Kovalya · Privacy
Your information belongs to you. This page explains, without jargon, what we collect, why, who we share it with, and how to take back control at any time.
01Who is responsible for your information
kovalya.com is operated by Kovalya. Kovalya is the controller of your personal information.
| Controller | Kovalya |
|---|---|
| Address | 4174 Granville St, Hubbards, NS B3K 5M1, Canada |
| Privacy contact | contact@kovalya.com |
Our customers are in Canada, and we handle personal information under Canadian privacy law:
- PIPEDA, and for customers in Quebec the Act respecting the protection of personal information in the private sector as amended by Law 25.
02What we collect
When you buy from us, we collect what you give us: your name, shipping address, email address and, if you provide one, your phone number. For a personalized product we also keep what you asked us to engrave (a first name, an initial, a date, a message) for as long as we need it to make and support your order.
When you browse the store, we automatically receive your device's IP address, which tells us which browser and operating system you use, plus the pages you visit.
We only collect what we need for the purposes described on this page.
03Why we collect it
| Purpose | Basis |
|---|---|
| Processing, making and delivering your order | Performance of the contract |
| Contacting you about your order and customer service | Performance of the contract |
| Marketing emails and texts | Your consent |
| Collecting and displaying reviews | Your consent |
| Preventing fraud and unpaid orders | Our legitimate interest |
| Measuring audience, improving the site and our ads | Your consent (via cookie choices) |
| Keeping accounting and tax records | Legal obligation |
04Consent, and how to withdraw it
How we get your consent
When you give us your personal information to complete a transaction, verify your card, place an order, arrange a delivery or return a purchase, we take it that you consent to us collecting and using it for that specific purpose.
If we ask for your information for another reason, such as marketing, we ask for your explicit consent, or we give you a clear way to say no.
How to withdraw it
You can change your mind at any time. Write to contact@kovalya.com and we will stop. Withdrawing your consent does not make what we did beforehand unlawful.
05Marketing emails and texts
Our commercial electronic messages follow Canada's Anti-Spam Legislation (CASL).
With your consent, we may email you about the store, new products and other updates. Every email carries our contact details and a working unsubscribe link: one click is enough, and we act on it immediately.
Text messages
If you enter your phone number at checkout and agree to receive our messages, you consent to order-tracking and cart-reminder texts, as well as promotional offers. We send no more than 4 texts a month. Reply STOP at any time to opt out.
06Who we share it with
We never sell your personal information. We share it only with the service providers we need to run the store, and only with what they need to do their job.
| Provider | What it does for us | What it receives |
|---|---|---|
| Shopify | Hosts the store, runs the checkout and processes payments | Order, contact and delivery details; payment data handled directly by Shopify |
| PayPal | Alternative payment method | Payment and billing details, if you choose PayPal |
| Carriers and tracking providers | Deliver your parcel and keep the tracking page up to date | Name, address, phone number, tracking number |
| Klaviyo | Sends our emails and, where applicable, our text messages | Email address, name, phone number, order history |
| PostHog | Measures how the site is used so we can improve it | Browsing data, IP address, device information |
| Meta (Facebook, Instagram) | Runs and measures our advertising | Browsing and purchase events, in pseudonymised form |
Some of these providers have their own privacy policies covering the information we have to pass to them. We recommend reading them.
Disclosure required by law
We may disclose your personal information if the law requires it, if a competent authority compels us, or if you breach our Terms of Sale.
Links to other sites
Once you leave our store or are redirected to a third-party site or app, this policy no longer governs you. We are not responsible for the privacy practices of those other sites.
07Shopify and payment
Our store is hosted by Shopify International Limited, 2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, which also provides the checkout and the payment service. Your data sits in Shopify's storage and databases, on a secure server behind a firewall.
If you pay through a direct payment gateway, Shopify stores your credit card information. It is encrypted under the Payment Card Industry Data Security Standard (PCI-DSS). Transaction information is kept only as long as needed to complete your order, then deleted.
All direct payment gateways follow PCI-DSS, managed by the PCI Security Standards Council, a joint effort of companies such as Visa, Mastercard, American Express and Discover.
08Information sent outside Canada
Some of our providers are located, or host their facilities, outside Canada — in particular in the European Union and the United States. In that case your information may be subject to the laws of that jurisdiction and accessible to its authorities under their applicable laws.
We use contracts to make sure those providers offer a level of protection comparable to the one required in Canada. Write to contact@kovalya.com if you want more detail about a specific transfer.
09How long we keep it
| Information | Kept for |
|---|---|
| Prospects (no order placed) | 3 years from the last contact |
| Customers and orders | 5 years from the end of the relationship, then archived for the legal period |
| Engraving and personalization details | With the order record, so we can handle any after-sales issue |
| Payment information | Held by the payment provider for the life of the card. We have no access to it. |
| Cookies | See section 11 |
10Security
We take reasonable precautions and follow industry best practice so that your information is not lost, misused, accessed, disclosed, altered or destroyed inappropriately.
Credit card information you give us is encrypted using SSL and stored with AES-256 encryption. No method of transmission over the Internet or of electronic storage is 100% secure, but we follow all PCI-DSS requirements and apply additional generally accepted industry measures.
If a confidentiality incident creates a risk of serious harm, we notify the people concerned and the competent authority, as the law requires.
11Cookies
A cookie is a small text file placed on your device by your browser. It lets the site recognise that device on a later visit. Only the sender of a cookie can read or change what is in it.
What we use them for
- Essential cookies — needed to browse the store and place an order. Without them you may be unable to check out.
- Analytics and personalization cookies — not required; they help us understand how the site is used and improve it.
- Advertising cookies — they let us show you relevant offers rather than irrelevant ones.
- Third-party cookies — set by other companies under their own privacy policies, and not necessary to use our site.
The main cookies on kovalya.com
- _session_id — unique session identifier, lets Shopify store information about your session.
- _shopify_visit — no data held; lasts 30 minutes from the last visit. Used to count visits.
- _shopify_uniq — no data held; expires at midnight the following day. Counts visits per unique customer.
- cart — unique identifier, lasts 2 weeks, stores your cart.
- _secure_session_id — secure session identifier.
- storefront_digest — unique identifier, used to check access when the store is password protected.
Your options
Your browser (Chrome, Safari, Firefox, Edge and others) lets you accept cookies, be warned before one is stored, or refuse them systematically. Check your browser's help menu. Refusing certain cookies may stop you from using parts of the site, including checkout.
Third-party features
We may embed third-party features, such as social network share or like buttons. Those networks can recognise you even if you did not use the button, if you were signed in to them at the same time. We have no control over what they do with that; please read their privacy policies.
12Automated decisions
We may use automated processing, in particular to identify customers and assess the risk of fraud or non-payment, based on variables such as the type of product, the items ordered and the customer profile.
If the risk is judged too high, a payment method may not be offered. You can always ask for a human to look at it, give us your side, and contest the automated decision by writing to contact@kovalya.com.
13Age of consent
By using this site you confirm you are of the age of majority in your province or territory of residence, and that you have given your consent for any minor in your care to use this site.
14Your rights, and who to complain to
You have the right to access the personal information we hold about you, to have it corrected, to ask for it to be deleted, to limit how it is used, to receive it in a portable form, to withdraw your consent, and to object to it being used for marketing.
Write to our privacy contact at contact@kovalya.com, giving your first name, last name and email address. We answer within thirty (30) days at the most.
If our answer does not satisfy you, you can escalate:
- if you live in Quebec — the Commission d'accès à l'information du Québec, which oversees Law 25;
- elsewhere in Canada — the Office of the Privacy Commissioner of Canada.
15Changes to this policy
We may change this policy at any time, and we review it at least every three (3) years. Changes take effect as soon as they are published, and the date at the top of this page tells you when it last changed.
If the store is acquired or merged, your information may be transferred to the new owners so that service continues; they would be bound by the same obligations towards you.