Privacy policy

MIZU (working name; legal entity: [LEGAL ENTITY TO BE CONFIRMED]) operates mizutea.ca, a Québec-based online storefront for Japanese teas. This policy explains what personal information we collect, why we collect it, how long we keep it and what your rights are. It is written in accordance with Québec’s Act to modernize legislative provisions as regards the protection of personal information (Law 25) and other applicable laws.

Person responsible for the protection of personal information

In accordance with Law 25, a designated person at MIZU is accountable for the protection of personal information. [PRIVACY OFFICER — PUBLIC DESIGNATION TO COME BEFORE LAUNCH, EMAIL: [email protected] (TO BE CONFIRMED)] Questions, access or correction requests, and complaints about your personal information may be sent to them by email.

Information we collect

• Account and orders: name, email address, mailing address and order history;
• Payment: handled by Stripe; card data (number, expiry date, security code) never touches our servers;
• Cookies and identifiers: language preference, cart contents and — with your consent — analytics and personalization (see the Cookie policy);
• Technical information: server logs (IP address, browser type) for security and diagnostics;
• Correspondence: emails and messages exchanged with customer service.

Purposes and consent

• Fulfilling orders: payment, preparation, shipping, invoicing and after-sales service;
• Providing customer service and answering your requests;
• Keeping the site secure, preventing fraud and countering abuse;
• Improving the site: aggregate usage statistics and personalized product recommendations.

Processing required to fulfil your order rests on the contract of sale and does not depend on consent. Analytics cookies and the personalization profile are used only with your consent, given through the consent banner; you can change or withdraw that consent at any time in the cookie settings, without affecting the lawfulness of processing already carried out. Some collection is otherwise permitted or required by law (for example invoicing and fraud prevention).

How long we keep information

• Orders and invoices: 6 to 7 years, per Revenu Québec and Canada Border Services Agency requirements [TO BE CONFIRMED with counsel];
• Technical logs: 12 months;
• Abandoned carts: 24 months;
• After these periods, information is destroyed or irreversibly de-identified, unless the law requires otherwise.

Your rights and how to exercise them

• Access: obtain confirmation that we hold personal information about you and receive a copy of it;
• Correction: have inaccurate or incomplete information amended;
• Portability: obtain, in a structured, commonly used format, personal information about you collected through technological means;
• Ceasing dissemination and de-indexing: in the cases and under the conditions provided by law;
• Complaint: file a complaint with the Commission d’accès à l’information du Québec (CAI) if you believe your rights are not being respected;
• How to exercise them: use the request tools available in your account or write to [email protected] (to be confirmed); we respond within 30 days of receiving your request at the latest.

Transfers of information outside Québec

Payments are processed by Stripe; your information may therefore be communicated, stored or processed outside Québec. Before any such transfer takes place, we carry out a privacy impact analysis in accordance with section 17 of Law 25 and put protective contractual clauses in place with the provider [reference: subprocessor register]. Our subprocessor list is published at: [SUBPROCESSOR LIST — TO BE PUBLISHED BEFORE LAUNCH].

Automated processing

The product recommendations shown on the site come from automated processing used for personalization only. No decision based exclusively on automated processing that produces legal effects or significantly affects you is made about you. You may obtain information about this processing, submit your comments, or turn personalization off at any time in the cookie settings or by writing to [email protected] (to be confirmed).

Privacy incidents and updates to this policy

We keep a register of privacy incidents. If an incident presents a risk of harm, we notify the Commission d’accès à l’information as well as the individuals concerned, in accordance with Law 25, and we take the steps needed to mitigate the risks. This policy may be updated; the version in force is the one published on this page as of its update date. Any significant change will be brought to your attention before it takes effect.