Privacy Policy – C. Victory Books (In-Store QR Checkout)

Effective: November 4, 2025

At C. Victory Books, we value your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our in-store QR checkout system for book purchases with instant pickup. This policy applies only to the QR checkout flow and does not cover general website activity unless specified.

We collect minimal data necessary for secure transactions and pickup. No data is sold or shared for marketing. Compliance: PIPEDA, PIPA, and COPPA (for children's privacy).

1. Information We Collect

We collect limited personal information solely to process your purchase and facilitate pickup. All data is handled securely and retained only as needed.

• Personal Identification: Name, email address, and optional phone number provided during checkout for receipts and contact.
• Payment Information: Credit card details are processed directly by Stripe (we do not store card numbers). We receive only transaction confirmations.
• Order Details: Selected books, quantities, purchase date, and pickup code (generated for your transaction).
• Device and Usage Data: IP address, browser type, device info, and session cookies (see Section 7) to maintain cart security during checkout. No location tracking beyond IP for fraud prevention.
• No Additional Data: We do not collect shipping addresses (in-store pickup only), social media info, or browsing history outside the checkout session.

2. How We Use Your Information

Your information is used exclusively for providing the in-store checkout service:

• To process payments and generate receipts via email/SMS (if phone provided).
• To create and verify pickup codes for in-store collection.
• To prevent fraud (e.g., IP checks during transaction).
• For internal record-keeping (e.g., inventory, sales reports) – anonymized where possible.
• To comply with legal obligations, such as tax reporting or dispute resolution.
• No Marketing: We do not use your data for promotions, newsletters, or profiling.

3. Sharing Your Information

We do not sell, rent, or trade your personal information. Disclosure is limited to:

• Service Providers: Stripe for payments (they have their own privacy policy: stripe.com/privacy).
• Legal Requirements: If required by law, court order, or government authority (e.g., tax audits).
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred with notice.
• No Third-Party Sharing: No sharing with advertisers, analytics firms, or other entities beyond the above.

4. Children's Privacy

Our QR checkout system is intended for use by adults (18+) or minors with parental/guardian supervision. We do not knowingly collect personal information from children under 13 years old (COPPA compliance).

• If you are under 13, do not use the checkout system or provide any information. Parents/guardians must assist minors aged 13–17.
• If we learn we have collected data from a child under 13, we will delete it promptly and notify the parent/guardian if possible.
• For purchases involving children (e.g., books for kids), we collect only the adult purchaser's details. No child-specific data is required.
• Parents/guardians: To request deletion or access to a minor's data, contact us (see Section 10).

5. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your information, including:

• HTTPS encryption for all checkout transmissions.
• Secure Stripe integration for payments (PCI DSS compliant).
• Session-based storage (cookies/localStorage) that expires after checkout.
• Access controls and regular security audits.
• Limitation: No system is 100% secure; we cannot guarantee absolute protection against breaches.

In case of a data incident, we will notify affected individuals and authorities as required by PIPEDA/PIPA.

6. Data Retention

• Transaction records: Retained for 7 years for tax/compliance purposes, then securely deleted.
• Emails/receipts: Available for 2 years, then anonymized or deleted.
• Cookies/session data: Deleted immediately after checkout session ends.
• You may request deletion at any time (subject to legal holds).

7. Cookies and Tracking

We use minimal cookies and tracking technologies solely for the checkout process:

• Essential Cookies: Session cookies to maintain your cart and secure the transaction (e.g., 'book_cart' for selected items). These are first-party, temporary, and do not track across sites.
• No Non-Essential Cookies: No advertising, analytics (e.g., Google Analytics), or third-party trackers. Browser settings can manage/delete cookies.
• Device Fingerprinting: Limited use for fraud detection (e.g., browser type, screen resolution) – not linked to personal identity.
• To opt out: Clear browser data or use privacy-focused browsers. Disabling cookies may prevent checkout completion.

8. Your Rights and Choices

Under PIPEDA and PIPA, you have rights regarding your personal information:

• Access: Request a copy of your data (free once per year).
• Correction: Update inaccurate information.
• Deletion: Request removal (except for legal retention needs).
• Withdrawal of Consent: Stop future processing (may affect services).
• Complaints: Contact us or the Office of the Information and Privacy Commissioner for BC.

To exercise rights, email writing4thekids@victorycbooks.com with your request. We respond within 30 days.

9. International Data Transfers

Data is primarily stored in Canada (via Stripe and our servers). For global Stripe users, data may be transferred to the US under Standard Contractual Clauses for adequacy. We ensure equivalent protection levels.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or laws. Significant updates will be posted here with a revised effective date. Continued use of the Services constitutes acceptance. Check periodically.

11. Contact Us

C. Victory Books – Protecting Your Privacy. Last updated: November 4, 2025.