Privacy Policy

Scope and identity of the organization

Maison Solani is responsible for the personal information under its control. For the purposes of applicable Canadian privacy law, our organization is:

Legal business name:
[LEGAL BUSINESS NAME]

Business address:
[FULL CANADIAN BUSINESS ADDRESS]

Province or territory:
[PROVINCE OR TERRITORY]

Privacy contact:
[PRIVACY EMAIL]

Depending on your location and the nature of the transaction, federal Canadian privacy law, substantially similar provincial privacy legislation or international data protection laws may apply.

Personal information we collect

The information we collect depends on how you interact with Maison Solani. It may include:

We do not intentionally request sensitive personal information unless it is necessary for a specific lawful purpose. Please do not include sensitive information in general customer service messages unless requested and appropriate.

How we collect information

We may collect personal information:

• directly from you when you place an order, create an account, contact us, subscribe or submit content;
• automatically through cookies, pixels, tags, SDKs, server logs and similar technologies;
• from Shopify and the apps, payment providers, carriers and other service providers supporting our store;
• from advertising, analytics and social media partners where permitted by law;
• from fraud-prevention, identity-verification and payment-risk providers;
• from publicly available sources or information you make public.

How we use personal information

We may use personal information to:

• process, fulfil, deliver and administer orders;
• take payments, issue refunds and manage chargebacks;
• provide customer service and respond to enquiries;
• create and manage customer accounts;
• send transactional messages about orders, returns and account security;
• provide marketing communications where permitted;
• personalize content, product recommendations and advertising;
• measure website use, campaign performance and customer experience;
• detect, investigate and prevent fraud, misuse and security incidents;
• maintain records and comply with tax, accounting, consumer protection and legal obligations;
• establish, exercise or defend legal claims;
• improve our website, services, collections and business operations.

We will not use personal information for a materially new purpose without obtaining consent where consent is required or otherwise ensuring the new use is permitted by law.

Consent and legal bases

Canada

Where Canadian private-sector privacy law applies, we rely on meaningful consent unless collection, use or disclosure without consent is authorized or required by law. The appropriate form of consent depends on the sensitivity of the information and the reasonable expectations of the individual.

European Economic Area, United Kingdom and Switzerland

Where applicable data protection law requires a legal basis, we process personal data on one or more of the following grounds:

• performance of a contract, including processing and delivering your order;
• compliance with legal obligations;
• our legitimate interests, where those interests are not overridden by your rights;
• your consent, including where consent is required for marketing, cookies or targeted advertising;
• the establishment, exercise or defence of legal claims.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing that occurred lawfully before withdrawal.

Cookies and similar technologies

We and our service providers may use cookies, pixels, local storage, tags and similar technologies to operate the website, remember preferences, protect accounts, understand website activity and support advertising.

These technologies may be grouped as:

• strictly necessary: required for checkout, security, account access and essential website functions;
• functional: used to remember settings and provide enhanced features;
• analytics: used to understand visits, navigation, performance and conversions;
• advertising: used to measure campaigns, personalize advertisements and build audiences where permitted.

Where required, non-essential technologies are used only after you make a choice through our cookie banner or privacy settings. You can revisit your choices through [INSERT COOKIE SETTINGS LINK OR INSTRUCTION].

Advertising and personalization

We may work with advertising and social media platforms to measure campaigns, understand audiences and show advertisements that may be more relevant to you.

Depending on the tools enabled, advertising partners may receive identifiers, device information, website events, purchase events or hashed contact information. List the advertising tools actually used:

• [META / FACEBOOK, IF USED]
• [GOOGLE ADS, IF USED]
• [TIKTOK, PINTEREST OR OTHER PLATFORM, IF USED]
• [SHOPIFY AUDIENCES OR SHOP CHANNEL FEATURES, IF USED]

Where required by law, we rely on consent for targeted advertising technologies. Certain jurisdictions may also provide a right to opt out of the sale, sharing or use of personal information for targeted advertising.

When we share personal information

We may disclose personal information to recipients that need it for legitimate business and legal purposes, including:

• Shopify and store-hosting providers;
• payment processors, banks and fraud-prevention providers;
• warehouses, fulfilment providers, shipping carriers and customs agents;
• customer-service, returns, review and help-centre providers;
• email, SMS and marketing automation providers;
• analytics, advertising and social media partners, subject to applicable choices;
• professional advisers, auditors, insurers and legal representatives;
• government bodies, regulators, courts and law-enforcement authorities where required or permitted;
• buyers, investors or advisers involved in a genuine business transaction.

Service providers are expected to use information only for authorized purposes and to protect it appropriately. Some providers may act as independent organizations with their own legal obligations.

Shopify and store infrastructure

Our store is hosted on Shopify. Shopify processes personal information to provide the commerce platform, checkout, fraud prevention, infrastructure, analytics and other services used by merchants and consumers.

Shopify may process information in countries other than your own and may provide certain consumer-facing services under its own privacy notices. Review Shopify's current consumer privacy information for details about Shopify's processing and available controls.

Apps installed on our store may also process information. Before publishing this policy, list or describe the material apps that handle customer information: [INSERT RELEVANT SHOPIFY APPS AND PURPOSES].

International data transfers

Maison Solani is based in Canada, and our service providers may process personal information in Canada, the United States, Europe and other countries. Information processed in another jurisdiction may be accessible to authorities under the laws of that jurisdiction.

Where European data protection law applies to a transfer to a country not recognized as providing an adequate level of protection, we rely on an approved transfer mechanism where required, such as standard contractual clauses, together with supplementary safeguards where appropriate.

Contact us for more information about relevant transfer safeguards.

Data retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including to:

• complete orders and provide customer service;
• maintain tax, accounting and transaction records;
• manage returns, disputes, warranties and chargebacks;
• prevent fraud and maintain security;
• comply with legal obligations;
• establish, exercise or defend legal claims.

Retention periods differ by category. Define and internally document your actual periods, for example:

• order and tax records: [INSERT PERIOD];
• customer-service communications: [INSERT PERIOD];
• marketing consent and suppression records: [INSERT PERIOD];
• security and fraud records: [INSERT PERIOD].

When information is no longer required, we delete, anonymize or securely dispose of it, subject to technical backup cycles and legal requirements.

Security and privacy incidents

We use administrative, technical and physical safeguards that are appropriate to the sensitivity of the information and the nature of our business. These may include access controls, secure payment processing, encryption in transit, staff access restrictions, monitoring and vendor management.

No method of transmission or storage is completely secure. You are responsible for protecting your account credentials and for notifying us promptly if you suspect unauthorized account activity.

If a privacy breach occurs, we will investigate, contain and document it and provide notifications to affected individuals and regulators where required by applicable law.

Canadian privacy rights

Subject to applicable law and exceptions, individuals may request:

• information about whether we hold personal information about them;
• access to personal information under our control;
• correction of inaccurate or incomplete information;
• withdrawal of consent, subject to legal and contractual restrictions;
• information about our policies, practices and use of service providers;
• an explanation of a refusal or limitation where required;
• the ability to raise a concern with our privacy contact.

We may need to verify your identity before processing a request. Access may be limited where permitted or required by law, including where disclosure would reveal another person's information or confidential commercial information.

Residents of provinces with applicable private-sector privacy laws may have additional rights. If your company is established in Quebec, Alberta or British Columbia, obtain province-specific legal review and update this policy accordingly.

EEA, UK and Swiss privacy rights

If applicable data protection law covers our processing, you may have the right to:

• receive information about the processing of your personal data;
• request access to your personal data;
• request correction of inaccurate data;
• request deletion in eligible circumstances;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• receive eligible data in a portable format;
• withdraw consent where consent is the legal basis;
• lodge a complaint with an applicable supervisory authority.

Where required, we respond to verified rights requests without undue delay and generally within one month, subject to lawful extensions.

If we are required to appoint an EU or UK representative, add their details here: [INSERT REPRESENTATIVE DETAILS OR REMOVE].

Rights in other jurisdictions

Customers in certain jurisdictions may have additional rights, including rights to know, access, correct, delete, opt out of targeted advertising, opt out of certain disclosures or appeal a privacy decision.

We will process verified requests in accordance with the law that applies to the request. We will not unlawfully discriminate against you for exercising a privacy right.

If your store actively targets residents of the United States, Australia or other regulated markets, add the disclosures and mechanisms required for those markets after obtaining legal review.

Marketing communications

We may send promotional email or SMS messages where we have the consent or other lawful authority required in the recipient's jurisdiction.

Commercial electronic messages sent under Canada's anti-spam legislation will identify the sender and include an unsubscribe mechanism where required. You can unsubscribe by using the link in an email, following SMS instructions or contacting us.

Unsubscribing from marketing does not stop transactional or service-related messages, such as order confirmations, delivery updates, account security messages or responses to your enquiries.

Identify the providers used: [EMAIL PLATFORM] and [SMS PLATFORM, IF USED].

Children's privacy

Our store is not directed to children, and we do not knowingly collect personal information from children below the age at which they may validly consent under applicable law.

If you believe a child has provided personal information without appropriate authorization, contact us so that we can review and, where appropriate, delete the information.

Third-party websites and services

Our website may contain links to third-party websites, social platforms or services. Their privacy practices are governed by their own policies, and Maison Solani is not responsible for information processed independently by those third parties.

Review the privacy policy of any external service before providing personal information.

Changes to this Privacy Policy

We may update this policy to reflect changes in our operations, service providers, technologies, legal requirements or privacy practices.

The updated version will be posted on this page with a revised “Last updated” date. Where required, we will provide additional notice or obtain consent for material changes.

Contact, requests and complaints

To ask a privacy question, exercise a right or submit a complaint, contact:

Privacy Officer / Privacy Contact:
[NAME OR TITLE]

Legal business name:
[LEGAL BUSINESS NAME]

Email:
[PRIVACY EMAIL]

Postal address:
[FULL CANADIAN BUSINESS ADDRESS]

Please describe your request and identify the account or transaction involved. We may request information reasonably necessary to verify identity and authority.

If you remain dissatisfied after contacting us, you may have the right to complain to the Office of the Privacy Commissioner of Canada, an applicable provincial privacy regulator or an applicable international supervisory authority.