Last update: January 28th, 2025

PRIVACY POLICY OF CONCEPT C. SHOP

9399-4721 Québec Inc. doing business as CONCEPT C. SHOP (“CONCEPT C.”, “we” or “our”) is committed to protecting the personal information we collect in the course of our business. This privacy policy (the “Policy”) describes in clear and simple terms the manner in which we respect our obligations in terms of protection of personal information and more specifically our practices regarding the collection, use, disclosure, retention and destruction of your personal information. Our person in charge of the protection of personal information (the “Privacy Officer”),  whose full contact details can be found in Section 11, ensures compliance and implementation of the Policy.

In order to ensure the implementation of the Policy, be assured that we have put in place internal practices concerning the management of your personal information. These practices include a framework on: 

• The security of your personal information;
• Management and prevention of confidentiality incidents;
• Performing privacy impact assessments; and
• Retention of your information throughout its life cycle.

Our commitment to you is clear :

• Be concise, clear and transparent;
• Obtain your consent when necessary;
• Allow you to exercise your rights regarding your personal information; and
• Protect the confidentiality of your personal information.

Our Policy has been developed in compliance with applicable privacy laws, including the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, the Act respecting the protection of personal information in the private sector, RLRQ, c. P-39.1 and similar provincial legislation. 

Policy content

1. WHO IS OUR POLICY AIMED AT?
2. WHAT PERSONAL INFORMATION DO WE COLLECT AND FOR WHAT PURPOSES?
3. HOW DO WE COLLECT YOUR PERSONAL INFORMATION?
4. DO WE USE COOKIES?
5. HOW DO WE PROTECT YOUR PERSONAL INFORMATION?
6. TO WHOM MAY WE COMMUNICATE YOUR PERSONAL INFORMATION?
7. CAN YOUR PERSONAL INFORMATION BE COMMUNICATED
   OR STORED OUTSIDE QUEBEC OR CANADA?
8. HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?
9. WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL INFORMATION?
10. CONFIDENTIALITY INCIDENT
11. HOW TO CONTACT OUR PRIVACY OFFICER?
    
12. POLICY UPDATE

1. WHO IS OUR POLICY AIMED AT?

The Policy applies to personal information collected in the course of all our activities, with the exception of personal information collected in respect of our employees, former employees and applicants for employment with us. It applies in particular to personal information collected when you visit our Website https://conceptcshop.com/ (the “Website”), when you purchase our products online or in-store, when you visit us in a bourique or in our hair salon, and when you contact us by any other means of communication. The Policy therefore applies, for example:

• To our past, present and future customers;
• To all users of our Website 
• To all persons contacting us.

Please note, however, that you are still responsible for protecting your personal information when you visit other websites. Our Policy does not apply to the collection, use, disclosure or retention of your personal information by other websites, although some links on our Website may allow you to access content from other third parties. We are not responsible for their policy regarding the protection of personal information and we encourage you to read the privacy notices or policies regarding the protection of personal information governing these third parties.

2. WHAT PERSONAL INFORMATION DO WE COLLECT AND FOR WHAT PURPOSES?

Personal information is any information which relates to a natural person and allows directly or indirectly that person to be identified, whether taken separately or in combination with other information. For greater clarity, personal information is any information which allows you to identify:

• a person directly, for example, an identifier such as a name, government ID; or
• indirectly through the combination of several specific elements specific to its physical, physiological, genetic, psychic, economic, cultural or social identity.

Please note that we collect only the personal information necessary to provide you with our products and services. Below are the categories of personal information we collect and examples for each category. This information is all collected for a specific purpose detailed after the following table.

TYPES OF PERSONAL INFORMATION	EXAMPLES
Identity and contact information	First and last name; Email address; Phone number; Postal address.
Commercial information	Number of products purchased; Customer number; Billing email; Billing mailing address.
Financial information	Amount invoiced and outstanding; Partial credit card number.
Information about your communications with us	History and report of our discussions with you; Email exchanges; Online chat; Customer service telephone recordings.
Marketing information	Products remaining in your “Wishlist” or shopping cart; Your consumer habits.
Information about your digital interactions To learn more about our use of cookies, please see Section 4 of this Policy.	Email address; Information about your devices; Route and browsing history; Duration of visits on our Website.

In general, we collect your personal information in order to offer you our products and services and to improve them. Except as provided by law, if we need to use your personal information for purposes other than those set out in this Policy, we will obtain your consent before using this information.

We collect your personal information, to the extent permitted by law, for:

1. Identification or authentication purposes

When we wish to register you as a new customer, we require certain information to identify you. This information will be used in particular to find your file and to ensure that your information is associated with your account when you wish to benefit from our products and services.

In general, we collect Identity and contact Information to fulfill this purpose. Your information may also be used in certain cases to authenticate you, for example to ensure that you are the right person when you wish to access your file.

2. Providing you with our products and services 

When you do business with us, it is necessary for us to process some of your information in order to determine your eligibility for our products and services, to deliver your product to you, to advise you appropriately based on your needs, to answer any questions you may have, to handle your complaints and to assist you in all your dealings.

3. Contacting you

As part of our business relationship with you, we may need to contact you from time to time to inform you of important changes applicable to your products and services and inform you of changes to our Policy.

In general, we collect Identity and contact Information to fulfill this purpose.

4. Managing our risks 

As an enterprise, we need to take a number of preventive actions to manage the risks associated with our activities, in order to avoid financial losses, operational breakdowns and internal and external fraud. 

5. Meet our legal and regulatory obligations

In operating our enterprise and due to the nature of our activities, we must comply with certain legal and regulatory obligations. We are therefore obliged to use your information in order to, for example:

• Comply with the Income Tax Act;
• Defend ourselves in the event of legal claims or demands.

6. Send you advertising offers, promotions or any other communications by email, paper mail or telephone 

In order to offer you a more personalized service, we may use your personal information to communicate offers likely to meet your needs, our latest promotions, newsletters or surveys, for example.

In order to adequately personalize these communications, we may analyze your personal information for profiling purposes. This allows us to avoid sending you communications that do not correspond to your expectations.

We also use targeted online advertising through similar audiences (“look a like”) and use invisible tags/pixels on our Website or in your emails to ensure that advertising offers and promotions sent to you correspond to your needs and preferences.

Please note that we will only send you these communications if you have, where required by law, chosen to receive them, and that you may withdraw your consent at any time.

3. HOW DO WE COLLECT YOUR PERSONAL INFORMATION?

Most of the time, we collect your personal information directly from you. There are, however, situations in which we may collect your personal information from other sources, with your consent or as required by law:

• From other third parties to help us serve or protect you, from our business partners, for example;

• Based on your use of our products and services, our Website.

4. DO WE USE COOKIES?

“Cookies” are files containing an identifier (a series of letters and numbers) sent by a Web server to a Web browser and stored by the browser. The identifier is then sent to the server each time the browser requests a page from the server. Cookies are “persistent” when they are stored by a Web browser and remain valid until their scheduled expiry date, unless they are deleted by the user before that date. Cookies are called “temporary” when they expire at the end of a user’s browsing session. Even if Cookies do not generally contain information personally identifying a user, Personal Information which CONCEPT C. retains about you may be connected to the information contained in the Cookies or obtained from them.

Our service providers use Cookies which may be stored on your computer or device when you navigate our Website.

You can set your preferences and manage the types of Cookies you wish to allow by clicking here. Redefine my preferences.

Blocking access to all Cookies will detract from the quality of use of several websites. If you refuse the use of all Cookies, you will not be able to use all of the functionalities of the Service.

We use Cookies for the following purposes:

1. Strictly necessary 

These cookies are essential to enable you to move around the Website and use its functionalities, such as access to secure areas of the Website. The Website cannot function properly without these cookies. Visitors cannot refuse to be tracked by these cookies.

2. Functional cookies

These cookies enable the Website to provide enhanced functionality and personalization. They may be set by us or by third-party providers whose services we have added to our pages. If you do not allow these cookies, some or all of these services may not function properly.

3. Performance cookies 

These cookies enable us to monitor and improve the performance of our Website. For example, they enable us to count visits, identify traffic sources and see which parts of the Website are most popular.

4. Cookies enabling targeting 

These cookies may be installed on our Website by our advertising partners. They may be used by these organizations to profile your interests and show you relevant advertisements on other sites. They are based on the unique identification of your browser and internet device. If you do not allow these cookies, you will receive less targeted advertising. To allow us to use these Cookies you must first activate them in our Cookie management center.

5. HOW DO WE PROTECT YOUR PERSONAL INFORMATION?

We are committed to protecting personal information in our possession in accordance with industry standards. To this end, we implement reasonable security measures to protect your personal information against loss, theft, unauthorized access, disclosure and unauthorized use. Our security measures are adapted to the amount and sensitivity of personal information.

TYPES OF MEASURES	EXAMPLES OF MEASURES
Technical measures	Use of strong internal passwords; Two-factor authentication; Data encryption Encryption at rest; Depersonalization.
Administrative measures	Access management on a “need-to-know” basis; Internal policies and training on the protection of personal information; Our employees are bound by confidentiality agreements that survive the end of their employment.
Material measures	Locked filling cabinets; Limited access to offices; Surveillance cameras.

Please note, however, that the transmission of personal information over the Internet is never completely secure. Although we take every precaution to protect your personal information, we cannot guarantee the security of personal information transmitted over the Internet. You choose to transmit information through this channel at your own risk.

If you believe that your personal information has been compromised or if you have any concerns in this regard, we invite you to contact our Privacy Officer at the contact details provided in Section 11.

6. TO WHOM MAY WE COMMUNICATE YOUR PERSONAL INFORMATION? 

Within our company, access to your personal information is limited to those employees who require access in order to perform their duties. These employees are made aware of the need to protect personal information, and policies are in place to ensure their protection.

However, in order to offer you affordable, quality products and services, we must communicate some of your personal information outside our enterprise. Rest assured that we require third parties to whom we disclose your personal information to respect the standards set by law and the security measures required to protect your personal information. We never sell your personal information, and will only disclose in compliance with applicable privacy laws.

1. To our service providers 

In order to carry out certain purposes described in the Policy, we do business with service providers to whom we may communicate or give access to your personal information when necessary for the performance of their service contract.

However, rest assured that we put in place written contracts with our service providers in order to namely:

• Guarantee the confidentiality of your personal information;
• Ensure that the information is used only to perform the service agreement;
• Ensure that the service provider does not retain any personal information when it is no longer required for the performance of the service agreement, with the exception of information contained in backup systems, which will be deleted according to the deletion cycle predetermined by the service provider;
• Ensure that the service provider communicates with us immediately in the event of a confidentiality incident or any attempt to do so.

The categories of service provider with whom we do business include the following:

• Computer and technical services;
• Cloud hosting service;
• Software for marketing and customer service;
• Platform offering payments services;
• Appointment scheduling software. 

2. To courts, law enforcement authorities, regulators, governmental officials or prosecutors 

More specifically, we may disclose your personal information to comply with a search warrant, to respond to an investigative body, to comply with a court order, if we believe disclosure is necessary to comply with applicable laws, if required by law, to pursue a legal claim or to assert a defence.

3. To other third parties 

We may need to disclose your personal information to other third parties in certain specific circumstances, always within the limits permitted by law or after obtaining your consent, for example:

• As part of a business transaction (a merger, an acquisition by another enterprise, obtaining a loan or financing, for example);
• In the event of insolvency or bankruptcy.

7. CAN YOUR PERSONAL INFORMATION BE COMMUNICATED OR STORED OUTSIDE QUEBEC OR CANADA? 

Yes. The subcontractors with whom we do business and other third parties to whom we disclose your personal information may operate and process your personal information outside Quebec and Canada. 

In all cases where we disclose your personal information outside Quebec or Canada, we ensure that your personal information is handled securely and in compliance with this Policy, and that a written agreement exists with the third party regarding the handling of your personal information. In addition, before disclosing your personal information outside Quebec, we always conduct a privacy impact assessment to evaluate, among other things, the risks inherent in the disclosure as well as the applicable legal regime of the state where your information would be disclosed.

We will not disclose your personal information unless we are satisfied that it will be adequately protected.

8. HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?

The personal information we collect is retained only as long as necessary to fulfill the purposes set out in Section 2 of the Policy and to comply with our legal and regulatory obligations. We have internal procedures and policies in place to ensure that your personal information is subject to a specified retention schedule, and that it is securely destroyed or, when allowed by applicable privacy laws, anonymized once this period has elapsed. If the information has been anonymized, it is no longer possible to identify you directly or indirectly, as this is an irreversible process. 

If you have any questions concerning the retention of your personal information, please contact our Privacy Officer using the contact details provided in Section 11.

9. WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL INFORMATION?

1. Access to your personal information 

Subject to the exceptions provided by law, you have the right to request a copy of, or access to, the personal information we hold about you. At your request, we will confirm the existence of the personal information, communicate it to you and allow you to obtain a copy of it. At your request, computerized personal information will be communicated in the form of a written and intelligible transcript. If you have limitations, reasonable accommodations will be provided upon request to enable you to exercise the right of access under this section. You may exercise your right of access by contacting our Privacy Officer at the coordinates provided in Section 11. Also note that:

• Access to your personal information is free of charge. However, in certain circumstances, such as if the request is excessive or unfounded, we may charge an administration fee for transcribing, reproducing, transmitting or requesting additional copies of your personal information. We will inform you of any such charges before processing your request;
• We generally respond to all requests for access within 30 days of receipt of any necessary information. When we are unable to grant access, or if additional time is required to fulfill a request, we will notify you in writing.
• Unless doing so raises serious practical difficulties, computerized personal information collected from you and not created or inferred using personal information concerning you, will, at your request, be communicated to you in a structured, commonly used technology format. The information will also be communicated, at your request, to any person or body authorized by law to collect such information.

2. Rectification of your personal information 

If you consider that your personal information is inaccurate or incomplete, you may rectify it by contacting our Privacy Officer at the coordinates provided in Section 11. It is your responsibility to inform us of any changes to your personal information so that we can ensure that your personal information is kept up to date.

3. Obtain information on the processing of your personal information 

You have the right to obtain additional information relating to the processing of your personal information. If you cannot find the answer to your questions in the Policy, you can contact our Privacy Officer using the contact details provided in Section 11.

4. Withdraw your consent 

When you give your consent for secondary purposes, in other words, purposes that are not essential to offer you our products and services, you may withdraw it at any time, without any consequence.

However, if you refuse to provide us with personal information that is necessary for us to offer you our products and services or that is required by law, we may no longer be able to provide you with some of our services. In this case, we may have to cancel our commitment to you. You will, however, be informed of the occurrence of such a situation.

5. Dissatisfaction with the management of your personal information

If you have any questions, concerns or dissatisfaction with this Policy or with the management of your personal information or you wish to file a complaint, you may contact our Privacy Officer using the contact details given in Section 11.

10. CONFIDENTIALITY INCIDENT

We take any incident or attempted incident of confidentiality, whether potential or real, seriously. For the purposes of the Policy, a “Confidentiality Incident” refers to any unauthorized access, use, or communication of personal information, as well as the loss of personal information or any other breach of its protection. Any Confidentiality Incident is taken seriously and communicated to regulatory authorities and affected individuals in accordance with applicable privacy laws. Our Privacy Officer will engage competent authorities to assist in resolving the issue.

If you have concerns regarding the collection, use, disclosure, retention, or destruction of your personal information, you can directly contact our Privacy Officer using the contact details provided in Section 11.

11. HOW TO CONTACT OUR PERSON IN CHARGE OF THE PROTECTION OF PERSONAL INFORMATION?

The protection of your personal information is important to us. We have appointed a Privacy Officer who ensures compliance with and implementation of applicable privacy legislation and acts as the person in charge of the protection of personal information. You can reach them using the following contact details: 

Data Operations Manager
Privacy Officer
1360 Avenue Galilée, Quebec City, QC, G1P 4E3

Phone number: 1 (833) 519-5927
Email: AdminRPR@conceptcshop.com

POLICY UPDATE

This Policy takes effect on the date mentioned at the top of the page and replaces all previous versions. The history of previous versions of the Policy can be obtained on request from our Privacy Officer.

The Policy may be updated at our sole discretion based on changes in our practices and legislation on the protection of personal information. When the Policy is updated, the changes will be specifically brought to your attention and a notice will be available on the home page of our Website. When the changes are of a material nature or require your consent, we will notify you by email if we have your email address.