Privacy policy

Privacy Policy — Celltro

Last Updated: August 11, 2026

Celltro is a commercial brand operated by Phonio Technologies Inc. ("Celltro," "we," "our," or "us"), a Quebec corporation registered under NEQ 1180390438. We are committed to protecting personal information and ensuring it is managed responsibly, transparently, and securely.

This Privacy Policy outlines what personal information we collect, how we process and share it, how long we retain it, and your statutory rights. This policy applies to our website www.celltro.ca, our online B2B ordering portal, commercial wholesale accounts, and all communications or transactions conducted with Celltro via email, phone, web forms, messaging platforms, or other channels.

This policy should be read in conjunction with our General Terms and Conditions of Sale and other operational site policies.

1. Who Is Responsible for Your Personal Information?

Phonio Technologies Inc. is responsible for personal information under its control, including information processed on its behalf by contracted service providers.

The designated Privacy Officer can be reached as follows:

President & Privacy Officer
Phonio Technologies Inc. / Celltro
Email: support@celltro.ca
Address: 1055A Raymond Blvd
Quebec, QC G1B 2R5, Canada

All questions, access/rectification requests, or privacy-related complaints should be directed to the Privacy Officer.

2. Scope of This Policy

Celltro operates primarily as a business-to-business (B2B) wholesale distributor. General corporate data—such as a registered company name or commercial mailing address—does not typically constitute personal information. However, information identifying a natural person (such as a sole proprietor, corporate director, representative, technician, or business contact) is protected under applicable privacy legislation.

This policy does not apply to irreversibly anonymized data or aggregated metrics that cannot identify a specific individual.

3. Information We Collect

We limit data collection strictly to what is reasonably necessary to fulfill the purposes outlined in this policy.

a) Identity, Contact & Wholesale Account Details

We may collect:

Full name, job title/role, language preferences, direct email address, and telephone number;
Commercial business name, operating DBA, physical address, website, and business contact details;
Corporate registration numbers (such as an NEQ, Business Number, or sales tax registration numbers) required to open and verify wholesale accounts;
Documentation required to confirm commercial trade eligibility or the representative’s signing authority;
Account management data, including account tier, preferences, and authentication credentials managed via our e-commerce platform. We never have access to your raw, unencrypted password.

For sole proprietorships or unincorporated repair businesses, business details may directly identify an individual and are treated as personal information.

b) Orders & Transactions

We may collect:

Ordered SKUs, quantities, wholesale pricing, applied tier discounts, taxes, and transaction terms;
Billing and delivery street addresses;
Order history, backorders, special procurement items, RMA credits, and account balances;
Tax invoices, sales receipts, dispatch manifests, tracking numbers, and proof-of-delivery signatures;
Records concerning warranty claims, product exchanges, bench inspection reports, and customer service inquiries.

c) Payment Information

Depending on the selected settlement method, we receive payment confirmation status, billing information, transaction reference identifiers, and reconciliation data.

Credit card transactions are processed securely by PCI-DSS compliant third-party payment gateways. Celltro does not receive, view, or store full credit card numbers or CVV codes. Payments completed via Interac e-Transfer or direct wire transfer may disclose the payor's name, originating financial institution, email address, or transaction memo.

d) Returns, RMA Claims & Technical Support

When submitting an RMA or warranty claim, we may collect support messages, diagnostic photos/videos, device model and OS version, hardware serial numbers, test reports, proof-of-purchase invoices, and technical details required to evaluate the claim.

Never transmit screen unlock passcodes, account credentials, or personal end-customer data stored on client devices. If diagnostic images or testing videos capture incidental customer data, redact or mask it before submission.

e) Communications & Marketing

We may retain:

Inbound and outbound emails, web form submissions, live chat transcripts, and phone logs;
Language and messaging preferences;
Consent records for commercial electronic messages (CEMs);
Email delivery, open rates, and click metrics, where tracking is enabled and lawful.

f) Technical & Website Usage Data

When you browse our portal, our systems and third-party tools automatically collect technical device data, including:

IP address and approximate geographic location derived from it;
Device type, browser configuration, operating system, and language settings;
Browsed catalog pages, search queries, cart contents, session clicks, and access timestamps;
Referring URLs, campaigns, or search engines;
Online identifiers, session cookies, and tracking pixels.

g) Product Reviews & Testimonials

When you submit a review regarding a component or Celltro's services, we collect your name or pseudonym, email address, order verification data, star rating, feedback text, and attached photos or videos. Your rating, name/pseudonym, review comments, and media may be published publicly on our website. Your email address and internal order details are kept private unless explicitly included by you within the public review body.

4. How We Collect Information

We collect personal information through several channels:

Directly from you: When registering a wholesale account, submitting an order, completing payments, contacting support, filing an RMA claim, or subscribing to industry newsletters;
Automatically: During portal navigation via cookies, server logs, web beacons, and performance monitoring scripts;
From commercial service partners: Including Shopify, payment processors, shipping couriers, fraud prevention providers, and communications platforms;
From public and corporate registries: Where necessary to verify corporate existence, confirm tax registration, or validate the signing authority of a business representative, in accordance with applicable law.

Upon written request, we will disclose the source of any personal information gathered from a third party, subject to statutory legal restrictions.

5. How We Use Information

We process personal information for the following business purposes:

Creating, administering, and safeguarding wholesale accounts;
Validating B2B trade eligibility, commercial creditworthiness, and volume discount tiers;
Fulfilling, invoicing, packing, routing, and delivering orders;
Managing pre-orders, backorders, refunds, store credits, RMA evaluations, and warranty replacements;
Communicating order confirmations, logistics updates, invoice reminders, and support responses;
Detecting and mitigating fraud, chargebacks, security intrusions, and unauthorized system access;
Ensuring portal functionality, technical optimization, and website security;
Analyzing wholesale product demand to optimize inventory forecasting and catalog offerings;
Evaluating marketing performance and serving relevant B2B announcements (strictly where required consent has been obtained);
Maintaining corporate accounting, tax, and audit records in compliance with Canadian and Quebec law;
Enforcing our legal agreements and defending against commercial disputes or claims.

We do not process personal information for secondary purposes incompatible with the above without obtaining your prior express consent, unless otherwise required or authorized by law.

6. Consent & Opt-Out Choices

We collect, use, and disclose personal information based on your consent, except where statutory exceptions apply under applicable privacy legislation. Consent may be express or implied depending on the nature of the data and the commercial context.

Certain identity and transaction details are strictly required to open wholesale accounts, verify commercial businesses, process payments, and dispatch shipments. Refusing or withdrawing consent for these necessary operational purposes may prevent us from providing services or fulfilling orders.

Commercial marketing emails and non-essential analytical/profiling cookies are deployed only with appropriate consent. You may withdraw consent for optional marketing or non-essential cookies at any time, subject to reasonable administrative notice and existing contractual obligations. Withdrawing consent does not affect the legality of processing carried out prior to withdrawal.

7. Cookies & Tracking Technologies

Our portal utilizes the following categories of tracking technologies:

Strictly Necessary: Essential for core platform security, session management, shopping cart functionality, payment tokenization, and fraud screening. These cannot be disabled without compromising fundamental portal operations.
Functional: Retain user preferences such as interface language, regional settings, and display configurations.
Analytics & Performance: Gather aggregated metrics on portal navigation, page load speeds, and technical performance to help us improve user experience.
Advertising & Profiling: Track campaign engagement, identify product interest, build custom audience segments, and deliver targeted B2B promotions on third-party platforms.

In accordance with Quebec privacy law (Law 25), non-essential tracking technologies that collect identifying, geolocation, or profiling data are deactivated by default and activated only after obtaining your express opt-in consent. You can accept, refuse, or adjust cookie settings at any time via our "Cookie Preferences" banner or footer link. Declining non-essential cookies will not prevent you from placing orders or managing your account.

Managing Cookies via Browser Controls

The most direct method to adjust non-essential cookies on Celltro is through the "Cookie Preferences" link on our site. Additionally, you can clear existing cookies or block future storage through your web browser settings:

Disabling all cookies, including strictly necessary ones, will cause portal malfunctions, preventing you from logging into your account, maintaining items in your cart, or checking out. Refusing non-essential cookies through our preference center does not impact checkout capabilities.

8. Service Providers & Third-Party Technologies

Celltro utilizes the following operational technologies. Processed data varies based on used features, your privacy selections, and account settings.

Service	Primary Function	Data Processed
Shopify, Shopify Payments & Shop Pay	E-commerce infrastructure, customer accounts, cart, payments, fraud screening, and expedited checkout	Contact details, device/browser metadata, cart data, order records, delivery and billing addresses, payment authorization tokens. Shopify may store encrypted payment credentials in Shop Pay on behalf of registered users.
Google Analytics	Traffic analysis, referral attribution, and site engagement tracking	Online identifiers, device specs, browser type, approximate city/region location, pageviews, session duration, and referral sources. We do not transmit direct personally identifiable information (PII) to Google Analytics.
Meta Pixel	B2B ad measurement, conversion tracking, and audience optimization	Online identifiers, IP address, device metadata, viewed product pages, and conversion events (e.g., cart additions, completed checkouts). Deployed only with prior consent.
Microsoft Clarity	UX analysis, behavior heatmaps, and session session replays	Page navigation paths, mouse clicks, scrolls, cursor movements, screen resolution, and session interactions. Session replays are structural event reconstructions, not webcam or screen recordings of the individual.
Consentik	Cookie banner deployment, consent logging, and preference compliance	Recorded consent status, accepted/rejected categories, timestamp, technical device IDs, IP address, and browser headers needed to document compliance audit trails.
Judge.me	Collection, verification, and display of product reviews	Reviewer name or pseudonym, email address, associated order/product SKU, star rating, feedback text, uploaded media, and verified buyer status.

You may review the respective privacy notices of Shopify, Google, Meta, Microsoft, Consentik, and Judge.me to understand how they process information under their own organizational controls.

Google Analytics, Meta Pixel, Microsoft Clarity, and non-essential Judge.me features are categorized by specific purpose. Where opt-in consent is legally required, they activate only after consent is recorded via Consentik. You can modify your choices at any time via "Cookie Preferences" on our site.

As our platform grows, we may introduce new applications or replace existing vendors. Prior to onboarding, we perform Privacy Impact Assessments (PIAs) where required, verifying security measures and cross-border transfer protections. We update this policy and our consent center whenever substantial changes occur. Processing existing data for a new, incompatible purpose will require renewed consent.

9. Shopify, Shopify Payments & Shop Pay

Our wholesale storefront is hosted on the Shopify platform. Card payments are processed via Shopify Payments, and eligible users may utilize Shop Pay accelerated checkout. Shopify processes device, navigation, account, cart, and payment details to operate and secure these services in accordance with merchant settings.

When choosing Shop Pay, Shopify securely stores payment cards, billing details, and shipping addresses within your personal Shop account to facilitate checkout across participating merchants. That processing is governed by your direct relationship with Shopify. You may manage your Shop data and exercise privacy rights directly through Shopify's privacy portal.

To learn more about Shopify’s independent consumer data practices, review the Shopify Consumer Privacy Policy: https://www.shopify.com/legal/privacy/consumers.

10. Who We Share Information With

We do not sell, trade, or rent personal information to third parties. We share only the information reasonably required with the following recipient categories:

Our e-commerce platform host, cloud infrastructure, secure storage, and IT maintenance partners;
Payment gateway providers, banking institutions, and merchant fraud prevention networks;
Commercial freight couriers, postal services, logistics partners, and local Quebec delivery drivers;
Transactional email providers, customer support ticketing systems, and web form processors;
Web analytics and digital advertising partners (strictly upon recorded user consent);
Chartered professional accountants, underwriters, legal counsel, and professional advisors bound by confidentiality;
Tax, regulatory, judicial, or law enforcement authorities where mandatory by law or judicial warrant;
Prospective or actual counterparties in connection with commercial financing, corporate restructuring, merger, or asset acquisition, under strict non-disclosure safeguards.

All contracted vendors are authorized to process personal data strictly to fulfill their designated contracted services and must comply with legal and contractual confidentiality obligations.

11. Cross-Border Transfers Outside Quebec

While Celltro operates from Quebec, Canada, certain third-party cloud service providers may store or process personal data in other Canadian provinces, the United States, or other international jurisdictions. Consequently, data may be subject to the lawful jurisdiction and access powers of local courts and authorities in those territories.

Prior to transferring personal information outside Quebec, we conduct Privacy Impact Assessments (PIAs) as mandated by Quebec Law 25. We establish appropriate contractual, technical, and organizational measures to ensure personal data receives protection comparable to Quebec standards.

12. Data Retention & Secure Disposal

We retain personal data strictly for as long as necessary to fulfill the original collection purposes, satisfy corporate tax obligations, and protect our legal rights.

Standard retention timeframes are structured as follows:

Category	Standard Retention Window
Incomplete account registrations & inquiries	Up to 24 months following the last communication, unless specific business necessity requires longer
Wholesale account profiles & commercial records	Maintained throughout the active business relationship, and generally up to 24 months following the last commercial order, excluding records subject to statutory tax retention
Orders, invoices, tax records & financial ledgers	Generally 6 full fiscal years following the relevant tax year, or longer where required by tax authorities, audit requirements, or pending legal disputes
RMA claims, warranty files & support tickets	Retained for the duration necessary to resolve claims, administer component warranties, and verify batch defect patterns; associated financial adjustments follow statutory accounting periods
Consent audit trails & marketing opt-outs	Retained for as long as needed to respect client preferences and demonstrate regulatory compliance with CASL and Law 25
Fraud mitigation & security audit logs	Retained for the duration reasonably necessary to detect, investigate, and prevent fraud, security breaches, or system abuse
Cookie & tracking session data	Determined by the lifespan of the specific cookie or script, as specified in our cookie preference center, after which data is purged or aggregated

Retention windows may be extended in the event of an ongoing regulatory audit, investigation, or legal dispute. Once the retention period lapses, personal data is irreversibly destroyed, shredded, or anonymized in compliance with industry standards.

13. Security Safeguards

We maintain physical, technical, and administrative safeguards calibrated to the sensitivity, volume, and format of the personal data under our control, including:

Role-based access controls restricting data access strictly to personnel on a need-to-know basis;
Mandatory robust passwords, multi-factor authentication (MFA), and secure administrative access;
SSL/TLS transport layer encryption for all website communications and reliance on certified payment processors;
Employee confidentiality undertakings and privacy compliance training;
Scheduled data backups, vulnerability patch management, network firewalls, and incident response plans;
Due diligence and contractual privacy covenants with third-party service providers.

While we implement rigorous industry controls, no electronic transmission or cloud storage environment is 100% immune to breach. Consequently, absolute security cannot be guaranteed.

14. Privacy Incidents & Breach Notification

We maintain an incident response protocol to promptly detect, contain, assess, and document potential confidentiality incidents. Where an incident presents a risk of serious injury, we notify the Commission d’accès à l’information du Québec (CAI), affected individuals, and any other relevant privacy authorities in accordance with applicable laws. We also take immediate corrective action to mitigate harm and prevent recurrence.

15. Your Statutory Rights

Subject to legal exceptions and identity verification, you hold the right to:

Request confirmation of whether we hold personal data about you, and request access to or a copy of that data;
Request the rectification of inaccurate, incomplete, or outdated personal information;
Request the erasure of personal information when its collection, communication, or retention is no longer authorized by law or business necessity;
Withdraw consent to specific data uses or communications at any time;
Request the portability of computerized personal data collected directly from you, delivered in a structured, commonly used technological format, or request its direct transfer to an authorized third party;
Request, under circumstances provided by law, the de-indexing or cessation of dissemination of personal information;
Unsubscribe at any time from commercial electronic messages;
Lodge a formal complaint regarding our privacy practices.

All requests must be submitted in writing to our Privacy Officer (Section 1). We may request reasonable proof of identity and signing authority prior to fulfilling requests. Information provided for identity verification will be used solely for that purpose.

We process access and rectification requests diligently and within thirty (30) calendar days of receipt, as prescribed by Quebec law. If a request is denied in whole or in part, we will provide written reasons along with information on available legal recourses.

You may also submit a complaint directly to the Commission d’accès à l’information du Québec: https://www.cai.gouv.qc.ca.

16. Commercial Communications

With your consent, we may send you wholesale updates, new inventory arrivals, promotional pricing, and product announcements. Every commercial message includes a one-click unsubscribe mechanism. You may also opt out by emailing support@celltro.ca. Opting out of marketing communications does not suppress critical operational notices regarding orders, security alerts, invoices, or warranty claims.

17. Protection of Minors

Celltro's website and B2B ordering portal are intended strictly for commercial enterprises and authorized adult representatives. Our services are not directed to minors, and we do not knowingly collect personal data from individuals under 14 years of age without required parental or legal consent. If you believe a minor has submitted personal data to us, please notify our Privacy Officer immediately.

18. Third-Party Websites & External Links

Our portal may contain links to external third-party websites or services. These external sites operate independently under their own privacy policies. Celltro assumes no responsibility for third-party privacy practices or content. We recommend reviewing external privacy notices before submitting personal data.

19. Policy Amendments

We may update this Privacy Policy periodically to reflect changes in our operational procedures, technical stack, service partners, or legal requirements. The updated policy will be posted on this page with an updated effective date.

In the event of material updates, we will provide prominent notice on our website or contact registered account holders directly where required by law. Any substantial new processing of previously gathered data will require renewed consent unless otherwise authorized by statute.

20. Inquiries & Dispute Resolution

For questions, rights requests, or privacy concerns, please contact: