Privacy policy

Who this policy covers

This policy explains how Nibbo ("we", "us") collects, uses, discloses and protects personal information when you visit nibbo.ca, place an order, or contact us. It is written to meet Quebec's Law 25 and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

Our privacy officer

The person in charge of protection of personal information at Nibbo is Ahmed Al-Dabboos. Direct any privacy question, complaint or rights request to hello@nibbo.ca, marked "Privacy."

What we collect

• Contact and order information you give us directly: name, email address,

shipping and billing address, phone number if provided, and order contents — collected to fulfil and ship your order, process payment, and provide support.

• Account information, if you create one: email, password (stored hashed by our

platform, never in plain text), order history and wishlist.

• Communication preferences: whether you've consented to marketing email, SMS,

or both. We ask for consent to each channel separately — agreeing to one does not enrol you in the other.

• Technical and usage information: pages viewed, device and browser type,

approximate location from IP address, and similar analytics data, collected through cookies and similar technology.

Cookies and tracking technology

We use cookies required to operate the store (cart, checkout, sign-in) and, where enabled, analytics and marketing cookies (for example, to measure which pages are useful or to show relevant ads). Before any identification, location or profiling technology beyond what's strictly necessary to run the store is activated for a Quebec resident, we disclose that it is in use and provide a way to turn it off, and non-essential tracking defaults to off until you choose to allow it. You can manage cookie preferences at any time through the cookie settings link in the site footer, and through your browser's own controls.

Why we collect it, and the consent behind it

We collect and use personal information only for the purpose we told you about at the time of collection: fulfilling your order, operating your account, responding to your message, or — only with your separate, specific consent — sending you marketing communications. We do not bundle consents together; agreeing to receive order updates does not mean you have agreed to marketing email, and vice versa. You can withdraw consent at any time, free of charge, as described below.

We do not sell your personal information. We do not and will not sell, rent or trade your personal information to third parties for their own marketing purposes.

Who we share it with

We share personal information only with service providers who need it to help us run the store, under contractual obligations to protect it and use it only for the purpose we specify — for example, our e-commerce platform, payment processor, shipping carriers, and, where you've consented, our email/SMS marketing platform. We do not share personal information with unrelated third parties for their own use.

Cross-border storage and processing

Some of the service providers above operate outside Quebec, including in the United States. That means your personal information may be stored or processed outside Quebec and Canada, and may become subject to the laws of that jurisdiction, including lawful access by that jurisdiction's authorities. We choose providers with strong contractual privacy and security commitments, but we want you to know this before you provide information to us, as required under Law 25.

How long we keep it

We retain order and transaction records for six years from the end of the year in which the transaction occurred, matching the record-keeping period required of retailers under the Canada Consumer Product Safety Act. Account information is kept while your account is active and for a reasonable period after inactivity to meet legal and accounting obligations, then deleted or anonymized. Marketing consent records (what you agreed to, when, and how) are kept for as long as needed to prove consent, generally the length of the relationship plus a limitation period.

Children

We do not knowingly collect personal information — including an email address or phone number — from a child under 14 without the consent of a parent or guardian. If you believe a child has provided us with personal information without that consent, contact our privacy officer and we will delete it.

Your rights

Subject to limited exceptions set out in law, you have the right to:

• Access the personal information we hold about you;
• Correct information that is inaccurate, incomplete or out of date;
• Withdraw consent to a use we've told you about, at any time;
• Request deletion or de-indexing of personal information, subject to our

legal retention obligations described above;

• Receive a copy of certain personal information you've provided us, in a

structured, commonly used format, so you can transfer it elsewhere (data portability); and

• File a complaint with us directly, or with Quebec's *Commission d'accès à

l'information or the federal Office of the Privacy Commissioner of Canada*, if you believe we have not respected your rights.

To exercise any of these rights, contact our privacy officer at hello@nibbo.ca. We will respond within the time required by law.

How we protect it

We rely on our service providers' security controls (encryption in transit, access controls, hosting security) and limit access to personal information internally to what's needed to do the job. If a privacy incident poses a real risk of serious injury to you, we will notify you and the Commission d'accès à l'information without delay, and we keep an internal register of every incident, as Law 25 requires.

Unsubscribing

Every marketing email includes an unsubscribe link, effective within 10 business days of your request, at no cost, with no login or further action required. For SMS, reply STOP at any time.

Changes to this policy

We may update this policy as our practices or the law changes. The effective date at the top reflects the most recent version. Material changes affecting how we use your information will be communicated before they take effect where required by law.

Contact

Email hello@nibbo.ca, marked "Privacy," for any question, correction request or complaint.