Privacy policy

Last updated November 2026

This policy explains how we handle personal information, under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL).

Who is responsible

Burhan Aslam o/a Niagara Fragrances is responsible for your personal information. Our privacy officer is Burhan Aslam, who answers privacy questions and requests:

What we collect and why

• Your order: name, email, phone (optional unless you pay at pickup), what you bought, your pickup time and place, and how you paid. We use it to fill your order, hand it to the right person (we may ask for photo ID matching the name), send your receipt and order emails, and keep the business and tax records the law requires.
• Payment: you enter your card or wallet directly with our payment processor, Stripe. We never see or store your full card number; we keep only what Stripe tells us, such as “Visa ending 4242” and its payment reference.
• Your account (only if you create one): email, password (stored only as a secure hash), name, wishlist and order history.
• Messages you send us through the contact form, and our replies.
• Marketing emails: only if you tick the box, which starts unticked. We record when, where and with what wording you agreed, as CASL requires.
• Cookies: essential cookies keep your bag and sign-in working. Analytics and advertising cookies load only if you accept them in the cookie banner, and you can change your choice at any time.
• How the site is used: Google Analytics shows us which pages and steps work. If you accept cookies it can recognise your browser across visits; if you don't, Google gets only anonymous measurements with nothing stored on your device. We never send Google your name, email, phone or card details for analytics.
• Ads that brought you here: if you came from one of our ads on Google, Facebook or Instagram and accepted cookies, we note which ad it was. When that order is paid we tell Google or Meta the ad led to a sale (the order number and amount), with your email, phone and name only as scrambled codes (hashes) they can match but not read, and your browser's address, which we delete once it's sent. If you don't accept cookies, nothing about you is sent to them.

Who we share it with

Only service providers that help us run the shop, and only what each needs: Stripe (payments), our email provider (order emails), our hosting provider (the website and its database, in Toronto, Canada), Google (analytics, and with your permission, ad results) and Meta (with your permission, ad results). They may use your information only to provide those services. We don't sell personal information. We may also share it when the law requires, for example with the Canada Revenue Agency.

Information stored outside Canada

Our shop's records are kept in Canada. Some of the providers above (Stripe, Google, Meta and our email provider) process information in the United States or other countries, where it can be accessed under those countries' laws.

How long we keep it

• Orders, receipts and refunds: at least 6 years after the end of the tax year they belong to, as Canadian tax law requires, then deleted.
• Your account: until you ask us to close it. Orders stay with our tax records as above.
• Marketing consent: until you unsubscribe. We keep the record of when you agreed and unsubscribed for 3 years after, to show we followed CASL.
• Contact messages: as long as needed to answer you, and with our business records after that.

How we protect it

The site uses encrypted connections. Admin access is limited to the people who run the shop and protected by passwords and a second sign-in step. Payment details stay with Stripe. If a breach of our safeguards creates a real risk of significant harm to you, we'll tell you and the Office of the Privacy Commissioner of Canada as soon as we can.

Unsubscribing

Every marketing email has an unsubscribe link that works in one click, and we act on it right away (always within 10 business days). Emails about your orders, like receipts and pickup codes, still come, since they're part of your purchase.

Your rights

You can ask to see the personal information we hold about you, have it corrected, have your account closed, or withdraw consent. Write to our privacy officer at the email above, or use our contact page; we answer within 30 days. If you're not satisfied, you can contact the Office of the Privacy Commissioner of Canada.