PRIVACY POLICY
Last updated: 2 September 2026
This Privacy Policy explains how Sanovex OÜ, an Estonian company trading as NorthernRest ("we", "us", "our"), collects, uses, discloses and protects your personal information when you visit or buy from northernrest.ca (the "Website").
We are established in Estonia and we sell to customers in Canada. Because we are established in Estonia, our handling of your personal information is governed by the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act, and — because we sell to you in Canada — by Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector ("Law 25") where it applies to you, and the consumer protection legislation of your province or territory. Throughout this policy we use the Canadian term "personal information".
1. Personal Information We Collect
Order information. When you place or attempt to place an order, we collect your name, email address, phone number, billing address and shipping address, and the details of the items you order.
Payment information. We do not collect or store your full card number. Your payment is processed by our payment provider through Shopify. We receive only the payment method used, the last four digits of the card, and confirmation that the payment succeeded or failed.
Customs information. We also process the information needed to clear your order through Canadian customs: your name, delivery address and phone number, and the description and value of the goods.
Communications. The content of the messages you send us through our contact form, by email or to our customer service, together with our replies.
Device and usage information. When you visit the Website we collect your IP address, browser type and version, operating system, time zone, referring page, and the pages and products you view. This is collected through server log files, cookies, tags, pixels and web beacons, as described in section 2 and in our Cookie Policy.
2. Cookies & Consent
We use cookies and similar technologies. Cookies that are strictly necessary to display the Website, keep your basket and complete your order are always active. Cookies used to measure how the Website is used and to show you advertising are only activated after you accept them in the consent banner shown on your first visit. The banner lets you refuse all non-essential cookies in a single click, at the same level as accepting them.
You can change or withdraw your choice at any time by reopening the cookie settings from our Cookie Policy page. Withdrawing your consent does not affect anything we did while it was valid. Our Cookie Policy lists each cookie we use, what it does and how long it lasts.
3. How We Use Your Personal Information
We use your personal information to:
- process your order, take payment, and prepare and ship it;
- declare and clear your order through Canadian customs, and account for any duties and taxes due on it;
- keep you informed about your order and answer your questions;
- handle returns, refunds and warranty claims;
- detect and prevent fraud, chargebacks and abuse of the Website;
- meet our legal obligations, including Estonian and Canadian tax, customs and commercial record-keeping rules;
- measure and improve how the Website performs, where you have accepted measurement cookies;
- send you marketing messages and show you advertising, where you have consented and until you withdraw that consent.
3bis. Legal Bases for Processing (GDPR)
Where the GDPR applies, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Processing, shipping, returning and refunding your order | Performance of a contract — Art. 6(1)(b) |
| Customs clearance, VAT, accounting and record-keeping | Legal obligation — Art. 6(1)(c) |
| Fraud prevention, chargeback handling and Website security, including hCaptcha | Legitimate interests — Art. 6(1)(f) |
| Measurement and advertising cookies, and marketing emails | Consent — Art. 6(1)(a) |
Where we rely on our legitimate interests, you have the right to object under section 7. Providing the order and customs information in section 1 is a contractual and legal requirement — without it we cannot ship your order.
4. Disclosure of Your Personal Information
We do not sell your personal information. We share it only with the following recipients, and only with what each of them needs:
- Shopify Inc. and our payment provider - to host the store and process your payment.
- Our fulfilment partner and carriers, they receive your name, delivery address and phone number to pack and ship your order.
- Customs authorities and our customs agents - to clear your order into Canada.
- Google LLC and Intuition Machines, Inc. (hCaptcha) - website measurement, advertising where you have consented, and protection of our contact form.
- Our accountants and legal advisers, and public authorities where required by law or a court order.
5. Behaviour-Based Advertising
Where you have accepted advertising cookies, we use Google Ads to show you advertising for our products on Google services and on other websites, including advertising based on products you have viewed on our Website.
You can withdraw your consent at any time in our cookie settings.
You can also manage interest-based advertising directly with the general industry opt-out tools below. They are provided for your convenience and do not indicate that we use each of these advertising networks; the recipients we actually share information with are listed in section 4.
Facebook: https://www.facebook.com/settings/?tab=ads
Google: https://myadcenter.google.com/home
Bing: https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads
DAA: https://optout.aboutads.info
AdChoices Canada (Digital Advertising Alliance of Canada): youradchoices.ca
6. Profiling and Tracking Technologies
We do not make any decision about you by automated means alone.
Where we use technologies that can identify, locate or profile you - our measurement and advertising cookies - we activate them only with your consent, and you can deactivate them at any time in our cookie settings. Your browser also allows you to block or delete cookies; blocking strictly necessary cookies may stop the Website from working.
7. Your Rights
You may ask us to:
- access the personal information we hold about you and know how it is used;
- correct information that is inaccurate, incomplete or out of date;
- delete information we no longer need and, if you reside in Quebec, stop disseminating it or de-index a link to it;
- withdraw your consent to marketing, or to measurement and advertising cookies, at any time;
- receive a copy of the computerised personal information you provided to us, in a structured and commonly used technological format, and have it transferred to another organisation;
- restrict our processing of your information while we verify a correction or an objection you have raised;
- object at any time to processing we base on our legitimate interests, including processing for direct marketing.
Write to privacy@northernrest.ca. We reply within 30 days. We may need to verify your identity first. Some of these rights are subject to exceptions set out in law: where we cannot act on a request, we will tell you why and how to challenge our decision.
Some information we must keep even if you ask us to delete it, in particular the order, invoice and customs records that Estonian and Canadian law require us to retain. In that case we delete everything else, and we tell you what we kept and why.
8. Right to Lodge a Complaint
Please contact us first at privacy@northernrest.ca. We will look into your complaint and reply to you.
If you are not satisfied with our answer, or if we refuse a request you have made under section 7, you may complain to the authority that applies to you:
Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) — our lead supervisory authority under the GDPR.
Tatari 39, 10134 Tallinn, Estonia — aki.ee
Office of the Privacy Commissioner of Canada — for complaints under PIPEDA.
30 Victoria Street, Gatineau, Quebec K1A 1H3 — priv.gc.ca
Commission d'accès à l'information du Québec — if you reside in Quebec.
cai.gouv.qc.ca
Where we refuse a request to access, correct or delete your personal information, you may apply to the Commission for a review of our decision within 30 days of receiving it.
For complaints that are not about privacy, please contact the consumer protection authority of your province or territory; the list is in our Terms and Conditions.
9. Data Retention
- Order, invoice and customs records: 7 years, as required by Estonian and Canadian tax and customs law.
- Customer service correspondence: 3 years from our last exchange with you.
- Marketing consent records: for as long as your consent is valid, plus 3 years, so that we can demonstrate the consent we relied on.
- Measurement and advertising data: as set out in our Cookie Policy.
- Customer account details: until you close your account, then 12 months.
- Server log files: 12 months.
When these periods expire we destroy your personal information, or anonymise it so that it can no longer be linked to you.
10. Transfers Outside Canada and Outside Quebec
We are established in Estonia, and some of our service providers and logistics partners operate outside Canada. Your personal information is therefore processed outside Canada and, if you reside in Quebec, outside Quebec. The recipients listed in section 4 operate in Estonia, the European Union, Canada, the United States and Asia.
Before communicating personal information outside Quebec we carry out a privacy impact assessment and put contractual protections in place with each recipient. For transfers outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses, or on the EU–U.S. Data Privacy Framework where the recipient is certified under it, together with additional technical and organisational safeguards. You may request a copy of these safeguards at privacy@northernrest.ca.
11. Security and Privacy Incidents
We protect your personal information with measures appropriate to its sensitivity, including encrypted transmission, restricted access, and written commitments from each of our service providers. No system is completely secure, and we ask you not to send us sensitive information by email.
We keep a register of confidentiality incidents. If an incident presents a risk of serious injury to you, we will notify you without delay and, as applicable, the Office of the Privacy Commissioner of Canada and the Commission d'accès à l'information du Quebec.
Where an incident is likely to result in a risk to your rights and freedoms, we also notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of it, as required by the GDPR.
12. Marketing Emails
We send marketing emails only to people who have given us their express consent, and to customers whose consent is implied by a purchase made in the previous 24 months, as permitted by Canada's Anti-Spam Legislation. Every message identifies Sanovex OÜ, gives our postal address and an email address at which we can be reached, both valid for at least 60 days, and includes an unsubscribe link. We process unsubscribe requests within 10 business days.
13. Children
The Website is intended for adults. We do not knowingly collect personal information from anyone under the age of majority in their province or territory. If you believe a child has provided us with personal information, write to privacy@northernrest.ca and we will delete it.
14. Changes
We may update this Privacy Policy to reflect legal or operational changes. We will post the updated policy on this page with a new "Last updated" date and, where the changes are material, notify you by email or by a notice on the Website before they take effect.
15. Contact
Company name: Sanovex OÜ
Registered office: Sepapaja tn 6, 15551 Tallinn, Estonia
Phone (Canada): +1(236)232-0090
Email: info@northernrest.ca
Our customer service is available Monday to Friday, 9 AM to 5 PM. We reply within 24 hours.
For anything concerning your personal information: privacy@northernrest.ca
Person in charge of the protection of personal information
The person in charge of the protection of personal information at Sanovex OÜ is our Managing Director, who can be reached at privacy@northernrest.ca or at Sepapaja tn 6, 15551 Tallinn, Estonia.