Privacy policy

Privacy Policy

Last updated: 07/16/2026

This policy explains what personal information we collect when you shop with us — online at wickedwandas.ca or in person at our Ottawa store — why we collect it, who we share it with, how long we keep it, and what rights you have over it.

We sell intimate products. We understand that what you buy from us is nobody else's business, and we treat your information accordingly. This policy is written to be read, not to be skimmed past — if anything in it is unclear, ask us.

If anything in our Terms of Service conflicts with this policy on a question of personal information, this policy governs.

Who we are

WW Inc. — registered as Wicked Wanda's Adult Emporium Inc. — operates wickedwandas.ca and our retail store at 327 Bank Street, Ottawa. We are responsible for the personal information described in this policy. We refer to ourselves as WW Inc. throughout.

Our Privacy Officer is Wanda Cotie. You can reach her with any question, concern, complaint, or request about your personal information:

The law that applies

We are governed by Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the federal private-sector privacy law. It applies to us regardless of our size.

PIPEDA treats some information as more sensitive than other information, and requires a higher standard of care for it. Purchase history from a store like ours can reveal a great deal about a person — their sexuality, their relationships, their body, their private life. We treat your order history as sensitive information, because it is.

What we collect

When you place an order

  • Your name
  • Email address
  • Shipping and billing address
  • Phone number, if you give us one (optional for domestic orders, required for international)
  • Order contents, order history, and any comments you add at checkout
  • Payment confirmation, the type of card used, and the last four digits of the card number

When you contact us

Whatever you choose to tell us — your email address, phone number, and the contents of your message. If your question includes private details, we use them only to answer you.

When you create an account

Your login credentials, saved addresses, preferences, and order history.

When you subscribe to our emails

Your email address, and a record of when and how you consented.

When you leave a review

Your name or display name, the review content, and any photograph you choose to upload.

Automatically, when you visit the site

  • IP address — recorded by our web server, as with any website. Used for security and to understand traffic levels.
  • Device and browser information — type, version, operating system, screen size, and other technical identifiers.
  • Cookies and similar technologies — see the cookies section below.
  • Usage information — pages viewed, items added to cart, how you arrived at the site, through Shopify's built-in analytics.

When you shop in our Ottawa store

In-store card payments are processed through a Moneris terminal. We receive confirmation of the transaction, the card type, and the last four digits. We do not collect your name or contact details for a walk-in purchase unless you ask us to — for a special order, a delivery, or a warranty claim.

What we do not collect

We never see or store your full card number. Payment card details are entered directly into our payment processor's systems and are tokenized — meaning we receive a reference to your payment, not the card itself. Nobody at WW Inc. can retrieve your card number, including us. This is not a policy choice we could reverse; it is how the system is built.

We do not ask for and do not want information about your health, your sexuality, your relationships, or your identity beyond what is needed to sell you something and get it to you.

Why we collect it

We use your personal information to:

  • Process, fulfill, and deliver your order
  • Take payment and issue refunds
  • Contact you about your order, including our discreet ready-for-pickup notifications
  • Handle returns, defect claims, and warranty registrations
  • Answer your questions and provide customer support
  • Maintain your account, if you have one
  • Send you marketing emails, if and only if you have consented
  • Invite you to review a product you bought, if you have consented
  • Authenticate your account and detect or prevent fraud
  • Understand how our site is used, so we can improve it
  • Meet our legal and tax obligations, and respond to valid legal process

We do not use your information for any purpose beyond these without asking you first.

Consent

By placing an order, you consent to us using your information to fulfil it. That consent is implied by the transaction itself — we cannot ship you a parcel without an address.

For anything beyond fulfilling your order — marketing emails in particular — we ask for your express consent, and you can withdraw it at any time.

You can withdraw consent by unsubscribing from any marketing email, by contacting our Privacy Officer, or by asking us in store. We will honour it. Some consequences are unavoidable: if you withdraw consent for us to hold your order information, we cannot process a warranty claim or a refund on that order, and we will tell you that before acting.

Who we share it with

We do not sell, rent, trade, or license your personal information. We have never done so and have no intention of starting.

We do share it with service providers who make the store work. Each of these receives only what they need, and each is bound to use it only for the service they provide to us:

  • Shopify — our e-commerce platform. Hosts our website, stores order and customer data, and provides our analytics. Shopify's servers are located outside Canada, primarily in the United States. See the section below on our relationship with Shopify.
  • Shopify Payments — processes card payments on wickedwandas.ca.
  • Moneris — processes card payments in our Ottawa store.
  • PayPal — if you choose to pay by PayPal, your transaction is handled under PayPal's own privacy policy.
  • Sezzle — if you choose to pay in instalments through Sezzle, your transaction is handled under Sezzle's own privacy policy. Sezzle receives the information it needs to assess and process your instalment plan, including your name, contact details, and order amount.
  • Canada Post — receives your name, address, and phone number so your parcel can be delivered. They do not receive your order contents.
  • Loox — our product review platform. Receives your name, email address, and order details in order to send review invitations and publish reviews you write.

We share your information in these other circumstances:

  • When you direct us to. For example, when you ask us to ship to a third party or register a warranty with a manufacturer.
  • Disputed or fraudulent transactions. If a transaction is contested, we are obliged to provide the relevant information to the card issuer, the payment processor, or the appropriate authority.
  • Legal requirement. If we are required by law, court order, subpoena, search warrant, or other lawful demand to disclose information, we will comply. We will limit any disclosure to what is legally required, and we will tell you it happened unless we are prohibited from doing so.
  • Protecting our rights. To enforce our terms and policies, or to defend ourselves or our customers in a legal proceeding.

If our business is ever sold, merged, or restructured, customer information may transfer to the new owner as part of that transaction. Any such transfer would be subject to this policy, and we would notify you.

Our relationship with Shopify

Our store is hosted by Shopify. Beyond acting as our service provider, Shopify also collects and processes information about your use of our store for its own purposes — improving its platform, and powering certain enhanced features we use, which draw on data from your interactions across our store, other Shopify merchants, and Shopify itself.

For that processing, Shopify is responsible for your personal information rather than us, including for handling any request you make about it. You can read the Shopify Consumer Privacy Policy to understand what they do, and use the Shopify Privacy Portal to exercise rights directly with them.

We are telling you this because it is true and you are entitled to know it, not because we are trying to shift responsibility. If you would rather raise something with us, do — we will help you get to the right place.

Information stored outside Canada

Because Shopify hosts our store on servers outside Canada, primarily in the United States, your personal information is stored and processed outside Canada. While it is there, it is subject to the laws of that country, which means it may be accessible to foreign courts, law enforcement, and government authorities under those laws.

This is true of essentially every Shopify store, and we tell you because you are entitled to know it, not because we consider it a problem we are hiding.

Our staff

Our staff can see the information needed to do their jobs: your name, address, contact details, and what you ordered. Order fulfillment does not happen by magic.

What we commit to is this: our staff are trained on discretion and privacy, your order information is never a topic of conversation, and access is limited to people who need it to serve you. If you have ever worried about being recognized or discussed, you should not be — this is the core of how we operate, in store and online.

How we protect it

  • Our site enforces HTTPS on every connection. Insecure HTTP requests are refused. Look for the padlock in your browser's address bar on any site where you enter personal information — ours or anyone else's.
  • Payment card data is tokenized and never reaches our systems.
  • Access to customer data is limited to staff who need it, through individual accounts.
  • Our platform providers maintain the physical and network security of the infrastructure, including PCI DSS compliance for payment handling.
  • Our staff are trained on privacy and discretion as a condition of the job.

No system is perfectly secure, and we are not going to claim otherwise. Information sent to us over the internet may not be secure while in transit, so please do not use unsecured channels to send us anything sensitive. What we can tell you is that we do not hold the information that would do you the most harm — your card number is not ours to lose.

If something goes wrong

If a breach of security safeguards occurs that creates a real risk of significant harm to you, we will notify you and report it to the Office of the Privacy Commissioner of Canada as required by PIPEDA. We will tell you what happened, what information was involved, and what you can do about it.

How long we keep it

  • Order and transaction records — 7 years, which meets our tax record-keeping obligations under Canadian law.
  • Customer accounts — for as long as the account is active. Accounts inactive for [3 years] are deleted, after we email you first.
  • Marketing subscriptions — until you unsubscribe. Consent records are kept for 3 years after that, as Canada's Anti-Spam Legislation requires us to be able to demonstrate consent.
  • Customer service emails — 2 years.
  • Reviews — published until you ask us to remove them.
  • Website analytics — as retained by Shopify under its own schedule.

When a retention period ends, information is deleted or anonymized. We do not keep personal information indefinitely simply because storage is cheap.

Your rights

Under PIPEDA you have the right to:

  • Know what we hold about you. Ask, and we will tell you what personal information we have, how we have used it, and who we have shared it with.
  • Get a copy of it. We will provide it in an understandable form, free of charge, within 30 days. If we need more time, we will tell you why.
  • Correct it. If something is wrong or incomplete, tell us and we will fix it.
  • Have it transferred. Ask and we will provide your information in a portable format, or send it to another organization where that is practical.
  • Withdraw consent, subject to legal and contractual limits.
  • Ask us to delete it. We will, unless we are legally required to keep it — tax records being the main example.
  • Complain, to us or to the Privacy Commissioner.

To exercise any of these, contact our Privacy Officer. We may ask you to confirm your identity first, so that we do not hand your information to somebody else. You may appoint someone to make a request on your behalf; we will ask for proof that you authorized them, and we may still need to verify your identity with you directly.

We will not treat you differently for exercising any of these rights. No worse service, no worse pricing, no notes on your file.

There are narrow situations where we may not be able to give you access — for example, where doing so would reveal personal information about another person. If we refuse a request, we will tell you why in writing and explain how to challenge it.

For information Shopify processes for its own purposes, use the Shopify Privacy Portal. Ask us if you are not sure which applies — we would rather help than send you in a circle.

Cookies and tracking

We use cookies and similar technologies for the following:

  • Essential cookies — keep your shopping cart working, keep you logged in, and secure the checkout. The site cannot function without these.
  • Analytics cookies — Shopify's built-in analytics, which tell us how many people visit, which pages they read, and where they came from. We use this to improve the site.
  • Loox — sets cookies to display reviews and to know whether you have already been asked for one.

You can block or delete cookies through your browser settings. Blocking essential cookies will break the cart and checkout.

We do not run advertising pixels or behavioural ad tracking on wickedwandas.ca, and we do not use your information to target ads to you on other websites.

Marketing emails

We only send marketing email to people who have asked for it. Canada's Anti-Spam Legislation (CASL) requires it, and so does common decency.

Every marketing email we send identifies us, gives our contact information, and includes a working unsubscribe link. Unsubscribing takes effect immediately and always within 10 business days, as the law requires.

Transactional messages — order confirmations, shipping notices, our discreet ready-for-pickup text — are not marketing and are sent because you bought something. They cannot be unsubscribed from separately.

Reviews

If you leave a review through Loox, your display name, review text, and any photo you upload are published on our site and are publicly visible. Use whatever name you are comfortable having on a public page — this is one place where discretion is in your hands, and we would rather you thought about it before posting than after.

Ask us and we will remove your review.

Age restriction

Our products and services are for adults. Nobody under 18 may use this website or purchase from us. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. If you are the parent or guardian of someone under 18 who has given us their information, contact our Privacy Officer and we will remove it.

Links to other sites

Where we link to another website, that site has its own privacy policy and we are not responsible for it — including for the accuracy or security of anything you find there. Manufacturer warranty registration pages are the most common example. Read their policy before giving them your information. A link from us is not an endorsement.

Changes to this policy

If we change this policy, we will update the date at the top. If a change materially affects how we handle your information, we will tell you rather than quietly amending the page.

Questions and complaints

Contact our Privacy Officer first — most things can be sorted out directly, and we would like the chance:

We will acknowledge your complaint, investigate it, and tell you the outcome.

If you are not satisfied with our response, you have the right to complain to the Office of the Privacy Commissioner of Canada, at priv.gc.ca or 1-800-282-1376. You do not need our permission and we will not hold it against you.

Related policies

This policy is published by WW Inc. (registered as Wicked Wanda's Adult Emporium Inc.) and applies to wickedwandas.ca and our Ottawa store.