Privacy & Cookie Policy

Last updated 20 August 2026

Beauté Lia Hair is a premium beauty retailer in Halifax, Nova Scotia. This policy explains what personal information we collect when you visit or shop at our online store, why we collect it, who we share it with, and the choices you have. We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Who we are

For the purposes of this policy, the organisation responsible for your personal information (the “data controller”) is:

• Legal entity: PORT902 INC.
• Operating as: Beauté Lia Hair E-commerce
• Address: C8 56 Supreme Crt, Halifax, Nova Scotia, Canada
• Privacy contact: privacy@port902.ca

2. What personal information we collect

Information you give us

• Account details — first and last name, email address, and a password (stored only as a one-way cryptographic hash, never in readable form).
• Order details — billing and shipping address (shipping soon to be available), phone number, and the contents of your order.
• Messages — anything you write to us through our contact form, by email, or in a product review.
• Marketing preferences — whether you have subscribed to our newsletter.

Information we collect automatically

• Device and connection data — IP address, browser type and version, operating system, and screen size.
• Usage data — pages viewed, products viewed, search terms used on our site, items added to your cart, and the date and time of each visit.
• Referral data — the site or link that brought you to us.

This information is recorded in our web server logs and by the cookies described in section 6.

Information we receive from others

• Payment confirmations from our payment processor (see section 4).
• Basic profile details from a social network, if you choose to sign in with one (see section 5).
• Delivery updates from the carrier handling your shipment, once shipping becomes available.

3. How we use your information

Under PIPEDA we rely on your consent to collect, use and disclose your personal information. Some of that consent is implied — placing an order clearly implies consent to use your address to fulfil it — and some is express, such as ticking the box to join our newsletter. You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice (see section 10).

4. Payments

Card payments on this store are processed by Stripe (Stripe Payments Canada, Ltd. and Stripe, Inc.). When you pay, your card details are collected inside a secure payment field hosted by Stripe and sent directly to Stripe — they do not pass through, and are never stored on, our servers.

We receive back from Stripe only the information we need to manage your order: whether the payment succeeded, the card brand, the last four digits of the card, the expiry month and year, and the billing address you entered.

Stripe acts as an independent controller of the payment data it collects and processes it under its own privacy policy, available at stripe.com/en-ca/privacy.

5. Signing in with a social account

You can create an account or sign in using a third-party account such as Google. If you choose to do so, that provider asks for your permission and then sends us a limited set of details — typically your name, email address, and a unique account identifier. We use these to create or match your Beauté Lia Hair account.

We never receive your password for that account, and we do not post anything to it. You can disconnect Beauté Lia Hair at any time from the security or connected-apps settings of the provider concerned; doing so does not delete the order history already held in your store account.

6. Cookies and similar technologies

A cookie is a small text file placed on your device by your browser. Some are essential to the store working at all; others are optional. The categories we use are:

Our store platform (Adobe Commerce / Magento Open Source) sets a number of cookies in the first two categories, including PHPSESSID, form_key, private_content_version, mage-cache-sessid, mage-messages, section_data_ids, and recently_viewed_product. Stripe sets its own cookies on the checkout page to detect fraud.

Your choices. Every major browser lets you see the cookies stored on your device, delete them, and refuse new ones — look under Settings for “Privacy”, “Cookies”, or “Site data”. Please note that blocking strictly necessary cookies will stop you from signing in or completing an order. If you have blocked cookies and are having trouble, see how to enable cookies in your browser.

We do not currently respond to browser “Do Not Track” signals, as no common standard for interpreting them has been agreed.

7. Who we share your information with

We do not sell your personal information, and we never rent or trade it. We share it only with service providers who help us run the store, and only to the extent they need it to perform that service for us:

• Payment processing — Stripe.
• Shipping and delivery (soon to be available) — once shipping becomes available, the carrier handling your parcel will receive your name, delivery address, and phone number.
• Email delivery — the provider that sends our transactional and marketing email.
• Hosting and infrastructure — the provider that hosts this website and its database.
• Social sign-in — the provider you choose, at the moment you choose it.

We may also disclose personal information where we are required to by law, by a court order, or by a lawful request from a government or regulatory authority; where necessary to investigate fraud or protect our legal rights; or to a purchaser, in the event that our business or its assets are sold, in which case we will require them to honour this policy.

8. Where your information is stored

Our website and database are hosted in Canada. Some of our service providers — including Stripe — process information on servers in the United States and other countries. When personal information is held in another country it is subject to the laws of that country, and may be accessible to that country’s courts and law-enforcement or national-security authorities under their own legal processes.

We require every provider we use to protect personal information to a standard comparable to the protection it receives here, through contractual and other means.

9. How long we keep your information

• Order and transaction records — at least six years from the end of the tax year they relate to, as required by the Canada Revenue Agency.
• Account details — for as long as your account is open, and for a reasonable period afterwards in case you return.
• Contact-form and support messages — up to two years after your enquiry is resolved.
• Marketing lists — until you unsubscribe, plus a suppression record so that we do not email you again by mistake.
• Server logs — typically 90 days.

When information is no longer needed for the purpose it was collected for, we delete it or render it anonymous.

10. Your rights

Under PIPEDA you have the right to:

• Access the personal information we hold about you, and be told how it has been used and who it has been shared with.
• Correct information that is inaccurate or incomplete.
• Withdraw consent to our use of your information at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawing consent may mean we can no longer provide certain services to you.
• Ask us to delete your account and the information associated with it, except where we are legally required to keep it.
• Complain about how we have handled your information.

Much of this you can do yourself: sign in and open Account Information to correct your name or email, or Address Book to update your addresses. For anything else, write to our privacy contact in section 15. We will respond within 30 days, as PIPEDA requires. There is no charge for a reasonable request. We may ask you to verify your identity before we act, so that we do not disclose your information to someone else.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

11. Marketing email

We send marketing email only to people who have asked for it, in line with Canada’s Anti-Spam Legislation (CASL). Every marketing message we send identifies us, gives our contact details, and contains a working unsubscribe link that we action within 10 business days — usually immediately.

Unsubscribing from marketing does not stop transactional messages such as order confirmations, pickup notices, and password resets, which we must send to complete the order you placed.

12. How we protect your information

All traffic between your browser and our store is encrypted with TLS (HTTPS). Passwords are stored only as salted one-way hashes. Access to the store’s administration area is restricted to authorised staff and protected by individual accounts. Card data never touches our servers, as described in section 4.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach occurs that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

13. Children

Our store is intended for adults. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, please contact us and we will delete it.

14. Changes to this policy

We may update this policy as our business, our technology, or the law changes. The date at the top of the page always shows when it was last revised. If we make a material change to how we use your personal information, we will give you notice by email or by a prominent notice on the store before the change takes effect.

15. Contact us

Questions about this policy, or about the personal information we hold about you, should go to our Privacy Officer:

• Email: privacy.port902.ca
• Post: Privacy Officer, PORT902 INC., C8 56 Supreme Crt, Halifax, Nova Scotia, Canada
• Online: our contact form