GiddyGadget.com (Cherrytree Drive, Brampton, ON L6Y 3P1) is the controller of the personal information described here. Effective date: 28 July 2026.
Who is responsible
The person in charge of protecting personal information at GiddyGadget.com is our Privacy Officer. Reach them at info@giddygadget.com, or by post at Cherrytree Drive, Brampton, ON L6Y 3P1. Every question, request or complaint in this policy goes to that address and is answered within 30 days.
What we collect and why
- To fulfil your order: name, shipping and billing address, email, phone. We cannot ship without these.
- Payment: handled entirely by Stripe. Card numbers never reach our servers and we never store them.
- Marketing email: only if you opt in explicitly. The box is never pre-ticked, and you must confirm by clicking a link we email you (double opt-in). We record the time and IP address of that confirmation as proof of consent, as CASL requires.
- Analytics and advertising: only if you accept them on the cookie banner — see the next section for exactly what that controls.
Cookies and tracking technologies, and how to turn them off
- Essential cookies keep your cart, your sign-in and checkout security working. They are always set, because the shop cannot work without them, and they are not used for advertising.
- Analytics and advertising — we run Google Consent Mode v2, which sets advertising storage, advertising personalisation, ad user data and analytics storage to denied by default on every page, before any tag is able to run. Meta’s pixel script is not fetched at all until you accept. Choosing “Essential only”, or ignoring the banner, leaves everything denied — ignoring it grants nothing.
- Changing your mind: the Cookie preferences link in the footer reopens the banner on any page, so you can change your answer at any time. Withdrawing takes the same single click as accepting.
- Turning them off yourself: your browser settings can block or delete cookies, and Google publishes an official Analytics opt-out browser add-on.
Who we share it with
Only with the processors needed to run the store: Stripe (payments), our fulfilment and shipping partners (your delivery details, so your order can be picked, packed and shipped), our email provider (order and marketing email), and, with your consent, Google and Meta for analytics and advertising measurement. Each is bound by contract to use your information only to provide that service to us. We never sell your personal information.
Information communicated outside Canada
Running this store means your personal information is communicated outside Quebec and outside Canada. Your name, delivery address and phone number are sent to fulfilment partners in China so your order can be shipped; Stripe, our email provider, Google and Meta process data in the United States and elsewhere. Before we use a processor we assess whether the information will receive adequate protection there, taking account of the law that applies in that country, and we bind the processor by contract. You should know that information held in another country can be subject to that country’s laws, including access by its courts and authorities. Ask our Privacy Officer if you want the detail for a particular processor.
Automated decision-making
No decision about you is made by a machine alone. Nothing — pricing, eligibility, whether we accept your order — is decided exclusively by automated processing of your personal information. Stripe screens payments for fraud and can decline a card; if that happens to you, email us and a person will look at it.
Advertising profiling, if you allow it. We would rather say this plainly than hide it under “analytics”: if you accept advertising cookies, Google and Meta may use what they observe on this site to measure our ads and to show you ads elsewhere, and the Meta integration can send them a scrambled (hashed) form of the email or phone number you gave at checkout so they can match you to an account. That is profiling in the sense Quebec’s Law 25 means it. It is why the setting is off until you turn it on, why the banner asks before anything runs, and why you can withdraw it from the Cookie preferences link in the footer. Decline it and none of it happens; the shop works exactly the same.
How long we keep it
- Orders, invoices and tax records: 7 years, as Canadian tax and business-record rules require, and then anonymised — the sale stays in our books, you are removed from it.
- Inactive customer accounts: removed after 3 years with no order and no sign-in.
- Marketing subscriptions: until you unsubscribe, apart from the record of your consent, which CASL requires us to be able to produce.
- Analytics: the provider’s own retention period.
Your rights
- Access and correction — a copy of what we hold about you, and correction of anything inaccurate or incomplete.
- Deletion — of anything we are not legally required to keep (see retention above).
- Portability — the information you gave us, in a structured, commonly used technical format, or sent straight to another organisation where that is possible.
- De-indexing and cessation of dissemination — you can require us to stop disseminating your personal information, or to de-index any link giving access to it, where doing so causes you serious injury to reputation or privacy.
- Withdrawing consent — one-click unsubscribe in every marketing email, and the Cookie preferences link in the footer for analytics and advertising.
Email info@giddygadget.com and we respond within 30 days, free of charge. If you are not satisfied with our answer you can complain to the Office of the Privacy Commissioner of Canada, or, in Quebec, to the Commission d’accès à l’information du Québec. If you live in a US state with its own privacy law, make the same requests to the same address and we will handle them the same way.
If something goes wrong
If personal information we hold is lost, or accessed or used without authorisation, and that creates a risk of serious harm, we will notify the people affected and the appropriate regulator promptly — telling you what happened, what information was involved and what to do about it. We keep a register of every confidentiality incident, notifiable or not.