Privacy Policy — bareandfair.ca

    Effective: December 15, 2025

    Welcome to bareandfair.ca (the "Site"), operated by Bare and Fair SkinCare Inc. ("Bare & Fair," "we," "us," or "our"). We take your privacy seriously and designed this policy to be clear, practical, and compliant with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and aligned with GDPR-style principles for individuals in the EEA/UK.

    Jurisdiction & Governing Law. This policy and any related disputes are governed by the laws of British Columbia and the federal laws of Canada applicable therein. If you reside in the EEA/UK, your local laws may provide additional rights; this policy is intended to complement—not limit—those rights.

    Introduction

    This Privacy Policy explains what we collect, why we collect it, how we use and share it, and the choices and rights you have. It applies to personal information collected through the Site, related pages, email communications, and digital services we operate.

    By using the Site, you consent to the practices described in this policy. If anything here conflicts with applicable law, the law prevails.

    Information We Collect

    We collect only what we need for specific, identified purposes.

    1) Information you provide

    • Account & profile: name, email, password.
    • Orders & checkout: shipping/billing addresses, contact number, delivery instructions.
    • Payments: payment method details routed through our payment processors (e.g., Shop Pay/Shopify Payments, Stripe, PayPal). We do not store full credit card numbers.
    • Support & community: messages to customer service, survey responses, product reviews, and other user-generated content.
    • Marketing preferences: newsletter opt‑ins and consent records.

    2) Information collected automatically

    • Device & usage: IP address, browser type, operating system, time zone, pages viewed, links clicked, referring/exit pages.
    • Cookies & similar tech: identifiers used to keep you signed in, remember cart contents, measure performance, and personalize content. See Cookies & Tracking below.

    3) Information from third parties

    • Ecommerce platform: We use Shopify to power our store and checkout.
    • Payment & fraud prevention: payment confirmation, limited card metadata (e.g., last four digits, brand), and fraud/risk signals.
    • Logistics: carriers' delivery and status updates.
    • Analytics & advertising partners: aggregated performance and campaign measurement data.

    Children. We do not knowingly collect information from children under 13. If you believe a child provided personal information, contact us so we can delete it.

    How We Use Your Information

    We use personal information to:

    • Provide the service: create/manage accounts; process and fulfill orders; arrange shipping; provide customer support.
    • Improve & personalize: troubleshoot, test features, analyze Site performance, and tailor content.
    • Marketing (with consent where required): send product updates, offers, and newsletters; you can opt out anytime via the unsubscribe link.
    • Security & fraud prevention: detect, prevent, and investigate abuse or harmful activity.
    • Compliance: maintain records for tax/audit requirements; respond to lawful requests.

    Legal bases (EEA/UK where applicable): performance of a contract (fulfilling orders), legitimate interests (Site security, product improvement), consent (email marketing and non‑essential cookies), and legal obligations.

    Data Sharing (Service Providers & Other Disclosures)

    We do not sell your personal information. We share it in limited circumstances:

    • Shopify (platform provider): Our store and checkout are hosted on Shopify. Shopify acts as our service provider/processor and may process your personal information to provide the ecommerce platform, checkout, analytics related to platform operations, and security/fraud prevention.
    • Other service providers: hosting/cloud storage, email delivery, customer support tools, payment processors, shipping/fulfillment partners, security/fraud tools, and analytics/advertising vendors. They may access personal information only to perform services for us and must safeguard it.
    • Business transfers: in connection with a merger, acquisition, financing, or sale of assets, your information may be transferred with appropriate safeguards.
    • Legal & safety: if required by law, subpoena, or to protect rights, property, and safety.
    • With your direction: for example, when you post a review or share content.

    International transfers. Your information may be processed outside your province/country (including the United States, EU, and other locations where our providers operate). Where required, we implement appropriate safeguards (e.g., Standard Contractual Clauses) to protect your information.

    Your Rights

    Under PIPEDA (Canada) you can:

    • Access personal information we hold about you.
    • Request correction if it is inaccurate or incomplete.
    • Inquire about our policies and practices and how we use or share your information.
    • Challenge our compliance with PIPEDA through our Privacy Officer (see Contact Us) and, if unresolved, with the Office of the Privacy Commissioner of Canada (OPC). Provincial rights may also apply (e.g., OIPC BC under the Personal Information Protection Act (PIPA)).

    If you are in the EEA/UK, you may have the rights to access, rectification, erasure, restriction, objection, portability, and to withdraw consent at any time without affecting prior processing. We will honor valid requests as required by law.

    How to exercise your rights. Email us (see Contact Us). We may take reasonable steps to verify your identity and jurisdiction. We aim to respond within 30 days or as required by applicable law.

    Cookies & Tracking

    We use cookies and similar technologies to:

    • Essential operations: keep you signed in, remember your cart, enable checkout.
    • Performance & analytics: understand Site traffic and improve features (e.g., Google Analytics 4 and Shopify analytics tools).
    • Personalization & marketing: present relevant content and measure campaign effectiveness (only with consent where required).

    Your controls. You can manage cookie preferences via our cookie banner/manager and your browser settings. Some browser signals (like "Do Not Track") are not yet standardized, so we rely on choices you make in our cookie tools. We use Shopify's Customer Privacy controls to honor your consent across our store and checkout.

    If you install third‑party apps or interact with third‑party links, those parties may set their own cookies subject to their own policies.

    Security

    We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls, least‑privilege practices, and vendor due diligence. No method of transmission or storage is 100% secure; if we detect a security incident affecting your data, we will take steps consistent with legal obligations and best practices.

    Retention

    We keep personal information only as long as necessary for the purposes described above or as required by law.

    • Account data: retained while your account is active and up to 24 months after inactivity, unless you request deletion sooner or longer retention is required by law.
    • Order & transaction records: retained for 7 years to meet tax/audit obligations.
    • Customer support: retained 24 months from last interaction.
    • Marketing preferences/consent: retained until you withdraw consent (we maintain limited records to document consent history).
    • Analytics data: retained per tool configuration (for GA4, commonly 2 or 14 months for user‑level data).

    When retention ends, we delete or de‑identify information.

    Updates to This Policy

    We may update this policy to reflect operational, legal, or regulatory changes. We will post the updated version with a new "Effective" date and, where required, notify you through the Site or by email. Your continued use of the Site after changes take effect indicates acceptance of the revised policy.

    Contact Us

    Privacy Officer — Bare and Fair SkinCare Inc.
    Email: hello@bareandfair.ca
    Mailing address: Bare and Fair SkinCare Inc., 4265 Lougheed Highway, Suite 1010, Burnaby, BC V5C 3Y6, Canada

    If we can't resolve your concern, you can contact the Office of the Privacy Commissioner of Canada or your provincial regulator (e.g., OIPC of BC) for guidance or to make a complaint:

    Quick ways to use your rights

    • Access/Portability/Correction/Deletion: email hello@bareandfair.ca.
    • Marketing opt‑out: click "unsubscribe" in any marketing email or adjust preferences in your account.
    • Cookies: open the cookie banner/manager on our Site to change settings at any time.
    • Complaints: contact us first; if unresolved, reach the OPC or your provincial authority.

    Shopify‑Specific Information

    For transparency, here are direct links to Shopify's policies that govern platform processing on our behalf:

    For questions about how we use Shopify services or other processors, please contact our Privacy Officer.