Luoma Works
Customer portal

Privacy Policy

Last updated: 23 October 2026

Luoma Works Corporation ("Luoma Works", "we") is an Alberta corporation based in Edmonton that imports goods from outside Canada for business customers. This policy explains what personal information we collect through our website (luomaworks.com) and customer portal (app.luomaworks.com), why we collect it, who sees it and what your rights are. It follows Alberta's Personal Information Protection Act (PIPA) and, where it applies, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Our customers are businesses. Most of the information we hold is about companies, orders and goods; the personal information is mostly the names and contact details of the people who work with us.

Who is responsible

Privacy officer: Ramon Eduardo Diaz Ramos, Director — contact@luomaworks.com, +1 (587) 335-5018. Write to him with any question, request or complaint about personal information.

What we collect

  • Contact and account information: name, business email, telephone, company and role, preferred language, and the portal's sign-in records (the email address you sign in with and the time).
  • Order information: suppliers, goods, prices, shipping and delivery details, and the documents you upload or we add to an order (product lists, quotes, Orders, invoices, payment slips, shipping and customs documents). These may contain personal information such as names, signatures and bank-transfer references.
  • Payment records: amounts, dates, payment method and the reference number of transfers you report. We do not collect card numbers. Payments are made by bank transfer to the account we confirm with you by telephone.
  • Messages you write in the portal or send to us by email or through the contact form.
  • Technical information: IP address, browser and device type, pages visited and the time, collected automatically in our hosting provider's logs to run and secure the service. The cookies we use are listed in the Cookie Notice.

We do not buy information about you, we do not build profiles of you and we do not sell personal information.

Why we use it

  • To provide the service: take your request, obtain quotes, prepare and sign the Order, import and deliver the goods, record payments and keep every document of the order in one place.
  • To communicate about your orders: the portal and our emails tell you when an order moves forward, when a payment is due or received, and when a document or message is added.
  • To meet legal obligations: customs and import records (Canada Border Services Agency), tax records (Canada Revenue Agency) and the record-keeping period in our agreement with you.
  • To keep the service secure: sign-in, access control, logs and fraud prevention.

We rely on the consent you or your company give when signing the Import and Supply Framework Agreement and when using the portal, and on the need to perform that agreement. Where the law allows us to use business contact information to reach you about your company's business, we do so without further consent.

Who we share it with

  • Service providers that store or process information for us, under contract and only for our purposes: Supabase (database, sign-in and file storage, hosted in Canada — Montréal region), Vercel (website and portal hosting; servers in the United States), Resend (delivery of our emails; United States), DocuSign (electronic signature of Orders) and our email provider.
  • Suppliers, freight forwarders and customs brokers, to the extent needed to place, ship, clear and deliver your order (for example a delivery address and a contact name).
  • Authorities when the law requires it, for example the Canada Border Services Agency or the Canada Revenue Agency.
  • Professional advisers (accountant, lawyer) bound by confidentiality.

Information outside Canada

Your information is stored in Canada. Some service providers process it in the United States (website hosting and email delivery), where it is subject to the laws of that country. Under Alberta's PIPA you may ask our privacy officer for written information about our policies and practices regarding service providers outside Canada.

How long we keep it

  • Order records, invoices, payment and customs documents: at least 6 years after the end of the year in which the order was completed, as our agreement and Canadian tax and customs law require.
  • Account information: while your company is our customer and for 1 year after.
  • Messages and website enquiries: up to 2 years.
  • Technical logs: 30 days, unless needed to investigate an incident.

How we protect it

Encryption in transit and at rest; sign-in by one-time email links instead of passwords; access limited by role, so a customer sees only its own company's orders; a record of changes on every order; service providers chosen for their security certifications. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify you and the Office of the Information and Privacy Commissioner of Alberta, as the law requires.

Your rights

You may ask to see the personal information we hold about you, to correct it, and to learn how it has been used and to whom it has been disclosed. You may withdraw consent, subject to legal and contractual limits: we may then be unable to continue the service, and records we must keep by law remain. Write to the privacy officer; we respond within 45 days. If you are not satisfied, you may complain to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Other points

Our service is for businesses and is not intended for anyone under 18. We do not send marketing email without your express consent; every message we send identifies us and says how to stop receiving it. We may update this policy; the date at the top changes, and important changes are announced in the portal.