Privacy policy

This policy complies with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL) and, for US customers, applicable state privacy laws.

Person in charge

ROKEDO, 62 Sweetland Avenue, Apartment 2b, Ottawa, Ontario, K1N7T6, Canada. Person in charge of the protection of personal information: Hatim Ghaiti — hello@oserene.com.

Information collected

• Identity and contact details (name, delivery address, email, phone) to process and deliver your orders.
• Payment data, processed exclusively by Stripe; Oserene never has access to it.
• Email address for the newsletter and cart reminders, only with your consent.
• Chat messages (name, email, content) to answer your questions.
• Browsing data (pages viewed, device) for audience measurement and advertising, subject to your consent.

Purposes

• Processing orders, delivery and after-sales service.
• Compliance with legal obligations (tax and accounting records, 7 years).
• With your consent: newsletter, abandoned cart reminders, advertising cookies. You may withdraw consent at any time.
• Fraud prevention, site improvement, customer support.

Communication to third parties and transfers outside Canada

Your information is only communicated to the service providers we need to run the shop: Stripe (payment), our logistics partners CJ Dropshipping and the carriers (name, delivery address and phone number, to prepare and ship your parcel, including from warehouses outside Canada), 17TRACK (tracking number and destination country, to follow your parcel), our host Netlify (United States), our database Supabase, our emailing provider Resend (United States) and, only with your consent, Meta, Google, OpenAI and Metricool (visit tracking pixel) for audience measurement and advertising (the email address and phone number sent to Meta are pseudonymised with a cryptographic hash), as well as ipify (United States), which tells us the IPv6 address of your connection without keeping it. Information transferred outside Canada is subject to the laws of the country where it is stored; these transfers are governed by contractual protections that provide a comparable level of protection. Your information is never sold.

Retention

Order data: 7 years (legal obligation). Newsletter: until consent is withdrawn. Chat: 12 months. Cookies: 13 months maximum. Information is then securely destroyed or anonymised.

Your rights

You have the right to access, rectify and, under certain conditions, delete your information, and to withdraw your consent at any time — every commercial email includes an unsubscribe link, as required by CASL. Write to hello@oserene.com; we reply within 30 days. You may also lodge a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Visitors in the European Union and the United Kingdom (GDPR)

If you live in the European Union or the United Kingdom, the GDPR (and the UK GDPR) also applies. Legal bases: performance of the contract (orders, delivery, customer service), consent (advertising and measurement cookies, newsletter), legitimate interest (fraud prevention and site security) and legal obligation (accounting). In addition to the rights above, you have the right to data portability, to object, and to restrict processing. You may lodge a complaint with your supervisory authority: CNIL (France), APD/GBA (Belgium), Autoriteit Persoonsgegevens (Netherlands) or ICO (United Kingdom).

Cookies and tracking

The site uses strictly necessary cookies (cart, session, language) and audience measurement and advertising cookies (Meta, Google, OpenAI). How we ask depends on where you are, based on your approximate location (country and province or state, deduced from your IP address and not stored):

• European Union, United Kingdom, Quebec and any other location: measurement and advertising cookies are only set after you agree in the consent banner.
• United States and Canada (outside Quebec): these cookies are active by default, with a notice shown on your first visit; you can refuse them in one click (“Reject all” or “Customize”) or later via “Manage cookies” at the bottom of every page.

When advertising cookies are active, the events of your visit (product viewed, added to cart, checkout started, purchase) are also sent to Meta from our server (Conversions API) together with your IP address, browser type, Meta identifiers, a random identifier specific to your browser and, if you have given them to us, your email address and phone number in hashed form, as well as, after an order, the name and delivery address of that order, also hashed, and the country deduced from your IP address, so that each event is counted once. No profiling decision is made automatically.

Security

Data is transmitted over encrypted connections (TLS), stored with access-controlled providers, and access is limited to persons who need it. Any breach of security safeguards presenting a real risk of significant harm will be reported to the Privacy Commissioner and the persons concerned, as required by PIPEDA.