The fine print
Privacy notice
Written to be read, not to be scrolled past. It says what At Eaze collects, why, where it lives, and what you can make us do about it.
The short version On this build nothing you do leaves your device. There are no third party cookies, no analytics, no advertising pixels and no calls to any origin other than this site. Everything the site remembers about you is written to your own browser and you can read it or wipe it yourself from your account.
The organisation
Who we are
A-Lifestyle At Eaze is an independent streetwear retailer trading from one location in Brampton, Ontario. It is the organisation responsible for the personal information described in this notice.
- Legal name
- A-Lifestyle At Eaze
- Physical address
- 25 Peel Centre Dr, Unit 203b
Bramalea City Centre
Brampton, Ontario L6T 3R5
Canada - Store hours
- 10 AM to 9 PM daily
- Applicable law
- The Personal Information Protection and Electronic Documents Act, Canada's federal private sector privacy law, together with Ontario consumer protection law and Canada's anti spam legislation.
This notice covers this website and the store counter. It does not cover the shopping centre, the card processor, or any other business you deal with on the same trip.
Collection
What we collect, and what for
Personal information is collected for the stated purposes below and for nothing else. Under PIPEDA the legal basis for each of them is your consent, and the kind of consent differs by purpose: implied consent where the purpose is obvious from the act of ordering, and express consent where the law requires you to say yes on purpose. Both are set out in the table.
| What | Stated purpose | Basis of consent |
|---|---|---|
| Name and contact details | To identify an order as yours, to reach you about it, and to release a pickup at the counter. | Implied. You give it in order to place an order. |
| Delivery address | To ship the order and to give the carrier what it needs to deliver it. | Implied, for delivery orders. |
| Order and return history | To fulfil, track, exchange and refund orders, and to keep the sales records that tax law requires the store to keep. | Implied, plus a legal record keeping obligation. |
| Payment result and card token | To match a payment to an order and to raise a refund against it later. | Implied. The card details themselves are held by the processor, not by At Eaze. |
| Loyalty tier and points balance | To show a member what they have and, once the programme is signed off, to apply it. | Express. You join the programme on purpose. |
| Marketing email address | To send drop, restock and sale email, and nothing else. | Express, opt in, under Canada's anti spam legislation. |
| Chat messages you type | To answer the question you asked and to keep the thread readable while you are on the site. | Implied. You choose to open the chat and type. |
The table scrolls sideways on a narrow screen.
What we never do
- We do not sell, rent, trade or licence personal information to anybody, at any price.
- We do not build advertising profiles and we do not run advertising trackers.
- We do not use your order history to set a different price for you than for anybody else.
- We do not collect more than the purpose needs, and we do not keep it after the purpose ends and the record keeping period runs out.
This device
What this build stores in your browser
This is the complete list. Every item is written to your own browser's local storage on this device, under a key that starts with the same short prefix. None of it is a cookie, none of it is sent to a server, and none of it is readable by any other site.
| Stored value | What it holds | Why |
|---|---|---|
| Theme | Bright or dark. | So the site opens the way you left it, with no flash of the wrong theme. |
| Bag | Product, size, colour and quantity for each line you added. | So your bag survives a reload and a closed tab. |
| Wishlist | The products you saved. | So the saved list is there when you come back. |
| Consent record | The answer you gave the consent bar, the version of the notice it applied to, and the moment you gave it as a timestamp. | So the store can produce proof of the choice you made, which is what the law asks for. |
| Addresses and marketing choice | The delivery addresses and the email preference on the demonstration account. | So the account panel has something real to edit and to honour. |
| Operator session | Which demonstration operator is signed in to the staff console and what role they hold, plus the trail of actions that session took. | So the staff console can gate what a role is allowed to do and can show its own audit trail. |
| Catalogue overlay | Any product edit a staff console session made on top of the built catalogue. | So a demonstration edit survives a reload without changing the shipped catalogue file. |
| Chat thread | The messages typed into the on site chat in this browser. | So a thread is still readable when you move between pages. |
| Eaze Buddy thread | The questions typed into Eaze Buddy, the store assistant in the corner of the page, and the answers it gave. Buddy is a separate assistant from the chat above and keeps its own thread. | So the conversation is still there when you move between pages. |
| Install invitation | One word saying whether you installed this site as an app or waved the invitation away. | So the invitation is not put in front of you again after you have answered it. |
The table scrolls sideways on a narrow screen.
No third party anything There are no third party cookies on this site. There is no analytics package, no tag manager, no advertising pixel, no session recorder, no font service and no content delivery network. Fonts, scripts, styles and images are all served from this origin. On this build, no data leaves your device.
You can read the whole of it, exactly as stored, with the Download my data button in the privacy panel of your account. That file is assembled on your device and is not uploaded anywhere. The Delete my data button next to it removes every one of the values above that belongs to you as a shopper. It deliberately leaves the operator session, its audit trail and the catalogue overlay, because those are the store's own working records on a shared demonstration device and not your personal information. Staff clear those from the staff console itself, by signing out and by resetting the overlay.
Your choice
Consent, and how to withdraw it
The consent bar appears on your first visit. Whatever you answer, the choice is written down with the moment you made it as a timestamp, so the store can show what you agreed to and when. That record is visible to you in the privacy panel of your account, in plain language.
Withdrawing consent
- Use Privacy choices in the site footer to reopen the bar and change your answer. The new answer is written with a new timestamp and replaces the old one.
- Withdraw marketing consent from the profile panel in your account, or from the unsubscribe link in any marketing email.
- Withdraw everything by using Delete my data, which clears the consent record along with the rest.
Withdrawing consent is free and takes effect immediately. Some consent cannot be withdrawn without ending the service it supports: the store cannot deliver an order without a delivery address, and it cannot drop a sales record that tax law obliges it to keep.
Marketing email and anti spam law
Canada's anti spam legislation governs commercial email. The store's position on it is simple and it does not bend for a campaign.
- Express consent only. Marketing email goes to people who ticked a box saying they want it. A tick is never pre filled, and buying something is never treated as asking for email.
- Every send is identified. Each marketing message carries the store's legal name and its physical mailing address, so you always know who sent it.
- One click unsubscribe. Every marketing message carries a working unsubscribe link that takes one click and no sign in. The store acts on it immediately and in every case well inside the ten business days the law allows.
- Transactional email is separate. Order confirmations, ready to collect notices, shipping notices, refund notices and replies to something you asked are not marketing. They are always on, they are not affected by an unsubscribe, and they carry no promotional content.
- Consent is recorded. The store records what you consented to, when, and where the consent came from, so it can be produced on request.
Honest about email No email is sent from this build. No email service is connected to it. Ticking the marketing box in the account panel records the preference in your own browser and nothing more. The rules above are what the live store runs on the day email is switched on.
Your rights
Access, correction and deletion
You can ask what the store holds about you, ask for it to be corrected, and ask for it to be deleted. Every request is answered within 30 days, which is the outer limit PIPEDA sets, and there is no charge for a routine request.
The controls that work today
These are in the privacy panel of your account, and they act on real stored values in this browser rather than pretending to.
- Download my data. Writes out everything this site has saved about you in this browser as a readable file, assembled on your device. The file names the store side console records it leaves out and says why.
- Delete my data. Clears the bag, wishlist, addresses, preferences, consent record, theme, the chat thread and the Eaze Buddy thread from this browser, along with the note of how you answered the install invitation, and tells you how many values it removed. The staff console records are left where they are, for the reason given above.
- Your details. Corrects the name, email and addresses held on the account.
- Privacy choices. In the site footer, reopens the consent bar so you can change your answer.
Requests about store side records
In production, records that live on the store's systems rather than in your browser, such as an order history or a payment token, are requested at the counter with photo identification, so nobody can ask for somebody else's file. The store confirms your identity, answers within 30 days, and where a request is refused it says which part of the law allows the refusal and how to challenge it.
Deletion is honoured except where a record must be kept, such as a sales record inside the retention period tax law sets. In that case the store says which record is being kept and for how long, rather than quietly keeping it.
Location
Where your data lives
In production, customer records, order records and the operational database are pinned to Canadian region infrastructure. That is a configuration choice, so it is checked rather than assumed: the region setting on every store of customer or order data is verified at go live and the check is recorded as part of the launch sign off.
Where a supplier processes data on the store's behalf, the store uses contractual terms that hold that supplier to a comparable standard of protection, and it names the categories of supplier here rather than leaving them vague. Today those categories are a payment processor, a delivery carrier and an email service.
Honest about this build This build has no backend, so there is no database and no region to pin. Nothing is transmitted anywhere at all. The residency commitment above is a production commitment, and this page carries the verified statement once go live has been signed off.
Cards
Payments and card data
Card data never touches At Eaze infrastructure. In production the card fields are served and processed by a Canadian payment processor on its own hosted checkout. Card numbers, expiry dates and security codes are never written to an At Eaze database, never appear in an At Eaze log, and are never visible to store staff.
What comes back to the store is a payment result and a token that can be used to match a payment to an order and to raise a refund. It cannot be used to reconstruct a card. Because the store never handles card data itself, it sits on the lightest of the PCI DSS self assessment questionnaires, SAQ A, which is the correct posture for a retailer in this position.
No card is taken on this build No payment processor is connected. No card field on this build submits anywhere and no money moves. Do not enter a real card number into this site. The payment section of the help page says the same thing in the place where a shopper meets it.
Access for everyone
Accessibility and AODA
At Eaze commits to WCAG 2.0 level AA across this website, which is the standard the Accessibility for Ontarians with Disabilities Act sets for public websites. Accessibility is treated as a build gate here rather than a polish pass at the end.
What that means in practice on this site: one main heading per page, real landmarks and headings rather than styled text, every control reachable and operable from a keyboard with a visible focus ring, form fields with real labels, colour contrast checked in both the bright and the dark theme, motion that is additive so content is readable with scripts off and with reduced motion on, and wide tables that scroll inside their own focusable box instead of forcing the page sideways.
Reporting a barrier
If any part of this site or the store stops you doing something, the store wants to hear it, and it treats a barrier report as a defect rather than as feedback. Report it at the counter at Unit 203b, Bramalea City Centre, during store hours. A barrier report is acknowledged and answered, and the store will supply the same information in another format on request at no extra cost.
A published reporting channel that does not need a trip to the mall, and the store's accessibility plan and feedback process in writing, are in place for the AODA compliance date of 31 December 2026.
Safeguards
Security and breach response
Safeguards are matched to how sensitive the information is. The site is served only over an encrypted connection with a content security policy that names this origin and nothing else, so it cannot load code, fonts, images or trackers from anywhere but here. Script is held to the strictest setting the policy has, with no inline script and no evaluated string anywhere on the site. The one relaxation is the inline style attribute, which the rack needs to paint a colourway swatch in its own colour, and a style attribute cannot fetch or send anything. Staff access to customer records is limited by role, so a staff member sees what their job needs and no more, and staff actions in the console are written to an audit trail.
A documented breach response procedure is written and rehearsed before launch, not after an incident. It covers containing the breach, assessing whether it creates a real risk of significant harm, reporting to the Office of the Privacy Commissioner of Canada and notifying affected people where that test is met, and keeping the breach record that PIPEDA requires the store to hold. Notification to affected people goes out as soon as feasible.
Honest about this build The breach procedure is a launch deliverable. It is written and signed off before the store takes its first real order, and this section is updated with its date at that point.
Straight answer
What is demonstration, and what is production
So that nothing on this page reads as a bigger claim than it is, here is the split.
| Item | On this build |
|---|---|
| Browser storage list | Working, and complete. Every row is a value this build writes, and it writes nothing the list does not name. |
| Consent record with timestamp | Working. Written and readable in your account. |
| Download my data | Working. It reads your real stored values. |
| Delete my data | Working. It really removes your stored values, and leaves the staff console records it says it leaves. |
| No third party calls | Working, and enforced by the content security policy served with every page. |
| Marketing email and unsubscribe | Not connected. No email is sent from this build. |
| Payment processing | Not connected. No card is charged. |
| Canadian region residency | A production commitment, verified at go live. |
| Counter requests with identification | A production procedure. |
| Breach response procedure | Documented before launch. |
| Published privacy contact point | Confirmed at launch. See below. |
The table scrolls sideways on a narrow screen.
Reach us
How to reach us about privacy
PIPEDA requires an organisation to name an accountable contact point for privacy. At Eaze confirms that contact point at launch, and this page publishes it the day it exists. It is not invented in advance and it is not a name borrowed from somewhere else.
Until then the accurate contact point is the store itself, in person, during store hours.
- In person
- A-Lifestyle At Eaze
25 Peel Centre Dr, Unit 203b
Bramalea City Centre
Brampton, Ontario L6T 3R5 - Hours
- 10 AM to 9 PM daily
- Privacy contact point
- Confirmed at launch and published here.
If you are not satisfied with how the store handles a privacy question, you can take it to the Office of the Privacy Commissioner of Canada, which oversees PIPEDA and accepts complaints from the public.
Last updated September 2026. This notice applies to build 2.0.0 of the At Eaze site. When the notice changes materially, the consent bar asks again rather than treating an old answer as covering a new purpose.