Privacy policy

Privacy Policy

Last updated: 4 August 2026

Hydraleaf (“we”, “us”, “our”) respects your privacy. This privacy policy explains what personal data we collect, why we collect it, how we use it and what rights you have. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). We also comply with applicable Canadian legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada’s Anti-Spam Legislation (CASL).

1. Who is responsible (Data Controller)

  • Data Controller: Hydraleaf, 1234 Rue Principale, bureau 200, Halifax, NS B3H 4R2, Canada
  • Data Protection Officer: Alex Tremblay — contact@hydraleaf.store

2. What data we collect

  • Order data: name, email address, delivery and billing address, phone number, order contents.
  • Payment data: this is processed directly by our payment service providers. We never store your full payment card number.
  • Customer account and marketing: email address and preferences, if you subscribe to our newsletter.
  • Technical data: IP address, device and browser type, pages viewed, referring website — collected using cookies and similar technologies.

3. Why we collect data (Purposes and lawful bases for processing)

  • To process, deliver and track your orders (performance of a contract);
  • To provide customer service and handle returns and refunds (performance of a contract and legal obligation);
  • To send you marketing communications where you have given your explicit consent (you can withdraw your consent at any time);
  • To measure and improve our website and advertising campaigns (legitimate interests or consent);
  • To detect fraud and comply with our legal and tax obligations (legal obligation).

4. Consent

We ask for your consent where the processing of personal data requires it, and we rely on it for marketing communications and for the use of non-essential cookies. You can withdraw your consent at any time by writing to contact@hydraleaf.store or by using the unsubscribe link included in every marketing email. Withdrawing your consent may prevent us from providing certain services to you.

5. Who we share data with

We do not sell your personal data. We share it only with trusted service providers who help us run our online shop, and only for that purpose:

  • Shopify Inc. — e-commerce platform and hosting;
  • Payment processors (Shopify Payments, PayPal and similar) — secure payment processing;
  • Delivery and logistics partners (including Royal Mail) — delivery of your order;
  • Email marketing partners — sending the newsletters and messages you have subscribed to;
  • Analytics and advertising partners — website usage statistics and advertising performance.

Some of these service providers may process or store data outside the United Kingdom or Canada, in particular in the United States. In such cases, we ensure an adequate level of data protection as required by applicable data protection law, using appropriate safeguards (such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses, or UK adequacy regulations).

6. How long we keep data

We keep order data for as long as required by applicable accounting, tax and consumer protection law, and marketing data until you withdraw your consent. After that, the data is permanently deleted or anonymised.

7. Your rights

Under the UK GDPR, the Data Protection Act 2018 and applicable law, you have the right to request access to your personal data, to request the correction of inaccurate or incomplete data, to request erasure of your data (the “right to be forgotten”), to restrict or object to processing, and to request the transfer of your data to another organisation (data portability). You can also object to direct marketing at any time. Please contact us at contact@hydraleaf.store. We will respond to your request within the time limit set by applicable law (generally within one month).

If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with the competent supervisory authority. In the United Kingdom, this is the Information Commissioner’s Office (ICO) (ico.org.uk). Where relevant, you may also contact the Office of the Privacy Commissioner of Canada (Commissariat à la protection de la vie privée du Canada, priv.gc.ca).

8. Data security

We use appropriate technical and organisational measures to protect your personal data, including secure connections (HTTPS/SSL) and strict access controls. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

9. Cookies

We use cookies that are strictly necessary for our online shop to function (such as the shopping basket, checkout and security), as well as analytics and advertising cookies. In accordance with PECR, we ask for your consent before placing non-essential cookies, via our cookie banner. You can also manage or block cookies in your browser settings; please note, however, that this may affect the availability of certain features of our online shop.

10. Minors

Our products and website are intended for adults. We do not knowingly collect personal data from minors.

11. Changes to this privacy policy

We may update this policy from time to time. The date at the top of this page shows when it was last updated. We will announce any material changes on this page.

12. Contact details

Hydraleaf — Data Protection Officer
1234 Rue Principale, bureau 200, Halifax, NS B3H 4R2, Canada
contact@hydraleaf.store

Customers in Canada

Customers in Canada receive the same service, with free tracked delivery via Canada Post and prices shown in Canadian dollars. Your rights are protected under the Competition Act (R.S.C., 1985, c. C-34), the Consumer Protection Act, 2002 (Ontario) and the Consumer Protection Act (Quebec, CQLR c P-40.1). We handle your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), and we send commercial electronic messages only in accordance with Canada’s Anti-Spam Legislation (CASL). The contact details above apply: contact@hydraleaf.store.