Privacy Policy

Last updated: September 20, 2026

Eco Spas is committed to protecting the privacy of our customers and website visitors. This policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights under applicable law.

This policy applies to personal information collected by Eco Spas through our website (ecospas.ca), by phone, by email, and in person at our showrooms. It is written in compliance with Alberta's Personal Information Protection Act (PIPA, SA 2003, c P-6.5) and, where applicable, Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Who We Are

Eco Spas ("Eco Spas," "we," "us," or "our") is a Canadian company that manufactures, sells, and delivers HDPE hot tubs. Our principal place of business is 260300 Writing Creek Crescent, Balzac, Alberta. We are responsible for the personal information we collect and hold. Our Privacy Officer can be reached using the contact information in Section 14.

2. What Personal Information We Collect

We collect only the personal information that is necessary for the purposes described in this policy. Depending on your interaction with us, this may include:

Category	Examples
Identity	Full name
Contact	Email address, phone number, mailing or delivery address
Transaction	Products ordered, delivery details, quotes requested, payment records (amount, method — not full card numbers)
Communications	Emails, texts, or notes from phone calls between you and Eco Spas
Location	City or region (to determine delivery eligibility and proximity to showrooms)
Technical	IP address, browser type, pages visited, time on site, device type — collected automatically via Google Analytics (anonymized; does not identify you personally)

We do not collect sensitive personal information such as financial account numbers, social insurance numbers, health information, or government-issued ID numbers.

3. How We Collect It

We collect personal information in the following ways:

• Directly from you — when you fill out a quote request form on our website, call or email us, visit a showroom, or sign a purchase agreement.
• Automatically — when you visit ecospas.ca, our website analytics tools (Google Analytics 4) collect technical data about your visit. See Section 8.
• From third parties — in limited circumstances, such as when a third party (e.g. a contractor or dealer) refers you to us and provides your contact details with your knowledge.

4. Why We Collect It — Purposes

We collect and use personal information only for the following purposes, which we identify at or before the time of collection:

• To respond to your inquiry or quote request.
• To process, fulfill, and deliver your order.
• To communicate with you about your order, delivery, or installation.
• To process payment and maintain transaction records.
• To administer and honour warranty claims.
• To send you information about Eco Spas products, promotions, and events — only where you have consented or where we have an existing customer relationship and you have not opted out.
• To improve our website, products, and services using aggregated, anonymized analytics data.
• To comply with our legal obligations (e.g. tax record-keeping).

We will not use your personal information for any new purpose without first identifying that purpose and, where required, obtaining your consent.

5. Consent

Express consent is obtained when you submit a quote request form, sign a purchase agreement, or explicitly agree to receive marketing communications.

Implied consent applies where the purpose is obvious and consistent with the transaction — for example, we use your delivery address to arrange delivery of the product you purchased. No further consent is required for this.

Withdrawing consent. You may withdraw your consent to any use of your personal information at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may mean we are unable to provide you with certain services. To withdraw consent, contact our Privacy Officer (see Section 14).

Marketing opt-out. You may opt out of marketing communications at any time by replying "UNSUBSCRIBE" to any email from us or by contacting us directly. We will process your opt-out within 10 business days.

6. How We Use and Disclose Your Information

We do not sell, rent, or trade your personal information. We will not disclose your personal information to any third party except in the following circumstances:

• Service providers — companies that help us operate our business, such as delivery carriers and payment processors. These providers are bound by confidentiality obligations and are permitted to use your information only to perform services on our behalf. See Section 7.
• Legal requirement — if we are required by law, court order, or government authority to disclose your information.
• Business transfer — if Eco Spas is sold, merged, or restructured, your information may be transferred as part of that transaction. We will notify you in advance if your information will be subject to a materially different privacy policy.
• With your consent — in any other circumstance where you have expressly consented to the disclosure.

7. Third-Party Service Providers

We currently work with the following categories of third-party service providers who may handle your personal information:

Provider	Purpose	Data shared
Delivery carriers	Transporting your hot tub to your property	Name, delivery address, phone number
Payment processors	Processing credit card or e-transfer payments	Amount, payment method (card data processed directly by the processor; we do not store card numbers)
Google LLC	Google Analytics 4 — website analytics; Google Tag Manager — tag delivery	Anonymized usage data (IP addresses are anonymized; see Section 8)
Email / communication platforms	Sending and receiving emails related to your order or inquiry	Name, email address, message content

We take reasonable steps to ensure that our service providers provide a comparable level of protection to the personal information they handle on our behalf.

Some providers (including Google) may store data on servers located outside Canada. By using our website, you consent to the transfer of your anonymized analytics data to the United States where Google's servers are located, subject to Google's privacy policy.

8. Cookies and Analytics

What we use. Our website uses the following tools that collect information automatically:

• Google Analytics 4 (GA4) — tracks page views, session duration, user flow, device type, and general geographic region (city level). IP addresses are anonymized. Data is retained in Google Analytics for 14 months.
• Google Tag Manager (GTM) — a tag management container that deploys analytics scripts. It does not itself store personal data.

Cookies. Google Analytics uses first-party cookies (stored in your browser) to distinguish returning visitors and track session data. These cookies do not contain your name or contact information.

Opting out of analytics. You may opt out of Google Analytics tracking across all websites by installing the Google Analytics Opt-out Browser Add-on. You can also disable cookies in your browser settings, though this may affect website functionality.

We do not use advertising cookies, cross-site tracking, remarketing pixels, or third-party behavioural advertising on this website.

9. How Long We Keep Your Information

We retain personal information only as long as necessary to fulfil the purposes for which it was collected, or as required by law. In general:

• Customer records (purchase agreements, delivery records, warranty documentation) — retained for 7 years following the transaction to satisfy tax, accounting, and warranty obligations.
• Quote inquiries that did not result in a purchase — retained for 12 months, then securely deleted.
• Marketing consent records — retained for as long as the consent is active and for 2 years after opt-out, to demonstrate compliance.
• Website analytics data — retained by Google Analytics for 14 months (as configured in our GA4 property), then automatically deleted by Google.

When personal information is no longer required, we destroy it securely or render it anonymous.

10. How We Protect Your Information

We take the security of your personal information seriously and implement safeguards appropriate to the sensitivity of the information. These include:

• HTTPS encryption on all pages of ecospas.ca.
• Limiting access to personal information to employees and contractors who need it to perform their job.
• Using password-protected systems and cloud services with industry-standard security practices for storing customer records.
• Not storing full payment card numbers — card transactions are handled directly by our payment processor.

No method of data transmission or storage is 100% secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security. In the event of a security breach that creates a real risk of significant harm, we will notify affected individuals and the Office of the Information and Privacy Commissioner of Alberta as required by PIPA.

11. Your Rights

Under Alberta's PIPA, you have the following rights with respect to your personal information held by Eco Spas:

• Right of access. You may request a copy of the personal information we hold about you. We will respond within 45 days of receiving a written request, or notify you if an extension is needed.
• Right of correction. If you believe your personal information is inaccurate or incomplete, you may request that we correct it. We will make the correction or, if we disagree, note your request in your file.
• Right to withdraw consent. As described in Section 5, you may withdraw consent to any non-mandatory use of your information at any time.
• Right to complain. If you believe we have handled your personal information in a manner that does not comply with PIPA, you may file a complaint with the Office of the Information and Privacy Commissioner of Alberta (OIPC) at oipc.ab.ca or by calling 780-422-6860. We ask that you contact us first so we can attempt to resolve the matter directly.

To exercise any of these rights, contact our Privacy Officer at the address in Section 14. We may need to verify your identity before processing your request.

12. Children

Our website and services are directed at adults. We do not knowingly collect personal information from individuals under the age of 18. If you believe we have inadvertently collected information from a minor, please contact us immediately and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

For significant changes that affect how we use information you have already provided, we will notify you directly where we have contact information on file.

14. Contact — Privacy Officer

For questions, access requests, correction requests, complaints, or to withdraw consent, please contact our Privacy Officer:

If you are not satisfied with our response, you may escalate your complaint to the Office of the Information and Privacy Commissioner of Alberta: