Holylovelybody

Personal data

What we hold, and why.

We keep what an order needs and nothing else, we do not sell it to anyone, and you can ask for it back or ask us to delete it at any time.

What we collect

Only what an order requires.

When you place an order we receive your name, email address, telephone number and, if it is being shipped, your delivery address. We also keep a record of what you ordered.

When you write to us through the contact page, we receive what you chose to put in that message.

We never receive your card details. Payments are handled by Stripe, and your card number goes to them directly. It does not pass through this shop and we could not see it if we wanted to.

Why

Each piece has a job.

Your name and address get the parcel to you. Your email carries the order confirmation and the message telling you it has been sent or is ready. Your phone number is there for the carrier when a delivery needs it, and for us if there is a problem with your order that email will not solve quickly.

Your order history lets us answer questions about a past order, and honour a return.

Who else sees it

Two others, both necessary.

Stripe, to take the payment and to process a refund if one is due.

The shipping carrier, which receives your delivery address, a parcel cannot reach you otherwise.

Nobody else. We do not sell, rent or trade your details, and we do not pass them to advertisers.

How long

As long as the records need to exist.

Order records are kept for seven years, which is what a business is expected to retain for tax purposes in Canada. Messages sent through the contact page are kept while they are useful for answering you, and then removed.

Cookies

What this site stores in your browser.

This site keeps your shopping bag so it survives you closing the tab, and remembers basic preferences. There are no advertising trackers and no third-party analytics profiling you across other sites.

Your rights

Ask, and it happens.

You can ask what we hold about you, ask us to correct it if it is wrong, ask for a copy, or ask us to delete it. We will act within thirty days.

Some records we cannot delete on request, a completed order has to stay in the books for the retention period above. Where that applies, we will tell you which record and why rather than simply refusing.

Write to us on the contact page and say what you would like done.

This policy follows Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). If you are not satisfied with how we have handled a request, you may raise it with the Office of the Privacy Commissioner of Canada.