Privacy Policy

The data controller is:

L'Original
Address: 163 rue Saint-Paul Ouest, Montréal, Quebec H2Y 1Z5, Canada
Email: chris@loriginalartgallery.com
Phone: +1 (514) 999-9611

Privacy Officer
As required by Quebec's Law 25, the person in charge of the protection of
personal information within the company is Dorian Verdier. You can reach
him at dorian@loriginal.org, or by mail at the address above.

You can contact us for any questions regarding your personal data.

We collect the following data:

Identification data:

• First and last name
• Email address
• Phone number (optional)

Navigation data:

• IP address
• Browser type
• Pages visited
• Visit duration

Transaction data:

• Order history
• Payment information (securely processed by Stripe)
• Delivery address

Your data is used for:

• Order management: Process and deliver your purchases
• Communication: Send you order confirmations and updates
• Artist communications: Contact artists regarding their applications, jury decisions, account access, profile completion, and related customer-care or onboarding assistance, including by SMS where the artist has consented.
• Service improvement: Analyze site usage to improve user experience
• Legal compliance: Comply with our legal and tax obligations
• Marketing: Send you promotional offers (with your consent)

The processing of your data is based on:

• Contract execution: To process your orders
• Consent: For analytical and marketing cookies
• Legitimate interest: To improve our services
• Legal obligation: For accounting and taxation

We use different types of cookies:

Necessary cookies (always active):

• Shopping cart management
• Authentication
• Language preferences

Analytical cookies (with your consent):

• Google Analytics: Traffic analysis
• Microsoft Clarity: Session recordings

Marketing cookies (with your consent):

• Personalized advertising
• Remarketing

You can manage your cookie preferences at any time.

We only share your data with:

Service providers:

• Stripe: payment processing
• Delivery services: order shipping
• Vercel, Amazon Web Services: site and file hosting
• Resend: transactional email delivery
• Twilio: text messaging, to people who consented to it
• Supabase: storage of recommendation vectors
• OpenAI (and Azure OpenAI): computing recommendation vectors from artwork images and your browsing
• Cal.com: appointment booking
• Google (Analytics, Ads), Meta and Microsoft Clarity: audience measurement, advertising and session recording, only if you consented

Legal authorities:

• In case of legal obligation or court order

Transfers outside Quebec. These providers process data outside Quebec,
mainly in the United States and the European Union. As required by Law 25, we
assess before each communication that the information receives adequate
protection there.

Automated recommendation. The vectors computed by OpenAI are used solely to
order the artworks shown to you. No decision producing legal effects, or
similarly significantly affecting you, is made on that basis.

We never sell your data to third parties.

Phone numbers collected for text messaging are not sold, rented, or shared with third parties for marketing purposes.

Depending on where you live, your rights come from Quebec's Law 25,
Canada's Personal Information Protection and Electronic Documents Act, or the
GDPR. We apply the most favourable regime to everyone:

• Right of access: obtain a copy of your data
• Right to rectification: correct inaccurate data
• Right to erasure: delete your data (under conditions)
• Right to restriction: limit the processing of your data
• Right to portability: receive your data in a structured, commonly used format
• Right to object: object to the processing of your data
• Right to withdraw consent: at any time
• Right to de-indexing: request that your information stop being disseminated (Law 25)
• Right to be informed of an automated decision and to submit your observations

To exercise your rights, write to dorian@loriginal.org. We answer **within
30 days** of receiving your request.

To stop receiving text messages, reply STOP to any of our messages. For
emails, use the unsubscribe link at the bottom of the message.

We implement appropriate security measures:

• SSL/TLS encryption for all communications
• Secure data storage
• Restricted access to personal data
• Regular security audits
• PCI-DSS compliance for payments

We retain your data:

• Account data: Until account deletion
• Order data: 10 years (legal obligation)
• Analytics data: Maximum 26 months
• Cookies: According to durations defined in our cookie policy

For any question about your personal data, write to the privacy
officer:

Email: dorian@loriginal.org
Mail: Dorian Verdier, L'Original, 163 rue Saint-Paul Ouest, Montréal, Quebec H2Y 1Z5, Canada

If our answer does not satisfy you, you may file a complaint with the authority
competent where you live:

In Quebec, Commission d'accès à l'information du Québec
2045 rue Stanley, suite 900, Montréal, Quebec H3A 2V4
Phone: 1 888 528-7741, Website: www.cai.gouv.qc.ca

Elsewhere in Canada, Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, Quebec K1A 1H3
Phone: 1 800 282-1376, Website: www.priv.gc.ca

In the European Union, with the supervisory authority of your country of
residence.