Privacy Policy

Effective date: November 12, 2026. This Privacy Policy explains what personal information Rugs District collects when you visit rugsdistrict.com or buy from us, why, who we share it with, how long we keep it and how to exercise your rights. It is written to meet Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25), Canada's PIPEDA, the EU and UK General Data Protection Regulation (GDPR), Canada's Anti-Spam Legislation (CASL) and US state privacy laws such as California's.

1. Who is responsible

Rugs District, Montréal, Québec, Canada, is responsible for your personal information (the "controller" under the GDPR).

Person in charge of the protection of personal information (Privacy Officer): the owner of Rugs District. Contact: [email protected], subject line "Privacy".

2. The short version

• We collect what we need to sell and deliver your order, answer you and keep the store secure.
• We measure visits with our own analytics on our own servers. We don't use advertising pixels and we don't sell or rent your personal information, or share it for targeted advertising.
• In Québec, the rest of Canada, the EU, the UK and Switzerland, analytics stay off until you accept them. Everywhere, you can refuse them, and we respect the Global Privacy Control signal.
• Marketing emails only go to people who agreed to receive them, and every one has an unsubscribe link.

3. What we collect and why

When you order

Name, email, phone number (optional), shipping and billing address, the items you buy, prices, discount codes, currency and your order history with us. Why: to process, produce, ship and track your order, send order and shipping emails, handle returns, refunds and chargebacks, and keep accounting and tax records. Legal basis (GDPR): performance of our contract with you, and our legal obligations (tax and accounting).

Payment details are entered directly with Stripe or PayPal. We never see or store your full card number; we receive a payment confirmation, the payment method type and, for cards, the brand and last four digits.

When you type your email at checkout but don't finish

We save your email and cart so you can pick up where you left off, and we may send one reminder email about the items you left behind. You can unsubscribe from it with one click. Legal basis: our legitimate interest in helping you complete a purchase you started (in Canada, implied consent under CASL following your inquiry).

When you contact us, ask for a custom rug or sign up for alerts

• Contact form and emails: your name, email, order number and your message, to answer you.
• Custom rug requests: your name, email, the image or artwork you send and your notes, to quote, design and produce your rug.
• Restock alerts: your email and the product, to tell you once when it's back.
• Newsletter: your email and the date and place you signed up, to send drops, restocks and offers, only with your consent, which you can withdraw at any time.

When you write a review

Your name, email, rating, review, photos and the location you enter. Your email is never published. Your first name, location, rating, review and photos are public on the Site. After delivery we may email you once to ask for a review.

When you browse

Always (strictly necessary): your cart, your currency choice and your cookie choice are stored in your browser so the store works. Our servers also process technical data such as your IP address to deliver pages and protect the store against abuse (for example, limiting how many reviews one connection can send). We don't store your IP address in our analytics.

Only with your consent where required (analytics): a random visitor ID and session ID, the pages and products you view, what you add to your cart, the website or campaign that sent you (referrer, UTM tags and ad-click identifiers such as gclid or fbclid), your device type, browser, screen size, language and approximate country (from your time zone or language, not your precise location). We use this to understand which pages and campaigns work and to improve the store. These analytics run on our own servers; we don't share them with Google, Meta, TikTok or other ad networks. Legal basis: your consent (Québec, Canada, EU, UK, Switzerland) or our legitimate interest in improving our store (elsewhere, with the right to refuse).

Address autocomplete

When you type your street address at checkout, the characters you type and the country you selected are sent by our server to Google's Places service to suggest matching addresses. We don't send your name, email, payment details or order. Google's privacy policy: policies.google.com/privacy.

We don't

• sell or rent personal information, or "share" it for cross-context behavioural advertising;
• use advertising pixels or third-party tracking cookies on the Site;
• make decisions about you based solely on automated processing;
• collect sensitive information (health, beliefs, etc.); please don't include it in messages.

4. Cookies and similar technologies

You can change your choice at any time with the "Cookie settings" link at the bottom of every page, or by deleting cookies in your browser. Refusing analytics doesn't affect your ability to shop.

5. Who we share it with

We share personal information only with service providers who need it to run the store, under contracts that require them to protect it and use it only for us:

• Payments: Stripe and PayPal (payment processing, fraud prevention, disputes).
• Production and delivery: our production partners and the carriers who print and deliver your order (name, shipping address, phone number if given, items), and our parcel-tracking service (tracking numbers).
• Email: our email delivery provider, to send order, shipping and (if you agreed) marketing emails.
• Hosting and infrastructure: the companies that host the Site and its database.
• Address suggestions: Google (see section 3).

We may also disclose information when the law requires it (for example a court order), to protect our rights or prevent fraud, or as part of the sale of our business, in which case the buyer must respect this policy.

6. Where your information is stored

Some of our providers store or process information outside Québec and Canada, including in the United States, the European Union and the countries where our production partners and carriers operate. Before transferring information outside Québec, we assess whether it will be adequately protected, and we use contractual safeguards. For transfers from the EU, the UK or Switzerland, we rely on adequacy decisions (Canada has one for commercial organisations) or the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents. Information held abroad may be accessible to the authorities of those countries under their laws.

7. How long we keep it

• Orders, invoices and payment records: 6 years after the end of the tax year of the order, as Canadian and Québec tax laws require.
• Customer service messages and custom requests: up to 3 years after our last exchange, to handle follow-ups and warranty claims.
• Saved carts from unfinished checkouts: until you complete or abandon the purchase, and no longer than 6 months.
• Newsletter: until you unsubscribe; we then keep only your email on a do-not-contact list so we never email you again by mistake.
• Reviews: as long as they are published, or until you ask us to remove them.
• Analytics: no longer than 26 months, after which they are deleted or anonymised.

When information is no longer needed, we delete it or anonymise it so it can't identify you.

8. Your rights

Depending on where you live, you can ask us to:

• access the personal information we hold about you and learn how it's used and who it's shared with;
• correct it if it's inaccurate, incomplete or out of date;
• delete it, or stop disseminating it and de-index any link to your name (Québec);
• receive it in a structured, commonly used technological format, or have it sent to someone else (portability);
• withdraw your consent (for example to marketing emails or analytics) at any time;
• object to or restrict certain uses, including any use for marketing;
• in some US states, opt out of the "sale" or "sharing" of personal information (we don't do either) and not be discriminated against for using your rights.

To make a request, email [email protected] with the subject "Privacy". We may ask you to confirm your identity, for example from the email address on your order. We reply within 30 days, free of charge. You may also use an authorised agent, who must show us your written permission.

If you're not satisfied with our answer, you can complain to: the Commission d'accès à l'information du Québec (cai.gouv.qc.ca); the Office of the Privacy Commissioner of Canada (priv.gc.ca); the data protection authority of your EU country; or, in the UK, the Information Commissioner's Office (ico.org.uk).

9. Marketing emails

We send newsletters and offers only if you signed up, and abandoned-cart or review-request emails only as described above. Every marketing email identifies us and has a working unsubscribe link; we process unsubscribes within 10 business days, usually immediately. Order and shipping emails are part of your purchase and are sent even if you unsubscribe from marketing.

10. Security

We protect your information with encryption in transit (HTTPS), access limited to people who need it, strong authentication for our staff console, and payment processing handled entirely by PCI-DSS certified providers. No system is perfectly secure. If a confidentiality incident creates a risk of serious injury to you, we will notify you and the competent authorities, as the law requires, and we keep a register of incidents.

11. Children

The Site is meant for adults and teenagers shopping with a parent's permission. We don't knowingly collect personal information from children under 14 (16 in the EU) without the consent of a parent or guardian. If you believe a child has sent us information, contact us and we will delete it.

12. Links to other sites

The Site links to social networks and other sites (for example Instagram or TikTok). Their own privacy policies apply when you visit them.

13. Changes

We'll update this policy when our practices or the law change, and change the effective date at the top. If a change materially affects how we use information you already gave us, we'll tell you by email or on the Site before it applies and, where required, ask for your consent.

14. Contact

Privacy Officer, Rugs District, Montréal, Québec, Canada. [email protected] (subject "Privacy").