Tow350 Customer Authorisation Privacy Policy

Last updated: October 16, 2026

Tow350 is operated by: Digital350 Inc.

Who collects your information and Tow350's role

The towing company identified at the top of your authorisation form (“Company”) collects your information through Tow350 to document your instructions and authorisation, administer its services and support the transaction shown on the form.

The Company is responsible for its services, charges, obtaining required customer authorisations, the lawful instructions it gives Tow350, and its own use or disclosure of information accessed or exported from the platform. It manages its personnel's access and use of customer and payment information.

Tow350 collects, records and stores information on the Company's behalf through its software platform. Tow350 also handles relevant technical information to operate, secure and support the platform, respond to enquiries and meet applicable legal obligations.

Tow350 is not the towing service provider. It does not set or approve the Company's charges. Your payment authorisation is given to the Company named on the form, not to Tow350. This form does not authorise Tow350 to charge you for the Company's services.

Contact the Company about services, charges, refunds and payment disputes. Privacy requests may be directed to the Company or to Tow350 using the contact information below.

Information collected

The form collects the information entered or displayed for the transaction, including:

The platform also records the signing date and time, your internet protocol (IP) address, the version of the terms accepted, the acknowledgement selection and relevant access/security events.

If the Company sends your authorisation link by text message through the platform, the platform records the mobile number the Company entered, that a message was sent, its delivery status and the message text with the link masked. The Company decides whether to send a text.

Your device location is collected only if your device can provide it and you permit it. If permission is declined or location is unavailable, the form records that no location was shared. It does not substitute a guessed location. Declining location permission does not prevent you from signing.

We do not sell authorisation information, use it for advertising or marketing, or use cookies to track you for advertising purposes.

Why the information is used

The Company uses the information to identify the customer, vehicle and transaction; document the instructions and authorisation provided; administer its services; and collect the payment specifically authorised on the form.

Tow350 processes and stores the information on the Company's behalf to create and make available the authorisation record and provide the related platform functions.

Relevant records may also be used to answer enquiries, investigate disputed or potentially unauthorised activity, protect the platform and meet applicable legal obligations.

Providing information does not permit the Company to make charges outside your actual payment authorisation or use your information for unrelated purposes without an appropriate legal basis.

Your choice and authorisation

You choose whether to submit the form and provide the requested information. Before submitting, review the Company name, invoice, authorised amount, payment terms and this policy.

The form's acknowledgement explains that the Company collects the information through Tow350 for its transaction and that Tow350 processes and stores it for the purposes described here.

Your payment authorisation permits the Company to use the payment method you authorise to collect the amount specified on the form, in accordance with the stated payment terms. It is not a general permission for unrelated or additional charges, and it does not authorise Tow350 to collect payment for itself.

Provide another person's information or use another person's payment method only if you have the necessary authority.

If you do not wish to provide information necessary for the transaction, ask the Company about available alternatives. Location permission is optional. Consent does not waive your rights under applicable law.

Company management, security and responsibility for misuse

The Company manages its customer transactions and determines the transaction-related purposes for requesting information. It is responsible for its lawful instructions, services, charges and its personnel's use or disclosure of information.

The Company has operational responsibility for its customer-record retention and deletion, selecting authorised users, controlling their permissions, protecting credentials and devices, using the platform's available security controls, preventing unauthorised charges or disclosures and securing downloaded, printed or separately stored records.

Tow350 collects, processes and stores the information on the Company's behalf using the platform safeguards described in this policy. Its role includes providing the software and supporting the platform's operation and security.

To the extent permitted by applicable law, Tow350 does not assume responsibility or liability for the Company's independent misuse of information, unlawful instructions, unauthorised charges, disclosures, failure to manage its required retention/deletion, or insecure handling of information by its personnel or in its own systems.

This allocation does not exclude responsibility attributable to Tow350's own acts or omissions concerning its platform, personnel, service providers or handling of information. It does not limit any right, remedy or responsibility that cannot lawfully be excluded.

The Company's use of Tow350 does not mean that Tow350 approves its services, charges or use of customer information.

Who can access the information

The Company's authorised administrators can access its authorisations. Company access is restricted to that Company's records.

Routine card listings show card brand and the last four digits. To reveal full card details on screen, an administrator must enter the separate passcode again. Before the details are decrypted for that reveal, the system records the administrator's identity and the time. If that record cannot be written, the on-screen reveal is refused.

The Company is responsible for protecting its credentials and ensuring its personnel use information only for authorised purposes.

Tow350 personnel may access relevant information to operate, support or secure the platform or meet legal obligations. Hosting and storage providers process information needed to provide the service, and the text-message provider (Twilio) carries your authorisation link when the Company sends it by text through the platform. Information may also be disclosed where required or otherwise permitted by applicable law.

Authorisation PDFs and downloaded copies

Authorisation PDFs currently contain the full card number, expiry, cardholder name and security code, together with the other information on the form. Access to the PDF through the platform requires the Company's passcode.

The PDF carries a warning that it may contain full card details, must not be emailed and must be deleted after use. Once downloaded, a copy is outside the platform's access controls. Encryption of information in the platform database does not protect a separately downloaded PDF.

The Company is responsible for the security, authorised use and retention of copies it downloads or stores elsewhere. Deleting an authorisation within Tow350 does not erase copies already held by the Company or another recipient.

Retention and Company-managed deletion

The Company determines the retention and deletion of its customer authorisation records, subject to applicable law. Tow350 does not apply a preset automatic purge or expiry date to those records.

Customer details, vehicle details, signatures, signed documents and payment information remain in the platform until the Company deletes the relevant record. There is no automatic scheduled deletion of these records.

The Company is responsible for establishing and applying lawful retention periods, reviewing whether information remains necessary, preserving records where required and using the available deletion controls when information is no longer needed.

The absence of an automatic purge does not authorise indefinite retention where continued storage is unnecessary or prohibited. A customer's consent does not create permission to retain payment information contrary to applicable requirements.

The Company also manages the retention, access and security of information it downloads, prints or stores outside Tow350. Platform deletion does not erase those separate copies.

Deleting an authorisation is permanent. It removes the customer and vehicle details, the signature, the stored card record and the signed document from active systems, and it also removes that authorisation's own access and security history, including the records of any on-screen card reveal. What is kept is a single administrative record of the deletion itself: which administrator deleted which authorisation and when, with the invoice reference and amount where the form had been signed. That record contains no name, phone number, address, vehicle details, card details, signature or document. Any record that remains linkable to you remains personal information.

The signed document is removed from file storage by a routine daily cleanup, so it may persist for up to about a day after the authorisation record itself is deleted. That cleanup removes only documents whose authorisation has already been deleted; it does not delete anything on a schedule of its own.

Customers may request access, correction, withdrawal of consent or deletion through the Company or Tow350. Requests will be assessed in accordance with applicable law, including any justified retention requirement. We will explain any restriction that applies.

The Company's applicable retention periods or criteria are available from the Company identified on the form. Where the Company publishes its own privacy policy, the authorisation form links it beside this one.

Backups and deletion limits

The platform's backup configuration uses a rolling seven-day retention period for backup snapshots. This backup cycle does not delete active customer authorisation records. Information manually deleted from active systems may remain in a protected backup until that backup expires.

Deletion from active systems therefore does not mean immediate erasure of every backup copy or a copy previously downloaded by the Company. We do not promise immediate deletion from Company-controlled systems.

Requests concerning copies retained in the Company's own systems should be directed to the Company. You may also contact Tow350 regarding its handling of information or assistance with a privacy request.

Storage, security and service providers

Authorisation information is held in the platform's database and private file storage, hosted through Supabase in the United States. The authorisation platform uses AWS Oregon. Files are subject to platform access restrictions rather than openly available to the public.

The full card number, expiry, cardholder name and security code are stored encrypted. Routine listings retain the brand and last four digits in readable form. Access controls and recorded on-screen reveals are additional safeguards; they do not guarantee that loss, unauthorised access or misuse can never occur.

For some authorisations signed before October 8, 2026, the stored expiry date and cardholder name can no longer be decrypted, because of a defect in how the encryption values were saved that has since been corrected. That information remains encrypted and was never exposed by the defect; it simply cannot be read back, so those two fields may be unavailable if you ask about an older record. The card number and security code are unaffected.

Because information is processed in the United States, it may be subject to United States laws and lawful access by courts or public authorities there.

If the Company stores paperwork in Microsoft SharePoint or another system, those copies are held under its account and its policies. The Company remains responsible for them.

The Company provides the authorisation link to you, either directly or by a text message sent through the platform at the Company's request. Tow350 does not send your authorisation link or your payment details to anyone else.

Your privacy rights

Subject to applicable law, you may ask for information about what is held about you and how it is used or disclosed, access to your information, correction of inaccurate information, withdrawal of consent to further consent-based processing, or deletion where applicable.

You may contact either the Company or Tow350. We may request information reasonably necessary to verify your identity and locate the record. Do not email your full card number or security code.

Withdrawing privacy consent does not, by itself, reverse a completed charge, cancel a separate payment authorisation or extinguish an amount lawfully owed. Contact the Company about cancelling a payment authorisation or disputing a charge. Your consumer and payment dispute rights remain unaffected.

Where a request cannot be fully fulfilled because of a restriction permitted by applicable law, we will explain the reason. Tow350 will coordinate with the Company where appropriate without limiting either organisation's own obligations.

Access requests are answered within 30 days, subject to extensions permitted by applicable law. We will notify you of any permitted extension and its reason. Other requests and complaints are addressed within the period required by applicable law.

If your concern remains unresolved, you may contact the Office of the Privacy Commissioner of Canada or another applicable privacy regulator.

Changes to this policy

We update the date when this policy changes. The version of the terms accepted when an authorisation is signed is recorded and is not overwritten by a later version.

We will provide any notice and obtain any additional consent required by law before using existing information for materially different purposes.

Contact

For services, charges, refunds, payment disputes and Company-held copies, contact the towing company named on your form.

For privacy requests or concerns about Tow350's handling of information:

Tow350 Privacy Officer
Legal operator: Digital350 Inc., Mississauga, Ontario, Canada
Email: Solution@tow350.com

Include the Company name and invoice reference, if available. Do not send a full card number or security code by email.