Effective date: July 27th 2026 Last updated: July 27th 2026
Nic-Hit International Inc. (“NIC-HIT”, “we”, “us”) sells nicotine replacement therapy products regulated by Health Canada. This policy explains how we collect, use, disclose, retain, and protect personal information.
Registered address: 1950 boul. des Laurentides, Laval, Quebec H7M 2Y5, Canada
Website: https://nic-hit.ca
We are subject to Quebec’s Act respecting the protection of personal information in the private sector. The Personal Information Protection and Electronic Documents Act (PIPEDA) may also apply to interprovincial or international transactions involving personal information and in other circumstances governed by federal law.
2. Privacy Officer
In accordance with Quebec Law 25, we have designated a person responsible for the protection of personal information:
Name: Jonathan Albanese
Title: President
Email: info@nic-hit.ca
Mail: 1950 boul. des Laurentides, Laval, Quebec H7M 2Y5, Canada
The person exercising the highest authority is the Privacy Officer by default unless the function has been delegated in writing. The title and contact information above must be published on the website.
Privacy governance. NIC-HIT maintains policies and practices governing the protection of personal information, including retention and destruction, employee roles and access, complaint handling, confidentiality incidents, service-provider oversight and privacy impact assessments. These practices are approved by the Privacy Officer and reviewed periodically.
3. Information we collect
3.1 Website visitors
• Pages viewed, time on site, referring source, approximate location derived from IP address
• Device and browser type
• Information you voluntarily submit through contact or enquiry forms (name, email, message)
• Store locator queries (approximate location or postal code, if you provide it)
3.2 Customers who purchase directly from us
• Name, shipping and billing address, email address, telephone number
• Order contents, order history, and transaction records
• Payment confirmation details (we do not store full payment card numbers — see Section 7)
3.3 Customers who purchase through Amazon
When you buy NIC-HIT products through Amazon, Amazon collects and processes your information under Amazon’s privacy notice and marketplace terms. Depending on the fulfilment method and NIC-HIT’s approved Amazon access, Amazon may provide us with limited information needed for merchant-fulfilled shipping or applicable tax, regulatory and recordkeeping obligations. This may include order details, the customer’s or recipient’s name, delivery address and an Amazon-generated contact identifier. Where Amazon fulfils the order, Amazon generally handles delivery information directly. NIC-HIT may access permitted information through Amazon Seller Central and, if implemented and authorized, the Amazon Selling Partner API (SP-API).
We do not receive or store full payment-card information from Amazon. Payments made through Amazon are processed through Amazon’s systems.
3.4 Health-related information
We do not require you to disclose health information to purchase our products. If you voluntarily provide health information for example, when contacting us with a question about product use or a suspected adverse reaction, we treat it as sensitive personal information subject to heightened protection and use it only to respond to your enquiry and, where applicable, to comply with legal or regulatory reporting obligations.
We do not use health information for marketing, and we do not sell it under any circumstances.
4. How we use personal information
| Purpose | Information used |
| Processing and fulfilling orders | Contact, address, order details |
| Customer service and product enquiries | Contact details, order history, correspondence |
| Regulatory compliance and adverse-event reporting | Contact details, product details, any reported reaction |
| Website operation, security, and improvement | Technical and usage data |
| Marketing communications (with consent) | Email address, purchase history |
| Advertising performance measurement | Aggregated and de-identified campaign data |
| Fraud prevention and legal obligations | As required |
We do not sell personal information.
5. Consent
We collect, use, and disclose personal information with your knowledge and consent, except where permitted or required by law.
Express consent is obtained for marketing communications and for any collection of sensitive information. Implied consent applies where the purpose is evident and the information is provided voluntarily — for example, providing a shipping address to receive an order.
You may withdraw consent at any time, subject to legal and contractual restrictions, by contacting our Privacy Officer. Withdrawal may limit our ability to provide certain services. Marketing emails include an unsubscribe link in every message.
6. Regulatory and adverse-event reporting
Our products are licensed natural health products regulated by Health Canada. If you report a suspected adverse reaction, we are legally required to record and report certain details to Health Canada and, where applicable, to the product’s manufacturer or importer.]
Adverse-event records are retained as required by applicable regulations and are not subject to deletion on request during the mandated retention period.
7. Service providers and disclosure
We share personal information only as necessary, with:
• Payment processors —STRIPE. Card details are collected and processed directly by the processor; we do not receive or store full card numbers.
• Shipping and logistics providers — for delivery.
• Amazon — where you purchase through Amazon.ca.
• Website hosting and analytics providers — [HOSTING PROVIDER], [Google Analytics].
• Professional advisers — legal, accounting, and regulatory consultants, bound by confidentiality.
We use written agreements or applicable platform terms requiring service providers to protect personal information, limit its use to authorized purposes, report confidentiality incidents and securely return or destroy information when the service ends, as required by applicable law.
We may also disclose personal information where required by law, court order, or regulatory authority, or to protect our legal rights.
8. Storage location and cross-border transfers
Personal information may be stored or processed outside Quebec and outside Canada, including in the United States, where our hosting, analytics, and marketplace service providers operate.
Information stored outside Canada may be accessible to foreign courts, law enforcement, and regulatory authorities under the laws of that jurisdiction.
In accordance with Quebec Law 25, we conduct a privacy impact assessment before transferring personal information outside Quebec and enter into written agreements requiring adequate protection.
You may contact our Privacy Officer for information about where your personal information is stored.
9. Security safeguards
We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including:
• Encryption in transit using TLS 1.2 or higher
• Encryption at rest for stored personal information
• Role-based access controls limiting access to personnel who require it
• Multi-factor authentication on systems containing personal information
• Logging and monitoring of access to personal information
• Secure credential management — API keys and access tokens are stored in a dedicated secrets manager, never in source code or configuration files
• Periodic review of security practices and access rights
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Retention and deletion
We retain personal information only as long as necessary for the purposes identified, or as required by law.
| Category | Retention |
| Order and transaction records | 7 years (tax and commercial law) |
| Marketplace customer data retrieved via API | Deleted within 30 days of order fulfilment, except where retention is required for tax, legal, or regulatory purposes |
| Adverse-event reports | As required by Health Canada regulations |
| Enquiry correspondence | [PERIOD] after resolution |
11. Your rights
Under PIPEDA and Quebec Law 25, you have the right to:
• Request access to the personal information we hold about you, subject to applicable legal restrictions.
• Request correction of inaccurate, incomplete or equivocal information.
• Withdraw consent to the collection, use or disclosure of personal information, subject to legal and contractual restrictions.
• Request correction or deletion where the collection, communication or retention of personal information is not authorized by law, subject to applicable retention obligations.
• Request computerized personal information collected from you in a structured, commonly used technological format, subject to the conditions and exceptions established by law; this does not include information created or inferred by NIC-HIT.
• Request that NIC-HIT cease disseminating personal information or de-index a hyperlink where the statutory conditions are met.
• Where a decision about you is based exclusively on automated processing, be informed of that fact, request the information required by law and submit observations to a member of our personnel who is able to review the decision.
To exercise a right, contact our Privacy Officer at info@nic-hit.ca. We will respond within 30 days. We may request verification of your identity before acting.
If you are not satisfied with our response, you may file a complaint with:
• Commission d’accès à l’information du Québec — cai.gouv.qc.ca
• Office of the Privacy Commissioner of Canada — priv.gc.ca
12. Automated decision-making
We do not make decisions about you based exclusively on automated processing of your personal information.”
13. Cookies and tracking
Our website uses cookies and similar technologies to operate the site, remember preferences, and measure performance.
| Type | Purpose | Consent |
| Strictly necessary | Site function, security, cart | Not required |
| Performance and analytics | Understanding site usage | Required |
| Marketing | Advertising measurement | Required |
Non-essential cookies are set only with your consent, obtained through our cookie banner. You may change your preferences at any time via website (Home- Page) or through your browser settings
Under Quebec Law 25, technologies that identify, locate, or profile you are deactivated by default.
14. Age restriction
Our products are intended for adults 18 years of age or older (19 in some provinces). We do not knowingly collect personal information from minors. If we learn that we have collected information from a minor, we will delete it promptly.
We do not direct marketing to minors.
15. Breach notification
If a confidentiality incident presents a risk of serious injury, we will:
• Notify affected individuals promptly
• Notify the Commission d’accès à l’information du Québec and, where applicable, the Office of the Privacy Commissioner of Canada
• Maintain a register of confidentiality incidents as required by Law 25
• Take reasonable measures to reduce risk of injury and prevent recurrence
We maintain a register of all confidentiality incidents as required by law. If an incident presents a risk of serious injury, we will promptly notify affected individuals and the Commission d’accès à l’information du Québec and, where applicable, the Office of the Privacy Commissioner of Canada. We will take reasonable measures to reduce the risk of injury and prevent similar incidents.
16. Third-party integrations and application programming interfaces
We operate internal reporting integrations that retrieve our own business data from third-party platforms, including the Amazon Advertising API and the Amazon Selling Partner API.
NIC-HIT may use internal systems or authorized service providers that connect to Amazon services, including Amazon Seller Central, the Amazon Selling Partner API (SP-API) and the Amazon Advertising API.
Purpose. Amazon integrations may be used to retrieve information concerning NIC-HIT’s products, listings, inventory, sales, payments, shipments, advertising campaigns and order records for permitted purposes such as order administration, merchant-fulfilled shipping, internal business analysis, inventory planning, advertising measurement and applicable tax, regulatory or recordkeeping obligations. Amazon customer personal information is not used for off-Amazon marketing, audience building or unrelated promotional purposes.
Data accessed. The Amazon Ads API may provide campaign and performance information, such as campaigns, impressions, clicks, advertising costs and attributed sales. SP-API may provide product, listing, inventory, payment, shipment, sales and order information. Where NIC-HIT has the required Amazon authorization and the information is necessary for merchant-fulfilled shipping or a legal obligation, SP-API may also provide limited customer or recipient information, such as a name and delivery address. NIC-HIT does not receive full payment-card information from Amazon.
Handling. Data retrieved through these integrations is:
• Amazon customer PII is used only for purposes permitted by Amazon and applicable law.
• Amazon customer PII is not used for off-Amazon marketing, audience building or unrelated promotional purposes.
• Information retained beyond 30 days after delivery for a legal obligation is isolated, protected and used only for that obligation.
• The technical controls listed in this section must be verified against NIC-HIT’s actual architecture and Amazon’s current Data Protection Policy.
Credentials for these integrations are stored in a dedicated secrets manager with restricted access and are rotated periodically.
No independent relationship. These integrations do not create any relationship between you and our service providers beyond the purchase you have made. Amazon’s collection and processing of information are governed by Amazon’s privacy notice and marketplace terms. NIC-HIT remains responsible for protecting the personal information it receives or retrieves from Amazon.
17. Changes to this policy
We may update this policy from time to time. The effective date at the top indicates when it was last revised. Material changes will be communicated through our website and, where appropriate, by email.
18. Contact
Nic-Hit International Inc.
1950 boul. des Laurentides
Laval, Quebec H7M 2Y5 Canada
Email: info@nic-hit.ca
General: info@nic-hit.ca
Telephone: 1-888-929-0835