Privacy policy

Last Updated: August 8, 2026

HeyWhiskey (“Company,” “we,” “our,” or “us”) respects your privacy and is committed to protecting your personal information. This policy applies to all users accessing or purchasing from heywhiskeyshop.com, including customers in Canada, the United States, the European Union, the United Kingdom, and other regions we ship to. Depending on where you live, additional rights described in Sections 10.2 (EU/UK – GDPR) and 10.3 (California – CCPA/CPRA) may apply to you.

1. Who We Are — Corporate Identity & Legal Operator

HeyWhiskey is a brand operated by Andrii Khavro.

Registered Company Name: Andrii Khavro
Company Registration Number: 1001221008
VAT/GST Number: 700711823RT0001
Registered Address: 8 Mercer Street, Toronto, Ontario, M5V 0C4, Canada
Email: info@heywhiskeyshop.com
Phone: +1 437-870-1603
Business Hours: 9:00 AM–5:00 PM (Monday to Friday), Eastern Time (Toronto)

2. Types of Personal Information We Collect

A. Direct Information (Provided by You)

Full name
Shipping/billing address
Phone number
Email address
Account login data
Order, return, refund, and warranty information
Customer service communications
Uploaded files or attachments

B. Payment Details (Securely Processed)

Collected by third-party processors (Visa, Mastercard, PayPal, Apple Pay, Google Pay, Shop Pay, etc.):

Partial card info (masked)
Transaction status & ID
Fraud detection logs

We never store full credit card numbers or CVV codes.

C. Automatically Collected Data

IP address
Approximate geo-location
Device identifiers
Browser details
Session duration
Pages visited
Heatmaps & scroll tracking
Referrer URLs
Shopping behavior patterns
Abandoned cart activity

D. Cookies & Digital Identifiers

Session cookies
Preference cookies
Analytics cookies
Advertising cookies
Device fingerprinting identifiers
Pixel tags
Web beacons
Server logs

E. Marketing Interaction Data

Email open rate
Link click tracking
SMS deliveries & interaction logs
Ad engagement metrics

F. Third-Party Data Integration

If you interact via Google Login, Facebook Login, or Apple Login, we may receive a name, email, profile ID, and authentication confirmation.

3. How We Use Your Information

A. Order Processing & Ecommerce Operations

Validating orders
Shipping to your address
Handling cancellations
Processing returns & exchanges
Issuing refunds or warranty replacements

B. Customer Service & Communication

Responding to inquiries
Sending order updates
Providing technical support
Managing complaints

C. Marketing, Personalization & Advertising

Personalized product recommendations
Retargeting ads on Meta, Google, TikTok
Email marketing
Promotional notifications
Behavioral segmentation

You may unsubscribe or opt out at any time (see Section 6.B and Section 10.3 regarding advertising data sharing).

D. Analytics, Research & Website Optimization

Measuring traffic
Understanding customer navigation
Improving site layout
A/B testing
Troubleshooting errors

E. Fraud Detection & Security Monitoring

Blocking suspicious transactions
Identifying stolen credit cards
Protecting accounts
Preventing fraudulent returns

F. Legal & Regulatory Requirements

Tax compliance
Responding to lawful data requests
Preventing misuse or abuse

4. Legal Basis for Data Collection

The legal basis we rely on depends on where you are located:

Canada (PIPEDA): Consent, contractual necessity, legitimate interest, and legal obligation.

European Union / United Kingdom (GDPR/UK GDPR):

Contractual necessity — to process and fulfill your order
Consent — for marketing emails, SMS, and non-essential cookies (you may withdraw consent at any time)
Legitimate interest — for fraud prevention, analytics, and site security, balanced against your rights
Legal obligation — for tax, accounting, and regulatory compliance

United States / California (CCPA/CPRA): We collect and use personal information as necessary to provide our services, and disclose categories of personal information to third-party advertising partners as described in Section 6 and Section 10.3.

5. Cookies & Tracking Technology

We use cookies for website operation, security verification, cart & checkout functionality, personalized advertising, and analytics/performance tracking.

Users can disable or customize cookie preferences at any time through their browser or cookie settings.
Visitors from the EU/UK: where required by law, non-essential cookies (advertising and analytics) are only set after you provide consent via our cookie banner. You may withdraw consent at any time.
Visitors from California: you may opt out of the use of cookies for cross-context behavioral advertising via the link in Section 10.3.

6. Sharing & Disclosure of Information

We may share information with:

A. Service Providers (Operational Support)

Shopify
Shipping carriers
Payment processors
Fraud monitoring companies
Cloud hosting providers

B. Advertising/Marketing Partners

Meta (Facebook, Instagram)
Google Ads
TikTok Ads (if used)

Under California law (CCPA/CPRA), sharing data with these partners for cross-context behavioral advertising may be considered a “sale” or “share” of personal information. See Section 10.3 for your opt-out rights.

C. Legal & Government Authorities

Only when required by law, regulation, or court order.

D. Business Transfers

If HeyWhiskey is acquired, merged, or sold.

We do not sell personal data for money.

7. International Data Transfers

Your data may be processed in Canada and other jurisdictions via our cloud and service partners (including the United States).

For transfers of personal data originating in the EU/UK to countries without an adequacy decision, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) or equivalent mechanisms with our service providers, along with:

Contractual safeguards
Secure transfer mechanisms
Encryption in transit and at rest

8. Data Retention

Data Type	Retention Period	Reason
Order history	7–10 years	Accounting & tax compliance
Customer accounts	Until deleted by user	Core service
Payment logs	2–3 years	Fraud prevention
Marketing preferences	Until unsubscribed	Customer choice
Cookies	30 days–2 years	Website optimization
Customer support messages	3–5 years	Quality & legal
Warranty & return claims	3–7 years	Legal & service reference

9. Security Measures

We protect your data through:

SSL website encryption
HTTPS secure browsing
PCI-DSS-compliant payment processing
Firewalls & anti-malware
IP-based fraud scoring
Device fingerprinting
24/7 security monitoring
Limited employee data access
Secure password hashing

Despite advanced protections, no system is 100% hack-proof.

10. Your Privacy Rights

Your rights depend on where you live. Sections 10.1–10.3 below describe the frameworks that may apply to you.

10.1 Privacy Rights for Canadian Users (PIPEDA & Provincial Privacy Laws)

You have the following rights under PIPEDA and Canada’s provincial privacy regulations (Ontario, Alberta, British Columbia, and Quebec):

A. Right to Access Your Personal Information

You may request a complete copy of the personal data we hold about you, how it’s used, categories collected, third parties it’s shared with, and the purposes of processing. We provide this free of charge, typically within 30 days.

B. Right to Correct (Rectify) Inaccurate Information

If any information we hold is incorrect, outdated, incomplete, or misleading, you may request correction, update, or amendment. We will make changes promptly and notify relevant third parties where legally required.

C. Right to Withdraw Consent

Where consent is required (e.g., marketing emails), you may withdraw it at any time. This does not affect order confirmations, legal notifications, or security messages.

D. Right to Request Data Deletion

You may request deletion of your personal information unless it must be retained for tax records, fraud prevention, legal obligations, or transaction/warranty history. We delete what we legally can and inform you of any exceptions.

E. Right to Challenge Compliance

If you believe your data has been mishandled, you may file a complaint with HeyWhiskey’s Privacy Office, the Office of the Privacy Commissioner of Canada (OPC), or your provincial privacy authority. We will cooperate fully with investigations.

F. Right to Transparency

You have the right to clear information about why data is collected, how long it’s kept, who has access, and what safeguards protect it.

G. Right to Be Informed of Data Breaches

If your personal information is involved in a breach posing a real risk of significant harm, we will notify you as required under PIPEDA.

H. Right to Opt Out of Direct Marketing

You may opt out of email promotions, SMS promotions, retargeting/personalized marketing, and newsletters at any time. You will still receive essential transactional messages.

I. Consent for Commercial Electronic Messages (CASL)

As a Canadian business, our marketing emails and SMS messages comply with Canada’s Anti-Spam Legislation (CASL). We only send commercial electronic messages where we have your express or implied consent, and every marketing message includes a functioning unsubscribe mechanism honored within 10 business days. Implied consent (e.g., from an existing customer relationship) expires after the period set by CASL unless renewed by express consent.

10.2 Privacy Rights for EU/UK Users (GDPR / UK GDPR)

If you are located in the European Economic Area or United Kingdom, you have the following rights under the GDPR/UK GDPR:

Right of access — obtain a copy of your personal data and information about how it is processed
Right to rectification — correct inaccurate or incomplete data
Right to erasure (“right to be forgotten”) — request deletion of your data, subject to legal retention obligations
Right to restrict processing — request that we limit how we use your data in certain circumstances
Right to data portability — receive your data in a structured, commonly used, machine-readable format
Right to object — object to processing based on legitimate interest or for direct marketing purposes
Right to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal
Right to lodge a complaint — with your local data protection supervisory authority, or the UK Information Commissioner’s Office (ICO) for UK residents

To exercise any of these rights, contact us using the details in Section 11. We will respond within one month, as required by the GDPR.

10.3 Privacy Rights for California Users (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Right to know — what personal information we collect, use, disclose, and (if applicable) sell or share, and for what purposes
Right to delete — request deletion of personal information we’ve collected, subject to legal exceptions
Right to correct — request correction of inaccurate personal information
Right to opt out of sale/sharing — opt out of the “sale” or “sharing” of your personal information for cross-context behavioral advertising (see Section 6.B). To opt out, email info@heywhiskeyshop.com with the subject line “CCPA Opt-Out Request,” or adjust your cookie preferences where available.
Right to limit use of sensitive personal information — where applicable
Right to non-discrimination — we will not deny goods or services, charge different prices, or provide a different level of service because you exercised a CCPA right

We do not sell personal information for money. We may “share” data with advertising partners as described in Section 6, which you can opt out of as described above.

11. How To Exercise Your Rights

You may exercise any of the rights above by contacting us:

Email: info@heywhiskeyshop.com
Phone: +1 437-870-1603

Verification Required: To prevent fraud, we may verify your email address, billing/shipping address, recent order numbers, or identity.

Response Time:

Canada: up to 30 days
EU/UK: up to 1 month (extendable by 2 months for complex requests)
California: up to 45 days (extendable by 45 days where necessary)

12. Automated Decision-Making & Profiling

We may apply algorithms for fraud detection, personalized ads, product recommendations, and risk scoring. You may request to opt out by contacting us using the details in Section 11.

13. Data Breach Response Plan

If a breach occurs: (1) assess severity, (2) notify affected users, (3) report to regulators where required (e.g., PIPEDA, GDPR supervisory authorities), (4) secure systems, (5) take steps to prevent future breaches.

14. Third-Party Links Disclaimer

We are not responsible for the privacy practices of external websites, affiliate partners, or advertising networks.

15. Children’s Privacy Protection

We do not knowingly collect data from children under 16. For users in the United States, we comply with the Children’s Online Privacy Protection Act (COPPA) and do not knowingly collect data from children under 13. Parents may request immediate deletion of a child’s data by contacting us.

16. Business Continuity & Data Backup Policy

We maintain secure data backups, disaster recovery plans, and redundant storage systems to ensure customer data is not lost due to hardware failures.

17. Data Minimization & Purpose Limitation

We only collect data that is necessary, purpose-driven, and legally justified. No unnecessary or excessive data is stored.

18. User Responsibility Section

Users agree to provide accurate information, protect their passwords, use the site legally, and avoid fraudulent activity.

19. Policy Update & Version Control

HeyWhiskey may modify this Privacy Policy at any time, due to new legal requirements, new website features, third-party service changes, business structure updates, or security improvements.

How we notify changes:

Updated “Last Updated” date on this page
Optional email notification
Website announcement

Continued use of the website indicates acceptance of updated policies.

20. Contact Information

For questions, complaints, or rights requests: