Quebec Law 25 compliant

Privacy Policy

Last updated: May 8, 2026 · Version 1.0

1. Who we are

Maison Aurélia is an author jewelry workshop based in Montréal (Quebec, Canada). We design and craft 18K gold and lab-grown stone jewelry in limited series.

Address: 1234 Saint-Paul East, Montréal (QC) H2L 1H8
General email: hello@maison-aurelia.ca
Phone: +1 (514) 555-0188

2. Privacy Officer (Person in Charge of Personal Information Protection)

In accordance with Section 3.1 of Quebec Law 25, we have designated a Privacy Officer:

• Name: Léa Aurélia Tremblay, founder
• Dedicated email: privacy@maison-aurelia.ca
• Phone: +1 (514) 555-0188, ext. 2

This is the person to contact for any question about your data, or to exercise any of your rights (see section 8).

3. What data we collect

Data you provide

• Identity: first name, last name, email, phone (optional), shipping and billing address
• Customer account (if created): hashed password, order history, wishlist
• Communications: content of messages sent through the contact form or by email
• Payment: processed by our provider Stripe Inc. — we never store your credit card number

Automatically collected data

• Technical: IP address, browser type, operating system, language, pages visited, dates and durations
• Cookies: only with your consent per category (see section 5)

4. Why we collect it

Every collection has a specific, limited purpose:

• Process your order: identity, address, payment, delivery communication (basis: contract performance)
• Respond to you: handle requests sent via the contact form (basis: consent)
• Keep you informed: send our newsletter, only if you consent via double opt-in (CASL + Law 25)
• Improve the site: anonymized audience measurement, only with your consent (basis: consent)
• Security and fraud: protect transactions and your account (basis: legitimate interest)
• Legal obligations: invoicing, accounting, product warranty (basis: legal obligation)

5. Cookies

We use four cookie categories. Per Section 8.1 of Law 25, all non-essential categories are disabled by default until you give explicit consent.

• Essential (always active): cart, language, theme (light/dark), session security. No third-party transfer.
• Preferences (on consent): wishlist, product option choices, stored on your device only.
• Statistics (on consent): anonymized audience measurement (Plausible Analytics, hosted in Europe — no identifiable data transferred outside Canada).
• Marketing (on consent): advertising campaigns (Google Ads, Meta Ads) and remarketing. May involve transfer outside Quebec (United States) — see section 7.

You can change your preferences at any time: Manage my cookies

6. Retention periods

• Active customer account: for the duration of membership + 3 years after last login
• Order data: 10 years (Tax Act accounting requirement)
• Payment data: 13 months maximum, hosted by Stripe (PCI-DSS Level 1)
• Newsletter subscription: until unsubscribe + 30 days for processing
• Contact messages: 3 years after last exchange
• Statistics cookies: 13 months maximum
• Marketing cookies: 6 months maximum

7. Transfers outside Quebec

Some of our features involve data transfer outside Quebec. In accordance with Section 17 of Law 25, we have conducted a Privacy Impact Assessment (PIA) for every transfer. Recipients:

• Stripe Inc. (United States) — payment processing. PCI-DSS Level 1 certified and compliant with the Commission d'accès à l'information requirements.
• Canada Post / Purolator (Canada) — order shipping. Data limited to name and address.
• Brevo (France) — newsletter delivery. EU hosting, GDPR and Law 25 compliant.
• Plausible Analytics (Germany) — audience measurement, anonymized at source, no identifiable data transferred.

Transfers to the United States (Stripe, potential hosting) are subject to standard contractual clauses and an assessment of the recipient country's legal regime (CLOUD Act).

8. Your rights (Law 25)

Under Quebec Law 25, you have the following rights regarding your personal data:

• Right of access — get a copy of all data we hold about you
• Right of rectification — correct inaccurate, incomplete or ambiguous information
• Right to portability (since September 22, 2024) — receive your data in a structured, commonly used format, or have it transferred to another provider
• Right to withdraw consent — at any time, without justification, by the same means as the consent
• Right to cessation of dissemination / de-indexation ("right to be forgotten")
• Right to be informed of automated decisions — we do not practice automated profiling

To exercise a right: send an email to privacy@maison-aurelia.ca. Response within a maximum of 30 days.

If you are dissatisfied, you may file a complaint with the Commission d'accès à l'information du Québec: cai.gouv.qc.ca

9. Privacy incidents

In the event of a privacy incident with a risk of serious harm, in accordance with Section 3.5 of Law 25, we commit to:

• Notify the Commission d'accès à l'information du Québec as soon as possible
• Notify any affected person whose data is involved
• Keep a register of incidents for 5 years, available to the CAI upon request

10. Minors

Our site is not intended for persons under 14. We do not knowingly collect data from minors without the explicit consent of a parent or guardian (Section 4.1, Law 25). If you are a parent and notice your child has provided us with data, contact the Privacy Officer for immediate deletion.

11. Changes to this policy

Any material change to this policy will be notified to you via a site banner and, where applicable, by email. The last updated date is shown at the top of this page.

Policy drafted using the Nextiweb "Law 25 starter" template (May 2026), aligned with the guidelines of the Commission d'accès à l'information du Québec and Quebec's Act respecting the protection of personal information in the private sector (P-39.1).