1. Introduction
Hempcoasterly (“we”, “us” or “our”) respects the privacy of individuals who visit our website, purchase our cotton and linen placemat and coaster sets, or contact us regarding our products and services.
This Privacy Policy explains how we collect, use, disclose, retain and manage personal information when you visit https://www.hempcoasterly.com, place an order, make a payment or communicate with us.
Hempcoasterly operates from Canada and offers products to customers in European markets. We handle personal information in accordance with applicable Canadian privacy legislation and, where applicable, the European Union General Data Protection Regulation (GDPR), the UK GDPR and relevant national data protection legislation.
By using our website, you acknowledge that you have had the opportunity to read this Privacy Policy. Where consent is required by law, we will request it separately and will not treat website use alone as consent to every form of data processing.
2. Data Controller and Contact Information
For the purposes of applicable data protection legislation, the data controller responsible for the processing described in this Privacy Policy is:
Brand: Hempcoasterly
Email: coast@hempcoasterly.com
Website: https://www.hempcoasterly.com
Country of Operation: Canada
For privacy-related enquiries, requests concerning personal information or questions about this Policy, please contact us at coast@hempcoasterly.com.
3. Personal Information We Collect
We collect personal information that is relevant to operating our online shop, processing orders, responding to enquiries and meeting applicable legal obligations.
3.1 Information You Provide
Depending on how you interact with our website, we may collect:
- Name and contact details, including email address and telephone number.
- Billing and delivery addresses.
- Order details, including products purchased, quantities, prices and order references.
- Information you provide when contacting us about a product, order, return or refund.
- Account details, if you create an account on our website.
- Preferences and consent records relating to communications and cookies.
Please provide information that is accurate and relevant to your enquiry or purchase.
3.2 Payment Information
Payments on our website are processed by Stripe, our payment processing provider.
When you make a purchase, information required to process the payment may include your name, billing details, transaction amount, currency, order reference and payment method details. Depending on the payment method and transaction, Stripe may process card details or other payment-related information.
Payment information is handled through the applicable payment process. We do not intentionally collect or store complete payment card numbers or card security codes in our ordinary customer order records.
Stripe may process personal information under its own privacy notice and contractual terms, including where Stripe determines certain purposes and means of processing independently of Hempcoasterly.
3.3 Information Collected Automatically
When you visit our website, certain information may be collected automatically, subject to applicable consent requirements. This may include:
- IP address and general location information derived from it.
- Browser type, device type and operating system.
- Pages visited and interactions with website content.
- Date, time and duration of website visits.
- Referring website addresses and diagnostic records.
- Cookie identifiers and related website preferences.
We use this information for website operation, service administration, usage analysis and the identification of unusual activity where appropriate.
4. Purposes and Legal Bases for Processing
We process personal information only for identified and legitimate purposes and use an appropriate legal basis where required by applicable law.
| Purpose | Applicable legal basis, where relevant |
|---|---|
| Processing purchases and payments | Performance of a contract |
| Arranging order fulfilment and delivery | Performance of a contract |
| Responding to customer enquiries | Legitimate interests or steps requested before entering a contract |
| Managing returns, refunds and order-related matters | Performance of a contract or compliance with legal obligations |
| Maintaining accounting and transaction records | Compliance with applicable legal obligations |
| Maintaining website records and identifying unusual activity | Legitimate interests, subject to applicable law |
| Sending optional marketing communications | Consent where required, or another lawful basis where permitted |
| Using non-essential analytics or advertising cookies | Consent where required by applicable law |
| Establishing, exercising or defending legal claims | Legitimate interests or another applicable legal basis |
Where we rely on legitimate interests, we consider the relevant interests and the impact on individuals. Where consent is required, you may withdraw it at any time, without affecting processing that took place lawfully before withdrawal.
We will not use personal information for a materially different purpose without an appropriate legal basis and any notice or consent required by law.
5. Payment Processing Through Stripe
Hempcoasterly uses Stripe to process payments for purchases made through our website.
When you proceed to payment, relevant transaction and customer information is transmitted to Stripe for payment authorisation, transaction processing, payment confirmation, refunds and related activities.
Depending on the payment method and transaction, Stripe may also process information to meet its own legal obligations and to identify or address fraudulent transactions and other unlawful activity.
Stripe may use affiliated entities, financial institutions, card networks and other service providers as necessary to provide its services. The information processed and the applicable roles of these parties depend on the transaction and the services involved.
Hempcoasterly does not control every processing activity undertaken by Stripe in its capacity as an independent data controller. Stripe’s processing is governed by its applicable privacy documentation and legal obligations.
You do not need to create a Stripe account merely to complete a purchase through an available guest payment option. Available payment methods depend on the checkout options provided at the time of purchase.
6. Disclosure of Personal Information
We may disclose relevant personal information to the following categories of recipients where necessary and lawful:
6.1 Payment and Financial Service Providers
Stripe and relevant financial institutions or payment networks may receive transaction information to process payments, refunds and related transactions.
6.2 Order Fulfilment and Delivery Providers
Delivery companies and fulfilment service providers may receive the recipient’s name, delivery address, contact details and relevant order information to prepare, transport and deliver purchases.
6.3 Website and Business Service Providers
We may engage providers that support website hosting, website maintenance, customer communications, order administration, record keeping and website analysis. Such providers may process information on our behalf under applicable contractual arrangements.
6.4 Professional Advisers and Public Authorities
We may disclose information to accountants, legal advisers, regulators, courts or public authorities where reasonably necessary to comply with legal obligations, respond to lawful requests or establish, exercise or defend legal claims.
We do not disclose personal information to unrelated parties for their own marketing purposes without an appropriate legal basis.
7. International Data Transfers
Because Hempcoasterly operates from Canada and serves customers in European markets, personal information may be processed in Canada and other countries where our service providers or their relevant operations are located.
Where the GDPR or UK GDPR applies, we will use an applicable legal mechanism for international transfers when required. Depending on the circumstances, this may include an adequacy decision, approved standard contractual clauses or another lawful transfer mechanism.
The legal protections applicable to information processed in another country may differ from those in your country of residence. We will take the steps required by applicable law when arranging relevant transfers.
8. Data Retention
We retain personal information only for as long as necessary for the purposes for which it was collected, taking account of applicable legal requirements, accounting obligations, the handling of customer requests and the establishment or defence of legal claims.
The following retention periods are our general retention schedule, subject to applicable statutory requirements and the need to preserve relevant records for ongoing matters.
| Information category | General retention period |
|---|---|
| Order, invoice and transaction records | Up to 7 years after the relevant transaction, where required or justified by applicable accounting, tax or legal requirements |
| Customer contact and order enquiry records | Up to 24 months after the enquiry has been closed, unless a longer period is reasonably necessary for an ongoing matter |
| Customer account information | While the account remains active and, following closure, for the period necessary to complete outstanding matters or meet legal obligations |
| Return, refund and complaint records | Up to 7 years after the matter is closed where necessary for accounting, legal compliance or the handling of potential claims |
| Consent and preference records | For as long as necessary to demonstrate compliance, honour preferences and address related legal requirements |
| Website logs and diagnostic records | Generally up to 12 months, unless a longer period is reasonably necessary for an identified purpose |
| Non-essential cookie data | For the duration specified in the relevant cookie settings or consent information |
These periods are not intended to require retention of every category of information for the maximum period stated. We review retention according to the type of information and the purpose for which it is held.
Where information is no longer required, we will delete it, anonymise it or otherwise dispose of it in accordance with applicable law, unless continued retention is legally required or permitted.
Stripe may apply separate retention periods to information it processes under its own legal obligations and policies.
9. Cookies and Similar Technologies
Our website may use cookies and similar technologies to support website functions and remember user preferences.
Depending on their purpose, these technologies may include:
- Essential cookies: Used for functions necessary for the operation of the website, such as maintaining a shopping basket and processing checkout requests.
- Preference cookies: Used to remember selected settings and preferences.
- Analytics cookies: Used to understand website visits and interactions where permitted.
- Marketing cookies: Used to support advertising-related activities where applicable and permitted.
Stripe may also use cookies or similar technologies in connection with its payment services, subject to the applicable payment process and its own privacy practices.
Where required by law, non-essential cookies will only be placed or activated after you have provided the relevant consent. You may change or withdraw your cookie preferences through the available cookie settings.
For further information, please refer to our Cookie Policy.
10. Data Protection and Confidentiality
We maintain administrative and organisational measures appropriate to the nature of the personal information we handle. These measures are intended to limit access to authorised personnel and service providers who require the information for legitimate business purposes.
We also seek to limit the collection and disclosure of personal information to what is relevant to the stated purposes.
No method of transmitting or storing information can be assumed to eliminate every possible risk. We therefore review our information-handling practices as appropriate to the nature of our business and applicable legal requirements.
Where a personal data breach occurs, we will assess the circumstances and make any notifications required by applicable law.
11. Your Privacy Rights
Depending on your place of residence and the legislation applicable to the processing, you may have the right to:
- Request access to personal information we hold about you.
- Request correction of inaccurate or incomplete information.
- Request erasure of personal information where the relevant legal conditions are met.
- Request restriction of certain processing activities.
- Object to processing based on legitimate interests, where applicable.
- Request a copy of certain personal information in a portable format where the relevant legal conditions are met.
- Withdraw consent where processing is based on consent.
- Object to direct marketing and related profiling where applicable.
- Lodge a complaint with the relevant data protection or privacy supervisory authority.
These rights are subject to applicable legal conditions and exceptions. We may need to verify your identity before responding to a request.
To exercise a privacy right, contact us at coast@hempcoasterly.com. Please describe your request and provide sufficient information for us to identify the relevant records.
We will respond within the period required by applicable law. Where permitted, we may request additional information necessary to verify your identity or clarify your request.
If you are located in the European Union or the European Economic Area, you may contact the relevant data protection supervisory authority in your country of residence or work, or where an alleged infringement occurred. If you are located in the United Kingdom, you may contact the Information Commissioner’s Office.
Canadian individuals may also contact the Office of the Privacy Commissioner of Canada or the relevant provincial privacy authority, as applicable.
12. Marketing Communications
We may send marketing communications where permitted by applicable law and where any required consent has been obtained.
You may unsubscribe using the link provided in a marketing email or by contacting coast@hempcoasterly.com.
Unsubscribing from marketing communications does not prevent us from sending necessary messages concerning an existing order, payment, refund or other transaction-related matter.
We maintain records of marketing preferences as necessary to respect your choices and meet applicable legal obligations.
13. Children’s Privacy
Our website is intended for general retail customers and is not directed specifically at children.
We do not knowingly seek to collect personal information from children where such collection would be unlawful. If you believe that a child has provided personal information to us in circumstances that require further action, please contact coast@hempcoasterly.com so that we can review the matter.
14. Third-Party Websites and Services
Our website may contain links to external websites or services. Their privacy practices are governed by their own policies, and we do not control their independent processing activities.
We encourage you to review the relevant privacy information before providing personal information directly to an external service.
15. Changes to This Privacy Policy
We may update this Privacy Policy when our business practices, website functions or applicable legal requirements change.
The latest version will be published on this page with its updated date. Where required by law, we will provide additional notice or obtain consent before implementing a material change affecting personal information.