Privacy policy

• We collect only what we need to take your order, deliver it and look after you afterwards.
• We never sell or rent your personal information.
• We share it only with the services that help us run the shop, such as payment and shipping.
• You can ask to see, correct or delete your information at any time.

The White Willow is a small Canadian online shop at thewhitewillow.ca, selling essential oils, supplements, soaps and personal care. In this policy, “we” and “us” mean The White Willow, and “you” means anyone who visits the site or buys from us.

We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). For customers in Quebec, we also follow Quebec’s Act respecting the protection of personal information in the private sector, as updated by Law 25.

• When you order: your name, email address, billing and shipping addresses, your phone number if you give it, what you bought and what you paid.
• When you pay: you enter your card details into the secure payment form of Stripe, our payment processor, and they go straight to Stripe. We never see or store your full card number.
• If you create an account: your sign-in details and your order history.
• When you contact us: your name, your email address and whatever you write to us.
• If you join our newsletter: your email address.
• When you visit: like every website, our server receives your IP address, browser type and the pages you request. Our host keeps these in its logs for security.

• To process your order, take payment and deliver your parcel.
• To send your order confirmation and shipping updates.
• To answer your questions and handle returns and refunds.
• To keep the business and tax records Canadian law requires.
• To protect the shop and our customers from fraud and misuse.
• To send our newsletter, only if you asked for it.

We don’t build advertising profiles, and we don’t make automated decisions about you.

When you place an order or send us a message, you agree to our using your information for that purpose. The newsletter is opt-in: we only send it if you sign up, and you can unsubscribe at any time by replying to any newsletter or by contacting us.

You can withdraw your consent at any time. If you withdraw consent we need to complete an order, we may not be able to finish it, and we’ll tell you if that’s the case.

We share only what each service needs to do its job:

• Stripe, our payment processor, to take your payment and help prevent fraud. See Stripe’s privacy policy.
• Canada Post, our shipping carrier, which receives your name and shipping address, and sometimes your email or phone number, to deliver your parcel and send tracking updates.
• NameHero, our website host, which stores the site and its data for us on servers in Canada.
• Email delivery services, which send our order emails and replies.
• Google Fonts, which serves the typefaces this site uses. Your browser downloads them from Google’s servers, so Google receives your IP address. See Google’s privacy policy.

We may also disclose information when the law requires it, for example to tax authorities or in response to a court order. If the business is ever sold, customer information would pass to the new owner under the same protections.

Our website, including your account and order records, is hosted on servers in Canada. Some of the other services above, such as Stripe and Google, may store or process information outside Canada, including in the United States. While it’s there, it is subject to the laws of that country and may be accessed by its authorities. We choose services that protect personal information to a standard comparable to Canada’s.

We use only the cookies the shop needs to work: to remember what’s in your cart, keep you signed in to your account and complete checkout securely. We don’t use advertising or tracking cookies, and we don’t use analytics. If that ever changes, we’ll update this policy first.

You can block cookies in your browser settings, but the cart and checkout won’t work without them.

• Orders and payments: six years from the end of the tax year they relate to, as Canadian tax law requires.
• Your account: until you ask us to close it. Order records are still kept for the six years above.
• Messages: as long as we need them to help you, and no more than two years after your last message.
• Newsletter: until you unsubscribe.

When we no longer need information, we delete it or make it anonymous.

The site uses an encrypted connection (HTTPS), card details are handled only by our payment processor, and access to customer information is limited to the people who run the shop.

No system is perfectly secure. If a breach ever creates a real risk of significant harm to you, we will tell you and report it to the Office of the Privacy Commissioner of Canada and, for Quebec residents, to the Commission d’accès à l’information, as the law requires.

You can ask us to:

• tell you what personal information we hold about you and how we have used it;
• correct anything that is wrong or incomplete;
• delete your information, apart from records we must keep by law;
• stop using your information for a purpose you agreed to, such as the newsletter.

If you live in Quebec, you can also ask for your information in a structured, commonly used digital format, and ask us to stop sharing it.

To make a request, contact us. We may ask you to confirm your identity first. We’ll reply within 30 days, and there is no charge.

Our shop is meant for adults. We don’t knowingly collect personal information from children. If you think a child has given us their information, let us know and we will delete it.

The owner of The White Willow is responsible for the personal information we hold and acts as our privacy officer. For Quebec, this is the person in charge of the protection of personal information. You can reach them through our contact page.

Please contact us first, and we’ll do our best to put things right. If you’re not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada. Quebec residents can also contact the Commission d’accès à l’information du Québec.

When we change this policy, we’ll post the new version here and update the date at the top of the page. If a change affects how we use information you’ve already given us, we’ll ask for your consent first.