Original Delites (“we”, “us”, “our”) is a Canadian small-batch food brand based in Ontario. We respect your privacy and we collect only what we need to run our business — taking your order, shipping it, processing payment, and occasionally telling you about new flavors if you’ve asked us to. This policy explains what we collect, why, how long we keep it, and what your rights are under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Law 25, the EU GDPR (if you’re in Europe), and the California Consumer Privacy Act (CCPA/CPRA) (if you’re in California).
If anything below is unclear, write to [email protected] and we’ll explain.
What we collect
We collect personal information in three ways:
- You give it to us — when you place an order (name, shipping address, billing address, email, phone, payment info), sign up for our newsletter (email), create an account (email + password), or write to support (whatever you write to us).
- Automatically as you browse — IP address, approximate location (country/region — see Cookies below), browser type, the pages you view, the products you click, the date and time of each visit, and a session ID. We use cookies and similar technologies for this; details in our Cookie Policy.
- From service providers — our payment processor (Stripe) tells us whether a payment was successful; our shipping carriers (Canada Post, USPS, UPS, FedEx, DHL) tell us tracking events; our analytics provider gives us aggregate visit data; fraud-detection tools may flag suspicious orders.
Why we collect it
| Purpose | Legal basis (GDPR) |
|---|---|
| Fulfilling your order & processing payment | Performance of a contract |
| Sending order confirmations, shipping updates & receipts | Performance of a contract |
| Handling refund or support requests | Performance of a contract / our legitimate interests |
| Marketing emails (only if you opted in) | Consent — withdrawable at any time |
| Improving the website, fixing bugs, measuring traffic | Our legitimate interests in running the business |
| Preventing fraud and abuse | Our legitimate interests / legal obligation |
| Meeting tax, accounting, and regulatory record-keeping obligations | Legal obligation |
Who we share it with
We do not sell your personal information. We share what’s necessary with the small number of service providers that help us run the business:
- Stripe — payment processing. They handle your card data directly; we never see it. Stripe’s privacy policy.
- Shipping carriers — Canada Post, USPS, UPS, FedEx, DHL. We share your name, address, phone, and a barcode.
- Email providers — for transactional email (order confirmations, shipping updates) and marketing email (only to subscribers).
- Web hosting & backup providers — to keep the site online.
- Analytics — privacy-respecting analytics; we do not allow them to use your data for advertising profiling.
- Government & law enforcement — only if we receive a lawful demand (subpoena, court order, etc.) or where required by tax law.
International transfers
We’re based in Canada and our servers are in Canada and the United States. If you’re in the EU, UK, Quebec, or California, your data may be transferred outside your jurisdiction. We use providers that meet equivalent privacy standards (Standard Contractual Clauses for GDPR transfers, etc.).
How long we keep it
- Order records — 7 years (required by Canadian tax law).
- Account data — until you delete your account, then up to 7 years for legal/tax reasons; we anonymize where we can.
- Marketing subscribers — until you unsubscribe, then 12 months for audit logs.
- Support emails — 24 months.
- Analytics — typically 14 months.
Your rights
Depending on where you live, you have some or all of these rights. To exercise any of them, email [email protected]:
- Access — request a copy of the personal info we hold about you.
- Correction — ask us to fix anything wrong or out of date.
- Deletion (“right to be forgotten”) — ask us to delete your data, subject to the legal retention periods above.
- Portability — receive your data in a machine-readable format.
- Withdraw consent — at any time, for anything you previously consented to (notably marketing email — there’s an unsubscribe link in every newsletter).
- Object — to processing based on legitimate interests, including profiling.
- Lodge a complaint — with the Office of the Privacy Commissioner of Canada, your provincial commissioner, or the relevant EU data protection authority.
We respond to verifiable rights requests within 30 days, free of charge.
How we keep your data safe
We use HTTPS everywhere on this site, encrypt sensitive data at rest, restrict access to need-to-know staff, and require two-factor authentication on the systems where customer data lives. Payment data is handled by Stripe and never touches our servers. No system is perfectly secure, but we take this seriously and we’ll notify you (and the regulator, where required) within 72 hours of becoming aware of a breach involving your personal data.
Children
This site isn’t directed at children and we don’t knowingly collect personal information from anyone under 16. If you’re a parent or guardian and you believe your child has sent us data, write to us and we’ll delete it.
Changes to this policy
We may update this policy as our business changes or as laws change. We’ll bump the “Last updated” date at the top of the page, and for material changes we’ll also email subscribers and post a notice on the site.
Contact
Original Delites · Ontario, Canada
Privacy contact: [email protected]
General contact: [email protected]
Questions about this page?
Write to [email protected] and a human will reply within two business days.