GiddyGadget.com is the controller of the personal information described here. Effective date: 28 July 2026.
Who is responsible
The person in charge of protecting personal information at GiddyGadget.com is our Privacy Officer. Reach them at info@giddygadget.com. Every question, request or complaint in this policy goes to that address and is answered within 30 days.
What we collect and why
- To fulfil your order: name, shipping and billing address, email, phone. We cannot ship without these.
- Payment: handled entirely by Stripe. Card numbers never reach our servers and we never store them.
- Marketing email: only if you opt in explicitly. The box is never pre-ticked, and you must confirm by clicking a link we email you (double opt-in). We record the time and IP address of that confirmation as proof of consent, as CASL requires.
- Analytics and advertising: only if you accept them on the cookie banner — see the next section for exactly what that controls.
Contact form. If you write to us through the form on our Contact page, your name, email address, chosen topic and message are emailed to us so we can answer. What you write is never stored on this website — there is no copy of your message in our database, only the email in our inbox. There is one narrow exception, and it is about reaching you rather than keeping your data: if that email cannot be sent, your name, email address and the topic you chose — never the message itself — are recorded in this site’s operations log, so that a person can see a message was lost and contact you about it. That log holds only the 50 most recent entries, and the copy our store software keeps is deleted after 30 days.
Cookies and tracking technologies, and how to turn them off
- Essential cookies keep your cart, your sign-in and checkout security working. They are always set, because the shop cannot work without them, and they are not used for advertising.
- Analytics and advertising — we run Google Consent Mode v2, which sets advertising storage, advertising personalisation, ad user data and analytics storage to denied by default on every page, before any tag is able to run. Meta’s pixel script and Pinterest’s tag are not fetched at all until you accept. Choosing “Essential only”, or ignoring the banner, leaves everything denied — ignoring it grants nothing.
- Proof that you accepted: when you click “Accept all”, we keep a server-side record of that acceptance so we can demonstrate it if it is ever challenged — a consent ID, your IP address, your browser’s user-agent string, the exact wording you were shown, and the date and time. We keep this record for 13 months and then delete it automatically. An erasure request removes the IP address and user-agent from it straight away; the consent ID, wording and timestamp are kept as anonymised proof that consent was given, which we are required to be able to show. If you have never accepted, choosing “Essential only” is never recorded this way — declining creates no record at all. If you accepted and later withdraw, we do not create a new record: we stamp the withdrawal onto the record you already have, so it shows when your consent ended.
- Changing your mind: the Cookie preferences link in the footer reopens the banner on any page, so you can change your answer at any time. Withdrawing takes the same single click as accepting.
- Turning them off yourself: your browser settings can block or delete cookies, and Google publishes an official Analytics opt-out browser add-on.
Who we share it with
Only with the processors needed to run the store: Stripe (payments), our fulfilment and shipping partners (your delivery details, so your order can be picked, packed and shipped), our email provider (order and marketing email), and, with your consent, Google, Meta and Pinterest for analytics and advertising measurement. Each is bound by contract to use your information only to provide that service to us. We never sell your personal information.
Information communicated outside Canada
Running this store means your personal information is communicated outside Quebec and outside Canada. Your name, delivery address and phone number are sent to fulfilment partners in China so your order can be shipped; Stripe, our email provider, Google, Meta and Pinterest process data in the United States and elsewhere. Before we use a processor we assess whether the information will receive adequate protection there, taking account of the law that applies in that country, and we bind the processor by contract. You should know that information held in another country can be subject to that country’s laws, including access by its courts and authorities. Ask our Privacy Officer if you want the detail for a particular processor.
Automated decision-making
No decision about you is made by a machine alone. Nothing — pricing, eligibility, whether we accept your order — is decided exclusively by automated processing of your personal information. Stripe screens payments for fraud and can decline a card; if that happens to you, email us and a person will look at it.
Advertising profiling, if you allow it. We would rather say this plainly than hide it under “analytics”: if you accept advertising cookies, Google, Meta and Pinterest may use what they observe on this site to measure our ads and to show you ads elsewhere, and the Meta and Pinterest integrations can send them a scrambled (hashed) form of the email or phone number you gave at checkout so they can match you to an account. Pinterest’s happens from our own server once your order is paid, rather than from your browser, and it also carries your IP address and your browser’s user-agent string. It is still governed by the same answer you gave the banner: we record that answer on the order at the moment you buy, and an order that carries no answer is treated as a refusal and reported to nobody. That is profiling in the sense Quebec’s Law 25 means it. It is why the setting is off until you turn it on, why the banner asks before anything runs, and why you can withdraw it from the Cookie preferences link in the footer. Decline it and none of it happens; the shop works exactly the same.
How long we keep it
- Orders, invoices and tax records: 7 years, as Canadian tax and business-record rules require, and then anonymised — the sale stays in our books, you are removed from it.
- Inactive customer accounts: removed after 3 years with no order and no sign-in.
- Marketing subscriptions: until you unsubscribe, apart from the record of your consent, which CASL requires us to be able to produce.
- Cookie consent records: 13 months, then deleted automatically — or sooner and anonymised, on an erasure request (see “Cookies and tracking technologies” above).
- Analytics: the provider’s own retention period.
Your rights
- Access and correction — a copy of what we hold about you, and correction of anything inaccurate or incomplete.
- Deletion — of anything we are not legally required to keep (see retention above). The one exception is our record that you consented to cookies: we anonymise it rather than delete it, because it is also our evidence that we were entitled to set advertising cookies for you — see “Cookies and tracking technologies” above.
- Portability — the information you gave us, in a structured, commonly used technical format, or sent straight to another organisation where that is possible.
- De-indexing and cessation of dissemination — you can require us to stop disseminating your personal information, or to de-index any link giving access to it, where doing so causes you serious injury to reputation or privacy.
- Withdrawing consent — one-click unsubscribe in every marketing email, and the Cookie preferences link in the footer for analytics and advertising.
Email info@giddygadget.com and we respond within 30 days, free of charge. If you are not satisfied with our answer you can complain to the Office of the Privacy Commissioner of Canada, or, in Quebec, to the Commission d’accès à l’information du Québec. If you live in a US state with its own privacy law, make the same requests to the same address and we will handle them the same way.
If something goes wrong
If personal information we hold is lost, or accessed or used without authorisation, and that creates a risk of serious harm, we will notify the people affected and the appropriate regulator promptly — telling you what happened, what information was involved and what to do about it. We keep a register of every confidentiality incident, notifiable or not.