Privacy Policy

Last updated: September 10, 2026

At ISTEA, protecting your privacy and personal information is important to us.

This Privacy Policy explains transparently how ISTEA collects, uses, discloses, retains, and protects your personal information when you visit our website, make a purchase, communicate with us, or use our services.

Personal Information We Collect

Depending on how you interact with ISTEA, we may collect the following personal information:

your first and last name;
your email address;
your telephone number, when you provide it;
your billing and shipping addresses;
information relating to your orders, purchases, returns, and exchanges;
information necessary to process your payments;
your communications with our customer service;
your communication preferences and subscription to our marketing communications;
certain technical data related to your use of the website, including your IP address, device or browser type, and certain information relating to your browsing activity;
any other information you voluntarily choose to provide to us.

We seek to limit the collection of personal information to what is necessary for the purposes identified in this Policy or otherwise indicated at the time of collection.

How We Collect Personal Information

Your personal information may be collected:

directly from you when you place an order, complete a form, communicate with us, or subscribe to our communications;
automatically when you use our website, including through cookies and similar technologies;
through service providers necessary for the operation of our online store and the provision of our services.

Why We Use Your Personal Information

ISTEA may use your personal information for purposes including:

processing, preparing, and shipping your orders;
processing and administering payments;
communicating with you regarding an order or request;
providing customer service;
processing returns, exchanges, and refunds;
operating and securing our website;
detecting or preventing fraud and unauthorized activities;
improving our store, products, services, and customer experience;
sending you marketing communications when you have consented to receive them;
complying with our legal, tax, accounting, and regulatory obligations;
exercising or defending our rights when necessary and permitted by law.

We will not use your personal information for purposes that are incompatible with those for which it was collected, except where permitted by law or with your consent when required.

Legal Bases for Processing

Where applicable law requires us to identify a legal basis for processing your personal information, including where the General Data Protection Regulation (“GDPR”) applies, ISTEA may process your information on one or more of the following bases:

performance of a contract, including to process an order, payment, delivery, return, or refund;
your consent, including for certain marketing communications or tracking technologies where consent is required;
compliance with a legal obligation, including tax, accounting, or regulatory requirements;
our legitimate interests, where permitted by law, including securing our store, preventing fraud, improving our services, and protecting our rights, provided that these interests are not overridden by your rights and freedoms.

Consent

Where required by law, ISTEA obtains your consent before collecting, using, or disclosing your personal information.

Your consent must be clear, freely given, and informed, and must be provided for specific purposes.

You may withdraw your consent where permitted by law. Withdrawing your consent does not affect the lawfulness of processing carried out before its withdrawal and may limit our ability to provide certain services where particular information is necessary to provide those services.

Payments

Payments made through our store are processed by the payment service providers available at the time of your purchase.

ISTEA does not directly retain your complete payment card information.

Information necessary to complete a transaction may be collected and processed by our payment service providers in accordance with their own privacy and security practices.

Shopify and Other Service Providers

Our online store is operated using Shopify.

In order to operate our store and provide our services, we may disclose certain personal information to service providers that act on our behalf or participate in providing our services, including providers of:

e-commerce and hosting services;
payment processing;
shipping and transportation;
technology services;
analytics and performance measurement;
communications and marketing;
professional services, where necessary.

We seek to limit the information disclosed to what is necessary for the performance of the relevant services.

These service providers may be located in Quebec, elsewhere in Canada, or abroad.

Processing and Transfer of Information Outside Quebec or Your Country of Residence

Some of our service providers may process or store personal information outside Quebec, Canada, or your country of residence.

In these circumstances, the information may be subject to the laws of the jurisdiction in which it is processed or stored and may be accessible to competent authorities in accordance with those laws.

Where required by applicable law, ISTEA takes the necessary measures to ensure an appropriate level of protection for personal information transferred outside its jurisdiction of origin.

For individuals to whom the GDPR applies, transfers of personal information outside the European Economic Area are carried out in accordance with the mechanisms and safeguards recognized under applicable law, where required.

Cookies and Similar Technologies

Our website uses or may use cookies and other similar technologies necessary for its operation.

These technologies may be used to:

operate the online store;
remember certain preferences;
maintain your shopping cart;
secure certain features;
understand how the website is used;
measure the performance of the website and our communications;
personalize certain experiences or communications, where you have consented.

Where your consent is required, the relevant technologies are used in accordance with the choices you make through the privacy tools available on our website.

You may also manage certain cookies through your browser settings. Disabling certain essential cookies may, however, affect the operation of certain website features.

Marketing Communications

When you choose to subscribe to our communications, ISTEA may use your contact information to send you news regarding our collections, launches, events, or other communications related to the brand.

You may withdraw your consent to receive these communications at any time by using the unsubscribe link provided or by contacting us.

Withdrawing your consent to marketing communications does not affect communications necessary to process or follow up on your orders.

Retention and Destruction of Personal Information

ISTEA retains personal information only for as long as necessary to fulfill the purposes for which it was collected and to comply with applicable legal, tax, accounting, or regulatory obligations.

Retention periods may vary depending on the nature of the information, the reason it was collected, and applicable legal requirements.

When personal information is no longer required, it is securely destroyed or anonymized where permitted by law and where appropriate.

Protection and Security

ISTEA takes reasonable security measures to protect the personal information under its responsibility against loss, theft, unauthorized access, use, disclosure, or modification.

The nature of the measures used takes into account, among other things, the sensitivity, quantity, purpose, and format of the information concerned.

Despite these measures, no method of electronic transmission or storage can guarantee absolute security.

Privacy Incidents

If an incident involving personal information occurs, ISTEA will take reasonable measures necessary to reduce the risk of harm and prevent similar incidents from occurring.

Where required by law, affected individuals and the appropriate authorities will be notified of the incident.

Your Rights

Depending on your place of residence, the circumstances, and applicable laws, you may have the right to request:

access to the personal information we hold about you;
correction of inaccurate, incomplete, or ambiguous information;
information regarding how your personal information is collected, used, or disclosed;
withdrawal of your consent, where permitted by law;
deletion or erasure of certain personal information, where provided by law;
restriction of the processing of certain information;
objection to certain processing of your personal information;
cessation of the dissemination of certain information or its de-indexation where the conditions provided by law are met;
communication of certain computerized personal information in a structured and commonly used technological format where the right to data portability provided by law applies;
exercise of any other right granted to you under applicable law.

To exercise any of these rights, please contact the person responsible for the protection of personal information using the contact details provided below.

We may be required to verify your identity before responding to your request.

Rights of Individuals in the European Economic Area

Where the GDPR applies to the processing of your personal information, you may benefit from additional rights provided under this legislation, including:

the right to access your personal information;
the right to request correction of your personal information;
the right to request erasure of your personal information in certain circumstances;
the right to request restriction of its processing;
the right to object to certain processing;
the right to data portability where the applicable conditions are met;
the right to withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before its withdrawal;
the right to lodge a complaint with the competent data protection supervisory authority.

These rights may be subject to certain conditions, limitations, or exceptions provided under applicable law.

To exercise your rights, you may contact us at clientservices@istea.store.

Person Responsible for the Protection of Personal Information

The person responsible for the protection of personal information at ISTEA oversees compliance with applicable privacy practices and handles requests concerning personal information.

Person Responsible for the Protection of Personal Information
Founder — ISTEA
clientservices@istea.store
Montreal, Quebec, Canada

Any questions, access requests, correction requests, or concerns regarding the protection of your personal information may be submitted to this address.

Privacy Complaints

If you have concerns about how ISTEA handles your personal information, we encourage you to contact the person responsible for the protection of personal information.

Your request will be reviewed and handled in accordance with applicable laws.

You also retain the right to contact the competent privacy authority where circumstances permit.

For individuals to whom the GDPR applies, you may also lodge a complaint with the competent data protection supervisory authority in your country or region, where permitted by applicable law.