Same day delivery available on orders placed by 11am

00:00:00 remaining
Search

Privacy Policy — Yorkdale Flowers

Effective Date: July 6, 2026

Yorkdale Flowers is committed to protecting the privacy and personal information of our customers, website visitors, and business contacts. This Privacy Policy describes how we collect, use, disclose, and protect your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, and the ten fair information principles set out in Schedule 1 of PIPEDA as administered by the Office of the Privacy Commissioner of Canada.

Questions about this policy? Contact our Privacy Officer at info@yorkdaleflowers.com or call (647) 622-1338.

1. Accountability

PIPEDA Principle 1 — Accountability

Yorkdale Flowers is responsible for all personal information in its possession or under its control, including information transferred to third parties for processing. We have designated a Privacy Officer who is accountable for our compliance with PIPEDA and this Privacy Policy.

Our Privacy Officer ensures that:

  • Privacy policies and procedures are developed, implemented, and kept current.
  • Staff who handle personal information receive appropriate privacy training.
  • Complaints and inquiries from individuals are received and investigated.
  • Third-party contracts include appropriate privacy protections.
  • Privacy practices are reviewed on an ongoing basis.

2. Personal Information We Collect

PIPEDA Principle 4 — Limiting Collection

"Personal information" means any information about an identifiable individual. We collect only the personal information necessary to provide our products and services.

2.1 Customer & Order Information

  • Identity information: full name, email address, telephone number.
  • Delivery address: street address, city, province, and postal code.
  • Payment details: credit or debit card number (last four digits only retained), expiry date, and billing address. Full card data is processed and stored exclusively by our PCI-DSS certified payment processor — Yorkdale Flowers does not store raw card numbers.
  • Order details: items ordered, order date, delivery date, personalised card messages, and gifting preferences.
  • Account credentials: username and hashed password for customers who create an online account.

2.2 Communication Information

  • Email addresses and phone numbers provided when you contact us, subscribe to our newsletter, or make an inquiry.
  • Content of messages, feedback, or reviews you send us.
  • Records of your opt-in or opt-out from marketing communications.

2.3 Website & Technical Information

  • IP address, browser type and version, operating system.
  • Pages visited, time spent on pages, and referring URL.
  • Cookie identifiers and session data (see Section 13).

We do not collect sensitive personal information such as Social Insurance Numbers, health information, government-issued ID numbers, or racial/ethnic origin unless you voluntarily provide such information in a message to us, in which case it is used only to respond to your inquiry.

3. Purposes for Collection

PIPEDA Principle 2 — Identifying Purposes

We collect, use, and disclose personal information for the following purposes, which we identify at or before the time of collection:

  • Processing and fulfilling orders: To complete your purchase, arrange delivery or pickup, send order confirmations and receipts, and communicate about your order.
  • Customer account management: To create and maintain your online account, remember delivery preferences, and provide order history.
  • Payment processing: To authorise and process your payment through our certified payment processor.
  • Customer service: To respond to your questions, resolve complaints, and improve your experience.
  • Marketing and promotions: To send you our newsletter, seasonal promotions, and event invitations — only with your consent. You may opt out at any time.
  • Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions and other illegal activity.
  • Legal compliance: To meet our obligations under applicable federal and provincial laws, including tax reporting and consumer protection legislation.
  • Website improvement: To analyse how our website is used, troubleshoot technical issues, and improve our online services.
  • Corporate transactions: In the event of a merger, acquisition, or asset sale, personal information may be disclosed to a prospective or actual purchaser, subject to confidentiality obligations.

We will not use your personal information for any new purpose without first identifying that purpose and, where required, obtaining your consent.

4. Consent

PIPEDA Principle 3 — Consent

We obtain your knowledge and consent before or at the time we collect your personal information, and for any new use or disclosure that goes beyond the original purpose.

4.1 Express Consent

We obtain express (explicit) consent when we collect sensitive information, when we add you to our marketing email list, or when a reasonable person would consider the information to be sensitive in the context. Express consent may be given in writing (e.g., by ticking a checkbox), verbally by telephone, or electronically.

4.2 Implied Consent

When you place an order with us, we imply your consent to the collection and use of your contact and payment information for order fulfilment, customer service, and fraud prevention. Implied consent is appropriate where the purpose would be considered obvious and you voluntarily provide the information.

4.3 Withdrawing Consent

You may withdraw your consent at any time, subject to legal and contractual restrictions and reasonable notice. To withdraw consent:

  • Send an email to info@yorkdaleflowers.com stating the consent you wish to withdraw.
  • Click the "Unsubscribe" link at the bottom of any marketing email we send you.
  • Call our Privacy Officer at (647) 622-1338.

Please note that withdrawing consent to use your information for order fulfilment may prevent us from completing a transaction or providing a service you requested.

4.4 Consent — Exceptions

PIPEDA recognises circumstances where consent is not required, including: collection or use required by law, where seeking consent would compromise the accuracy of information or the purpose of its collection (e.g., fraud investigations), or where the personal information is publicly available.

5. Limiting Collection

PIPEDA Principle 4 — Limiting Collection

We collect personal information only by fair and lawful means and limit what we collect to the minimum necessary for the identified purposes. We do not collect information indiscriminately or aggregate personal information beyond what is needed.

When you browse our website without making a purchase or creating an account, we collect only technical and usage data through cookies, which may be managed through your browser settings (see Section 13).

6. Use, Disclosure & Retention

PIPEDA Principle 5 — Limiting Use, Disclosure, and Retention

We do not sell, rent, or trade your personal information. We use and disclose personal information only for the purposes for which it was collected, or as required or permitted by law.

6.1 Permitted Disclosures

We may share your personal information with:

  • Delivery and courier partners: To arrange and complete the delivery of your order to the specified address.
  • Payment processors: Our payment processor (currently Stripe) receives card data to authorise transactions. Stripe is PCI-DSS Level 1 compliant.
  • Email service providers: To send transactional emails (order confirmations, shipping updates) and, with your consent, marketing newsletters.
  • Website hosting and IT service providers: Our website is hosted on a third-party platform. These providers have access only to information necessary to perform their services and are bound by confidentiality agreements.
  • Accounting and legal advisors: Where necessary for tax reporting, legal compliance, or professional advice, subject to professional confidentiality obligations.
  • Law enforcement or regulators: Where required by applicable Canadian federal or provincial law, court order, or where we believe disclosure is necessary to protect the safety of any person.

6.2 Data Retention

We retain personal information only as long as necessary for the purposes for which it was collected, or as required by law:

  • Customer order records: 7 years from the date of the transaction (consistent with CRA requirements under the Income Tax Act).
  • Online account information: As long as your account remains active, plus 2 years after account closure, unless you request earlier deletion.
  • Marketing consent records: For the duration of the marketing relationship plus 3 years after opt-out, to demonstrate compliance.
  • Website analytics and cookies: Aggregated analytics data: up to 26 months. Individual session cookies: deleted at end of browser session.
  • Customer service correspondence: 3 years from date of last contact.

When personal information is no longer required, we destroy it in a secure manner (physical shredding for paper records; secure deletion or anonymisation for electronic records).

7. Accuracy

PIPEDA Principle 6 — Accuracy

We strive to ensure that the personal information we hold is as accurate, complete, and up-to-date as necessary for the purposes for which it is used.

You are responsible for notifying us of any changes to your personal information. If you believe information we hold about you is inaccurate or incomplete, please contact our Privacy Officer. We will investigate and, where warranted, correct or annotate the information. If we disagree that a correction is warranted, we will note your request in your file.

8. Safeguards

PIPEDA Principle 7 — Safeguards

We protect personal information using physical, organisational, and technological safeguards appropriate to the sensitivity of the information. Our safeguards include:

  • Technical measures: TLS/SSL encryption for all data transmitted through our website; encryption of stored payment-related data; access controls and password-protected systems; firewall and intrusion detection systems.
  • Organisational measures: Role-based access so staff access only information necessary for their job; privacy training for all employees who handle personal information; confidentiality clauses in employment and contractor agreements.
  • Physical measures: Locked filing cabinets for paper records; restricted access to areas where personal information is stored.
  • Third-party safeguards: Contractual requirements obligating our service providers to protect personal information to the same standard we apply.

8.1 Breach Notification

In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm, Yorkdale Flowers will:

  • Notify the Office of the Privacy Commissioner of Canada as soon as feasible.
  • Notify affected individuals directly.
  • Maintain a record of all breaches for a minimum of 24 months.

These obligations are set out in sections 10.1–10.3 of PIPEDA as amended by the Digital Privacy Act.

9. Openness

PIPEDA Principle 8 — Openness

We make information about our privacy policies and practices readily available to the public. This Privacy Policy is posted on our website at yorkdaleflowers.com/privacy-policy and is available in printed form upon request at our store.

Upon request, we will make available:

  • The name or title, and address, of our Privacy Officer.
  • The type of personal information we hold and a general account of how it is used.
  • How to gain access to personal information we hold about you.
  • How to make a complaint about our privacy practices.

10. Your Right of Access

PIPEDA Principle 9 — Individual Access

Upon written request to our Privacy Officer, you have the right to:

  • Know whether we hold personal information about you.
  • Access the personal information we hold about you.
  • Know how that information has been or is being used.
  • Know to whom it has been disclosed.
  • Challenge the accuracy and completeness of the information and have it amended as appropriate.

10.1 How to Submit an Access Request

Send a written request to our Privacy Officer (see Section 16). Your request must:

  • Be made in writing (email is acceptable).
  • Include sufficient identification to allow us to verify your identity.
  • Specify the information or category of information you wish to access.

10.2 Response Timeline

We will respond to your request within 30 days of receipt, as required by PIPEDA. If we cannot respond within 30 days, we will notify you of the extension and the reasons for it. We will provide access in a form that is generally understandable.

10.3 Permitted Refusals

In limited circumstances permitted by PIPEDA, we may be unable to provide access to certain information, such as information subject to solicitor-client privilege, information that would reveal personal information about a third party, or information collected in connection with an investigation of a breach of an agreement or a contravention of a law.

11. Challenging Compliance

PIPEDA Principle 10 — Challenging Compliance

You have the right to challenge our compliance with this Privacy Policy and PIPEDA. We take all privacy complaints seriously.

Our internal complaints process:

  • Submit your complaint in writing to our Privacy Officer (Section 16).
  • We will acknowledge receipt within 5 business days.
  • We will investigate your complaint and respond with our findings within 30 days, or notify you if additional time is required.
  • If we find a complaint is justified, we will take appropriate steps to correct our practices.

If you are unsatisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC):

12. Third-Party Service Providers

We work with carefully selected third-party service providers to operate our business. Where personal information is transferred to a third party, we ensure through contractual means that the third party provides comparable protection.

Key service providers include:

  • Payment Processing (Stripe, Inc.): Processes credit and debit card transactions on our behalf. Subject to PCI-DSS compliance. See Stripe's Privacy Policy at stripe.com/privacy.
  • Website Hosting (Cloud hosting provider): Hosts our e-commerce website and databases. Located in Canada or the United States.
  • Email Marketing (Email service provider, e.g., Mailchimp): Sends marketing and transactional emails on our behalf. We share only email addresses and first names of opted-in subscribers.
  • Delivery Services (Local courier / Canada Post): Receives recipient name, delivery address, and order notes solely to complete delivery.
  • Accounting Software (Cloud accounting provider): Stores invoice and transaction data for bookkeeping purposes.

Cross-border transfers: Some of our service providers are located in the United States. Personal information may therefore be subject to the laws of a foreign jurisdiction, including lawful access by government authorities in that jurisdiction. We take steps to ensure our providers meet Canadian privacy standards.

13. Cookies & Online Tracking

Our website uses cookies and similar tracking technologies to operate and improve the site.

  • Strictly necessary cookies: Required for the website to function, including maintaining your shopping cart and login session. These cannot be disabled.
  • Analytics cookies: Allow us to understand how visitors use our website (e.g., Google Analytics). Data is aggregated and anonymised where possible.
  • Marketing/preference cookies: Remember your preferences and, with your consent, allow us to serve you relevant promotional content.

You may manage or disable cookies through your browser settings. Disabling certain cookies may affect website functionality.

14. Children's Privacy

Our website and services are not directed to individuals under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact our Privacy Officer immediately and we will promptly delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

  • Post the revised policy on our website with an updated Effective Date.
  • Notify registered account holders by email where the change is material.
  • Obtain fresh consent where required by law.

Your continued use of our website or services after the effective date of a revised policy constitutes your acceptance of the updated terms.

16. Contact — Privacy Officer

All privacy inquiries, access requests, correction requests, consent withdrawals, and complaints should be directed to our designated Privacy Officer:

Privacy Officer
Yorkdale Flowers
89 Bentworth Ave, Unit 1B
North York, Ontario M6A 1P6
Canada

Email: info@yorkdaleflowers.com
Phone: (647) 622-1338
Website: yorkdaleflowers.com/privacy-policy

For further information about your privacy rights under Canadian federal law, or to file a complaint about how any organisation handles your personal information, contact the Office of the Privacy Commissioner of Canada:

Website: www.priv.gc.ca
Toll-free: 1-800-282-1376

This Privacy Policy was prepared in accordance with the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, and the ten fair information principles set out in Schedule 1 thereof, as interpreted by the Office of the Privacy Commissioner of Canada. Last reviewed: July 6, 2026.

Regulatory References