Privacy policy

Privacy policy

TORVIA takes the protection of your personal information seriously. This policy explains what we collect, why, who we share it with and what your rights are.

It is drawn up in accordance with the Québec Act respecting the protection of personal information in the private sector (Law 25) and the Personal Information Protection and Electronic Documents Act (PIPEDA). We also serve customers in the United States and respect the rights provided by applicable state privacy laws.

1. Person in charge of the protection of personal information

In accordance with Law 25, this role is held within TORVIA under the title shown above. It can be reached at the following address:

Write to this address for any question, access or correction request, or complaint concerning your personal information.

2. Information we collect

  • Order information: name, delivery and billing address, email, telephone number.
  • Payment information: handled directly by our payment provider. TORVIA never has access to your full card number and does not store it.
  • Browsing information: IP address, device and browser type, pages viewed, where your visit came from.
  • Communications: the content of messages you send us and, where applicable, your newsletter sign-up.

Our products are sold to adults, in accordance with our Terms of Service. We do not knowingly collect information from people under 14, the age from which Law 25 recognises personal consent.

3. Purposes

We use your information only to:

  • process, ship and track your orders;
  • handle returns, refunds and customer service;
  • prevent fraud and secure transactions;
  • meet our legal, accounting and tax obligations;
  • send you marketing communications, only if you have consented (you can unsubscribe at any time).

4. Sharing your information

We do not sell your personal information. We share it only with the providers needed to fulfil your order:

  • Shopify Inc. (Canada) — commerce platform, hosting and payment;
  • Our manufacturing and shipping partner (North America) — receives your name and delivery address;
  • Carriers (Canada Post, UPS, USPS and others) — for delivery;
  • Judge.me — customer review platform, which receives your name and email to invite you to review your order after delivery;
  • Public authorities — where required by law.

Some of these providers may process information outside Québec, in particular in the United States. We ensure by contract that they offer adequate protection, in accordance with Law 25.

5. Cookies

Our site uses cookies necessary for it to work (shopping cart, session, security) as well as the analytics tools built into the Shopify platform, which let us understand site traffic in aggregate form.

We currently use no third-party advertising pixels (for example Meta Pixel or Google Ads). Should that change, this policy would be updated and your consent obtained.

You can set your browser to block cookies; some site functions may then stop working correctly.

6. Retention

We keep information relating to orders for six (6) years after the last transaction, to meet our tax and accounting obligations. Newsletter information is kept until you unsubscribe. Beyond those periods, information is destroyed or anonymised.

7. Your rights

You have the right to:

  • access the information we hold about you;
  • have it corrected if it is inaccurate, incomplete or ambiguous;
  • withdraw your consent to marketing communications;
  • request deletion of your information, subject to our legal retention obligations;
  • receive your information in a structured, commonly used technological format (portability);
  • lodge a complaint with the Commission d'accès à l'information du Québec.

Customers in the United States: depending on your state of residence, you may also have the right to opt out of the sharing of your information for advertising purposes. You can exercise it on our Do not sell or share my personal information page.

To exercise these rights, write to support@torviabeauty.com. We respond within a maximum of 30 days.

8. Security

Data travels over encrypted HTTPS. Access to information is restricted to those who need it. In the event of a confidentiality incident presenting a risk of serious harm, we will notify the people concerned and the Commission d'accès à l'information, in accordance with Law 25.

9. Automated decisions

We make no decision about you based exclusively on automated processing of your personal information.

10. Changes

This policy may be amended. The update date below indicates the version in force.

Last updated: 14 August 2026