Privacy Policy
Last updated: October 19, 2026
This policy explains how Oliveira's Bakery ("we", "us") collects, uses and protects personal information when you visit our website, place an order, or contact us. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
By using our website or placing an order, you confirm that you have read this policy. Please review it before you share personal information with us. If you don't agree with it, please don't use the website.
1. Who we are and how to reach us
Oliveira's Bakery
4405-2920 Highway 7, Concord, Ontario L4K 0P4
Email: contactus@oliveirasbakery.com
Phone: 1-647-863-0641
Our Privacy Officer is accountable for how we handle personal information. You can reach the Privacy Officer at the email, phone number or mailing address above; please mark your message "Attention: Privacy Officer".
2. What we collect
- Orders: your name, email address, phone number, the items you order, and order notes, such as a gift message or the cookie flavours in a box.
- Pickup or delivery details: your delivery address, and the pickup or delivery method, date and time slot you choose.
- Catering inquiries: your name, email address, occasion, event date, number of guests, and the message you write.
- Payment: payments are processed at checkout by Shopify and its payment partners. We do not receive or store your full card number.
- Gift cards: gift card purchases and redemptions, which are recorded with your order.
- Reviews: if you leave a product review, your review and the name you provide.
- Website use: device and browser information, IP address, pages viewed, and items added to your bag. This is collected through cookies and similar tools (see section 4).
You are responsible for giving us accurate, complete and current information, including your delivery address and phone number, and for updating it if it changes. We are not responsible for problems caused by incorrect information you provide.
3. How we use it
We use personal information to:
- take, prepare, schedule, deliver and support your order;
- contact you about your order, pickup or delivery;
- answer catering inquiries;
- prevent fraud and keep our website secure;
- meet our legal and tax obligations;
- with your consent, measure and improve our advertising (see section 4).
We do not sell your personal information.
4. Cookies and your consent
- Essential cookies keep your shopping bag and checkout working. They are always on.
- Optional marketing cookies (Google, Meta and TikTok) stay off until you choose "Accept" on our cookie banner.
- If you accept, we share page visits, product details, bag additions and checkout starts with those providers. Their tags may also collect your IP address, device information and cookie identifiers. They use this to measure visits and personalize ads.
- Your choice is stored for 12 months.
- To change your choice, use "Cookie preferences" in our website footer at any time. Withdrawing consent stops future marketing tracking. It can't recall data that was already shared.
- Our Shopify checkout uses its own cookies to process your order.
5. Service providers we use
We share personal information only with service providers who need it to run our business:
| Provider | What it does for us |
|---|---|
| Shopify | Our online store, checkout, payments, order records and gift cards. Shopify's built-in Messaging, Forms, Flow and Checkout Blocks tools are part of our store. |
| Lovable and Supabase | Lovable hosts our website. Supabase (Lovable's database service) stores catering inquiries and our pickup and delivery scheduling and stock settings. |
| Buunto | Pickup and delivery date and time scheduling on our Shopify store. |
| Judge.me | Product reviews and review requests on our Shopify store. |
| Biscuits Bundles | Cookie-box bundles on our Shopify store. |
| AI tools | AI tools we use to help manage our store, which can read store data. |
| Advertising measurement (Google Ads and Google tag), only with your consent. Website fonts are also loaded from Google Fonts, which receives your IP address. | |
| Meta (Facebook) | Advertising measurement, only with your consent. |
| TikTok | Advertising measurement, only with your consent. |
We may also disclose information if the law requires it, or to protect our rights or the safety of others.
6. Storage outside Canada
Some of our service providers may store or process personal information outside Canada. When information is outside Canada, it may be accessible to courts, law enforcement and national security authorities of that country.
7. How we protect it and how long we keep it
- We use reasonable physical, organizational and technical safeguards that suit the sensitivity of the information. Access is limited to people who need it.
- No method of transmission or storage is completely secure. Please use the contact details above, not social media messages, for anything sensitive.
Retention periods:
- Orders and payment records: 6 years.
- Catering inquiries that don't become orders: 2 years.
- Cookie consent choice: 12 months, stored in your browser.
- Reviews: for as long as the review is displayed.
When we no longer need information, we delete or anonymize it securely.
8. Your choices and rights
- Access and correction: you may ask what personal information we hold about you, how it is used and who it has been shared with, and ask us to correct it. Send a written request to our Privacy Officer. We will respond within 30 days, or tell you within that time if we need an extension, why, and that you can complain to the Privacy Commissioner about it.
- Withdrawing consent: you may withdraw consent at any time, subject to legal or contractual limits. Use Cookie preferences, unsubscribe links, or contact us. Some information is needed to fulfil an order or meet legal duties, so withdrawing consent may mean we can't complete a service.
- Complaints: please contact our Privacy Officer first. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca/en/report-a-concern/ · 1-800-282-1376
9. Children
Our website and products are not directed to children, and we do not knowingly collect personal information from children. A parent or guardian who believes a child has given us information can contact us, and we will delete it.
10. Changes to this policy
We may update this policy. Changes take effect when we post them here with a new "Last updated" date. Please check this page from time to time. Continuing to use our website after a change means you accept the updated policy, where the law allows.
