Privacy policy

 

This Privacy Policy explains how thornandburrowx.shop collects, uses, discloses, retains, and protects personal information when you visit the website, create or use an account, place an order, communicate with us, or otherwise interact with our services. Depending on the circumstances, the Personal Information Protection and Electronic Documents Act (PIPEDA), substantially similar private-sector privacy laws in Alberta, British Columbia, or Québec, and other applicable laws may govern our practices.

Accountability and Contact

thornandburrowx.shop is accountable for personal information under its control. Privacy questions, access or correction requests, consent withdrawals, and complaints may be directed to our privacy contact at info@thornandburrowx.shop. We verify requests in a proportionate manner before disclosing or changing personal information.

Information We Collect
Identity and contact information: name, email address, telephone number, billing address, shipping address, and account identifiers.
Transaction information: products viewed or ordered, order value, discounts, currency, tax, payment status, shipment details, returns, refunds, and communications about a purchase.
Payment information: limited payment and fraud-screening information received from payment providers. Full card numbers are generally handled by authorized payment processors rather than stored by us.
Device and activity information: IP address, browser and device type, approximate location inferred from IP, pages viewed, referral source, timestamps, cookie identifiers, and interactions with site functions.
Communications and preferences: messages to customer service, reviews or other content submitted, language, marketing preferences, and records of consent or unsubscribe requests.
Information from partners: order, delivery, payment, fraud-prevention, analytics, and advertising information received from Shopify and other service providers, to the extent permitted by law.
Purposes for Collection, Use, and Disclosure

We process personal information for purposes a reasonable person would consider appropriate in the circumstances and, where required, with meaningful consent. These purposes include operating the store; displaying local pricing and availability; creating and administering accounts; processing payment; accepting, fulfilling, delivering, and documenting orders; providing support; administering returns, refunds, warranties, and disputes; detecting fraud and security incidents; maintaining business and tax records; improving site performance; measuring marketing; complying with law; enforcing agreements; protecting customers and the public; and establishing, exercising, or defending legal claims.

We do not use sensitive personal information for a new purpose without appropriate consent or another lawful basis. We do not sell personal information for money. If an activity constitutes a “sale,” “sharing,” or targeted advertising under a law that applies to you, we will provide any legally required notice and choice.

Consent and Your Choices

Consent may be express or implied, depending on the sensitivity of the information, your reasonable expectations, and legal requirements. You may withdraw consent for optional processing at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal does not affect processing already lawfully completed and may prevent us from providing a feature that requires the information.

We send commercial electronic messages only when permitted by Canada’s Anti-Spam Legislation or other applicable law. Marketing emails identify the sender, provide contact information, and include a no-cost unsubscribe mechanism. We process unsubscribe requests promptly and no later than the legally required period. Transactional messages concerning an order, security, recall, account, or requested service may still be sent.

Cookies and Similar Technologies

We and our authorized providers may use cookies, pixels, local storage, and comparable technologies for authentication, cart operation, security, preferences, site measurement, and advertising. Essential technologies are used to provide the service you request. Where law requires consent for optional analytics or advertising technologies, we request it before activating them. Browser settings can block or delete cookies, but some store functions may then be unavailable.

Service Providers and Other Disclosures

We may provide personal information to vendors that host or operate the store, process payments, prevent fraud, deliver orders, provide customer support, manage email, analyze performance, or supply professional services. They receive only information reasonably necessary for their role and are expected to protect it through contractual, organizational, and technical measures.

We may also disclose information when required by law, court order, or lawful governmental process; to investigate or prevent fraud, abuse, threats, or security incidents; in connection with a proposed or completed merger, financing, restructuring, sale, or transfer of all or part of the business, subject to appropriate protections; or with your direction or consent.

Cross-Border Processing

Our providers may process information outside your province or outside Canada. As a result, information may be subject to the laws of the jurisdiction where it is processed and may be accessible to courts, law enforcement, or national-security authorities in accordance with those laws. We remain responsible for personal information under our control and use safeguards appropriate to the sensitivity and context of the transfer.

Retention

We retain personal information only as long as reasonably necessary for the identified purposes, including order fulfilment, customer service, warranty administration, fraud prevention, legal claims, accounting, tax, and regulatory obligations. Retention periods vary by record type and legal requirement. When information is no longer required, we securely delete, destroy, or anonymize it, unless a legal hold applies.

Security and Incidents

We use administrative, technical, and physical safeguards appropriate to the sensitivity, amount, format, and use of the information. Measures may include access controls, authentication, encryption in transit where supported, vendor oversight, logging, employee confidentiality duties, and secure disposal. No system is completely secure, and we cannot guarantee absolute security.

We assess suspected privacy incidents, take reasonable measures to reduce harm, preserve required records, and notify affected individuals and regulators when the applicable legal threshold is met, including where a breach creates a real risk of significant harm or a Québec confidentiality incident presents a risk of serious injury.

Access, Correction, and Complaints

Subject to legal exceptions, you may request access to personal information we hold about you, an account of its use and disclosure, and correction of inaccurate or incomplete information. You may also ask questions, challenge compliance, or request information about applicable data-governance practices. We may ask for enough information to verify identity and locate the records. If access is refused in whole or part, we will explain the reason when legally permitted.

If you are dissatisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or the privacy regulator with jurisdiction in your province, including the regulators in Alberta, British Columbia, or Québec. Contacting us first may allow us to resolve the issue promptly, but it does not remove a legal right to complain to a regulator.

Children

The store is intended for people capable of entering a binding purchase agreement. We do not knowingly seek to collect personal information from children without legally valid consent. If you believe a child supplied personal information improperly, contact us so that we can investigate and take appropriate action.

Changes to This Policy

We may update this policy to reflect operational, legal, or regulatory changes. The revised version will show a new effective date. Where a change materially affects how previously collected information is used, we will provide additional notice or obtain consent when required.