Privacy Policy

1. Introduction

Elixir Sue ("we," "us," or "our") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in compliance with:

• Personal Information Protection and Electronic Documents Act (PIPEDA)
• Personal Information Protection Act (PIPA) of Alberta
• Canada's Anti-Spam Legislation (CASL)

Our business is located in Olds, Alberta, Canada, and we are committed to the principles of accountability, transparency, and individual control over personal information.

2. What Information We Collect

We collect personal information that you voluntarily provide to us and information automatically collected when you use our website:

2.1 Information You Provide

• Contact Information: Name, email address, phone number, mailing address
• Account Information: Username, password, preferences
• Purchase Information: Billing address, shipping address, payment information (processed securely through third-party payment processors)
• Communications: Messages, inquiries, feedback, and correspondence with us
• Age Verification: Date of birth or age confirmation (required by law for cannabis products)

2.2 Automatically Collected Information

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, time spent on pages, links clicked, referring website
• Cookies and Tracking Technologies: See Section 8 for details
• Location Data: General geographic location based on IP address

3. Why We Collect Your Information

In accordance with PIPEDA's accountability principle, we collect personal information only for specific, legitimate purposes:

• Order Fulfillment: To process, ship, and deliver your orders
• Customer Service: To respond to inquiries, provide support, and resolve issues
• Legal Compliance: To verify age (19+ in Alberta, 18+ in other provinces) and comply with cannabis regulations
• Account Management: To create and maintain your account, preferences, and order history
• Marketing Communications: To send promotional emails, newsletters, and product updates (with your consent per CASL)
• Website Improvement: To analyze usage patterns, improve functionality, and enhance user experience
• Fraud Prevention: To detect, prevent, and investigate fraudulent or unauthorized activities
• Legal Obligations: To comply with applicable laws, regulations, and legal processes

4. Legal Basis and Consent

Under PIPEDA and PIPA, we obtain your consent before or at the time of collecting personal information. Consent may be:

• Express Consent: Obtained through opt-in checkboxes, signed agreements, or verbal confirmation
• Implied Consent: Reasonably inferred from your actions (e.g., providing information to complete a purchase)

You may withdraw consent at any time, subject to legal or contractual restrictions. Withdrawal may limit our ability to provide certain services.

5. How We Use Your Data

We use your personal information only for the purposes identified at the time of collection or as otherwise permitted by law:

• Processing and fulfilling orders
• Communicating about orders, products, and services
• Sending marketing communications (with CASL-compliant consent)
• Personalizing your experience on our website
• Conducting analytics and research to improve our offerings
• Complying with legal and regulatory requirements
• Protecting against fraud, security threats, and illegal activities

6. Sharing of Personal Information

We do not sell, rent, or trade your personal information. We may share your information with:

• Service Providers: Third-party vendors who assist with payment processing, shipping, email delivery, analytics, and website hosting (under strict confidentiality agreements)
• Legal Authorities: When required by law, court order, or government regulation
• Business Transfers: In the event of a merger, acquisition, or sale of assets (with notice to affected individuals)
• Consent-Based Sharing: With your explicit consent for specific purposes

All third parties are contractually obligated to protect your information and use it only for the specified purposes.

7. Data Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by law:

• Account Information: Retained while your account is active and for a reasonable period after closure
• Transaction Records: Retained for 7 years to comply with tax and financial regulations
• Marketing Consent: Retained until you withdraw consent or unsubscribe
• Legal Requirements: Retained as required by applicable laws and regulations

After the retention period, personal information is securely destroyed or anonymized.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience, analyze usage, and deliver personalized content:

Types of Cookies We Use:

• Strictly Necessary: Essential for website functionality (e.g., shopping cart, login)
• Analytics: Help us understand how visitors use our site (e.g., Google Analytics)
• Marketing: Used to deliver relevant advertisements and track campaign effectiveness
• Functional: Remember your preferences and settings

You can manage cookie preferences through our cookie consent banner or your browser settings. Disabling certain cookies may affect website functionality.

9. Your Rights Under PIPEDA and PIPA

You have the following rights regarding your personal information:

• Right to Access: Request a copy of the personal information we hold about you
• Right to Correction: Request correction of inaccurate or incomplete information
• Right to Withdraw Consent: Withdraw consent for marketing communications or other non-essential uses
• Right to Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Right to Data Portability: Request your data in a structured, commonly used format
• Right to Object: Object to certain uses of your personal information
• Right to Complain: File a complaint with the Privacy Commissioner of Canada or Alberta's Office of the Information and Privacy Commissioner

To exercise these rights, contact our Privacy Officer (see Section 11).

10. CASL Compliance (Commercial Electronic Messages)

We comply with Canada's Anti-Spam Legislation (CASL) for all commercial electronic messages (CEMs):

Consent for Marketing Emails:

• Express Consent: Obtained through clear opt-in checkboxes during account creation or newsletter signup
• Implied Consent: May apply for existing business relationships (e.g., recent purchases within 2 years)
• Unsubscribe Mechanism: Every marketing email includes a clear, functional unsubscribe link
• Identification: All emails clearly identify Elixir Sue as the sender and include our contact information

You can unsubscribe from marketing emails at any time by clicking the unsubscribe link or contacting us directly. Transactional emails (order confirmations, shipping updates) are not subject to CASL consent requirements.

11. Contact and Complaints

If you have questions, concerns, or complaints about this Privacy Policy or our privacy practices, please contact our Privacy Officer:

We will respond to your inquiry within 30 days. If you are not satisfied with our response, you may file a complaint with:

• Office of the Privacy Commissioner of Canada: www.priv.gc.ca
• Office of the Information and Privacy Commissioner of Alberta: www.oipc.ab.ca

12. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction:

• Secure Socket Layer (SSL) encryption for data transmission
• Secure servers and databases with restricted access
• Regular security audits and vulnerability assessments
• Employee training on privacy and data protection
• Confidentiality agreements with third-party service providers

While we strive to protect your information, no method of transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

13. International Data Transfers

Your personal information may be transferred to and processed in countries outside of Canada, including the United States, where our service providers are located. These countries may have different data protection laws than Canada.

We ensure that appropriate safeguards are in place, including contractual protections, to maintain the security and confidentiality of your information during international transfers.

14. Children's Privacy

Our website and products are intended for adults only. We do not knowingly collect personal information from individuals under the legal age for cannabis purchase (19+ in Alberta, 18+ in other provinces).

If we become aware that we have collected information from a minor, we will take immediate steps to delete such information.

15. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. The "Last Updated" date at the top of this page indicates when the policy was last revised.

Material changes will be communicated through:

• A prominent notice on our website
• Email notification to registered users (where appropriate)
• Updated "Last Updated" date

Your continued use of our website after changes are posted constitutes acceptance of the updated Privacy Policy.

16. Accountability

Elixir Sue is accountable for all personal information under our control, including information transferred to third-party service providers. We have designated a Privacy Officer responsible for:

• Ensuring compliance with PIPEDA, PIPA, and CASL
• Developing and implementing privacy policies and procedures
• Responding to privacy inquiries and complaints
• Training employees on privacy obligations
• Monitoring and auditing privacy practices