Privacy Policy

BANA FLORIST INC., a corporation incorporated in Ontario, trades as Bana Florist and operates the website at banaflorist.ca from its shop in North York. In this policy, “we”, “us” and “our” mean that company.

We are responsible for the personal information in our custody. We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law, which governs businesses operating in Ontario.

PIPEDA requires us to name an individual accountable for our handling of personal information. Privacy questions, access requests and complaints go to our Privacy Officer:

info@banaflorist.ca · (647) 207-7071 · or by mail at the store address above, marked “Attention: Privacy Officer”.

We collect only what we need to take your order, deliver it, and answer your questions. What we hold depends on how you use the site.

If you place an order

• Your name, email address and phone number, so we can confirm the order and reach you if there is a problem with it.
• The delivery address, including any unit number and delivery notes you provide.
• Your chosen delivery date and time window.
• The items ordered, prices, any discount code used, and the order total.
• Any gift message or order notes you write.

If you are sending flowers to someone else

Gift orders mean we collect information about a person who is not our customer. For the recipient we collect their name, delivery address, and, if you give it, their phone number and email address. We use this only to complete that delivery.

Two commitments follow from that. First, please only give us a recipient’s contact details if you are comfortable doing so on their behalf. Second, we never show prices to a gift recipient. Receipts and order confirmations go to you, the purchaser, and never to the recipient’s address.

If you create an account

• Your name, email address and, optionally, a phone number.
• If you register with a password, we store a cryptographic hash of it. We never store the password itself and cannot read it or tell you what it is.
• If you sign in with Google, we receive your name, email address and profile picture from Google. We never receive or see your Google password.
• Saved delivery addresses, your wishlist, your order history, and your loyalty points balance and transaction history.

If you request a quote or contact us

For weddings, corporate work and other event enquiries we collect your name, email, phone number, the type of service, and whatever event details you choose to share, which may include the event date, location, guest count, budget range, and your message.

If you leave a review

We collect the name you choose to display, your rating, and your review text. Approved reviews are published on the site with that display name, so please do not include anything in a review you would not want shown publicly.

Automatically, as you browse

Our hosting provider records standard server logs, including IP addresses and browser information, for security and reliability. We also set the cookies described in section 6. We do not run analytics software, advertising pixels, or third-party trackers of any kind on this website.

We never see, handle, or store your full credit card number.

When online card payment is enabled, card details are entered into a secure payment window hosted by Helcim, a Canadian payment processor. Your card data travels directly from your browser to Helcim and never passes through our servers. Helcim is responsible for that data under its own privacy policy and its PCI DSS obligations. All we receive back and store is a transaction reference number, the amount, and whether the payment succeeded.

Where an order is arranged by phone, your card is processed on our in-store terminal and the number is not written down or kept.

We use personal information to:

• Take, process, and deliver your order, and send you order confirmations and delivery updates.
• Calculate the delivery fee for your address and confirm we can deliver to it.
• Answer your questions and respond to quote requests.
• Maintain your account, saved addresses, wishlist, and loyalty points.
• Keep the records we are required by law to keep, including for tax purposes.
• Detect and prevent fraud, and protect the security of the site.
• With your express consent, send you marketing emails about seasonal collections and offers.

We do not use your information for automated decision-making or profiling, and we do not build advertising profiles about you.

A cookie is a small file stored by your browser. We use only the cookies the site needs in order to work. There are no advertising or analytics cookies.

• Shopping cart. A cookie holding a random cart identifier, so your basket survives moving between pages. It expires after 30 days and cannot be read by scripts in your browser.
• Sign-in and security. If you have an account, cookies keep you signed in and protect forms against cross-site request forgery. Signing out clears them.

You can block or delete cookies in your browser settings. If you block the cart cookie, the shopping basket will not work.

We do not sell, rent, or trade your personal information. We share it only with the service providers that make the shop function, and only to the extent each one needs:

• Vercel hosts the website and processes requests to it. United States.
• Neon hosts our database, where order and account records are stored. United States.
• Resend sends our transactional email, such as order confirmations. United States.
• Helcim processes card payments. Canada.
• Googleprovides the optional “Continue with Google” sign-in, and the embedded map on our contact page. United States.
• openrouteservice converts a delivery address into a distance so we can quote the correct delivery fee. The address text is sent to this service; your name and contact details are not. Germany.
• Our delivery staff, who receive the recipient’s name, address, phone number and any delivery notes needed to complete the delivery.

We may also disclose personal information where the law requires it, for example in response to a court order or a lawful demand from a government authority, or where necessary to establish or defend a legal claim.

As the list above shows, some of our providers store and process data outside Canada, mainly in the United States and, for delivery distance lookups, in Germany.

PIPEDA requires us to tell you what this means: while your information is in another country, it is subject to that country’s laws, and courts, law enforcement and national security authorities there may be able to obtain access to it under those laws. We use providers that apply comparable protection by contract, but we cannot exempt them from the law where they operate. By using this site and placing an order, you acknowledge this transfer.

• Order and payment records: seven years, because the Canada Revenue Agency requires business records supporting a tax return to be kept for six years from the end of the tax year they relate to.
• Account information: for as long as your account is open, and then deleted or anonymised on your request.
• Quote and contact enquiries: up to three years, so we can pick up a conversation about a future event.
• Shopping carts that are never checked out: cleared periodically.
• Marketing consent records: as long as you are subscribed, and for three years after you unsubscribe, which is what CASL requires us to be able to prove.

When information is no longer needed for these purposes, we delete it or render it anonymous.

• The entire site is served over HTTPS, so traffic between your browser and us is encrypted.
• Passwords are stored only as salted cryptographic hashes, never as readable text.
• Our database is encrypted at rest and reachable only by the application, over an encrypted connection.
• Access to customer records in the admin area is restricted to authorised staff accounts, and administrative actions are logged.
• Card numbers never reach our systems, as described in section 4.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If a breach occurs that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada, as PIPEDA requires.

Canada’s Anti-Spam Legislation (CASL) sets strict rules for commercial email, and we follow them.

• We send marketing email only to people who have expressly asked to receive it. We do not add you to a mailing list because you placed an order.
• Every marketing message identifies us, gives our mailing address, and contains a working unsubscribe link.
• Unsubscribe requests are honoured without delay, and in any event within the ten business days CASL allows.
• Order confirmations, delivery updates and replies to your enquiries are not marketing. You will keep receiving those while you have an active order, because they are part of the service you asked for.

When you enter your address into the newsletter sign-up in our footer, we store that address together with the date you gave consent and the form you used. We keep that record so we can demonstrate, if asked, that we had your permission. If you unsubscribe we keep the record of the address and mark it as withdrawn, rather than deleting it, because that record is what proves we stopped.

Under PIPEDA you may:

• Ask what personal information we hold about you, how we have used it, and who we have disclosed it to.
• Receive a copy of that information.
• Ask us to correct anything inaccurate or incomplete.
• Withdraw your consent to our use of your information, subject to legal and contractual limits. If you withdraw consent needed to fulfil an order, we may not be able to complete it.
• Ask us to delete your account and the information attached to it. We will do so except where we are legally required to keep records, such as completed order and tax records.
• Unsubscribe from marketing email at any time.

Write to our Privacy Officer at info@banaflorist.ca. We will respond within 30 days, which is the deadline PIPEDA sets. We may ask you to confirm your identity first, so that we do not disclose your information to someone else. Access is normally free; if a request is unusually costly we will tell you the estimated cost before proceeding.

This site is intended for adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact our Privacy Officer and we will delete it.

If you are unhappy with how we have handled your personal information, please raise it with our Privacy Officer first, so we have the chance to put it right.

If you are not satisfied with our response, you have the right to complain to the Office of the Privacy Commissioner of Canada, at priv.gc.ca or 1‑800‑282‑1376.

We may update this policy as the business changes. The “last updated” date at the top always reflects the current version. If we make a change that materially affects how we use information you have already given us, we will seek your consent before applying it to that information.

See also our Terms & Conditions.