Privacy Policy

This website, jenoriscanada.ca, is run by:

The person in charge of the protection of personal information is [Name, title]. You can reach them at [privacy email address], or through the contact form on any page. This is who answers privacy questions, access requests and complaints, and is the contact Quebec’s privacy law asks us to name.

We are based in Canada and follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for customers in Quebec, the Act respecting the protection of personal information in the private sector. If you are in the European Union or the United Kingdom, the rights described below under your own law also apply to you.

We collect only what each part of the shop needs to work. Nothing is collected in the background for advertising.

When you place an order

Your name, email address, phone number, shipping address and any delivery note, along with what you ordered, the amounts, and the order reference. If you are signed in, the order is attached to your account. The phone number is collected because couriers use it to reach you about the delivery.

When you pay

Your card details are entered in a payment window provided by Helcim, our payment processor. They go to Helcim directly and never reach our servers. Helcim tells us whether the payment succeeded and gives us a transaction reference, which we keep with the order so we can issue refunds.

When you create an account

Your name, email address and a password, which we store only as a one-way hash. You may add a phone number and saved addresses. If you sign in with Google, Google sends us your name, email address, profile picture and an account identifier, and we store those instead of a password.

When you write to us

The contact form collects your name, email address, the subject, your message and, if you give it, a phone number. The chat collects your name, email address and the messages you send. A random identifier is set in a cookie so the chat can find your conversation again.

When you subscribe to the newsletter

Your email address, the date you entered it, where on the site you did so, and the date you confirmed. Nothing is sent until you click the link in the confirmation email.

The Jenöris Club

Your points balance and a record of each time points were earned, spent or reversed.

Technical information

Your IP address is held for a short time to limit how often forms can be submitted from one place, and is then deleted automatically. If the Cloudflare bot check is switched on for the contact form, Cloudflare processes your IP address and browser details to tell a person from a script. Our hosting provider keeps ordinary server logs. We do not run analytics or advertising scripts on this site.

• Taking payment, sending your receipt, packing and delivering your order, and handling returns and refunds.
• Running your account and the Jenöris Club, and showing you your own orders and points.
• Answering enquiries and chat messages.
• Protecting the site against fraud, abuse and automated submissions.
• Keeping the records that tax and accounting law requires of a business.

We do not sell personal information, rent it, or share it with anyone for their own marketing. We do not build profiles of visitors, and no decision about you is made automatically.

Today we send only emails that relate to something you did: an order receipt, a refund notice, and replies to your enquiries. Under Canada’s Anti-Spam Legislation these need no prior consent, and they contain no advertising.

The newsletter is separate and only ever goes to people who asked for it twice: once by entering an address in the form, and once by clicking the confirmation link we email. Every newsletter says who it is from, carries our mailing address, and has an unsubscribe link that works with one click and takes effect at once. Unsubscribing from the newsletter never stops order receipts or replies to your enquiries.

We use a small number of cookies, all of them for something you asked for. There are no analytics, advertising or tracking cookies, and no cookie banner is needed for the ones below. This is the complete list.

Three services set their own cookies inside their own windows when you use them: Helcim during payment, Google if you sign in with Google, and Cloudflare if the bot check on the contact form is on. Each is governed by that company’s privacy policy.

Our typefaces are served from this site, so viewing a page does not send a request to a font provider. You can block or delete cookies in your browser at any time; the shop works without them except for staying signed in and keeping a chat thread.

We use a small number of companies to run the shop. Each receives only what its job needs, acts on our instructions, and is bound by a contract that limits what it may do with the information.

• Helcim (Calgary, Canada) processes payments and refunds. Card details go to Helcim and not to us. Helcim states that its systems are in Canada and the United States.
• Vercel hosts the website and its server code.
• Neon hosts our database, which holds orders, accounts, enquiries and chat.
• Resend delivers our emails, so it sees your email address and the contents of receipts and notices.
• Google, only if you choose to sign in with Google.
• Cloudflare, only if the bot check on the contact form is switched on.
• Our couriers receive your name, address and phone number, because they cannot deliver without them.

Beyond that, we disclose personal information only where the law requires it, for example to a tax authority or in response to a valid legal order, or to protect the site and our customers from fraud.

Our database is hosted by Neon in the United States (the AWS us-east-2 region, in Ohio). Vercel and Resend also operate largely from the United States. Helcim holds payment data in Canada and the United States. This means your information is stored and processed outside your own province, and outside Canada. It is protected there by the contractual terms in our agreements with each provider, and it may be subject to the laws of the country where it is held.

If you are in Quebec, this is the notice of communication outside Quebec that Law 25 requires. If you are in the European Union or the United Kingdom, your information is transferred to Canada and the United States on the basis of the data protection terms our providers offer for such transfers.

• Orders, refunds and receipts: for at least six years after the end of the tax year they belong to, because the Canada Revenue Agency requires businesses to keep their records for that long.
• Your account, saved addresses and points: until you ask us to delete the account. Order records attached to it are kept for the period above, with the link to your account removed.
• Chat conversations: deleted automatically 60 days after the last message.
• Newsletter addresses: until you unsubscribe. We then keep the address marked as unsubscribed, so that it can never be added back by mistake, which the anti-spam law expects of us.
• Enquiries: kept while we are dealing with them and afterwards as part of our customer service records, so we can follow up if you write again.
• IP addresses used for rate limiting: a few hours at most, then removed automatically.

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct anything that is wrong or out of date;
• delete your account and the information in it, apart from records we are legally required to keep;
• withdraw a consent you gave earlier, for example by removing Google from your account;
• send you your information in a portable format, where that right applies to you.

Write to [privacy email address] or use the contact form. We will answer within 30 days. We may ask you to confirm your identity first, so that we never hand one person’s information to another.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), to the Commission d’accès à l’information if you are in Quebec, or to the data protection authority in your own country if you are in the European Union or the United Kingdom.

Every page and every request is encrypted in transit. Passwords are stored as one-way hashes, so nobody at Jenöris can read them. Card numbers never enter our systems. Access to orders and enquiries is limited to the people who fulfil them, behind their own sign-in. Forms are rate limited and screened for automated submissions.

If a breach of security ever creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner of Canada as PIPEDA requires, and any other authority the law requires us to inform.

This shop is for adults. You must have reached the age of majority in your province, territory or country to place an order or open an account. We do not knowingly collect information from anyone under 13, and if we learn that we have, we delete it.

When we change this page, the date at the top changes with it. If a change affects how we use information you have already given us, we will tell you on the site or by email before it takes effect.