payment processing is enabled in the future, card data will be handled exclusively by our payment processor (Stripe) and will never pass through or be stored on our servers.
• We do not use Google Analytics, Facebook Pixel, or any third-party advertising or behavioral tracking tools on this website.
• We do not collect sensitive personal information such as health data, government identification numbers, or financial account information.

3. How We Use Your Information

We use the personal information we collect only for the purposes for which it was provided:

3.1 To Fulfill Your Request

• Responding to parts inquiries and providing quotes
• Processing and managing your wholesale or retail account
• Sending email verification codes and account approval notifications
• Fulfilling orders and communicating about order status
• Processing warranty claims

3.2 To Operate and Improve the Website

• Diagnosing technical problems and ensuring website security
• Understanding how customers use the website to improve our parts catalog and content
• Preventing fraud and unauthorized access to accounts

3.3 To Communicate With You

• Sending transactional emails you request (quote responses, account confirmations, order updates)
• Sending commercial email communications (newsletters, promotions) only if you have provided express consent under CASL — see Section 10

We do not use your personal information for automated decision-making, profiling, or any purpose other than those listed above without first obtaining your consent.

4. Legal Basis and Consent

Under PIPEDA, we rely on your consent as the primary legal basis for collecting, using, and disclosing your personal information. Consent may be:

• Express consent: You actively agree — for example, by submitting a contact form, creating an account, or opting in to our newsletter. The purpose for collection is identified at the point of collection.
• Implied consent: Your consent is reasonably implied by the context — for example, providing your phone number when requesting a quote implies consent to be contacted about that quote.

You may withdraw your consent at any time by contacting our Privacy Officer at privacy@truetruckparts.com. Withdrawal of consent may affect our ability to continue providing services that depend on that information. We will inform you of the consequences before you withdraw.

In limited circumstances, we may collect or use personal information without consent where required or permitted by law — for example, to investigate a breach of an agreement, detect or prevent fraud, or comply with a lawful court order or legal obligation.

5. Who We Share Information With

We do not sell, rent, or trade your personal information to any third party. We share information only in the following limited circumstances:

5.1 Service Providers

We use a small number of third-party service providers who assist us in operating the website and communicating with customers. These providers are contractually required to use your information only as directed by us and to protect it with appropriate security measures:

• Hostinger (hosting and email): Our website is hosted on servers operated by Hostinger. Transactional emails (account verification, order confirmations) are sent via Hostinger's SMTP service.
• Stripe (future payment processing): If online payment is enabled, Stripe will process payment transactions. Stripe is PCI-DSS Level 1 certified. Card data is collected directly by Stripe and never touches our servers.
• NHTSA VPIC (VIN decoding): VINs entered into our decoder are forwarded to the U.S. National Highway Traffic Safety Administration's public vehicle database to retrieve vehicle specifications. No personally identifiable information is sent to NHTSA — only the VIN string.

5.2 Legal Requirements

We may disclose personal information if required to do so by law or in response to a valid legal process (such as a court order or government request), or when we believe disclosure is necessary to protect the safety of any person, investigate fraud, or enforce our legal rights.

5.3 Business Transfers

If True Truck Parts is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website before your information is transferred and becomes subject to a different privacy policy.

6. How Long We Keep Your Information

We retain personal information only as long as necessary for the purpose for which it was collected, or as required by law:

• Account information: Retained for the lifetime of your account and for up to 2 years after account closure, in case of warranty claims or outstanding inquiries.
• Contact and quote requests: Retained for up to 2 years from the date of the request, to support follow-up inquiries and warranty matters.
• Order records: Retained for a minimum of 7 years to comply with Canadian tax and commercial record-keeping requirements.
• Server logs: Automatically overwritten or deleted after 90 days.
• Email verification codes: Automatically deleted after 30 minutes of generation.
• VIN lookups: Not stored — processed in real time and discarded.

When personal information is no longer required, it is securely deleted or anonymized so that it can no longer be associated with you.

7. How We Protect Your Information

We implement technical, physical, and administrative safeguards appropriate to the sensitivity of the information and the risks involved:

• Encryption in transit: All data transmitted between your browser and our website is encrypted using TLS (HTTPS). Our SSL certificate is managed by Let's Encrypt.
• Password security: Passwords are hashed using bcrypt with a cost factor of 12. Plain-text passwords are never stored or logged.
• Access controls: Personal information in our database is accessible only to authorized personnel. Server access is protected by SSH key authentication.
• Security headers: Our website is served with Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers.
• No advertising trackers: We do not embed third-party advertising or tracking scripts that could expose your browsing behaviour to external parties.

Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. In the event of a data breach that poses a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada in accordance with PIPEDA's mandatory breach reporting requirements.

8. Cookies and Tracking

We use a minimal number of cookies:

• Session cookie (strictly necessary): A single session cookie keeps you logged in to your account while you browse the site. This cookie is deleted when you close your browser or log out. It does not track browsing behaviour.
• No analytics cookies: We do not currently use Google Analytics, Adobe Analytics, or any similar service. No third-party analytics cookies are set on this website.
• No advertising cookies: We do not use Facebook Pixel, Google Ads remarketing tags, or any other advertising tracking technologies.

You can instruct your browser to refuse all cookies or to alert you when cookies are being sent. If you disable the session cookie, you will not be able to remain logged in to your account, but all other features of the website will function normally.

9. Your Privacy Rights

Under PIPEDA, you have the following rights with respect to your personal information:

Right of Access

You have the right to request a copy of the personal information we hold about you. We will respond within 30 days of receiving a verifiable request, or notify you if an extension is needed.

Right of Correction

If the personal information we hold is inaccurate or incomplete, you have the right to request a correction. We will amend the record and, where appropriate, notify any third parties to whom the information was disclosed.

Right of Deletion

You may request that we delete your personal information. We will honour this request unless we are required to retain the information by law (for example, order records required for tax purposes) or where deletion is not technically feasible. We will inform you of any limitations before proceeding.

Right to Withdraw Consent

You may withdraw consent for any optional use of your information (such as commercial email) at any time without penalty, subject to legal or contractual restrictions. See Section 10 for email opt-out.

Right to File a Complaint

If you believe we have not handled your personal information in accordance with PIPEDA, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada:

We encourage you to contact us first at privacy@truetruckparts.com so we can attempt to resolve your concern directly.

To exercise any of the above rights, please contact our Privacy Officer with your request (see Section 13). We may ask you to verify your identity before processing a request to ensure that we do not disclose or delete information belonging to another person.

10. Commercial Email and CASL

We send two types of email messages:

• Transactional messages (account verification codes, quote responses, order confirmations, warranty updates) — these are sent as a direct result of an action you took and are not subject to CASL's consent requirements.
• Commercial electronic messages (newsletters, promotional offers, product announcements) — we send these only if you have provided express consent by actively opting in.

Every commercial email we send includes:

• Identification of True Truck Parts as the sender, including our mailing address
• A working unsubscribe mechanism that will process your opt-out within 10 business days

To unsubscribe from commercial emails at any time, click the unsubscribe link in any email we send, or email privacy@truetruckparts.com with the subject line "Unsubscribe."

11. Children's Privacy

Our website and services are directed to business operators and individuals in the commercial trucking industry. We do not knowingly collect personal information from anyone under the age of 18. If you believe a minor has provided us with personal information, please contact us immediately at privacy@truetruckparts.com and we will delete that information promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Post a notice on our website homepage for at least 30 days
• For significant changes that affect how we use information you have already provided, we will send a notice to the email address on your account at least 14 days before the change takes effect

Your continued use of our website after the effective date of any changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

13. Contact Our Privacy Officer

For any privacy-related questions, requests to access or delete your personal information, or concerns about how we handle your data, please contact:

We aim to acknowledge all privacy requests within 5 business days and to resolve them within 30 calendar days. If a request requires additional time, we will notify you of the extension and the reason for it.

This policy was prepared to comply with the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (PIPEDA) and Canada's Anti-Spam Legislation, S.C. 2010, c. 23 (CASL). Last updated: July 1, 2026.