Privacy Policy.

1. Who we are and when this policy applies

Santa Exotics LTD. (“Santa Exotics”, “we”, “us” or “our”) is a Canadian company. This policy applies to the public website operated by Santa Exotics and to personal information collected through that website or when you contact us about it. It does not automatically apply to separate mobile applications, products, services, employment processes, or third-party websites. Those activities may have separate privacy notices explaining their own data practices.

Canadian privacy laws may apply to our handling of personal information, including the Personal Information Protection and Electronic Documents Act (PIPEDA), depending on the activity and circumstances. We will comply with the privacy laws that apply to the information and activity in question.

2. Information we may collect

Information you provide. If you email us or otherwise contact us, we may receive your name, email address, contact details, message contents, attachments you choose to send, and other information you decide to provide. Please do not send passwords, payment-card details, government identification numbers, health information or other sensitive information unless we specifically request it through an appropriate secure process.

Technical and usage information. When you visit a website, our hosting environment and security tools may process your Internet Protocol (IP) address, date and time of access, pages or files requested, referring page, browser and device type, operating system, approximate network information, error reports and security events. This information may be recorded in server, firewall, diagnostic or security logs.

Information from service providers. Providers that help us host, secure, maintain or measure the website may process information generated when your browser connects to their services. The categories depend on which services are enabled and how they are configured.

We aim to collect only information reasonably necessary for identified purposes. We do not require visitors to create accounts or provide personal information simply to read the public company website.

3. How and why we use information

We may use personal information for purposes that a reasonable person would consider appropriate in the circumstances, including to:

• respond to questions, business enquiries, feedback and support requests;
• operate, display, maintain and improve the website and its content;
• monitor availability, diagnose errors and troubleshoot technical problems;
• protect the website, company, visitors and systems against spam, fraud, abuse, malicious traffic and unauthorized access;
• understand website performance and usage, where analytics tools are enabled and their use is permitted;
• remember settings or preferences, where preference technologies are enabled;
• meet legal, regulatory, accounting, record-keeping and lawful request obligations; and
• establish, exercise or defend legal rights where necessary.

We will not use personal information for a new purpose materially different from the purpose explained when it was collected unless we first provide any notice and obtain any consent required by law.

4. Cookies, pixels and similar technologies

Our website may use cookies or similar technologies now or in the future. These technologies can store or access information on your browser or device. Whether a technology is used, and whether consent is required, depends on its purpose, the information it handles, your location and applicable law.

Possible categories include:

• Strictly necessary: technologies used to deliver the website, maintain security, balance traffic, remember a privacy choice or provide a feature you request.
• Preferences: technologies that remember choices such as language, display or other settings.
• Analytics and performance: technologies that help us understand page visits, navigation, website performance and errors.
• Advertising and measurement: technologies that may deliver, limit or measure advertising or help understand whether an advertising campaign led to a visit or action.
• Embedded content and third-party tools: technologies that may be set by external services when we include videos, maps, social content, chat or other embedded features.

Consent and controls. If we introduce non-essential cookies or similar technologies for which consent is required, we will provide an appropriate notice and a way to accept or decline them before they are activated where required by applicable law. Where appropriate, visitors will be able to choose categories, change their preferences later and withdraw consent. We will not treat continued browsing alone as consent where the law requires a more meaningful choice.

You can also use your browser settings to block or delete cookies. Blocking strictly necessary technologies may affect site functions. Browser controls may not prevent every form of similar technology or third-party processing.

This section describes categories we may use; it does not claim that every category is currently active. If and when optional technologies are deployed, we will identify the actual tools or providers, their purposes, relevant retention periods and available choices in a cookie notice or preference tool, and update this policy to reflect the real configuration.

5. Third-party services and service providers

We may use service providers for website hosting, domain services, content delivery, security, spam prevention, email, analytics, advertising measurement, embedded content and technical support. These providers may process personal information to perform services for us or in connection with their own services. We seek to use providers and safeguards appropriate to the nature of the information and service.

The website currently loads typefaces through Google Fonts. When a browser requests those font files, Google may receive technical request information, which can include an IP address and browser information. Google's handling of that information is described in its Privacy Policy.

We may disclose information where you ask us to, where necessary to provide a requested service, where we have your consent, where needed to protect rights or security, or where required or permitted by law. We do not sell personal information for money.

6. International processing

Our company is based in Canada, but our hosting or other service providers may process or store information in Canada or other countries. When personal information is processed outside your home jurisdiction, it may be subject to the laws of that location and may be accessible to courts, regulators or law-enforcement authorities under those laws. We take reasonable steps to select service providers and safeguards appropriate to the information being handled.

7. Retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, address enquiries or disputes, maintain appropriate business and security records, and meet legal obligations. Technical log and security-record retention periods may depend on our server and service-provider configurations. When information is no longer required, we take reasonable steps to securely delete it, destroy it or make it anonymous, subject to lawful retention requirements and backup cycles.

8. Security safeguards

We use administrative, technical and physical safeguards appropriate to the sensitivity of information. Depending on the systems involved, safeguards may include access controls, system updates, secure configuration, monitoring, backups and encryption where appropriate and available. Access to personal information should be limited to people and providers who need it for legitimate purposes and are subject to confidentiality or other appropriate obligations.

No website, network, email transmission or storage method can be guaranteed completely secure. If a privacy breach occurs, we will assess it and take the steps required by applicable law, which may include containment, investigation, notification and reporting.

9. Your choices and privacy rights

Depending on the law that applies and the circumstances, you may have rights to request access to personal information we hold about you, ask for corrections, withdraw consent where consent is the basis for processing, or raise a concern about our practices. These rights may be subject to legal exceptions and identity verification.

You may choose not to provide information in a message to us, although this may limit our ability to respond. You may manage cookies through any preference tool we provide and through your browser settings.

To make a request or raise a concern, contact our Privacy Officer below. Please describe your request clearly. We may ask for information needed to verify your identity and locate relevant records. We will respond within the time required by applicable law.

10. Children and young people

This public company website is not designed to create child accounts or knowingly collect personal information directly from children. If you believe a child has provided personal information to us through the website, contact our Privacy Officer. We will review the matter and take appropriate steps in accordance with applicable law.

Separate products or applications intended for children or young people will require their own age-appropriate privacy information, consent processes and safeguards before launch.

11. Links and external websites

Our website may contain links to third-party websites or services. Those services are operated independently and have their own privacy practices. We encourage you to review their privacy notices before providing information or interacting with their features. We are not responsible for privacy or security practices of third-party sites we do not control.

12. Changes to this policy

We may update this policy when our website, products, service providers, data practices or legal obligations change. The current version will be posted on this page with an updated effective or review date. If a change is material, we will provide additional notice or obtain consent where required by law. We encourage you to review this page periodically.