Privacy Policy

Joneses at Willow, a division of Willow & Dove Studios (collectively, “we”, “us”, or “our”), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website at jonesesatwillow.ca and related services (the “Platform”).

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy legislation. By using the Platform, you consent to the practices described in this policy.

1. Information We Collect

We collect personal information you provide directly to us and information generated through your use of the Platform:

• Account information — your name, email address, phone number, and password when you register.
• Billing and payment information — payment card details processed securely through our payment provider (Stripe). We do not store full card numbers on our servers.
• Shipping information — mailing address and delivery instructions provided for store orders.
• Bidding activity — your bid history, won lots, invoices, and transaction records.
• Communications — messages you send us via contact forms, email, or support requests.
• Usage data — IP address, browser type, pages visited, referring URLs, and session duration, collected automatically when you access the Platform.
• Cookies and similar technologies — see Section 4 for details.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account and authenticate your identity.
• Process bids, invoices, and store orders.
• Send transactional emails (bid confirmations, outbid alerts, invoice notices, pickup reminders).
• Respond to your inquiries and provide customer support.
• Detect and prevent fraud, shill bidding, and other prohibited activity.
• Comply with legal obligations, including tax reporting and record-keeping requirements under Canadian law.
• Improve the Platform through aggregated, anonymised analytics.
• Send occasional service announcements or updates about upcoming auctions (you may unsubscribe at any time).

We do not sell, rent, or trade your personal information to third-party marketers.

3. Legal Basis for Processing

Under PIPEDA, we collect and use personal information only with your knowledge and consent, except where the law permits or requires otherwise. We rely on:

• Consent — you provide explicit consent when registering and accepting these policies.
• Contractual necessity — processing required to fulfil your auction or store purchases.
• Legal obligation — processing required to comply with Canadian tax law, anti-fraud regulations, and other statutes.
• Legitimate interest — fraud prevention, platform security, and service improvement.

4. Cookies and Tracking Technologies

We use cookies and similar technologies to operate and improve the Platform:

• Essential cookies — required to maintain your session and authentication state. These cannot be disabled without breaking core functionality.
• Functional cookies — remember your preferences (e.g., cart contents, watchlist).
• Analytics cookies — anonymous usage statistics to understand how the Platform is used and to improve it. We use aggregated data only.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from logging in or completing transactions.

5. Sharing with Third Parties

We share your personal information only in the following circumstances:

• Service providers — third-party vendors who assist us in operating the Platform, including payment processing (Stripe), email delivery (Resend), SMS notifications (Twilio), cloud hosting (Supabase, Vercel), and image processing. These providers are contractually bound to keep your information confidential and use it only for the purposes we specify.
• Legal requirements — when required by law, court order, or governmental authority, or to protect the rights, property, or safety of Joneses at Willow, our users, or the public.
• Business transfers — in the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. You will be notified of any such change in ownership.

All third-party providers we engage are required to maintain adequate data protection standards consistent with applicable Canadian privacy law.

6. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes described in this policy and to comply with our legal obligations:

• Account and transaction records are retained for a minimum of 7 years following the transaction date, as required for Canadian tax and accounting purposes.
• If you close your account, we will delete or anonymise your personal information within 90 days, except where retention is required by law.
• Server logs and analytics data are retained for no more than 12 months.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These include:

• TLS/HTTPS encryption for all data in transit.
• Row-level security and access controls on our database.
• Secure, hashed storage of passwords (we never store plain-text passwords).
• Payment processing via PCI-compliant Stripe; we do not store full card numbers.

No method of transmission over the Internet is 100% secure. If you have reason to believe your account has been compromised, please contact us immediately at hello@jonesesatwillow.ca.

8. Your Rights

Under PIPEDA and applicable Ontario privacy law, you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — request correction of inaccurate or incomplete personal information.
• Withdrawal of consent — withdraw consent to our use of your personal information at any time, subject to legal or contractual restrictions. Note that withdrawing consent may affect your ability to use the Platform.
• Deletion (right to be forgotten) — request deletion of your account and associated personal information, subject to our retention obligations under applicable law.
• Complaint — lodge a complaint with the Office of the Privacy Commissioner of Canada if you believe we have mishandled your personal information.

To exercise any of these rights, please contact us using the details in Section 10 below. We will respond within 30 days.

9. Children’s Privacy

The Platform is not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us and we will promptly delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the revised policy on this page with an updated “Last updated” date. For material changes, we will notify registered users by email or via a notice on the Platform before the change takes effect.

See also: Terms and Conditions