Privacy Policy

Lacet is committed to protecting the privacy of people who visit lacet.ca and subscribe to our newsletter. This policy explains what information is collected, how it is used, and what your rights are.

1. Data controller

Lacet inc., a business corporation incorporated under the Business Corporations Act (Québec) (NEQ : 1182098518), with its registered office in Stoneham-et-Tewkesbury (Québec), Canada, is the controller of personal data collected through this site. For any question or request, contact us at info@lacet.ca.

2. Information collected

When you subscribe to our newsletter, we collect:

• Your email address;
• The language chosen (French or English) at sign-up;
• The date and time of your consent.

No other information is requested or collected about you without your explicit consent.

3. Purpose and legal basis

Your email address is used solely to send you the Lacet newsletter (announcements about the shop opening, new services, events). Processing is based on your explicit consent, given when you check the box at sign-up and confirm your email via the double opt-in link.

Your contact details are never sold, rented, or shared for advertising purposes with third parties.

4. Processors

Newsletter delivery is operated by Brevo (formerly Sendinblue), a French company whose servers are located in the European Union. Brevo acts as a processor under Québec's Law 25 and the GDPR. Their policy is available at brevo.com/legal/privacypolicy.

If you consent to it (see section 8), limited data may also be transmitted to Meta Platforms, Inc. (Facebook, Instagram) for the purpose of measuring the performance of our advertising campaigns. Their policy is available at facebook.com/privacy/policy.

5. Transfers outside Québec

Since Brevo is based in France, your newsletter data is transferred outside Québec. France is recognized as offering a level of protection equivalent to Québec under the GDPR.

When you consent to advertising tracking (section 8), the relevant data is sent to Meta, headquartered in the United States (Ireland for European users). These transfers are governed by standard contractual clauses and Meta's policies.

6. Retention period

Your email address is kept as long as you remain subscribed to the newsletter. You can unsubscribe at any time via the link at the bottom of each email. Upon unsubscription, your address is removed from our mailing lists within 30 days.

7. Your rights

Under Québec's Law 25 and the GDPR, you have the following rights:

• Access: know what data we hold about you;
• Rectification: correct inaccurate information;
• Erasure: request deletion of your data;
• Withdrawal of consent: at any time, without justification;
• Portability: receive your data in a readable format;
• Complaint: with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or a competent European authority (CNIL in France).

To exercise any of these rights, write to us at info@lacet.ca. We will respond within 30 days.

8. Cookies and advertising tracking

Lacet uses advertising measurement tools only with your explicit consent, given through the banner displayed on your first visit. These tools allow us to assess the effectiveness of our campaigns (for example, knowing how many people who saw an ad later subscribed to the newsletter) and are not intended to profile your browsing.

The tools used are:

• Meta Pixel (browser side): a small script loaded from connect.facebook.net that places a cookie to measure conversions attributable to our Facebook and Instagram ads;
• Meta Conversions API (server side): when a conversion occurs (confirmed newsletter sign-up, contest entry), our servers send your email address and IP address to Meta in hashed form (SHA-256), along with an event identifier that allows Meta to deduplicate with the Pixel.

If you decline tracking (or have not yet answered the banner), neither tool is activated: the Pixel script is not loaded and no data is sent to Meta server-side. You can change your choice at any time by clearing the site's local storage (Browser settings → Privacy → Site data).

No third-party behavioural analytics tool (such as Google Analytics) is used. Only strictly necessary technical files (Cloudflare hosting) are placed without consent.

9. Security

Communications between your browser and our servers are encrypted via HTTPS. Access keys to third-party services (such as Brevo) are stored encrypted and are never exposed publicly.

10. Changes

This policy may be updated to reflect changes in our practices or the law. The date of the last update is shown at the top of this page. In case of a material change, newsletter subscribers will be notified by email.