Privacy Policy

Last updated: 2 October 2026

This policy explains how we handle personal information when you use bdhcreative.com, the online shop of BDH Creative. It says what we collect, why, who receives it, where it goes, how long we keep it, and what you can do about it. We have tried to write it in plain language. If anything is unclear, write to us at [email protected].

1. Who we are

BDH Creative is a brand of BDH Collective Inc. BDH Collective Inc. decides how personal information is used on this site and is responsible for it.

  • Company: BDH Collective Inc.
  • Address: 200-4388 Rue Saint-Denis, MontrĂ©al, QC H2J 2L1, Canada
  • Quebec enterprise number (NEQ): 1171250237
  • Email for privacy questions: [email protected]

The same company runs our other websites: bdhcollective.com, bdhworkshops.com, bdhstreams.com, bernardson.com, pixelconvos.link, econovisuals.com, bowc.xyz, tsoml.xyz and ennov-action.com. This policy covers bdhcreative.com only.

2. Person in charge of personal information

Under Quebec’s Act respecting the protection of personal information in the private sector, the person in charge of the protection of personal information at BDH Collective Inc. is our Founder. You can reach the Founder about any privacy matter:

  • By email: [email protected]
  • By mail: Person in charge of personal information, BDH Collective Inc., 200-4388 Rue Saint-Denis, MontrĂ©al, QC H2J 2L1, Canada

3. What we collect and why

We explain each activity separately, because each has its own purpose and its own rules. For each one we say what we collect, why, the legal basis, who receives it, and how long we keep it.

A note on legal bases. The European and UK General Data Protection Regulation (GDPR) requires us to name a legal basis from its article 6. Quebec law asks a different question: whether we need your consent, or whether the use is necessary for the purpose you gave us your information for. We give both answers.

3.1 Visiting the site

  • What: your IP address, the page you asked for, the time, and technical details your browser sends, such as browser type and device type.
  • Why: to deliver the pages to you, keep the site secure, block abusive traffic, and fix problems.
  • Legal basis: GDPR article 6(1)(f), our legitimate interest in running a secure website. Under Quebec law, this use is necessary to provide the site you asked for, so we do not ask for consent.
  • Who receives it: Hostinger, which hosts our website, and Cloudflare, which sits between your browser and our server and filters malicious traffic.
  • Where: we do not have a source that tells us in which country Hostinger or Cloudflare handles a given request. See section 6.
  • How long: technical logs are kept by these providers only for as long as they need them for security and operation, under their own settings.

Fonts. Our pages no longer load fonts from Google Fonts.

Emoji images from WordPress.org. If your browser cannot show an emoji used on one of our pages, the page loads that emoji as an image from WordPress.org (s.w.org). Your browser then connects to WordPress.org, which receives your IP address and the technical details your browser sends.

3.2 Cookies and similar tools

Some tools on this site store information on your device or read details about it. Section 4 explains which of them load today, and our Cookie Policy lists every cookie and tool by name.

3.3 Contact form

  • What: your name, your email address and your message.
  • Why: to answer your question, custom order request or collaboration request, and to follow up with you about it.
  • Legal basis: GDPR article 6(1)(b), steps you asked us to take, and article 6(1)(f), our legitimate interest in answering messages. Under Quebec law, we use your information only to handle the request you sent us, so we do not ask for your consent for that. We do not use contact messages for advertising.
  • Who receives it: the form sends a notification email, delivered by Emailit, our email delivery service, to our mailbox, which is hosted by Microsoft (Microsoft 365). Our replies to you are sent from and kept in that mailbox. A copy of your name, email address and message is also sent to our automation server, which runs n8n on a server we control, hosted by Hostinger, and from there it is stored as a contact in Boost.space, the customer database we use. Google Analytics also loads on the contact page, as explained in 3.8.
  • Where: we do not have a source that confirms the countries where Emailit, Microsoft and Boost.space store information. See section 6.
  • How long: we keep your message and contact record for as long as we need them to answer you and deal with any follow-up, then we delete them. If your message leads to an order, the order rules in 3.4 apply. You can ask us to delete your message at any time. In any case, this information is deleted no later than 2 years after our last exchange, unless one of the rules above requires us to keep it longer.

3.4 Orders and delivery

  • What: your name, billing and shipping address, email address, phone number, the products you order, and the order amount and status.
  • Why: to take your order, have it made and shipped, send you order emails, handle returns and questions, and keep the accounting records the law requires.
  • Legal basis: GDPR article 6(1)(b), performance of our contract with you, and article 6(1)(c), our legal obligation to keep tax and accounting records. Under Quebec law, this use is necessary to fill your order, so we do not ask for consent.
  • Who receives it: WooCommerce, the shop software that runs on our website; Printful, which produces our print on demand items and receives your name, shipping address and order details so your items can be made and delivered; the shipping carrier that delivers your order, which receives your name and delivery address (ask us and we will tell you which carrier handled your order); Emailit, which delivers our order emails; and Microsoft, which hosts our mailbox (Microsoft 365), for any email you exchange with us about your order.
  • Where: see section 6.
  • How long: basic order and payment records are kept for six years, because Canadian tax law requires it. They are used for accounting only and not to contact you. Your name, email address, shipping address and phone number can be deleted on request once they are no longer needed for the order, subject to that obligation.

We do not offer customer accounts on this site. You check out as a guest.

Our cart and checkout pages may also keep a copy of your cart in your browser’s storage. After you enter your delivery and billing details at checkout, that copy can include them. It stays on your device until your browser’s site data is cleared. Our Cookie Policy lists it.

3.5 Payments and fraud checks at checkout

  • What: the payment details you enter, the amount, and information about your device and browser that payment providers use to detect fraud.
  • Why: to take your payment securely and to prevent fraudulent payments.
  • Legal basis: GDPR article 6(1)(b), performance of our contract with you, and article 6(1)(f), our legitimate interest and the providers’ interest in preventing payment fraud. Under Quebec law, this use is necessary to complete the payment you asked for. This does not cover the WooPayments usage-tracking script or PayPal’s fraud-prevention script described below. Their status is not settled yet.
  • Who receives it:
    • WooPayments, a payment service from WooCommerce (Automattic Inc., United States). On the cart and checkout pages it loads Stripe’s payment script and Sift’s fraud-check script. Sift’s script loads as soon as the cart page opens, before you choose how to pay, and records that page view with a session ID. When you pay by card, WooPayments’ payment script may also build an ID from details about your device and browser and send it with your payment. A WooPayments usage-tracking script also loads on product pages and on the cart page. Usage tracking is turned off in our store settings, and the script’s settings on our pages tell it not to send anything, so it sends nothing.
    • PayPal, if you choose to pay with PayPal. PayPal’s payment buttons load on our product pages and on the cart and checkout pages.
  • An exception not yet settled: PayPal’s fraud-prevention script (FraudNet) collects information about your device and browser. It loads on our product pages and on the checkout pages as soon as a page opens. That happens before you choose to pay and without asking for your agreement first. We have not yet decided whether this script is needed for the site to work. Until we decide, we do not describe it as strictly necessary. You can object to it by writing to [email protected]. Our site has no setting today that stops this script for one visitor, so writing to us does not stop it from loading on your next visit.
  • Where: Automattic Inc. is in the United States. See section 6 for the others.
  • How long: the payment record attached to your order is kept for six years, as described in 3.4. Our website does not keep your full card number. The payment providers keep their own records under their own legal obligations.

3.6 Wishlist

  • What: the products you add to your wishlist, and a random session ID that links the list to your browser.
  • Why: so you can find those products again.
  • Legal basis: GDPR article 6(1)(b), a feature you chose to use. Under Quebec law, this is necessary to provide the feature you asked for.
  • Where it is kept: the wishlist is stored in our website’s database. A wishlist session cookie on your device links your browser to that list. The cookie is set only when you add a product.
  • Who receives it: Hostinger, which hosts our website and its database. We do not send your wishlist to any other company.
  • How long: until you remove the products, or until the wishlist session expires. Under the wishlist tool’s default setting, a session lasts 30 days. Our website then deletes expired wishlists automatically. Deleting the cookie in your browser disconnects you from the list, but it does not delete the list itself: the list is deleted when its session expires.

3.7 Emails we send you

  • What: your email address, the emails we send you, and, where Emailit’s open and click tracking is used, whether you open them and which links you click.
  • Why: to send order emails and replies to your messages, and to understand whether our emails are read.
  • Legal basis: order emails and replies: GDPR article 6(1)(b). Email open and click tracking: this needs your consent, GDPR article 6(1)(a). We do not ask for that consent today, and Emailit may record opens and clicks in the emails we send you. Marketing email: your consent, GDPR article 6(1)(a), and your express consent under Quebec law and Canada’s anti-spam law.
  • Who receives it: Emailit, which delivers the emails sent from this site and provides open and click tracking, and Microsoft, which hosts our mailbox (Microsoft 365), where our replies are sent from and kept.
  • How long: our website keeps a log of the emails it sends for 14 days. Replies stay in our mailbox as long as we need them for your request or order. Tracking information is kept only while we need it to understand how our emails perform.

Marketing email. We send marketing email only to people who have agreed to receive it. You can object to marketing at any time by writing to [email protected]. The newsletter sign-up box on our home page is not connected to a mailing list, so it does not add anyone to one. As explained in 3.8, Google Analytics may still pick up an email address typed into it.

3.8 Analytics

  • What: the pages you visit, the products you view and add to your cart, purchases, how you arrived, actions such as scrolling, clicks on links to other sites, file downloads, site searches and use of forms, your approximate location based on your IP address, device and browser details, and identifiers stored in cookies.
  • Why: to count visits and understand which pages and products people look at, so we can improve the shop, and, through the Google Ads link described below, to measure our Google ads.
  • Legal basis: this use needs your consent, GDPR article 6(1)(a), and under Quebec law your express consent. Google Analytics does not load until you allow Analytics with the consent tool described in section 4. It stays off until you allow it in the banner or the Privacy settings panel.
  • Who receives it: Google, through Google Analytics 4 (measurement ID G-C0DQL3DDS2), which the Site Kit plugin loads once you allow Analytics (Google tag GT-5R89PZD). Our Google Tag Manager container (GTM-MM4V9DR) also holds Google Analytics tags that would send events through our server-side container (GTM-TNVFBN8J), which runs on Google Cloud (App Engine). Our pages do not load the Google Tag Manager container today.
  • Information you type into our pages: the Google tag loaded by Site Kit has Google’s user-provided data collection turned on. It is set to detect email addresses, phone numbers and postal addresses automatically. So Google Analytics may pick up an email address, phone number or postal address that you type into a page of this site. This includes the contact form and the checkout. It may then send it to Google.
  • Link to Google Ads: our Google Analytics property is linked to our Google Ads account, and conversion tracking is turned on in Site Kit. Through this link, analytics data about your visit, such as purchases, can be used in Google Ads to measure our ads, and can be used for advertising audiences where that feature is on in our Google accounts. Because this is an advertising use, Google is also listed in 3.10 and in section 11.
  • Where: Google LLC is in the United States. We do not have a source that tells us in which region our server-side container runs.
  • How long: analytics data is kept for the period set in our Google Analytics account and is then deleted by Google. The analytics cookies stay on your device until they expire or you delete them.

3.9 Security and fraud checks

  • The tool: Fraud Blocker, from Fraud Blocker LLC in the United States. We have set it up to spot fake clicks on our ads.
  • How it works: it reads details about a device, such as the screen, the fonts, the graphics card and the time zone, and builds an ID from them. This technique is called device fingerprinting. It sets no cookie.
  • Status today: its tags sit in our Google Tag Manager container (GTM-MM4V9DR). Our pages do not load that container today, so Fraud Blocker does not run when you visit this site.

3.10 Advertising and social media

  • What: the pages you visit, the products you view and buy, identifiers stored in cookies, and device and browser details.
  • Why: to show ads to people who have visited our shop, to measure which ads lead to sales, and to judge our ad spending.
  • Legal basis: this use needs your consent, GDPR article 6(1)(a), and under Quebec law your express consent. The tools listed below as running do not load until you allow the category they belong to with the consent tool described in section 4.
  • Who receives it today:
    • Google (Google LLC, United States), through the link between our Google Analytics property and our Google Ads account described in 3.8. Google Analytics loads only after you allow Analytics.
    • WooCommerce order attribution, which records on your device where you arrived from, so that an order can be linked to the campaign that brought you. It loads only after you allow Advertising and social media.
  • Set up, but not running today:
    • Meta (Meta Platforms Inc., United States), through the Meta pixel.
    • LinkedIn (LinkedIn Corporation, United States), through the LinkedIn Insight tag.
    • HubSpot, through the HubSpot tracking script.
    • TikTok, through a TikTok pixel. TikTok would send data to China. We will not turn it on without updating this policy first.
  • How it is delivered: the Meta, LinkedIn, HubSpot and TikTok tags sit in our Google Tag Manager container (GTM-MM4V9DR). That container is also set up to send Google Analytics events through our server-side container (GTM-TNVFBN8J), which runs on Google Cloud (App Engine). Our pages do not load the Google Tag Manager container today, so none of these tags run when you visit. Our server-side container can also hold advertising tags, such as a TikTok Events API tag. Our pages do not send information to it today, because they do not load the Google Tag Manager container.
  • How long: each advertising company keeps the information under its own retention settings. The cookies stay on your device until they expire or you delete them.

Under some US state laws, letting advertising companies collect information on our site counts as “selling” or “sharing” personal information, or as targeted advertising. See section 11.

3.11 Your privacy requests

  • What: your name, your contact details, what you asked for, and our reply.
  • Why: to handle your request and to be able to show that we did.
  • Legal basis: GDPR article 6(1)(c), our legal obligation to answer privacy requests. Under Quebec law, this use is necessary to answer you.
  • Who receives it: Microsoft, which hosts the mailbox where privacy requests arrive and where we reply from (Microsoft 365). Nobody else outside BDH Collective Inc. receives it, unless the request concerns a provider named in this policy and we must pass it on.
  • How long: as long as we need it to prove how we handled your request and to deal with any complaint about it.

3.12 Comments and product reviews

  • What: you can leave a comment on our “Hello world!” blog post and a review on our BoldPulse Sports Bra product page. The forms ask for your comment or review, your name and your email address. The comment form also asks for a website, and the review form asks for a star rating. WordPress may also store the IP address and browser details sent with the form.
  • Why: to show your comment or review on our site.
  • Where it is kept: what you send is stored in our website’s database. The form says your email address will not be published.
  • Who receives it: Hostinger, which hosts our website and its database. When you send a comment or a review, WordPress emails a notice about it to our mailbox. The notice includes your name, email address, website, IP address and your text. Emailit delivers that email. Our website keeps a log of the emails it sends for 14 days, as explained in 3.7.
  • Cookies: if you tick the box to save your name, email and website in this browser, our website may set cookies on your device with those details. Our Cookie Policy lists them.
  • Pictures from Gravatar: we turned off commenter pictures on 1 October 2026, so our pages no longer load pictures from Gravatar (secure.gravatar.com).
  • How long: for as long as we need it for that purpose. You can ask us to delete your comment or review at any time.

4. Cookies and similar technologies

We sort the tools on this site into seven categories: Necessary, Security and fraud checks, Preferences, Analytics, Advertising and social media, Email tracking, and Embedded content and chat.

Our consent tool is active on this site. On your first visit, a banner asks for your choice, with the buttons Reject all, Choose and Accept all. Nothing optional loads before you choose. It holds back Google Analytics until you allow Analytics, and WooCommerce order attribution until you allow Advertising and social media. The Privacy settings link at the bottom of every page opens a panel where you can change or withdraw your choice at any time, category by category. The Your Privacy Choices link opens the same panel at its US privacy choices. If your browser sends a Global Privacy Control signal, we treat it as a refusal of advertising and data sharing. We keep your choice in your browser for 6 months, in a cookie named bdhc_consent and a copy in your browser’s local storage, and ask again after that. It also sends your choice to this website so the website can set the same cookie. The website does not keep a copy of your choice. To limit abuse, it counts those requests for about an hour under a scrambled form of your IP address. We also keep a record of each choice on our consent server, as proof of what you chose and when; it is described just below. If you allow these tools and later turn them off, they stop loading, but the _ga, _ga_* and sbjs_* cookies they already set can stay in your browser until they expire or you delete them. On a page with a form, turning a tool off takes full effect on the next page you open. These load whatever you choose: PayPal’s payment buttons on product pages and on the cart and checkout pages, PayPal’s fraud-prevention script on product pages and on the checkout pages, and Stripe’s payment script and Sift’s fraud-check script on the cart and checkout pages. On our shop pages, if you click the grid view or list view button, a cookie may remember your choice. We turned off commenter pictures from Gravatar on 1 October 2026. The tags in our Google Tag Manager container, including Meta, LinkedIn, HubSpot, TikTok and Fraud Blocker, do not run, because our pages do not load that container.

Records of your consent

Each choice you make in the banner or the Privacy settings panel is kept as a record. The record is our proof that you were asked and what you answered. Your browser sends it to our consent server, consent.bcall.dev, which runs on a server BDH Collective Inc. controls, hosted by Hostinger. A record contains:

  • a random consent ID for this choice, and the ID of your previous choice, if there was one;
  • what you did, for example accept all, reject all, save your choices or withdraw, and how you did it: through the banner, the settings panel, a link at the bottom of the page or your browser’s Global Privacy Control signal;
  • your choice for each of the seven consent categories, your choices for individual companies where the tool offers them, your three US opt-out choices, and whether your browser sent a Global Privacy Control signal;
  • the exact value stored in your consent cookie;
  • the date and time of your choice, the time our server received the record, and the date your choice expires;
  • the language and the exact version of the text you were shown, the version of this policy and the version of the consent tool;
  • the page where you made the choice (the path only, without any query string), the host name of the site that sent you there, and a general device type such as mobile or desktop;
  • a one-way coded value made from a shortened version of your IP address, using a key that changes every month;
  • if you were logged in to the site, your WordPress user number and a one-way coded version of your email address.

A record never contains your email address or your IP address in clear. Legal basis: under the GDPR, our legal obligation to be able to show that consent was given (articles 6(1)(c) and 7(1)); under Quebec law, this information is necessary to comply with the law. Each record is kept for the life of the consent, which is 6 months, plus 5 years, and is then deleted from our consent log. Encrypted backup copies are removed within 400 days after that.

You can write to [email protected] about any of these tools, or delete the cookies for this site in your browser. You can change or withdraw your choice at any time with the Privacy settings link.

Our Cookie Policy names every cookie and tool, its category and the company behind it.

5. Who we share information with

We do not share your personal information with anyone except the companies named below, for the purposes described in section 3, and authorities where the law requires it. Here is the complete list, by name:

  • Hostinger: hosts our website, its database (including wishlists, comments and product reviews) and the server where our automation tools run.
  • Cloudflare: protects and delivers our website.
  • WordPress.org: emoji images, loaded only when your browser cannot show an emoji used on a page.
  • Gravatar: commenter pictures were turned off on 1 October 2026, so Gravatar no longer receives anything from our pages.
  • Modular DS: a remote website management service connected to our website, which gives it technical access to the site and to the information stored in it.
  • Google (Google LLC, United States): Google Analytics 4, Site Kit, and Google Ads, which is linked to our Google Analytics property. Our Google Tag Manager container and our server-side tag container on Google Cloud (App Engine) are also set up. Our pages do not load the Google Tag Manager container today.
  • Microsoft (Microsoft 365): hosts our mailbox, which receives contact form messages, comment and review notices, order correspondence and privacy requests, and from which we reply.
  • Emailit: delivers our emails, including the notices we receive about comments and reviews, and provides email open and click tracking.
  • Boost.space: stores contact form submissions as contacts.
  • WooCommerce (Automattic Inc., United States): our shop software and the WooPayments payment service.
  • Stripe and Sift: payment processing and fraud checks used by WooPayments.
  • PayPal: payments by PayPal and its fraud-prevention script.
  • Printful: produces and ships our print on demand items.
  • Shipping carriers: deliver your order.
  • Fraud Blocker LLC (United States): set up to check for fake clicks on our ads, but not running on this site today (see 3.9).
  • Meta (Meta Platforms Inc., United States), LinkedIn (LinkedIn Corporation, United States), HubSpot and TikTok: advertising tags set up in our Google Tag Manager container. Our pages do not load that container today, so these tags do not run (see 3.10).

We may also disclose information when the law requires it, for example in response to a court order, or to establish or defend a legal claim.

6. International transfers

Your information may be processed outside Quebec and outside Canada, including in the United States, by the companies named in section 5. When it is, it is subject to the laws of the place where it is processed, and it may be accessible to the courts, law enforcement and national security authorities there.

You can ask us which country a given provider uses and what protection applies to your information there, by writing to [email protected].

7. How long we keep information

We keep personal information only for as long as we need it for the purpose we collected it for, or as long as the law requires. The periods for each activity are in section 3. In short:

  • Order and payment records: six years, for tax purposes.
  • The log of emails sent by our website: 14 days.
  • Wishlists: until you remove the products or the wishlist session expires, 30 days under the wishlist tool’s default setting.
  • Contact messages, comments and product reviews, privacy requests, analytics and advertising data: for as long as the purpose requires, as explained in section 3.

When we no longer need information, we delete it or make it anonymous.

8. Your rights

Depending on where you live, and in all cases under Quebec law, you have the right to:

  • Access: ask whether we hold personal information about you and get a copy.
  • Rectification: have inaccurate, incomplete or out-of-date information corrected.
  • Deletion: ask us to delete your information when we no longer need it or when its use is not lawful.
  • Portability: receive the information you gave us in a structured, commonly used technological format, and have it sent to another organisation.
  • Withdrawal of consent: withdraw any consent you gave, at any time. This does not affect what was done before you withdrew it.
  • Objection: object to our use of your information based on our legitimate interests, and to marketing, at any time, by writing to [email protected].
  • Restriction: ask us to limit how we use your information while a question about it is being resolved.
  • De-indexing: under section 28.1 of Quebec’s private sector privacy law, ask us to stop disseminating your personal information, or to de-index any hyperlink attached to your name that gives access to it, when that dissemination breaks the law or a court order, or when it causes you serious harm to your reputation or privacy that outweighs the public interest in the information.

9. How to exercise your rights

Write to our person in charge of personal information at [email protected], or by mail to BDH Collective Inc., 200-4388 Rue Saint-Denis, MontrĂ©al, QC H2J 2L1, Canada. Tell us what you are asking for and, if it concerns an order, the email address you used at checkout.

We may ask you for information to confirm your identity before we act, so that we do not give your information to someone else. We answer in writing within 30 days of receiving your request. There is no charge for a request, unless the law allows a reasonable fee for copying or sending information, in which case we tell you the amount first. If we refuse a request, we explain why and tell you how to challenge the decision.

10. Complaints

If you are not satisfied, please write to us first so we can try to fix the problem. You also have the right to complain to a regulator:

  • in Quebec, the Commission d’accès Ă  l’information du QuĂ©bec;
  • in Canada, the Office of the Privacy Commissioner of Canada;
  • in the European Union or the European Economic Area, the data protection supervisory authority of the country where you live or work, or where you think the problem happened;
  • in the United Kingdom, the Information Commissioner’s Office (ICO).

11. Information for US residents

This section applies to residents of US states with consumer privacy laws, including California, Colorado, Connecticut, Virginia, Texas, Oregon and Montana.

Categories of personal information we collect

  • Identifiers: name, email address, postal address, phone number, IP address, and cookie and device identifiers.
  • Commercial information: products ordered, order amounts and order history.
  • Internet or other electronic network activity: pages visited, products viewed, how you arrived, device and browser details, and email opens and clicks.
  • Approximate location: derived from your IP address.
  • Inferences: interest in our products, which can be used for advertising through the link between our Google Analytics property and Google Ads.

We do not intentionally collect sensitive personal information. Please do not include it in contact messages.

Sources

We collect personal information directly from you (forms, orders, emails), automatically from your device and browser (cookies and similar tools), and from our payment providers, which tell us whether a payment went through.

Purposes

Filling and delivering orders, taking payments and preventing fraud, answering messages, sending emails, keeping the site secure, measuring visits, advertising and measuring our ads, keeping records required by law, and handling privacy requests. Section 3 gives the details.

Who receives it

The companies listed by name in section 5. Service providers that process information for us: Hostinger, Cloudflare, Modular DS, Microsoft (Microsoft 365), Emailit, Boost.space, WooCommerce (Automattic Inc.), Stripe, Sift, PayPal, Printful, shipping carriers and Google (including Google Cloud). WordPress.org receives your IP address when your browser loads an emoji image from it (see 3.1). Third parties that receive information for advertising today: Google, for analytics and through the link between our Google Analytics property and Google Ads. Meta, LinkedIn, HubSpot and TikTok have advertising tags in our Google Tag Manager container, and Fraud Blocker LLC has a security tag there. Our pages do not load that container today, so those tags do not run.

Selling, sharing and targeted advertising

We do not sell personal information for money. Google Analytics loads on this site only after you allow Analytics. Our Google Analytics property is linked to Google Ads, so Google can use our analytics data in Google Ads. We treat that as “selling” or “sharing” personal information and as targeted advertising under US state laws. The categories involved are identifiers, internet activity and commercial information. We do not knowingly sell or share the personal information of consumers under 16.

Your opt-out rights

You have the right to opt out of:

  • the sale or sharing of your personal information;
  • targeted advertising;
  • profiling in furtherance of decisions that produce legal or similarly significant effects. We do not make such decisions about you today.

The Your Privacy Choices link at the bottom of every page lets you record your opt-outs in your browser, and keeps Advertising off. If your browser sends the Global Privacy Control signal, the consent tool records the same opt-outs for you. Google Analytics stays off unless you allow Analytics. You can also send us an opt-out request by writing to [email protected]. Our Cookie Policy explains how to block or delete cookies in your browser.

Your other rights

You have the right to know and access the personal information we hold about you, to correct it, to delete it, to get a portable copy, and not to be treated differently for using any of these rights. You may use an authorised agent, and we may ask the agent for proof of authority and ask you to confirm your identity. Section 9 explains how to make a request.

Retention

We keep each category only as long as described in sections 3 and 7: order and payment records for six years, and other information for as long as its purpose requires.

Appeals

If we decline to act on your request, you can appeal our decision. Write to [email protected] with the subject line “Privacy appeal” and tell us which decision you are appealing. The person in charge of personal information reviews the appeal and tells you in writing what was decided and why, within the time your state’s law allows. If your appeal is denied, you may contact the Attorney General of your state.

12. Children

This site is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child under 16 has given us personal information, write to [email protected] and we will delete it.

13. Security

We take reasonable steps to protect personal information against loss, theft and unauthorised access. Our website is served over an encrypted connection (HTTPS). Payments are handled by the payment providers named in section 3.5, and our website does not keep your full card number. No method of sending or storing information is completely secure, so we cannot guarantee absolute security. If a confidentiality incident creates a risk of serious harm to you, we will tell you and the regulators as the law requires.

14. Changes to this policy

We update this policy when our practices or the tools on this site change. The date at the top shows when it last changed.

15. Contact

For any question about this policy or your personal information, write to the person in charge of personal information:

BDH Collective Inc.
200-4388 Rue Saint-Denis
Montréal, QC H2J 2L1, Canada
Email: [email protected]

See also our Cookie Policy and our Terms and Conditions.