Privacy Policy

Curvelle ("we", "our", or "us") is a Canadian-owned online retailer operating at curvelle.com. We sell women's underwear, shapewear, lingerie, and swimwear across Canada. This Privacy Policy explains how we collect, use, disclose, and protect personal information in accordance with: - The Personal Information Protection and Electronic Documents Act (PIPEDA) (federal) - The Personal Information Protection Act (PIPA) of Alberta - The Personal Information Protection Act (PIPA) of British Columbia - Quebec's Act to Modernize Legislative Provisions Respecting the Protection of Personal Information (commonly called Law 25 or Act 25), fully in force since September 22, 2023 Alberta and British Columbia each have provincial privacy legislation deemed substantially similar to PIPEDA by the federal government. For residents of those provinces, their respective PIPA applies to how we handle your personal information in connection with purely intra-provincial commercial activities. Quebec Law 25 applies to any enterprise operating in Quebec and carries additional obligations described in Section 11 below. By shopping with us or creating an account, you consent to the collection, use, and disclosure of your personal information as described in this policy.

Personal information is any information about an identifiable individual. Under Canadian privacy law, personal information includes (but is not limited to): - Your name, address, email address, and phone number - Your payment information (processed and stored by our payment provider) - Your order and purchase history - Your size preferences, wishlist, and browsing activity on our site - Your IP address and device information Business contact information (such as a business name and business phone number used strictly in a business capacity) is generally not considered personal information under Canadian law. However, we treat all personal data with the same care regardless of its technical category.

We collect personal information in the following ways: Information you provide directly: - Account registration: name, email address, and password (hashed, never stored in plain text) - Order placement: shipping address, billing address, and payment details (payment is processed by Stripe; we do not store credit card numbers) - Size and fit preferences: bra size, underwear size, body measurements if you choose to provide them - Communications: emails, chat messages, or support requests you send us Information collected automatically when you visit our site: - Device and browser information: browser type, operating system, and screen resolution - Usage data: pages visited, products viewed, items added to cart, session duration, and click patterns - IP address and approximate location: used for fraud prevention, currency display, and tax calculation - Cookies and similar technologies: see Section 7 for our full cookie notice Information from third parties: - Payment confirmation and fraud signals from Stripe - Shipping confirmation and tracking data from our courier partners We collect only the personal information we need to fulfil the purpose for which it is collected, consistent with the principle of data minimization under Canadian privacy law.

We use your personal information only for the purposes for which it was collected or for a directly related purpose, as required by PIPEDA and the provincial PIPA laws. Specifically, we use your information to: - Process and fulfil your orders: including payment processing, shipping, and delivery confirmation - Manage your account: authentication, account settings, order history, and wishlist - Provide customer support: respond to inquiries, returns, exchanges, and complaints - Send transactional communications: order confirmations, shipping notifications, and return updates (these are essential; you cannot opt out while placing orders) - Send marketing communications: newsletters, promotions, and new arrivals — only with your consent, and you can unsubscribe at any time - Improve our store: analyze aggregate shopping patterns to improve product selection and site experience - Prevent fraud and abuse: detect fraudulent transactions and unauthorized account access - Meet legal obligations: retain billing records for tax purposes, respond to lawful government requests We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

We obtain meaningful consent before collecting, using, or disclosing your personal information, consistent with PIPEDA's consent requirements and the substantially similar provincial laws. Express consent (opt-in) is required for: - Marketing emails, SMS, and promotional communications - Sharing your information with third parties for purposes beyond order fulfilment Implied consent applies to: - Information collected as a necessary part of placing an order (e.g., shipping address for delivery) - Transactional emails required to complete a purchase You may withdraw consent at any time by: - Clicking Unsubscribe at the bottom of any marketing email - Emailing us at privacy@curvelle.com - Updating your communication preferences in your account settings Withdrawing consent for certain data uses (such as order processing) may affect our ability to provide services to you. Note for Quebec residents: Under Quebec Law 25, if we use your personal information for profiling, targeted advertising, or automated decision-making, we will obtain your express consent separately. See Section 11 for your additional rights.

We share your personal information only as necessary and only with organizations that have agreed to protect it appropriately. Service providers we use: - Stripe (payment processing): your billing address and payment method are shared with Stripe to process transactions. Stripe is PCI-DSS Level 1 certified. - Shipping carriers (Canada Post, Purolator, UPS, FedEx): your name and shipping address are shared to deliver your order. - Resend (transactional email): your email address is shared to send order confirmations and shipping notifications. - Supabase (database hosting): your account and order data is stored on Supabase-managed infrastructure in cloud data centres. We have a data processing agreement in place. - Vercel (website hosting): serves our website. No personally identifiable information beyond standard server logs. All third-party service providers are engaged under data processing agreements and are prohibited from using your personal information for any purpose other than the service they provide to us. Other disclosures: - Legal requirements: we may disclose information if required by law, court order, or government authority with proper legal jurisdiction - Business transactions: if Curvelle is acquired or merged, your information may be transferred to the new entity, subject to the same privacy protections. We will notify you before any such transfer. We will never sell your personal information.

We use cookies and similar technologies on our website. A cookie is a small text file stored on your device by your browser. Cookies we use: - Essential / functional cookies: required for your session (keeping you signed in), shopping cart state, and site security. These cannot be disabled without breaking the site. - Preference cookies: remember your settings, such as currency or language preference. - Analytics cookies: aggregate, anonymized data about site usage (e.g., pages visited, time on site). We use this to improve our store. No individual tracking. We do not use advertising cookies, cross-site tracking cookies, or any third-party tracking technology that follows you across other websites. You can manage cookies through your browser settings. Disabling essential cookies will prevent you from signing in or completing checkout. For Quebec residents: where we use cookies or automated data processing for purposes that go beyond site functionality, we will seek express consent as required by Law 25.

We keep your personal information only as long as necessary for the purposes described in this policy, or as required by law. - Account data (name, email, preferences): retained while your account is active. Deleted within 30 days of account closure upon request. - Order records: retained for 7 years from the order date, as required by the Canada Revenue Agency (CRA) for tax purposes. - Payment records: Stripe retains records of transactions; we retain the reference number only. - Marketing consent records: retained for the duration of our relationship to demonstrate compliance. - Server logs: automatically purged after 90 days. - Database backups: purged within 30 days once superseded. If you close your account or request deletion, we will anonymize or delete your personal information except where we are legally required to retain it (such as order records for tax compliance).

You have the following rights under PIPEDA and applicable provincial privacy laws: Access: You may request access to the personal information we hold about you. We will respond within 30 days (as required by PIPEDA). There is no fee for the first access request in a 12-month period. Correction: If you believe any personal information we hold about you is inaccurate or incomplete, you may request that we correct it. Withdrawal of consent: You may withdraw consent to certain uses of your personal information at any time (subject to legal or contractual restrictions). Deletion: You may request deletion of your account and associated personal information, subject to our legal retention obligations. Complaint: If you believe we have violated your privacy rights, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca. Alberta residents may also complain to the Office of the Information and Privacy Commissioner of Alberta. BC residents may complain to the Office of the Information and Privacy Commissioner for British Columbia. Quebec residents may complain to the Commission d'acces a l'information du Quebec (CAI). To exercise any of these rights, contact our Privacy Officer at privacy@curvelle.com.

We apply industry-standard safeguards to protect your personal information against unauthorized access, disclosure, alteration, and destruction: - Encryption in transit: all connections use TLS 1.2 or higher (HTTPS everywhere) - Encryption at rest: database encryption for stored records - Password security: passwords are hashed using bcrypt and are never stored or transmitted in plain text - Access controls: role-based access ensures only authorized personnel can access customer data - Payment security: payment data is handled exclusively by Stripe (PCI-DSS compliant); we never store raw card numbers If we become aware of a privacy breach that poses a real risk of significant harm to any affected individual, we will: 1. Notify the Office of the Privacy Commissioner of Canada as soon as feasible 2. Notify affected individuals directly 3. Maintain a record of all privacy breaches This is consistent with the breach notification requirements of PIPEDA (in force since November 1, 2018) and Quebec Law 25.

Quebec's Act to Modernize Legislative Provisions Respecting the Protection of Personal Information (Law 25) grants Quebec residents additional rights beyond federal PIPEDA: Right to data portability: You may request that we provide your personal information in a structured, commonly used technological format, or that we transfer it directly to another organization, where technically feasible. Right to de-indexation (right to be forgotten): If personal information about you is published on our site and is used to make a decision based solely on automated processing, you may request that we cease disseminating it or de-index it from search engines, where applicable. Profiling and automated decisions: Where we use your personal information for commercial profiling (such as product recommendations based on browsing history), we will disclose this, and you may object to such use. Privacy Officer: As required by Law 25, Curvelle has designated a Privacy Officer responsible for compliance with privacy legislation. You may contact our Privacy Officer at privacy@curvelle.com. Privacy Impact Assessments (PIAs): Before deploying any new technology that collects, uses, or communicates personal information, we conduct a Privacy Impact Assessment as required by Law 25. Consent for sensitive information: We obtain express consent for the collection of sensitive personal information, including biometric data and information relating to health, if applicable. If you are a Quebec resident and wish to exercise any of the rights above, or file a complaint, contact us at privacy@curvelle.com or the Commission d'acces a l'information du Quebec (CAI) at www.cai.gouv.qc.ca.

Our service providers and hosting infrastructure are located in the United States and Canada. When we transfer personal information outside of Canada (for example, to Stripe in the United States), we ensure that adequate contractual protections are in place, including data processing agreements that bind our service providers to privacy standards equivalent to Canadian law. For Quebec residents: any transfer of personal information outside Quebec requires us to conduct a privacy impact assessment and ensure the receiving jurisdiction provides adequate protection. By using our services, you acknowledge that your information may be processed and stored in the United States or other jurisdictions.

Our website and products are not directed at children under the age of 14. We do not knowingly collect personal information from children under 14 without verifiable parental consent. If you believe we have inadvertently collected information from a child under 14, please contact us immediately at support@curvelle.com and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will: - Post the updated policy at curvelle.com/legal/privacy - Update the "Last updated" date at the top of this page - Send a notice to registered account holders by email if the changes are significant We encourage you to review this policy periodically. Your continued use of our website after changes are posted constitutes acceptance of the updated policy.

If you have questions, concerns, or complaints about how we handle your personal information, or if you wish to exercise any of your rights, please contact our Privacy Officer: Privacy Officer, Curvelle Email: privacy@curvelle.com General support: support@curvelle.com Website: curvelle.com We will acknowledge your request within 5 business days and respond substantively within 30 days, as required under PIPEDA. If you are not satisfied with our response, you have the right to escalate your complaint to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca), or the applicable provincial commissioner for Alberta, BC, or Quebec.