1. Scope and accountability
This Privacy Notice explains how Twenty Arms Inc. collects, uses, discloses and protects personal information obtained through twentyarms.com, business enquiries and related preliminary diligence. Twenty Arms is responsible for personal information under its control. Privacy questions or requests may be sent to askus@twentyarms.com.
2. Information collected
Twenty Arms may collect:
- business contact information, including name, company, role, business email and telephone number;
- enquiry information, including commodity, quantity, proposed route, delivery basis and message content;
- technical and usage information generated when the website is accessed, such as IP address, device or browser information, security logs, cookies and analytics information;
- correspondence and records of the Company’s response; and
- after preliminary qualification and through an approved process, corporate, ownership, authority and identity information reasonably required for counterparty and transaction diligence.
Do not submit passports, government identification, bank statements, account numbers, proof of funds or other sensitive personal or financial information through the public form or ordinary email.
3. Purposes
Information may be used to receive, assess and respond to enquiries; communicate with business contacts; assess commercial feasibility and conduct preliminary screening; perform counterparty and transaction diligence where appropriate; maintain business, security and compliance records; prevent fraud, misuse and security incidents; operate, secure and improve the website; comply with legal obligations; and protect lawful rights.
Twenty Arms limits collection to information reasonably required for identified purposes and will seek additional consent where required for a materially different use.
4. Disclosure and service providers
Information may be disclosed to personnel and service providers who require it for these purposes, including website hosting, email, security, analytics, professional-advisory and diligence services. Information may also be disclosed to a proposed transaction counterparty with authorization or where reasonably required to advance an agreed process; to authorities where required by law; or to protect legal rights and prevent fraud or harm. Service providers are expected to handle information only for the applicable service and with appropriate safeguards.
5. International processing
Some service providers or transaction participants may process information outside Canada. Information processed in another jurisdiction may be subject to that jurisdiction’s laws and lawful-access rules. Twenty Arms considers the sensitivity of the information and the purpose of the transfer when selecting a submission or service channel.
6. Retention
Personal information is retained only as long as reasonably necessary for the identified purpose, applicable legal or recordkeeping obligations, dispute management, fraud prevention and legitimate business requirements. Information that is no longer required is deleted, anonymized or securely destroyed as appropriate.
7. Safeguards
Twenty Arms uses administrative, technical and organizational safeguards appropriate to the sensitivity of the information. No public website or ordinary email system can be guaranteed secure. Sensitive diligence material should be sent only through the process designated by Twenty Arms for the specific request.
Where PIPEDA applies, Twenty Arms will assess security incidents and will report a breach to the Office of the Privacy Commissioner of Canada, notify affected individuals and retain breach records when required by law, including where a breach creates a real risk of significant harm.
8. Cookies and analytics
The website uses necessary cookies and security technologies and currently loads a Google tag for site measurement. Google may receive technical information such as IP address, device and browser data, page interactions and cookie identifiers, depending on browser and consent settings. Browser settings can be used to limit cookies, although some site functions may be affected. This section should be reviewed whenever analytics, advertising or customer-management services change.
9. Marketing communications
Twenty Arms may send commercial electronic messages only with consent or another lawful basis and in accordance with Canada’s Anti-Spam Legislation where applicable. Such messages will identify the sender and include an unsubscribe mechanism. Transactional, security, legal or requested communications may still be sent where permitted.
10. Access, correction, withdrawal and complaints
Subject to applicable law, an individual may request access to or correction of personal information held by Twenty Arms and may withdraw consent for a consent-based use, subject to legal, contractual and recordkeeping restrictions. Requests should identify the individual and the relevant interaction so the Company can respond appropriately. We may need to verify the requester’s identity. Where PIPEDA applies, we will generally respond within its ordinary 30-day period, subject to permitted extensions. Concerns may be directed to the Privacy Officer at askus@twentyarms.com; an individual may also have the right to complain to the Office of the Privacy Commissioner of Canada or another applicable regulator.
11. Children
The website is intended for business users and is not directed to children. Twenty Arms does not knowingly solicit personal information from children through the website.
12. Updates and contact
This notice may be updated to reflect changes in practices or legal requirements. Questions, complaints and privacy requests may be sent to askus@twentyarms.com.
Effective date: 29 August 2026.