Privacy Policy

Effective date: October 8, 2026

Who we are

The Retail Cannabis Council of Ontario (“RCCO”, “we”) is a registered non-profit that represents independent cannabis retailers in Ontario. We are responsible for the personal information we collect through rccontario.com, and we handle it in line with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

Mailing address: 150 York Street, Unit 801, Toronto, ON M5H 3S5

What we collect and why

We only collect what you choose to give us through the forms on this site.

• Membership applications. Your name, email address and phone number; your store name, and optionally the legal business name, address, city, postal code and website; whether you are the owner/operator; and, for retailer applications, your Cannabis Retail Operator Licence (CROL) and Cannabis Retail Store Authorization (CRSA) numbers. You can also add a message. We use this to review your application, confirm your licences, contact you about your membership and keep our member records. When our staff review an application they record the decision, the date, who reviewed it and any notes.
• Contact form. Your name, email address, organization (optional), subject and message, so we can read and answer your enquiry.
• Newsletter sign-up. Your email address, so we can send you the RCCO newsletter.

We do not collect payment information on this site today. We do not use this website to track you for advertising, and we do not sell, rent or trade personal information.

Your consent

By submitting a form, you agree to us using your information for the purpose described above. We will ask for your consent again before using it for anything new. You can withdraw your consent at any time (see below), although we may then be unable to process a membership application or keep your membership active.

How we use it

• Membership review. When you apply, we send you an acknowledgement email and send a copy of your application to RCCO’s staff inbox so it can be reviewed. If you are approved we email you a confirmation.
• Member communications. If you tick the newsletter box on the membership application, we add you to our mailing list so we can keep you informed about RCCO’s advocacy, events and membership. The box is not ticked for you, and we record when you ticked it. If you leave it unticked, we only email you about your application and membership.
• Newsletter. We use your email address only to send the newsletter. When you sign up on the website, Mailchimp emails you a link to confirm, and you are only added once you click it. Every newsletter includes an unsubscribe link.
• Records. RCCO staff can download a list of approved members for membership administration.

Who we share it with

We share personal information only with service providers that help us run the site and communicate with you, and only as much as they need to do that job:

• Website hosting: Laravel Cloud, which runs on Amazon Web Services. Our site and database are hosted in Canada (Central).
• Email delivery: Resend, which sends the website’s emails, and Google Workspace, which hosts RCCO’s own mailboxes (including the staff inbox that receives applications).
• Mailchimp (Intuit Mailchimp), which we use to send our newsletter and member communications. For approved members we share name, email address, phone number, business name and city.

We may also disclose information where the law requires it.

Storage outside Canada

Some of our service providers, including Mailchimp and Resend, are based in the United States or store information there. We use providers that commit to protecting the information they hold for us, but information stored outside Canada is subject to the laws of the country where it is stored and may be accessible to courts and authorities there.

How long we keep it

We keep membership records for as long as you are a member and for 2 years after your membership ends. Applications we do not approve are kept for 1 year. Contact-form messages are kept for 1 year. Newsletter sign-ups are kept until you unsubscribe or ask us to remove you. After that, we delete the information or make it anonymous.

How we protect it

The site is served over an encrypted (HTTPS) connection. Membership records can only be viewed by RCCO staff who sign in to a password-protected area, and passwords are stored in a scrambled (hashed) form, never as plain text. We limit access to the people who need it. No system is perfectly secure, but we take reasonable steps to protect your information and will tell you if a breach puts you at real risk of significant harm, as the law requires.

Cookies

This site uses only the cookies it needs to work: a session cookie and a security cookie that protects the forms from misuse. They do not track you across other sites and are removed when they expire. We do not use analytics or advertising cookies.

Some pages load content from Google: the site’s fonts come from Google Fonts, and the Resources page includes an embedded Google map. When your browser loads these, Google receives your IP address and may set its own cookies under Google’s privacy policy. Links to LinkedIn, Instagram and other sites take you to services with their own privacy practices.

Your rights: access, correction and withdrawal

You can ask us to:

• tell you what personal information we hold about you and how we have used it;
• correct information that is wrong or out of date;
• stop sending you newsletters or member communications; or
• delete your information, where we don’t need to keep it.

Email us at the address below. We may need to confirm your identity first, and we will respond within 30 days. If you are not satisfied with our answer you can contact the Office of the Privacy Commissioner of Canada.

Questions and contact

Our privacy contact is Caroline Huard. You can reach them at info@rccontario.com or by mail at the address above.

Changes to this policy

If we change how we handle personal information we will update this page and its effective date. If a change is significant, we will let members know.