Privacy policy

Privacy Policy

Effective date: August 4, 2026

Cortleigh & Sumac respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain and protect personal information when you visit our website, place an order or communicate with us.

1. Accountability

Cortleigh & Sumac is responsible for personal information under its control. Privacy questions, access requests and complaints may be directed to our Privacy Officer using the contact information below.

2. Personal Information We Collect

Depending on your interaction with us, we may collect:

Your name, email address, telephone number, billing address and delivery address;
Order, transaction, return and customer-service information;
Account credentials and saved preferences;
Payment-related information processed by our payment providers;
Marketing preferences and communication history;
Browser, device, IP address, cookie and website-usage information;
Fraud-prevention and transaction-verification information; and
Other information you voluntarily provide.

We generally do not directly store complete payment-card numbers. Payments are processed by authorized third-party payment providers.

3. How We Collect Information

We collect personal information directly from you, automatically through our website and from service providers that help operate our business, including Shopify, payment processors, fraud-prevention providers, analytics services and delivery companies.

4. Purposes of Collection and Use

We may collect and use personal information to:

Process payments and fulfil orders;
Arrange shipping and provide delivery updates;
Manage accounts, returns, refunds and customer enquiries;
Verify transactions and prevent fraud or misuse;
Maintain website security and functionality;
Improve our products, services and customer experience;
Send marketing communications where we have the consent or other lawful authority required by Canada's Anti-Spam Legislation;
Maintain tax, accounting and business records; and
Comply with legal obligations and establish, exercise or defend legal claims.

5. Consent

We obtain meaningful consent where required, taking into account the sensitivity of the information and reasonable customer expectations. Consent may be express or implied where permitted by law.

You may withdraw consent to optional uses, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may affect services that require the relevant information.

6. Cookies and Similar Technologies

Our website may use cookies, pixels and similar technologies to operate essential functions, remember preferences, understand website performance and support advertising.

You may control cookies through your browser settings and any consent tools displayed on the website. Disabling essential cookies may affect website functionality.

7. Disclosure to Service Providers

We may disclose relevant information to:

Shopify and providers that host or operate our online store;
Payment processors, banks and fraud-prevention services;
Warehousing, fulfilment, postal and courier providers;
Customer-support, email, analytics and advertising providers;
Accountants, lawyers, insurers, auditors and other professional advisers;
Government authorities, regulators or courts where required or authorized by law; and
A purchaser or successor in connection with a proposed or completed business transaction.

Service providers may only use information as permitted by their agreements with us and applicable law.

8. Processing Outside Canada

Some service providers may process or store personal information outside Canada, including in the United States or other jurisdictions where they operate.

Information processed abroad may be accessible to courts, law-enforcement agencies or governmental authorities under the laws of that jurisdiction. We use reasonable measures when selecting and overseeing service providers.

9. Retention

We retain personal information only as long as reasonably necessary for the identified purposes and applicable legal, tax, accounting, security and dispute-resolution requirements. Information that is no longer required will be securely deleted, destroyed or anonymized.

10. Security Safeguards

We use reasonable physical, administrative and technical safeguards appropriate to the sensitivity of the information. These may include access controls, secure connections, service-provider reviews and staff or contractor confidentiality requirements.

No internet transmission or storage system can be guaranteed to be completely secure.

11. Security Breaches

Where the Personal Information Protection and Electronic Documents Act applies, we will assess security breaches and report a breach to the Office of the Privacy Commissioner of Canada, notify affected individuals and retain required records where the applicable legal threshold is met.

12. Access and Correction

You may request access to personal information under our control or ask us to correct inaccurate or incomplete information. We may need to verify your identity before processing the request.

Access may be limited where permitted or required by law, including where disclosure would reveal another person's personal information or protected confidential information. We will explain any lawful refusal where required.

13. Marketing Communications

You may unsubscribe from promotional emails using the unsubscribe link in the message or by contacting us. Unsubscribe requests will be processed within the period required by law.

You may continue to receive transactional communications concerning orders, deliveries, returns, security or account administration.

14. Children's Privacy

Our website is not directed to children under 16. We do not knowingly collect personal information from children without appropriate consent. A parent or guardian who believes a child has provided information to us may contact our Privacy Officer.

15. Privacy Complaints

Submit privacy complaints to our Privacy Officer. We will investigate and respond within a reasonable period.

If you are not satisfied with our response, you may be entitled to complain to the Office of the Privacy Commissioner of Canada.

16. Policy Changes

We may update this Privacy Policy when our practices, providers or legal obligations change. The updated policy will be posted with a revised effective date.