Privacy Policy For The Crafty Hearts

 1. Our Commitment to Your Privacy The Crafty Hearts (“we” and “The Company") is committed to protecting the privacy and security of your personal information. This Privacy Policy outlines how we collect, use, disclose, and safeguard your data when you visit https://thecraftyhearts.ca (the "Site") or when you purchase our handmade gifts and collaborative goods in person. This policy is designed to comply with the Personal Information Protection Act (PIPA) of Alberta and the Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada. 

2. Accountability & Oversight As a sole proprietorship, Emma Richards acts as the designated Privacy Officer and is responsible for ensuring compliance with this policy. The Company prioritizes secure transactional operations for all buyers and sellers; however, we also rely on trusted third-party platforms to host and process data. 

3. Information We Collect The Crafty Hearts only collects information that is necessary to fulfill our business operations and provide you with a secure shopping experience: 

• Identity and Contact Data: Name, billing address, shipping address, email address, and phone number. 
• Financial Data: Payment card details. These are processed entirely through our secure, third-party payment processors (whether online or via physical point-of-sale terminals). We do not store full or partial clear-text credit card numbers on our servers or personal devices. Every payment transaction is conducted via secure encryption through our third-party gateways, ensuring full compliance with the Payment Card Industry Data Security Standard (PCI DSS). 
• Technical and Usage Data: IP addresses, browser types, and interactions with our Site. As noted upon entering our Site, we use cookies to analyze website traffic and optimize your website experience. 

4. How We Use & Share Your Information Your personal information is used exclusively for the following purposes: 

• Fulfilling, shipping, and tracking orders across Canada. 
• Providing customer service and communicating regarding order status or custom requests. 
• Sending promotional materials or updates, provided we have obtained your explicit consent in accordance with Canada’s Anti-Spam Legislation (CASL). 
• Aggregating traffic data to improve the Site's functionality and user experience. 
• Meeting legal, regulatory, or tax obligations. 

We do not sell, rent, or trade your personal information. We only share your data with trusted third parties necessary to operate our business, such as: 

• E-commerce and Hosting Platforms: To maintain our Site and process orders securely (e.g., GoDaddy). 
• Logistics and Shipping Partners: To deliver your handmade goods. 
• Payment Processors: To securely facilitate transactions in accordance with PCI DSS requirements. 
• Legal Authorities: If required by law, subpoena, or to protect the rights and safety of The Company, the owner, or others. 

5. Consent & Your Rights By using our Site, accepting the cookie prompt, or submitting personal information to complete a purchase online or in person, you consent to the collection, use, and disclosure of your information as described in this policy. You may withdraw your consent at any time, subject to legal or contractual restrictions. Under PIPA and PIPEDA, you have the right to: 

• Request access to the personal information we hold about you. 
• Request corrections to any inaccurate or incomplete information. 
• Ask questions about our data handling practices. 

6. Security, Third-Party Liability, & Data Retention

• While The Crafty Hearts implements stringent digital security measures to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. 
• We rely on industry-leading third-party vendors for hosting and payment processing. 
• In the event of an unforeseen third-party vendor data breach, cyber-attack, or service interruption outside of our direct control, The Crafty Hearts will take all reasonable steps to mitigate any Risk of Harm. 
• However, the user acknowledges that the owner of The Crafty Hearts cannot guarantee absolute security and shall not be held liable for damages resulting from vulnerabilities in third-party platforms, provided we have met our statutory obligations for reasonable security arrangements. 
• We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by Alberta and Canadian law. 
• Once data is no longer required, it is securely destroyed or anonymized. 
• We deploy robust physical and digital security practices to protect personal information against loss, theft, and unauthorized access. 

7. Data Breach Notification In the highly unlikely event of a data breach or security incident that poses a "real risk of significant harm" (RROSH) to your personal information, we have an established incident response protocol. We will promptly notify affected individuals and report the breach to the Office of the Information and Privacy Commissioner of Alberta (OIPC) and the federal Privacy Commissioner, as required by PIPA and PIPEDA. 

8. Contact Our Privacy Officer If you have any questions, concerns, or requests regarding this Privacy Policy, your personal information, or how your data is handled, please contact our Privacy Officer at:

• Email: TechSupport@thecraftyhearts.ca 
• Subject: Privacy Policy Inquiry