Privacy policy

1. Person Responsible for Processing

This privacy policy applies to the website and online store operated by LA Touffe (referred to in this policy as "we," "us," or "our"). We are subject to Quebec Law 25 — formerly known as An Act to Modernize Legislative Provisions Concerning the Protection of Personal Information (S.Q. 2021, c. 25) — which governs how we collect, use, disclose, and retain personal information about you.

As a Quebec-based retail business, we are committed to handling your personal information responsibly, transparently, and only for the purposes described in this policy. By visiting our website or placing an order with us, you acknowledge that your personal information will be processed in accordance with the practices described below.

2. Personal Information Collected

We collect personal information about you in several ways, depending on how you interact with our website and online store. Below is a summary of the categories of personal information we may collect.

• Identity and contact information: Your name, email address, phone number, and billing or shipping address—collected when you create an account, place an order, or contact us.
• Transaction and purchase information: Order history, items purchased, payment method type (we do not store full card numbers), and transaction amounts — collected through our WooCommerce-powered store.
• Device and browsing information: IP address, device identifiers, pages visited, session duration, approximate geographic location, and browsing behavior—collected automatically through analytics and marketing tools when you browse our site.
• Advertising identifiers: Advertising IDs and social identifiers used to measure the effectiveness of our advertising campaigns and to show you relevant ads on platforms such as Meta (Facebook/Instagram) and TikTok.
• Consent preferences: Your cookie consent choices, recorded by our consent management platform (Moelleux, operated by Horizon-Cumulus) and stored for 13 months.
• Communications Information: Any messages, questions, or feedback you send us directly.

We do not knowingly collect sensitive categories of personal information, such as health data, financial account credentials, or government-issued identification numbers, beyond what is strictly necessary to process your orders.

3. Purposes of Processing

We collect and use your personal information only for specific, clearly defined purposes. The legal basis for each purpose is indicated below.

• Processing Your Orders and Managing Your Account — We use your personal, contact, and transaction information to fulfill purchases, process payments, arrange delivery, and manage your customer account. Legal basis: performance of a contract.
• Measuring website performance and improving our store — We use Google Analytics 4 and WooCommerce Analytics to understand how visitors navigate our site and how our store performs. This helps us improve the shopping experience. The data collected includes device identifiers, IP addresses, pages visited, session duration, and transaction data. Data is transferred to the United States. Legal basis: consent (you may withdraw your consent at any time via our cookie banner).
• Targeted advertising and remarketing — We use the Meta Pixel (Facebook) and TikTok Pixel to track conversions and show you relevant ads on those platforms after you visit our site. The data collected includes device identifiers, IP addresses, advertising identifiers, pages visited, and transaction data. Data is transferred to the United States (Meta) and China (TikTok). Legal basis: consent (you may withdraw your consent at any time via our cookie banner).
• Displaying website content correctly — We use Google Fonts to display text on our site and YouTube to display embedded videos. These services may collect your IP address and, in the case of YouTube, device identifiers and browsing behavior. Data is transferred to the United States. Legal basis: consent for non-essential functional services; legitimate interest for basic page rendering where no personal information is retained beyond the immediate request.
• Managing Your Cookie Consent Choices — We use Moelleux (operated by Horizon-Cumulus, Joliette, Quebec) to record and respect your consent preferences. A cookie named moelleux_{site_key} is stored in your browser for up to 13 months. Consent records and this policy are hosted in Quebec (OVH Beauharnois). No data is transferred outside of Canada for this service. Legal basis: legal obligation under Quebec Act 25.
• Sending transactional and business emails — We use a combination of Horizon-Cumulus Email (Quebec) and Microsoft 365 (United States) to send order confirmations, shipping updates, and other business communications. Data may be transferred to the United States via Microsoft 365. Legal basis: performance of a contract and legitimate interest.
• Compliance with Legal Obligations — We may retain certain personal information (such as transaction records) to comply with our obligations under applicable tax, accounting, and consumer protection laws. Legal basis: legal obligation.

4. Third Parties and Processors

We share your personal information with the following third-party service providers, each of which acts as a processor on our behalf or as an independent controller for its own purposes (notably advertising platforms). We have taken steps to ensure that each provider offers appropriate contractual safeguards.

We do not sell your personal information to any third party. Advertising platforms such as Meta and TikTok receive data through pixels that you authorize via our consent banner; those platforms process that data in accordance with their own privacy policies and as independent data controllers for their advertising services.

5. Transfers Outside Quebec

Several of our third-party service providers are located outside Quebec, and in some cases outside Canada. Under Section 17 of Quebec Act 25, we are required to assess the level of protection provided by each destination jurisdiction before transferring personal information there, and to take appropriate contractual or technical measures to protect that information.

The following cross-border transfers take place in connection with our website and operations:

• United States — Google Analytics 4, WooCommerce Analytics, Meta Pixel, Google Fonts, YouTube (embedded videos), and Microsoft 365 all transfer personal information to the United States. The United States does not have a privacy law at the federal level that is deemed equivalent to Quebec Law 25. We rely on contractual clauses (data processing agreements and standard contractual terms) with each provider to ensure an adequate level of protection. A Privacy Impact Assessment (PIA) has been or will be conducted for these transfers, as required by Quebec Act 25.
• China — TikTok Pixel transfers personal information (including device identifiers, IP addresses, advertising identifiers, pages visited, and transaction data) to servers operated by TikTok Inc. and its affiliates, which may be located in China or the United States. China does not have a privacy framework deemed equivalent to Quebec Law 25. We rely on TikTok’s data processing terms and standard contractual safeguards. Given the nature of this transfer, we strongly encourage you to review TikTok’s own privacy policy. A Privacy Impact Assessment (PIA) has been or will be conducted for this transfer. This service is only activated with your explicit consent via our cookie banner.

Your website hosting and consent management records remain in Quebec: our site is hosted by Horizon-Cumulus (Quebec), and all consent records managed by Moelleux are stored at OVH in Beauharnois, Quebec. No personal information processed by these core infrastructure services leaves Quebec.

For our business email, Horizon-Cumulus Email keeps communications within Quebec. However, Microsoft 365 is also used for certain business communications, and data processed through Microsoft 365 may be stored in the United States. Microsoft provides standard contractual safeguards for such transfers.

6. Retention Period

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy, or as required by law. The table below summarizes our retention practices by data type.

When personal information is no longer needed, we destroy or anonymize it in a secure manner so that it can no longer be linked to you.

7. Your Rights

Under Quebec Act 25, you have the following rights with respect to your personal information. To exercise any of these rights, please contact our Privacy Officer using the contact information provided in Section 8.

• Right of access: You may request a copy of the personal information we hold about you, along with information about how it is used and with whom it has been shared.
• Right to rectification: If any personal information we hold about you is inaccurate, incomplete, or ambiguous, you may ask us to correct it. If we have shared that information with third parties, we will notify them of the correction whenever possible.
• Right to erasure (right to be forgotten): You may ask us to delete personal information that was collected without a valid legal basis, or that is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to data portability: You may request that we provide you with the personal information you have provided to us in a structured, commonly used, machine-readable format so that you can transfer it to another organization, where technically feasible.
• Right to withdraw consent: Where we rely on your consent to process your personal information (for example, for analytics cookies or marketing pixels), you may withdraw that consent at any time by adjusting your preferences in our cookie banner or by contacting us directly. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

We will respond to your request within 30 days upon receipt, as required by Quebec Act 25. In complex cases, we may extend this period and will notify you accordingly.

If you are not satisfied with our response or believe that we are not handling your personal information in accordance with the law, you have the right to file a complaint with the Quebec Commission on Access to Information (CAI) at https://www.cai.gouv.qc.ca.

8. Person Responsible for the Protection of Personal Information

In accordance with Section 3.1 of Quebec Act 25, LA Touffe has designated a Person Responsible for the Protection of Personal Information. This person oversees compliance with Quebec Act 25, handles requests related to your rights, and serves as the primary point of contact for any privacy-related concerns.

• Name: Geneviève Fillion
• Title: co-founder
• Email: administration@latouffe.ca
• Phone: 438-397-1260

You may contact our Data Protection Officer at any time to exercise your rights, ask questions about this policy, or raise a concern about how your personal information is handled. We will acknowledge your request promptly and provide a full response within 30 days, as required by Quebec Act 25.

9. Effective Date and Versioning

This privacy policy takes effect on June 16, 2026 and supersedes any previous version.

Version: 1

We may update this policy from time to time to reflect changes in our practices, the services we use, or applicable law. When we make material changes, we will update the effective date above and, where appropriate, notify you by email or through a notice on our website. We encourage you to review this policy periodically to stay informed about how we protect your personal information.