Privacy Policy

Introduction

Shift Happens Auto Sales ("we", "us", or "our") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

This policy complies with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL), and applicable provincial privacy legislation in Alberta and across Canada.

This policy also describes how we implement Google Consent Mode v2, the difference between the cookies we run under implied consent and those that require your express opt-in, and how you can manage your cookie and tracking preferences at any time.

Information We Collect

Personal Information You Provide

We collect personal information that you voluntarily provide to us when you:

• Submit a contact form or vehicle inquiry
• Apply for financing
• Request a trade-in valuation
• Sign up for promotional offers
• Contact us via email or phone

The personal information we collect may include:

• Contact Information: Name, email address, phone number, mailing address
• Financial Information: Employment details, income information (for financing applications)
• Vehicle Information: Details about vehicles you own or are interested in purchasing
• Identification Information: Date of birth, driver's license number (if required for financing)

Information Collected Automatically

When you visit our website, certain technical information may be collected automatically. Aggregate analytics (Google Analytics 4) — including, for visitors in Canada, measuring which of our own Google ads brought a visit — runs under implied consent and can be switched off at any time; session recordings, ad personalization and marketing pixels run only if you expressly opt in. This may include:

• IP address (anonymized where technically possible)
• Browser type and version
• Device type and operating system
• Pages visited, session duration, and referral source (aggregate analytics — implied consent, opt-out available)
• Interaction data such as clicks and scroll depth via session recordings (Microsoft Clarity — express opt-in only)

Our Own Record of How the Site Is Used

We keep a first-party record of visits to this site so we can see what people look for, where our forms get in the way, and which cars draw interest. It is tied to a random identifier we create and store in your browser — not to your name. It may include:

• The pages you view (and their titles), how long you stay and how far you scroll, including which vehicles you look at and whether you open their photos
• Searches, filters and sorting you use on our inventory — including when nothing matched — and the numbers you try in our payment calculator (price, down payment, term, interest rate and payment only)
• Taps on our call, text, map and email buttons, the answers you pick in our approval quiz, and which questions you open in our FAQs
• How far you get in our forms: the step you reached, and the name of a field that showed an error — never what you typed into it
• The general source that brought you here (a search engine, an online ad, an AI assistant, another website or a direct visit) and, where an advertising campaign provides them, its campaign tags and click ID; your device type (phone, tablet or computer); how quickly the first page loaded; and your country and province as reported by our hosting provider

We do not store your IP address or your city, record your keystrokes, keep the contents of forms you did not submit, or make screen or session recordings as part of this record (optional session replay is handled separately by Microsoft Clarity, on express opt-in only — see the Cookies section). If you do submit a form, our team may see your visits on this browser alongside your inquiry — the ones before it and the ones after it, including the pages you view and how long you spend on each, as they happen — so we can respond with context, and if we have already spoken with you about it, our team may be told when you visit the website again so we can follow up at a helpful time. For this, a browser that has sent us a form keeps a small first-party cookie, shas_lb, for 90 days; it holds no personal information, and turning Analytics off in our cookie banner removes it. If an ad brought you here, we remember that campaign in your browser for up to 90 days so a later inquiry is credited to it. And if you go on to be approved for financing or buy a vehicle from us, we tell that ad platform that the ad click led to it, using the ad's own click ID — not your name or contact details — so we show fewer ads to people they won't help.

Detailed visit records are kept for 13 months and then deleted; after that we keep only daily totals that cannot identify anyone. This record is collected only while Analytics consent is on (it is on unless you choose otherwise in our cookie banner), is stored by us and our hosting and storage providers, and is never sold or shared with third parties for their own purposes. Choosing "Necessary Only" (or switching Analytics off) in our cookie banner stops it straight away and clears what is held in your browser; clearing your browser's site data resets the random identifier.

How We Use Your Information

We use your personal information only for the purposes for which it was collected and with your consent. These purposes include:

• Responding to Inquiries: To answer your questions about vehicles, services, and availability
• Processing Applications: To review and process financing and trade-in applications
• Completing Transactions: To facilitate vehicle sales and related services
• Providing Updates: To inform you about your applications, appointments, or vehicle availability
• Marketing Communications: To send promotional offers and updates (only with your explicit consent under CASL)
• Improving Our Services: To analyze aggregate, anonymized usage and improve our website and customer experience (Google Analytics 4 — implied consent, opt-out available; Microsoft Clarity session replay — express opt-in)
• Ad Measurement: To measure whether our own advertising works — which of our Google ads led to a visit or an inquiry (for visitors in Canada this is part of Analytics: implied consent, opt-out available); marketing pixels and any ad personalization remain express opt-in only
• Legal Compliance: To comply with legal obligations and protect our rights

Consent

Under PIPEDA, the form of consent we rely on is matched to the sensitivity of the information and your reasonable expectations. Consent on this website operates at three levels:

Form Consent (Express)

When you submit a contact form, financing application, trade-in request, or promotional sign-up, you explicitly consent to:

• Collection and use of the personal information in that form
• Opt-in to marketing communications (via separate, explicit checkbox — never pre-checked)
• Processing of your application or inquiry by our team

Aggregate Analytics (Implied Consent)

First-party, anonymized website analytics (Google Analytics 4) run under implied consent — active by default when you visit. We rely on implied consent here because the data is aggregate, non-sensitive, used solely to measure and improve our own website, and within the reasonable expectations of a website visitor. You may opt out at any time using the "Necessary Only" or "Customize" options on the cookie banner, or the "Cookie Preferences" link in our footer.

For visitors in Canada, this also covers measuring our own Google advertising: when you arrive from one of our Google ads, Google may set a first-party cookie so it can tell us that a later inquiry came from that ad. It is not used to personalize the ads you see or to build an audience, and switching Analytics off switches it off. Visitors outside Canada are not measured this way unless they turn on Marketing.

Cookie & Tracking Consent (Express Opt-In)

On your first visit a cookie consent banner is presented. You may choose "Accept All," "Necessary Only," or "Customize" to set per-category preferences across three categories: Analytics (Google Analytics 4, on by default — opt-out), Session Replay (Microsoft Clarity, off until you turn it on — express opt-in), and Marketing (Meta Pixel, off until you turn it on — express opt-in). Session recordings, ad personalization and marketing pixels never run unless you affirmatively enable them (measuring our own Google ads, described under Aggregate Analytics, follows your Analytics choice); opening the preferences panel and saving the defaults does not enable them. Your preference is stored in your browser's localStorage and honoured on subsequent visits. See "Cookie Preferences Management" below for full details.

You may withdraw or change your consent at any time via the "Cookie Preferences" link in our site footer, or by contacting us at intake.shifthappensautosales@gmail.com. Opting out of analytics, session replay, or marketing will not affect our ability to respond to an existing inquiry or complete a vehicle transaction.

Canada's Anti-Spam Legislation (CASL)

Commercial electronic messages we send — including financing follow-up emails, promotional offers, and vehicle availability alerts — require your express opt-in consent under Canada's Anti-Spam Legislation (CASL, Section 6).

Consent is collected via a clearly labelled, unticked checkbox at the point of form submission. We do not bundle marketing consent with service consent — you may receive a response to your inquiry without opting into promotional communications.

To withdraw CASL consent at any time:

• Click the unsubscribe link included in any commercial email we send; or
• Email intake.shifthappensautosales@gmail.com with subject "Unsubscribe."

We will honour all unsubscribe requests within 10 business days, as required by CASL Section 11(3).

Text Messages (SMS)

When you give us your phone number on a financing application, vehicle inquiry, or other form on this website, we may send you text messages about that inquiry — for example, a confirmation that we received your application and when to expect our call. Message frequency varies. Message and data rates may apply.

• To stop: reply STOP to any message. You will receive one confirmation and no further texts.
• For help: reply HELP, call us at (825) 736-4438, or email intake.shifthappensautosales@gmail.com.
• Carriers are not liable for delayed or undelivered messages.

We do not sell, rent, or share your mobile phone number or your text-message consent with any third party or affiliate for their marketing or promotional purposes. Text-message opt-in data and consent are never shared with third parties. The only company that handles your number for texting is the messaging provider that delivers our messages on our behalf (Twilio), which may use it for that purpose only.

Cookies and Tracking Technologies

We use cookies, localStorage, and third-party tracking scripts on this website. The following table describes every technology in use, organized by consent category.

Strictly Necessary (Always Active — No Consent Required)

These technologies are required for the website to function. They are not used for advertising or behavioural tracking, and they do not transmit data to third parties.

Partner Referral Link (Only When You Use a Partner's Link)

Partner Portal (Only For Our Partners)

Analytics — Google Analytics 4 (Active by Default · Opt-Out)

Google Analytics 4 runs under implied consent and is active by default. It measures aggregate, anonymized site usage to help us improve our services and does not build advertising profiles. You may opt out at any time via the cookie banner ("Necessary Only" or "Customize") or the "Cookie Preferences" link in our footer; opting out switches GA4 to a cookieless, non-identifying mode (see "Google Consent Mode v2" below).

Session Replay — Microsoft Clarity (Consent Required · Opt-In)

Session recordings and heatmaps are off by default and load only after you expressly enable "Session Replay" in the cookie banner. They are never activated by visiting the site or by saving the default cookie preferences.

Marketing (Consent Required)

These tools are activated only after you provide Marketing consent. They are used to measure ad campaign effectiveness and, where consent permits, to build anonymized audiences for advertising. You will not receive more ads as a result of visiting our site without Marketing consent.

Google Consent Mode v2

Our website implements Google Consent Mode v2. This is a framework that adjusts the behaviour of Google tags (GA4) based on your consent state — it does not disable the scripts entirely, but it changes what data they collect. By default, analytics storage is granted (implied consent). For visitors in Canada, the ad storage and ad user data signals that let Google tell us which of our ads led to a visit follow your Analytics choice; ad personalization is denied until you turn on Marketing. Outside Canada, all advertising signals are denied until you opt in.

If you opt out of Analytics (via "Necessary Only," or by switching Analytics off in "Customize"):

• GA4 switches to cookieless, aggregate "ping" signals for statistical modelling only
• No user identifiers, cookies, or persistent IDs are written to your device
• No behavioural tracking or ad personalization takes place
• Your individual journey is not tracked

Each category is governed independently: analytics (GA4) is on by default and can be turned off; session replay (Microsoft Clarity) and marketing (Meta Pixel) remain off until you expressly turn them on. They are not linked to one another.

Cookie Preferences Management

You are in full control of your cookie and tracking preferences at all times. Here is how to manage them:

• On first visit: A cookie consent banner appears at the bottom of the page. Choose "Accept All," "Necessary Only," or "Customize" to set per-category consent (Analytics, Session Replay, and/or Marketing).
• To change your preferences at any time: Scroll to the bottom of any page on our website and click "Cookie Preferences" in the footer. The preference panel will re-open.
• To reset all preferences (force banner to reappear): Clear your browser's localStorage for the domain shifthappensautosales.ca. The banner will reappear on your next visit. Instructions vary by browser — search "clear localStorage [your browser name]" for guidance.

Your consent preference is stored locally in your browser only. It is not linked to your name or any personal identifier. Clearing your browser data will reset your preference.

How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information with:

• Service Providers: Third-party companies that help us provide services (e.g., email delivery, error monitoring — see "Service Infrastructure" section below)
• Financial Institutions: For credit applications and financing approvals (with your explicit consent at time of application)
• Legal Authorities: When required by law, court order, or to protect our rights and the safety of others

All third parties are contractually required to keep your information confidential and use it only for the purposes for which we disclose it.

Cross-Border Data Transfers

Some of the third-party services we use — specifically Google Analytics 4, Microsoft Clarity, Meta Pixel, Sentry (error monitoring), Resend (email delivery), Twilio (text message delivery), Telegram (instant notifications to our staff about a new inquiry, including your name and phone number), Vercel (hosting for this website and the systems that receive your forms) and Cloudflare (storage for our vehicle photos and for our own visit record described above) — may transfer and process personal data outside of Canada, including in the United States, Ireland, and European Union member states.

Each of these providers handles your information under a Data Processing Agreement (DPA) or under the provider's standard data-processing terms, and we use them only to operate our services. Where regional data residency options are available, we select them (for example, GA4 is configured with the United States as the data processing region — this is the region Google requires for Consent Mode v2 compliance).

You may request a summary of the agreements and terms in place by contacting our Privacy Officer at intake.shifthappensautosales@gmail.com.

Service Infrastructure

The following backend services touch personal data in the course of operating our website. They are not tracking or advertising technologies — they are operational systems that support site reliability, form delivery, and sales follow-up.

Data Security

We implement appropriate technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit (SSL/TLS on all connections)
• Secure database storage with role-based access controls
• Regular security assessments and dependency updates
• Employee training on data protection and privacy practices
• Limited access to personal information on a strict need-to-know basis
• Error monitoring with PII scrubbing configured (see Sentry above)

Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal requirements. Our retention periods are:

• Contact Inquiries: 2 years from last contact
• Financing Applications: 7 years (as required by law)
• Vehicle Purchase Records: 7 years (as required by law)
• Marketing Communications: Until you unsubscribe or withdraw CASL consent
• Cookie Consent Preference (localStorage): Persists until you change your preferences or clear your browser's site data — no automatic expiry
• On-Site Activity Record (visitor journey): The random browser identifier persists in your browser until you clear your site data; the activity record saved with a submitted inquiry is retained with that inquiry per the periods above (e.g., Contact Inquiries: 2 years; Financing Applications: 7 years)
• Analytics Data (GA4, Microsoft Clarity): Per third-party retention policy — GA4: 14 months; Clarity: 13 months
• Marketing Pixel Data (Meta Pixel): Per Meta's retention policy — up to 180 days for ad targeting purposes
• Error Monitoring Logs (Sentry): 30 days
• Email Delivery Logs (Resend): 30 days

After the applicable retention period expires, we securely delete or anonymize your personal information. Third-party retention periods are governed by each provider's own data policies.

Your Privacy Rights

Under PIPEDA, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Withdraw Consent: Withdraw your consent for marketing communications or other optional uses at any time
• Data Export: Request a portable copy of the personal information you provided to us
• File a Complaint: Lodge a complaint with the Office of the Privacy Commissioner of Canada (see section below)

See the "Exercising Your Rights — Data Subject Requests" section below for the concrete mechanism to submit any of these requests.

Exercising Your Rights — Data Subject Requests

This section explains exactly how to submit a privacy request. We aim to make this process straightforward and at no cost to you.

How to Submit a Request

Email our Privacy Officer at intake.shifthappensautosales@gmail.com with the subject line:

We will acknowledge your request within 5 business days and complete it within 30 days, as required by PIPEDA Section 8.3. If we require additional time (complex requests), we will notify you before the 30-day period expires.

What to Include

• Your full name
• The email address you used on our forms (so we can locate your records)
• The type of request (Access, Correction, Deletion, Withdraw Consent, or Export)
• A brief description of what you are requesting

Identity Verification

For Access and Deletion requests, we may ask you to verify your identity before releasing or deleting records. This protects you against fraudulent requests from third parties. Acceptable verification: a government-issued photo ID (e.g., driver's license) with sensitive fields redacted (e.g., SIN, full date of birth). Verification documents submitted for this purpose are destroyed within 30 days of the request being closed.

Cost

Standard privacy requests are provided free of charge. In the rare case of excessive or clearly repetitive requests, we may impose a reasonable fee as permitted under PIPEDA Principle 9. We will notify you of any fee before proceeding.

Right to Escalate

If you are not satisfied with our response to a privacy request, you may escalate to the Office of the Privacy Commissioner of Canada — see contact details in the final section of this policy.

Third-Party Links

Our website may contain links to third-party websites, including lenders, vehicle history report providers, and government portals. We are not responsible for the privacy practices of these sites. We encourage you to read their privacy policies before providing any personal information.

Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a person under 18, please contact us immediately at intake.shifthappensautosales@gmail.com and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, third-party tools, or legal requirements. We will notify you of significant changes by posting the updated policy on our website with a new "Last Updated" date. For material changes affecting how we use your personal information, we will provide additional notice (e.g., email notification to users with active consent on file). We encourage you to review this policy periodically.

Contact Us

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or have a privacy concern, please contact our Privacy Officer:

We will acknowledge your inquiry within 5 business days and respond fully within 30 days as required by PIPEDA.