Scope and acceptance
By accessing our website or providing information through forms, checkout, email, or telephone, you acknowledge that you have read this policy. If you do not agree with its terms, please discontinue use of our digital properties. Separate terms may apply to specific promotions, wholesale agreements, or pilot programmes; where those terms conflict on a specific point, the programme-specific document prevails for that engagement only.
Categories of personal data
Depending on how you interact with us, we may process the following categories, not all of which will apply to every visitor:
- Identity and contact data: full name, billing and shipping address, email address, telephone number, company name, and job title when you represent an organization.
- Transaction data: order identifiers, product SKUs, payment status flags (card numbers are handled by payment processors under their certifications; we do not store full payment card numbers on our servers).
- Technical and usage data: IP address, browser type and version, operating system, device identifiers where available, referring URL, pages viewed, approximate geographic area inferred from IP, and timestamps.
- Communications content: free-text messages you submit through contact forms, chat transcripts if offered, and email threads.
- Preference data: cookie selections, newsletter topic preferences when collected, and language settings.
- Support and complaint data: descriptions of issues, photographs you voluntarily attach for damaged-goods claims, and courier tracking references.
Sources of data
We obtain personal data directly from you, automatically through cookies and similar technologies when you use the site, from payment service providers who confirm transaction outcomes, from delivery partners who report delivery status, and in limited cases from publicly available business directories when we verify corporate customers.
Purposes and legal bases
Under the GDPR and UK GDPR, we rely on one or more of the following bases: performance of a contract, legitimate interests that are not overridden by your rights, compliance with legal obligations, and consent where required (for example, non-essential cookies or certain marketing messages). Under PIPEDA and provincial laws, we identify purposes at collection and obtain meaningful consent where the law requires it.
Examples of processing
- Operating the website, authenticating sessions, and protecting against abuse.
- Fulfilling orders, arranging returns, processing refunds, and maintaining accounts.
- Responding to enquiries, managing complaints, and improving training materials internally.
- Conducting aggregated analytics to understand navigation patterns when you enable analytics cookies.
- Sending service announcements about orders, security, or policy updates.
- Complying with tax, accounting, and regulatory requests where disclosure is mandatory.
Cookies and similar technologies
We use cookies and local storage as described in our cookies policy. Essential technologies are needed for security and to remember your consent choices. Optional analytics or marketing technologies load only when you grant consent through the banner or settings panel.
Advertising and measurement
When we use digital advertising, measurement may rely on cookies or similar technologies subject to your consent and our cookies policy. We may process aggregated or pseudonymous data to evaluate campaigns and site performance. We do not sell personal information for third-party advertising where that sale is restricted by applicable Canadian law.
Disclosure to third parties
We disclose personal data to service providers who host infrastructure, transmit email, process payments, perform credit-card tokenization, provide customer-support tooling, or deliver parcels. Contracts require processors to use data only for defined purposes, implement appropriate security, and assist with data subject requests. We may disclose information when required by law, court order, or to protect the vital interests of a person.
International transfers
Some processors may store or process data in the United States, the European Union, the United Kingdom, or other regions. Where the European Commission or UK authorities have not issued an adequacy decision, we implement standard contractual clauses, supplementary measures when appropriate, and transfer impact assessments for recurring arrangements.
Retention
We keep personal data only as long as necessary for the purposes described. Indicative periods include: marketing consents until withdrawal plus a short grace period for suppression lists; contact-form messages up to twenty-four months unless a dispute requires longer retention; transactional and tax records up to seven years where Canadian or provincial law mandates; server logs up to twelve months; cookie consent records up to twelve months before renewal prompts.
Security measures
We employ TLS for data in transit, role-based access controls, multi-factor authentication for administrative interfaces where supported, periodic access reviews, vulnerability monitoring, and incident response procedures. While we strive to protect your information, no system is infallible; please use strong passwords and report suspicious account activity promptly.
Your rights
Subject to applicable law, you may request access to personal data we hold, ask for correction of inaccuracies, request deletion where no overriding ground applies, restrict certain processing, object to processing based on legitimate interests, receive a machine-readable copy of data you provided where processing is automated and contract-based, and withdraw consent where processing is consent-based. EU and UK residents may lodge complaints with their local supervisory authority. Canadian residents may complain to the Office of the Privacy Commissioner of Canada or a provincial commissioner where applicable.
Automated decision-making
We do not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals through this consumer website. Fraud screening may use risk scores with human review for flagged transactions.
Children
The site is not directed to children under sixteen. We do not knowingly collect personal data from children. If you believe we have received such information, contact us and we will delete it promptly.
Changes to this policy
We may update this policy to reflect operational, legal, or regulatory changes. Material updates will be highlighted through a notice on the website or, where appropriate, through email. Continued use after the effective date constitutes acceptance unless applicable law requires explicit consent for new processing.
Data protection requests
Email ask@zelmaronzar.world with “Privacy request” in the subject line. We may ask for reasonable identity verification before fulfilling access or deletion requests.
Postal correspondence
Zelmaronzar, Attention Privacy, 110 Bloor St W, Toronto, ON M5S 2W7, Canada. Include enough detail for us to locate your records without exposing excessive personal data on the envelope.