Privacy Policy

Bylands Customer Portal · Bylands Nurseries Ltd. · Effective September 10, 2026 · Version 1.0

This policy explains what personal information Bylands Nurseries Ltd. ("Bylands", "we", "us") collects when you use the Bylands Customer Portal (the "Portal"), why we collect it, who we share it with, how long we keep it, and the choices you have. The Portal is a business tool for wholesale customers of Bylands and the people who order on their behalf.

What we collect

• Your login. Your name, your email address, and your password. We store the password only as a one-way hash that cannot be turned back into the password.
• Your customer account. Which Bylands customer your login belongs to, and the delivery addresses, prices and availability list that customer is set up with in our business system.
• Your requests. The plants, quantities, requested delivery date and delivery address you send us, and what happened to each request (approved, declined, cancelled).
• Activity. Sign-ins and failed sign-in attempts with the internet address (IP address) they came from, and a log of actions such as viewing your list, sending a request or cancelling one. We keep this to protect your account and to answer questions about a request.
• Technical records. Standard server logs kept by our hosting provider (Microsoft Azure) for security and reliability.

We do not collect payment card details on the Portal. We do not use analytics, advertising or tracking services on the Portal.

Why we use it

• To give you access to your availability list, your prices and your requests.
• To pass your requests to your Bylands sales representative and to create the corresponding sales documents in our business system.
• To email you about your login (invitation, password reset) and about your requests (approved, declined).
• To keep the Portal and your account secure, including locking a login after repeated failed sign-ins.
• To keep the business records the law and our customer agreements require.

We rely on your consent, given when you create your login, and on the business relationship between Bylands and the customer your login belongs to. We do not use Portal information for marketing.

Cookies and local storage

The Portal sets one cookie, __Host-Http-cp_sess, which keeps you signed in for up to 14 days and is deleted when you sign out. It is strictly necessary for the Portal to work and it is not used to track you across other sites. The Portal also saves the quantities you have typed but not yet sent in your browser's local storage, so a half-built order survives a refresh; that draft never leaves your browser until you send it. Your choices under Account, Availability list (how plants are named and which columns show) are kept there too, on that device only, and are never sent to us. Because we use no analytics or advertising cookies, the Portal does not show a cookie consent banner.

Who we share it with

• Your Bylands sales representative and Bylands staff who handle your requests and your account.
• Microsoft, which hosts the Portal (Microsoft Azure) and our business system (Microsoft Dynamics 365 Business Central) on our behalf. Data is held in Microsoft data centres in Canada and the United States.

We do not sell personal information and we do not share it with advertisers or data brokers. We may disclose information where the law requires it.

How long we keep it

• Your login, for as long as your customer has Portal access and your login is active. A disabled or deleted login is removed from the Portal.
• Sign-in and activity records, for 24 months.
• Session records, for up to 14 days; invitation links, 7 days; password reset links, 1 hour.
• Requests and the sales documents they become, as long as our normal business records are kept.

How we protect it

All Portal traffic is encrypted (HTTPS). Passwords are hashed with scrypt and never stored or emailed in readable form. Sign-in is locked after repeated failures. The Portal reaches our business system through a single service account with the minimum permissions it needs. Access to Portal information inside Bylands is limited to the people who work with your account.

Your choices and rights

You can change your name and password on the Account page at any time. You can ask to see the personal information we hold about you, ask us to correct it, or ask us to disable or delete your login, by contacting your sales representative or emailing website@bylands.com. We answer within 30 days. If you are not satisfied with our answer, you may contact the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.

If something goes wrong

If we learn of a security breach that creates a real risk of significant harm to you, we will notify you and the appropriate privacy commissioner as the law requires.

Business use only

The Portal is for businesses that buy from Bylands and the adults who order on their behalf. It is not intended for anyone under 19.

Changes

We may update this policy. The current version is always at this address, with its effective date at the top. If a change affects how we use your information, we will tell you on the Portal or by email.

Contact

This policy is governed by the Personal Information Protection Act (British Columbia) and, where it applies, the Personal Information Protection and Electronic Documents Act (Canada).