Privacy Policy
This policy explains how EnoLight Ltd. (“EnoLight”, “we”), of Markham, Ontario, collects, uses, discloses and protects personal information through enolight.com, in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s private-sector privacy law and the US laws that apply to us. Personal information is information about an identifiable individual.
What personal information do we collect?
When you send us an enquiry or quote request, apply to become an affiliate or for a job, or make a payment on our site, we ask for the details that request needs, such as your name, company, email address, phone number and message.
When you make a payment on our Pay page, we keep a record of it: the order or invoice number, the amount, the cardholder’s name, the card type, the last four digits of the card, the result of the transaction, and the IP address the payment was started from, which helps prevent fraud. Your full card number and security code go directly to our payment processor, Helcim, and never reach our servers.
When you send us a form, we also record where it was sent from: the page, the website that led you to it, your device type (desktop, mobile or tablet) and your approximate location — country and state or province and, when analytics is allowed for your visit, city and postal code — derived from your IP address. We do not store your IP address with it.
When you browse our website we also collect information about how it is used, as described under “Website analytics” below.
How do we use your information?
We use the information we collect to:
• answer your enquiries and quote requests, and follow up with you by email or phone;
• consider your affiliate or job application;
• process payments made on our Pay page and keep records of them;
• send order- and support-related text messages (see “SMS Messaging”);
• understand which products, documents and pages interest our visitors and which of them led to an enquiry, and improve our website;
• keep our website and forms secure against spam and fraud;
• meet our legal, tax and accounting obligations.
SMS Messaging
When you give us your phone number in our contact or quote request form, you agree to receive order- and support-related text messages (SMS/MMS) from EnoLight about your request. Consent is not a condition of purchase, and we do not send marketing texts. Message frequency varies. Message and data rates may apply. Reply STOP at any time to opt out, or HELP for help. Carriers are not liable for delayed or undelivered messages.
No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Text-message opt-in data and consent are never shared with any third party.
Website analytics
We measure how our website is used so that we can improve it and understand which products interest our customers. When analytics is allowed for your visit (see “How does our site handle Do Not Track signals?” and “Opting out” below), our website records:
• the pages you view and how you arrived — the referring website and campaign tags such as utm_source;
• how you use each page — the links and buttons you click and where on the page you click, the files you download, the searches you run in our catalog, how far you scroll and how long the page is in view;
• which of our forms you start and submit — the names of the fields you use, never what you type into them;
• videos you start, page-speed measurements and technical errors;
• your device type, browser, operating system, window size, language, the User-Agent string your browser sends, and your approximate location (country, state or province, and city), derived from your IP address.
We collect this with our own code and store it in our own database. We do not store your IP address with it. A first-party cookie named eno_vid holds a random identifier so that we can recognise your browser on later visits; it contains no personal details.
Visitors from places where we ask for consent first — including Quebec, and everywhere outside the United States and Canada — are not measured this way unless they accept our cookie banner. In California and Pennsylvania our own statistics work as in the rest of the United States, but Google Analytics and Microsoft Clarity are used only if you choose “Allow all” on our banner. If your browser sends a Global Privacy Control or Do Not Track signal, we only count the page you view, without any identifier.
Our web server also logs every request it receives, as web servers do: the page or file requested, the time, the response, the referring page, your IP address and your browser’s User-Agent. We use these logs for security and troubleshooting, and to count visits to our pages and files, missing pages, redirects and visits by search engines and other bots — for every visitor, including those who are not measured as described above, since the counts use nothing stored in your browser (except that visits from EnoLight staff devices are left out). For each request the counts keep the page, the time, the response, the referring page, the country and state or province, and the device type; never your IP address or an identifier, and the User-Agent only for bots. The IP address is used only to confirm that a visitor calling itself Google’s or Microsoft’s search crawler really is one. Opting out does not affect the logs or these counts.
Linking your visits to an enquiry
When you send us a contact, quote or affiliate enquiry from a browser where analytics is allowed, we link the enquiry to the visits we recorded for that browser, so that our team can see which products and documents you looked at and answer you better. The forms say so next to the submit button. We never do this for job applications, and we do not do it when you have opted out or your browser sends Global Privacy Control or Do Not Track.
Do we use 'cookies'?
Yes. Cookies are small files that a site or its service provider stores in your web browser so that it can recognise your browser and remember certain information. We use these cookies and similar browser storage:
• enolight_geo (30 days): your approximate country and region, so that the site knows whether to ask for consent first.
• enolight_cookie_consent (1 year): your answer to our cookie banner — accepted, declined, or our own statistics only.
• eno_vid (13 months, renewed when you visit): the random identifier used by our own analytics.
• eno_vid_set (as long as eno_vid): contains no identifier; it only tells our site that an eno_vid cookie is present, so that it can be removed when analytics stops for your browser.
• enolight_analytics_optout (400 days): records that you opted out of analytics in this browser.
• eno_internal (400 days, renewed when used): set only on devices where someone from EnoLight has signed in to the administration of this website, or that our staff have marked, so that visits from those devices are left out of our statistics and Google Analytics and Microsoft Clarity do not load there.
• _ga and _ga_* (Google Analytics, up to 2 years) and _clck, _clsk and other Microsoft cookies (Microsoft Clarity, up to 1 year): set only when analytics is allowed for your visit.
• Cookies and storage used by Cloudflare and Cloudflare Turnstile to deliver the site securely and to protect our forms against bots.
• YouTube (Google): our product videos load from YouTube only when you press play; YouTube may then set its own cookies.
Third-party disclosure
• We do not sell, rent or trade your personal information for money.
• We share information only with the service providers that run parts of our business for us: our hosting provider; Cloudflare; Google (Google Analytics, and Google Workspace, which delivers our email, including the forms you send us); Microsoft (Clarity); Helcim (payments); and Dropbox (encrypted backups). Some of them may also use information for their own purposes, as their privacy statements describe (see “Analytics and service providers”).
• We also disclose information when the law requires it, or as part of a sale or reorganization of our business.
• We do not include or offer third-party products or services on our website.
Analytics and service providers
Google Analytics (Google LLC) measures visits and where they come from. We have switched off Google signals and ad personalisation for our website. Google’s use of this data is explained in How Google uses information from sites that use its services.
Microsoft Clarity (Microsoft Corporation) records how visitors use our pages — mouse movements, clicks, scrolling and what is shown on the page — as session recordings and heatmaps that help us find what is hard to use. Text you type is masked and never recorded. Microsoft may also use the data it collects through Clarity for its own purposes, including advertising, as described in the Microsoft Privacy Statement.
Cloudflare, Inc. delivers and protects our website, and Cloudflare Turnstile checks that our forms are sent by people rather than bots; see the Cloudflare Privacy Policy. Payments on our Pay page are processed by Helcim: your full card number goes directly to Helcim and never reaches our servers.
Google and Microsoft may collect information about your online activities over time and across different websites when you use our website. Google Analytics and Microsoft Clarity load only when analytics is allowed for your visit.
Opting out:
You can review or change your choices at any time with “Privacy choices” at the bottom of every page, or opt out of analytics in your browser with the control at the end of this page. Opting out stops our own analytics, Google Analytics and Microsoft Clarity in that browser; our web server’s logs, and the counts made from them without any identifier, are not affected (see “Website analytics”). You can also use the Google Analytics Opt-out Browser Add-on. Visitors who see our cookie banner can decline it, and can change their answer with the same control at the end of this page.
According to CalOPPA, we agree to the following:
Our Privacy Policy link includes the word ‘Privacy’ and can easily be found on every page of our website.
You will be notified of any Privacy Policy changes:
• On our Privacy Policy Page, which shows the date it was last edited.
You can review or change your personal information:
• By emailing us at [email protected].
How does our site handle Do Not Track signals?
We honor Do Not Track and Global Privacy Control signals. When your browser sends either one, we do not set our analytics identifier, we do not link your visits to an enquiry, Google Analytics and Microsoft Clarity do not load, and we record only an anonymous count of the pages you view. The cookies the site needs to work — your region, your cookie-banner answer and security — are still used.
Does our site allow third-party behavioral tracking?
Google (Google Analytics) and Microsoft (Microsoft Clarity) collect information about how you use our website on our behalf and may be able to connect it with your activity on other websites. They load only when analytics is allowed for your visit, and never when your browser sends Do Not Track or Global Privacy Control. We do not use advertising networks or place advertising cookies; Microsoft’s own use of Clarity data is described under “Analytics and service providers”.
Children
Our website is not directed to children, and we do not knowingly collect personal information from children under 16 (including children under 13, as the US Children’s Online Privacy Protection Act, COPPA, requires). If you believe a child has sent us personal information, email [email protected] and we will delete it.
Trademark
The EnoLight® word mark and logo are registered trademarks in the US owned by EnoLight Ltd.
Commercial email (CASL and CAN-SPAM)
We follow Canada’s Anti-Spam Legislation (CASL) and the US CAN-SPAM Act. In our commercial emails we:
• do not use false or misleading subjects or email addresses;
• identify the message as an advertisement where it is one;
• include the physical address of our business;
• monitor any third-party email marketing service we use for compliance;
• let you unsubscribe with the link at the bottom of each email, and honor unsubscribe requests within 10 business days.
When do we collect information?
We collect information when you fill out a form on our website (an enquiry, quote request, affiliate or job application), make a payment on our Pay page, or contact us by email or phone, and when you browse our website (see “Website analytics”).
How do we protect your information?
Card payments on our Pay page are entered in the secure payment form of Helcim, our payment processor. Your full card number and security code go directly to Helcim and never reach our servers; we keep only the payment record described under “What personal information do we collect?”.
Your personal information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the information confidential. Information you send us through our website is encrypted in transit (SSL/TLS).
We protect our website with Cloudflare’s security services, keep our software up to date, encrypt our off-site backups and limit access to our systems to authorized staff.
We use cookies to:
• Remember your region and your answer to our cookie banner.
• Recognise your browser for our own analytics, when analytics is allowed.
• Let Google Analytics and Microsoft Clarity measure visits, when analytics is allowed.
• Protect our forms against bots.
You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. You do this through your browser settings. Since each browser is a little different, look at your browser’s Help Menu to learn the correct way to modify your cookies. If you turn cookies off, the site keeps working.
How long do we keep information?
We keep personal information for as long as we need it for the purposes described in this policy: answering your enquiries, running and improving our website and products, understanding which products interest our customers, keeping our business records, and meeting our legal, tax and accounting obligations. How long that is depends on the kind of information:
• Our website analytics records — the pages viewed, the clicks and other events described under “Website analytics”, with the browser identifier, device, browser and location details that go with them: for as long as they help us understand how our website is used over time. When we no longer need them, we delete them or keep only totals that cannot be linked to you.
• Daily totals calculated from those records, such as how many times a page was viewed on a day by country, device type and referring website. They contain no identifier, IP address, city or browser details, cannot be linked to you, and are kept indefinitely.
• The link between an enquiry and your visits: for as long as we keep the enquiry.
• Web server logs, which include IP addresses: up to 30 days. They are kept for security and troubleshooting and to count visits as described under “Website analytics”, and are not affected by opting out.
• The records we count from those logs, which contain no IP address or identifier: 90 days. After that only daily totals are kept, indefinitely.
• Google Analytics: up to 14 months. Microsoft Clarity: recordings for about 30 days and heatmaps for up to 13 months, as set by Microsoft.
• Enquiries and applications you send us: as long as we need them to deal with your request and for our business records.
• Payment records: as long as Canadian tax law requires us to keep them (at least six years after the end of the year they relate to), and longer when we still need them for our business records.
• Enquiries and payments sent through our previous website, which we moved to this one in 2026, together with what that website recorded with them — the page they were sent from, approximate location and the pages viewed before sending: as long as we keep the enquiry or payment record.
You can ask us at any time to delete the information we hold about you, as described under “Your rights and requests”. Deleted information may remain in our encrypted backups for up to 13 months, until those backups expire.
Your rights and requests
You can ask to see, correct or delete the personal information we hold about you — including the website analytics linked to an enquiry you sent us — by emailing [email protected]. Tell us the email address you used in your enquiry so that we can find the related records. Before we disclose or delete anything, we confirm that you control that email address. We answer within 30 days.
You can also ask for a copy of the information you gave us in a structured, commonly used technological format, and withdraw your consent at any time (for analytics, with “Privacy choices” at the bottom of every page), subject to legal or contractual limits. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d’accès à l’information (cai.gouv.qc.ca).
The person in charge of the protection of personal information at EnoLight is our Privacy Officer, who can be reached by email at [email protected] or by mail at: Privacy Officer, EnoLight Ltd., 17-25 Valleywood Dr, Markham, Ontario L3R 5L9, Canada.
Where is your information stored?
Our website and its databases run on servers operated by our hosting provider, our service providers (Google, Microsoft, Cloudflare and Helcim) process information on their own systems, and encrypted copies of our backups, which cannot be read without our key, are kept with Dropbox. These may be located outside your province or country, including in the United States, where local authorities may be able to access it under local law.
Your privacy rights in California and other US states
We do not sell your personal information for money, and we do not use it for targeted advertising. Google Analytics runs for us with Google’s advertising features switched off. Microsoft may use what Clarity collects for its own purposes (see “Third-party disclosure”), which some state laws count as “selling” or “sharing”. To opt out of that, and of Google Analytics, choose “Privacy choices” at the bottom of any page, or turn on Global Privacy Control in your browser; either works as a request to opt out.
Depending on where you live, you may have the right to know what personal information we hold about you, to receive a copy of it, to correct it, and to have it deleted. You can use these rights as described under “Your rights and requests”, and we will not treat you differently for doing so.
If a data breach occurs
If a breach of security safeguards (in Quebec, a confidentiality incident) involving your personal information creates a real risk of significant harm to you (in Quebec, a risk of serious injury), we will notify you, and the Office of the Privacy Commissioner of Canada or the Commission d’accès à l’information, as soon as feasible, and other authorities where the law requires it.
We collect your email address in order to:
• Answer your enquiries, requests and questions.
• Process orders and payments, and send you information and updates about them.
• Send you information related to the products or services you asked about.
• Send you news about our products, only when you have agreed to it or when Canada’s Anti-Spam Legislation (CASL) and the US CAN-SPAM Act allow it (for example, for a limited time after you buy from us or ask us a question).
Unsubscribing from our emails
To stop receiving our marketing emails, use the link at the bottom of any of them or email [email protected]; we will remove you within 10 business days. We may still write to you about an order or request you have open.
Contacting Us
If there are any questions regarding this privacy policy, you may contact us using the information below.
17-25 Valleywood Dr, Markham, Ontario L3R 5L9, Canada
Last Edited on 2026-10-28