Privacy Policy

GiddyGadget.com (89 Cherrytree Drive, Brampton, ON L6Y 3P1, Canada) is the controller of the personal information described here. Effective date: 27 September 2026.

Who is responsible

The person in charge of protecting personal information at GiddyGadget.com is our Privacy Officer. Reach them at info@giddygadget.com, or by post at 89 Cherrytree Drive, Brampton, ON L6Y 3P1, Canada. Every question, request or complaint in this policy goes to that address and is answered within 30 days.

What we collect and why

• To fulfil your order: name, shipping and billing address, email, phone. We cannot ship without these.
• Payment: handled entirely by Stripe. Card numbers never reach our servers and we never store them.
• Marketing email: only if you opt in explicitly. The box is never pre-ticked, and you must confirm by clicking a link we email you (double opt-in). We record the time and IP address of that confirmation as proof of consent, as CASL requires.
• Analytics and advertising: depends on where you are. In Quebec, in the EU and UK, and anywhere outside Canada and the United States, only if you accept them on the cookie banner. Elsewhere in Canada and in the United States they are on by default, we tell you so on your first visit, and you can opt out at any time. The next section explains exactly how.

Contact form. If you write to us through the form on our Contact page, your name, email address, chosen topic and message are emailed to us so we can answer. What you write is never stored on this website — there is no copy of your message in our database, only the email in our inbox. There is one narrow exception, and it is about reaching you rather than keeping your data: if that email cannot be sent, your name, email address and the topic you chose — never the message itself — are recorded in this site’s operations log, so that a person can see a message was lost and contact you about it. That log holds only the 50 most recent entries, and the copy our store software keeps is deleted after 30 days.

Cookies and tracking technologies, and how to turn them off

• Essential cookies keep your cart, your sign-in and checkout security working. They are always set, because the shop cannot work without them, and they are not used for advertising. They include the cookies that remember your cookie choice (gg_consent, and gg_consent_gpc when you made that choice with Global Privacy Control on), and one that tells Meta’s integration on this site to hold its events until your choice allows them (wc_facebook_signals_state). None of them identifies you.
• Which rules apply to you. On your first visit your browser asks our own server which rules apply. The server looks your IP address up in a geolocation database kept on that server, so your address is not sent to anyone else for this, and answers with one word, opt-in or opt-out, which your browser keeps for 24 hours in a cookie called gg_region. That cookie holds only the answer, never your location. Visitors in Quebec, in the EU and UK, and anywhere outside Canada and the United States get opt-in. So does any visitor in Canada whose browser’s first language is French, because a location lookup can place someone in Quebec in the wrong province, and so does anyone we cannot place at all. IP geolocation by DB-IP, licensed under CC BY 4.0.
• Opt-in (Quebec, EU and UK, everywhere else): we run Google Consent Mode v2, which sets advertising storage, advertising personalisation, ad user data and analytics storage to denied by default on every page, before any tag is able to run. Meta’s pixel script and Pinterest’s tag are not fetched at all until you accept. Choosing “Essential only”, or ignoring the banner, leaves everything denied — ignoring it grants nothing.
• Opt-out (the rest of Canada and the United States): analytics and advertising cookies from Google, Meta and Pinterest are on from your first page, and a notice at the bottom of the screen says so until you answer it. Choosing Opt out turns them off straight away: Google is told to stop using its cookies, Meta’s pixel is revoked, Pinterest’s tag is silenced, and the analytics and advertising cookies already set on this site (_ga, _gid, _gcl, _fbp, _fbc, _pin_unauth, _epik) are deleted from your browser.
• Global Privacy Control: if your browser sends the Global Privacy Control signal, we treat it as an opt-out, including over an earlier “Accept all” or “OK” you gave before you turned the signal on. In the opt-out regions nothing is turned on and no notice is shown. If you click “Accept all” or “OK” while the signal is on, we take that as your deliberate choice for this site, and it stands until you change it.
• Proof that you accepted: when you click “Accept all” on the banner, or “OK” on the notice, we keep a server-side record of that acceptance so we can demonstrate it if it is ever challenged — a consent ID, your IP address, your browser’s user-agent string, which of the two you answered (1 for the banner, optout-1 for the notice) and its exact wording, and the date and time. We keep this record for 13 months and then delete it automatically. An erasure request removes the IP address and user-agent from it straight away; the consent ID, wording and timestamp are kept as anonymised proof that consent was given, which we are required to be able to show. Declining creates no record at all: choosing “Essential only” or “Opt out” is never recorded this way unless you had accepted before, and simply leaving the notice unanswered creates no record either. If you accepted and later withdraw, we do not create a new record: we stamp the withdrawal onto the record you already have, so it shows when your consent ended.
• Changing your mind: the Cookie preferences link in the footer reopens the banner, or the notice, on any page, so you can change your answer at any time. Withdrawing or opting out takes the same single click as accepting.
• Turning them off yourself: your browser settings can block or delete cookies, and Google publishes an official Analytics opt-out browser add-on.

Who we share it with

Only with the processors needed to run the store: Stripe (payments), our fulfilment and shipping partners (your delivery details, so your order can be picked, packed and shipped), our email provider (order and marketing email), and Google, Meta and Pinterest for analytics and advertising measurement, subject to your cookie choice (see “Cookies and tracking technologies” above). Each is bound by contract to use your information only to provide that service to us. We do not sell your personal information for money. Some US state privacy laws treat letting advertising platforms observe visits to a website as a “sale” or “sharing” of personal information; to opt out of that, use the Cookie preferences link in the footer or turn on Global Privacy Control in your browser.

Information communicated outside Canada

Running this store means your personal information is communicated outside Quebec and outside Canada. Your name, delivery address and phone number are sent to fulfilment partners in China so your order can be shipped; Stripe, our email provider, Google, Meta and Pinterest process data in the United States and elsewhere. Before we use a processor we assess whether the information will receive adequate protection there, taking account of the law that applies in that country, and we bind the processor by contract. You should know that information held in another country can be subject to that country’s laws, including access by its courts and authorities. Ask our Privacy Officer if you want the detail for a particular processor.

Automated decision-making

No decision about you is made by a machine alone. Nothing — pricing, eligibility, whether we accept your order — is decided exclusively by automated processing of your personal information. Stripe screens payments for fraud and can decline a card; if that happens to you, email us and a person will look at it.

Advertising profiling. We would rather say this plainly than hide it under “analytics”: when advertising cookies are on, Google, Meta and Pinterest may use what they observe on this site to measure our ads and to show you ads elsewhere, and the Meta and Pinterest integrations can send them a scrambled (hashed) form of the email or phone number you gave at checkout so they can match you to an account. Pinterest’s happens from our own server once your order is paid, rather than from your browser, and it also carries your IP address and your browser’s user-agent string. It follows the same cookie rules as everything else: at the moment you buy, we record on the order whether you accepted, declined, opted out (including through Global Privacy Control) or bought under the opt-out notice. Orders placed after accepting, or under the notice without opting out, are reported; every other order, including one that carries no answer at all, is reported to nobody. That is profiling in the sense Quebec’s Law 25 means it, which is why in Quebec, in the EU and UK and everywhere outside Canada and the United States it is off until you turn it on. In the rest of Canada and in the United States it is on unless you opt out, which you can do from the Cookie preferences link in the footer at any time. Either way, the shop works exactly the same with it off.

How long we keep it

• Orders, invoices and tax records: 7 years, as Canadian tax and business-record rules require, and then anonymised — the sale stays in our books, you are removed from it.
• Inactive customer accounts: removed after 3 years with no order and no sign-in.
• Marketing subscriptions: until you unsubscribe, apart from the record of your consent, which CASL requires us to be able to produce.
• Cookie consent records: 13 months, then deleted automatically — or sooner and anonymised, on an erasure request (see “Cookies and tracking technologies” above).
• Analytics: the provider’s own retention period.

Your rights

• Access and correction — a copy of what we hold about you, and correction of anything inaccurate or incomplete.
• Deletion — of anything we are not legally required to keep (see retention above). The one exception is our record that you consented to cookies: we anonymise it rather than delete it, because it is also our evidence that we were entitled to set advertising cookies for you — see “Cookies and tracking technologies” above.
• Portability — the information you gave us, in a structured, commonly used technical format, or sent straight to another organisation where that is possible.
• De-indexing and cessation of dissemination — you can require us to stop disseminating your personal information, or to de-index any link giving access to it, where doing so causes you serious injury to reputation or privacy.
• Withdrawing consent or opting out — one-click unsubscribe in every marketing email, and, for analytics and advertising, the Cookie preferences link in the footer or your browser’s Global Privacy Control signal.

Email info@giddygadget.com and we respond within 30 days, free of charge. If you are not satisfied with our answer you can complain to the Office of the Privacy Commissioner of Canada, or, in Quebec, to the Commission d’accès à l’information du Québec. If you live in a US state with its own privacy law, make the same requests to the same address and we will handle them the same way.

If something goes wrong

If personal information we hold is lost, or accessed or used without authorisation, and that creates a risk of serious harm, we will notify the people affected and the appropriate regulator promptly — telling you what happened, what information was involved and what to do about it. We keep a register of every confidentiality incident, notifiable or not.