PIPEDA Compliance

PIPEDA Compliance Statement

This statement explains how Algaplay handles the personal information of individuals in Canada in accordance with the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 ("PIPEDA"), and, where applicable, substantially similar provincial privacy legislation, including Quebec's Act respecting the protection of personal information in the private sector (the "Quebec Private-Sector Act", as amended by Law 25).

1. Accountability (Principle 4.1)

Algaplay [TBD: full legal entity name and Canadian address, if any] is accountable for the personal information under its control, including information transferred to third parties for processing. Our designated Privacy Officer can be reached at:

2. Identifying Purposes (Principle 4.2)

We collect personal information for the following identified purposes:

  • Creating and managing your customer account.
  • Processing orders, payments, deliveries, returns, and refunds.
  • Providing customer support and responding to enquiries.
  • Sending transactional and, where you have consented, marketing communications.
  • Operating, securing, and improving our website.
  • Complying with legal, tax, and accounting obligations.
  • Preventing fraud and protecting our rights and the rights of others.

Where we wish to use your personal information for a new purpose not identified above, we will obtain your consent before doing so, unless required or authorised by law.

3. Consent (Principle 4.3)

We obtain your knowledge and consent before collecting, using, or disclosing personal information, except where inappropriate (e.g. for the investigation of a breach of an agreement or contravention of a law). The form of consent we rely on (express or implied) depends on the sensitivity of the information and the reasonable expectations of the individual:

  • Express consent for marketing communications (in line with Canada's Anti-Spam Legislation, S.C. 2010, c. 23, "CASL"), for any sensitive information, and for any secondary uses not directly related to the purchase.
  • Implied consent for processing necessary to fulfil an order you have placed and for related transactional communications.

You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent for processing essential to your account or order may prevent us from continuing to provide that service.

4. Limiting Collection (Principle 4.4)

We limit the collection of personal information to what is necessary for the purposes identified above. We do not collect personal information indiscriminately, and we collect by fair and lawful means.

5. Categories of Personal Information We Collect

  • Account information: name, email, password (hashed), preferences.
  • Order and shipping information: billing and shipping address, telephone number, order history.
  • Payment information: processed by certified payment service providers; we do not store full card numbers.
  • Customer-service information: the content of your communications with us.
  • Marketing information: subscription status and engagement data (where you have given express consent under CASL).
  • Technical and usage information: IP address, device identifiers, browser type, pages viewed, cookies and similar technologies.

6. Limiting Use, Disclosure, and Retention (Principle 4.5)

Personal information is used and disclosed only for the purposes for which it was collected, except with your consent or as required or authorised by law. We retain personal information only as long as necessary to fulfil those purposes:

  • Account data: for the lifetime of the account plus up to 24 months of inactivity.
  • Order, invoice, and accounting records: typically 6 to 7 years, in line with the Canada Revenue Agency's record-keeping requirements and applicable provincial law.
  • Customer-service correspondence: up to 24 months from the last interaction.
  • Marketing data: until consent is withdrawn or 24 months of inactivity.
  • Logs and security data: typically 6–12 months.

Information that is no longer required is destroyed, erased, or made anonymous.

7. Accuracy (Principle 4.6)

We take reasonable steps to ensure that personal information is accurate, complete, and up-to-date for the purposes for which it is to be used. You can review and update your account information at any time by signing in to your account, or by contacting us.

8. Safeguards (Principle 4.7)

We protect personal information by appropriate physical, organisational, and technological safeguards, proportionate to the sensitivity of the information. These include encryption in transit (TLS), restricted access on a need-to-know basis, access logging, and contractual safeguards with our service providers.

9. Openness (Principle 4.8)

This statement, together with our Privacy Policy and Cookie Policy, makes specific information about our policies and practices relating to the management of personal information readily available to you.

10. Individual Access (Principle 4.9)

Upon request, and subject to the limited exceptions set out in section 9 of PIPEDA (e.g. solicitor-client privilege, information that would reveal personal information about another individual), we will inform you of the existence, use, and disclosure of your personal information and provide access to that information. You may also challenge the accuracy and completeness of the information and have it amended as appropriate.

To make an access or correction request, contact privacy@algaplay.com. We will respond within 30 days of receipt of your request, as required by section 8(3) of PIPEDA, unless an extension is permitted under section 8(4), in which case we will notify you.

11. Challenging Compliance (Principle 4.10)

You may direct any question or complaint about our compliance with the principles above to our Privacy Officer at privacy@algaplay.com. We will investigate all complaints and, if a complaint is found to be justified, take appropriate measures.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada:

If you reside in Quebec, Alberta, or British Columbia, you may also contact your provincial privacy commissioner.

12. Cross-Border Transfers

Some of our service providers (including our e-commerce platform Shopify and certain marketing and analytics tools) process personal information outside of Canada, in particular in the United States and the European Union. While the personal information is being processed abroad, it may be subject to the laws of those jurisdictions, including lawful access by foreign authorities. We use contractual and organisational safeguards comparable to those required for processing within Canada. You may contact our Privacy Officer for more information about a specific transfer.

13. Breach Notification

In accordance with section 10.1 of PIPEDA and the Breach of Security Safeguards Regulations, where a breach of security safeguards involving personal information under our control creates a real risk of significant harm to an individual, we will notify the affected individuals and the Office of the Privacy Commissioner of Canada as soon as feasible, and maintain a record of every breach of security safeguards.

14. Quebec — Law 25

If you are a resident of Quebec, additional rights and obligations apply under the Quebec Private-Sector Act, as amended by Law 25. In particular, you have the right to be informed of any automated decision based exclusively on automated processing of your personal information, the right to data portability (effective since 22 September 2024), and the right to be informed of any communication of your personal information outside Quebec. Algaplay's Privacy Officer is also the person responsible for the protection of personal information for the purposes of the Quebec Private-Sector Act and can be reached at the address above.

15. Children

Our store is not directed to children. We do not knowingly collect personal information from children without the consent of a parent or guardian. If you believe a child has provided personal information without such consent, please contact us so that we can delete it.

16. Changes

We may update this statement from time to time. The "last updated" date below indicates the most recent revision.

Last updated: 28 April 2026.