Privacy policy

Last updated: 24 July 2026

My Dabba is a small gift-box business based in Calgary, Alberta, operated by Kind Loom Naturals. This policy explains what personal information we collect, why we collect it, what we do with it, and the rights you have over it. We've written it in plain language on purpose.

Who is responsible for your information

Kind Loom Naturals, trading as My Dabba, is responsible for the personal information in our custody. The person in charge of protecting personal information is our Privacy Officer, who can be reached at:

Privacy Officer, Kind Loom Naturals o/a My Dabba
Email: mydabba.ca@gmail.com
Calgary, Alberta, Canada

This designation is made under section 3.1 of Quebec's Act respecting the protection of personal information in the private sector (Law 25).

What we collect

We only collect what we actually need:

• To fill your order: your name, email address, shipping and billing address, phone number if you give one, and what you bought.
• To take payment: your payment is processed by our payment provider. We never see or store your full card number.
• If you customize a box: the pieces you chose and any gift message you wrote.
• If you email or message us: whatever you tell us in that conversation.
• If you sign up for emails: your email address and whether you've opened or clicked our messages.
• Automatically when you browse: your IP address, browser and device type, the pages you viewed, and how you arrived at our site.

Why we collect it

Under Canadian privacy law we have to tell you our purposes at the time we collect, and we can't quietly use your information for something else later. Our purposes are:

• Processing, packing and shipping your order, and contacting you about it
• Confirming your selections if you built a custom box
• Handling returns, refunds and customer service
• Preventing fraud and keeping the store secure
• Sending marketing emails, only if you asked us to
• Understanding which products and pages people respond to, so we can curate better boxes
• Meeting our tax and record-keeping obligations

If we ever want to use your information for a genuinely new purpose, we'll ask you first.

Consent, and taking it back

Placing an order is your consent for us to use your information to fulfil it. Marketing emails are separate and always opt-in.

You can withdraw consent at any time by emailing us or clicking unsubscribe in any email. Withdrawing consent for marketing won't affect an order already in progress, and we may still need to keep certain records to meet tax and legal obligations.

Cookies and tracking

Some cookies are strictly necessary - they keep your cart working and let you check out. Those can't be switched off.

Everything else - analytics and any advertising or performance tracking - is off until you turn it on. You'll be asked when you first visit, and you can change your mind at any time through the privacy settings link in our footer.

Quebec residents: Law 25 requires this explicit opt-in for non-essential tracking, and we apply the same standard to every visitor regardless of province.

Who we share it with

We do not sell your personal information. We never have and we don't intend to. We share it only with the service providers we need to run the store:

• Shopify - hosts our store and processes orders
• Our payment provider - processes your payment securely
• Canada Post - delivers your parcel
• Our email provider - only if you subscribed

Each of these is bound to use your information only to provide their service to us. We may also disclose information where the law requires it, or to establish or defend a legal claim.

Where your information is stored

Our store runs on Shopify, and our providers may store or process your information on servers outside Canada, including in the United States. While it is outside Canada it may be accessible to foreign courts, law enforcement, or national security authorities under the laws of that country.

We chose providers who commit to protecting your information contractually, but we want you to know this rather than bury it. If this concerns you, email us before ordering and we'll talk it through.

Automated decisions

We don't use automated systems to make decisions about you. Every box is curated by a person, and every custom order is reviewed by a person before it ships.

How long we keep it

• Order records: seven years, because Canadian tax law requires it
• Marketing subscriptions: until you unsubscribe, then we suppress your address so we don't email you again by mistake
• Customer service emails: two years
• Browsing and analytics data: up to two years

When we no longer need information, we delete or destroy it securely.

How we protect it

Our site runs over an encrypted connection (HTTPS). Payment details go directly to our payment processor and never touch our systems. Access to customer records is limited to people who need it to do their job, and accounts are protected with strong, unique passwords and two-factor authentication.

No system is perfectly secure, and we won't pretend otherwise. If a breach occurs that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada - and the Commission d'acces a l'information du Quebec if Quebec residents are affected - as required by law.

Your rights

You can ask us to:

• Show you what personal information we hold about you
• Correct anything inaccurate or incomplete
• Delete information we no longer need to keep
• Stop using it for marketing
• Send you a copy in a structured, commonly used electronic format, or transfer it to another organization (data portability, under Law 25)
• De-index information about you that is being disseminated in a way that causes you serious injury (under Law 25)

Email mydabba.ca@gmail.com and we'll respond within 30 days. There's no charge. We may ask you to confirm your identity first, so we don't hand your information to someone else.

Children

Our store isn't directed at children and we don't knowingly collect information from anyone under 14. If you believe a child has given us their information, email us and we'll delete it.

Marketing emails

We follow Canada's Anti-Spam Legislation (CASL). We only email you if you've given express consent or you've bought from us recently. Every message identifies us and has a working unsubscribe link that stays live for at least 60 days. Unsubscribes are actioned within 10 business days, usually immediately.

If you're unhappy with how we've handled your information

Tell us first - email mydabba.ca@gmail.com and we'll take it seriously and respond in writing.

If you're not satisfied with our answer, you can complain to:

• Office of the Privacy Commissioner of Canada - 1-800-282-1376, priv.gc.ca
• Commission d'acces a l'information du Quebec, if you live in Quebec - cai.gouv.qc.ca

Changes to this policy

If we change this policy we'll update the date at the top and post the new version here. If the change is significant, we'll tell you by email.