Privacy Policy

Last updated: September 17, 2026

smashscrap.ca Ltd (“SMASH”, “we”, “our” or “us”) is the data controller responsible for the personal information collected through this website. SMASH buys catalytic converters directly from sellers and uses the submitted information to prepare an offer, arrange shipping, inspect the shipment, and complete payment if the seller accepts. We are committed to protecting your privacy in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, US state privacy laws.

This policy applies to this direct-purchase website. Other public websites owned and operated by smashscrap.ca Ltd may collect and use information for different services as described on those sites.

1. Information We Collect

When you submit a form on this site, we collect:

• Contact Information: Name, phone number, email address.
• Vehicle Information: VIN, year, make, model, trim, mileage, condition, and related details.
• Scrap Material Information: Types of scrap, estimated weight, and preferences.
• Location Information: Address for pickup or inspection purposes.
• Photos: Images of vehicles or scrap materials you upload.
• Technical Data: IP address, browser type, device information, and referring URL collected automatically through server logs and through the analytics service described in Section 10.

If you create a seller account on this site and complete identity verification, we also collect:

• Identity Documents: An image of a government-issued photo ID (such as a driver’s licence or passport) that you upload.
• Selfie Photo: A photo of your face, taken with your device camera at the time of verification. If the page cannot open your camera, it falls back to your device’s own photo picker, which asks for the camera but on some devices also lets you choose an image you already have.

We collect these to confirm that you are the person named on the account and to prevent fraud; until a photo ID and selfie are approved, buyer messages on your account stay locked. They are stored privately and reviewed by our staff. We do not run facial recognition or any other automated biometric matching on them, and we do not share them with anyone outside SMASH except where Section 4 says we may.

2. Legal Basis and Consent

We collect and process your personal information based on your express consent, provided when you check the consent box and voluntarily submit a form on this website. Your consent covers the specific purposes described in Section 3 of this Policy.

You may withdraw your consent at any time by contacting us using the information below. Withdrawing consent may affect our ability to process your request. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

3. How We Use Your Information

We use your information to:

• Process and evaluate your submission.
• Identify and price the catalytic converter(s) in your request.
• Send and administer an offer you request from SMASH.
• Arrange prepaid shipping, inspect the received shipment, and complete payment if you accept the offer.
• Communicate with you about your submission and any offers.
• Verify the identity of seller-account holders, where you have created an account.
• Maintain the security of our website and prevent abuse.
• Improve our services and user experience.
• Comply with legal obligations and prevent fraud.
• Enforce our Terms of Service.

4. Information Sharing

We may share your information with:

• Operational Service Providers: Providers that help us host the service, communicate with you, verify submitted information, arrange shipping, inspect shipments, or process payment. They may use the information only to perform services for SMASH under appropriate safeguards.
• Google: Google Analytics receives the usage and device information described in Section 10 directly from your browser. If you use the address field on one of our forms, what you type into it is sent to Google Maps so it can suggest matching addresses. Unlike the providers above, Google is not limited to purposes we specify: it handles this information under its own privacy terms.
• Legal Requirements: When required by law, court order, government investigation, or to protect our legal rights, safety, or property.

We do not sell your personal information to third parties for marketing purposes.

5. SMS/Text Messaging Program

If you consent to receive SMS/text messages from us (by checking the SMS consent box on our forms), we may send service-related messages from 1-855-762-7474 (1-855-SMASH-74) or 343-337-6274 (343-33SMASH), including:

• Quote follow-ups related to your request.
• Scheduling and shipping coordination.
• Customer care and support related to your request.

Transactional SMS consent is required to use this text-based converter quote service. It covers messages about your requested quote, shipping, and payment. Marketing SMS consent is optional and is not a condition of purchase or service. The two choices are presented separately on the quote form.

Message frequency varies. Message and data rates may apply.

You may opt out at any time by replying STOP to any message. Reply HELP for assistance.

No mobile information, SMS consent data, or text messaging originator opt-in data will be shared with third parties or affiliates for their marketing or promotional purposes. We may share information with service providers that help deliver SMS (e.g., messaging vendors, telecom providers) under appropriate restrictions.

For full details, see our SMS Terms & Conditions.

6. Cross-Border Data Transfers

Our servers and some of our service providers are located in the United States. If you are a Canadian resident, your personal information may be transferred to, stored, and processed in the United States or other jurisdictions outside of Canada. Personal information stored outside of Canada may be subject to the laws of that jurisdiction, including lawful access by courts, law enforcement, and government authorities.

By submitting your information, you consent to this transfer. Regardless of where your information is processed, smashscrap.ca Ltd remains responsible for personal information under our control and ensures it receives a comparable level of protection consistent with the requirements of PIPEDA.

7. Data Security

We implement reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information we collect, including encrypted data transmission (HTTPS/TLS) for all pages and form submissions.

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security.

8. Data Retention

We retain your information for as long as necessary to fulfill the purposes described in this policy and to meet our legal, audit, and dispute-resolution obligations. How long that is varies by the type of information and why we hold it. Removal is carried out by our staff rather than on an automated schedule, so a submission — including any identity documents and selfie described in Section 1 — stays on file until it is deleted on request or in a manual review.

You may ask us to delete your data at any time by contacting our Privacy Officer at privacypolicy@smashscrap.ca (Section 16). We will acknowledge your request and delete or anonymize your personal information unless we are required by law to keep it.

9. Your Rights

Depending on your jurisdiction, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Withdraw Consent: Withdraw your consent to processing at any time.
• Portability: Where technically feasible, request your data in a portable format.
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada or your applicable data protection authority.

We will respond to all rights requests within thirty (30) days. If we need additional time, we will notify you of the reason and expected timeline.

10. Cookies, Analytics and Tracking

This site uses cookies necessary for form functionality (such as CSRF protection and session management). Server logs automatically collect standard technical information for security and operational purposes.

Our public pages also load Google Analytics 4 (GA4), a third-party analytics service operated by Google. It loads automatically for all visitors as soon as a page opens; there is no cookie banner or consent prompt on this site, and the only way to stop it is through your own browser or device settings. GA4 sets its own cookies and sends Google the pages you view, the site or search that referred you, your browser, device and screen details, and an approximate location derived from your IP address. We use this to measure traffic and improve the site. Google processes that data under its own privacy terms.

Our forms also use Google Maps Places to suggest addresses. It loads only when you click into the street-address field, and from that point what you type into that field is sent to Google so it can offer matching addresses. Google handles it under its own privacy terms. If you would rather not use it, type your address without accepting a suggestion.

11. Children’s Privacy

Our services are not directed to individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will take steps to promptly delete it.

12. Breach Notification

In the event of a data breach that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, in accordance with PIPEDA’s mandatory breach reporting requirements. Notification will include a description of the breach, the types of information involved, and steps you can take to mitigate potential harm. We maintain records of all security incidents involving personal information, whether or not they meet the threshold for notification, as required under PIPEDA.

13. Canadian Privacy Law (PIPEDA)

For Canadian users, we comply with PIPEDA and its ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance. Our Privacy Officer oversees compliance. You have the right to access your personal information held by us and to challenge its accuracy.

14. US State Privacy Rights

If you are a resident of California or another US state with applicable privacy legislation, you may have additional rights, including:

• The right to know what personal information we collect, use, and disclose.
• The right to request deletion of your personal information.
• The right to opt out of the sale of your personal information (we do not sell personal information).
• The right to non-discrimination for exercising your privacy rights.

To exercise any of these rights, contact us using the information below.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Material changes will be highlighted or communicated through the website. Your continued use of the website after changes are posted constitutes acceptance of the revised policy.

16. Contact Us

For privacy-related inquiries, to exercise your rights, or to contact our Privacy Officer:

Email: privacypolicy@smashscrap.ca
General: info@smashscrap.ca
Toll-Free: 1-855-762-7474 (1-855-SMASH-74)