Privacy Policy

Last updated: August 23, 2026

Scope and Officer

This policy explains how Méditerranée Distribution Inc., doing business as CARTHIS LAB, collects, uses, discloses, retains, and protects personal information related to carthislab.com, orders, communications, and services.

Privacy Officer
Méditerranée Distribution Inc.
contact@carthislab.com

The person with the highest authority in the company holds this role by default, unless delegated in writing.

Personal Information We May Collect

Depending on your interactions and only when necessary, we may collect:

• contact details, such as name, billing and shipping address, email, and phone number;
• order and transaction information, such as products, amounts, taxes, shipping, returns, and refunds;
• account information, if the customer account feature is enabled;
• the content of communications with customer service;
• technical and usage information, such as IP address, browser, device, pages visited, and events associated with actually enabled cookies or similar technologies;
• communication preferences and recorded consents;
• information reasonably necessary for security, fraud prevention, and compliance with legal obligations.

We do not seek to collect information that is not necessary for the stated purposes.

Sources and Means of Collection

Information may come directly from you when you place an order, create an account, fill out a form, subscribe to a communication, or write to us. It may also be generated through your use of the site or received from providers necessary for the transaction, depending on the tools actually used.

Purposes of Use

We use the necessary information to:

• process, confirm, deliver, and support orders;
• manage payments, taxes, returns, refunds, and requests;
• provide the customer account and requested features, when enabled;
• communicate about an order or respond to a request;
• ensure site security, prevent fraud, and enforce our terms;
• maintain required records and comply with legal, tax, and accounting obligations;
• send commercial communications when the required consent has been obtained or as permitted by law;
• measure and improve the site only through actually configured tools and applicable consents.

Cookies, Analytics, and Advertising

The site may use cookies strictly necessary for its operation. Non-essential cookies, analytics tools, personalization, profiling, or advertising tools are described here only if actually enabled, and are managed in accordance with the required choices and consents.

Disclosure to Third Parties

We may disclose necessary information to categories of providers that help us operate the store, notably the e-commerce platform (Shopify), payment, delivery, hosting, security, support, and communication services, to the extent these categories reflect actual practices.

We may also disclose information when required or permitted by law, notably to protect our rights, prevent fraud, or respond to a competent authority.

We do not sell or rent personal information.

Processing Outside Québec

Certain providers may process or store information outside Québec. Before any disclosure outside Québec, the company carries out the required assessment and implements appropriate contractual and security measures.

Retention and Destruction

Information is retained only for as long as necessary for the stated purposes and legal, tax, accounting, fraud prevention, and dispute management obligations, and is then destroyed or anonymized in accordance with applicable internal practices.

Security and Incidents

We implement reasonable administrative, technical, and physical measures based on the sensitivity, quantity, use, and format of the information. No system offers absolute security. In the event of a privacy incident, we apply the assessment, mitigation, logging, and notification measures required by law.

Rights and Choices

Subject to the conditions and exceptions provided by law, an individual may request access to their information, its correction, the withdrawal of consent to certain uses or disclosures, and exercise other applicable rights.

A written request may be sent to the Privacy Officer. We may verify the requester's identity proportionately before responding. A complaint may also be filed with the Privacy Officer or the Commission d'accès à l'information du Québec.

Commercial Communications

An individual may unsubscribe using the link provided in commercial emails or by writing to us. Transactional messages necessary for an order may continue to be sent.

Children

Where a minor's consent cannot be validly given by them alone, the required authorization is obtained.

Changes

We may update this policy to reflect changes in our practices or legal requirements. The update date is indicated at the top. Any significant change is brought to the attention of affected individuals through an appropriate means.