Privacy policy

Last updated: November 11, 2026

This Privacy Policy describes how Black Rose Hobbies (“we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you visit blackrosehobbies.com, shop with us in store or online, use your customer account, attend events, or sell us cards.

We are a trading-card and hobby shop in Toronto, Ontario, Canada. For privacy questions or to make a request about your information, contact us at info@blackrosehobbies.com, 289-224-2790, or 5000 Dufferin St, Unit B1, Toronto, ON M3H 5T5.

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and any other privacy laws that apply in the provinces or territories where we do business, including, where applicable, Quebec’s Law 25, because we sell to customers in Quebec. This policy also describes marketing rules under Canada’s Anti-Spam Legislation (CASL).

1. The information we collect

We collect personal information that you give us, that is created when you use our services, and that we receive from service providers who help us run the shop.

This may include:

  • Identity and contact details: name, email address, phone number, billing and shipping address
  • Account information: sign-in details, order history, store-credit balance, saved preferences, and communications with us
  • Transaction information: products ordered or picked up, payment status, tournament or event tickets, and refunds or exchanges
  • Payment information: we do not store your full payment card number. Card details are collected by our payment processors
  • Buylist and trade-in information: photos, card lists, condition notes, payout method, and the identification we require to complete a sale
  • Event information: ticket holder name, decklists where an event requires them, and other information needed to run a tournament
  • Usage data: IP address, browser and device type, pages visited, dates and times, referring URL, and similar diagnostic data
  • Messages you send us by email, phone, social media, or web forms

2. How we use personal information

We use personal information to:

  • Process, fulfill, ship, and provide pickup for orders, and to provide customer support
  • Create and manage your customer account and store credit
  • Process buylist purchases and pay you
  • Run events and tournaments, including decklist or prize administration where required
  • Prevent fraud, abuse, and unauthorized transactions, and to verify orders or pickup identity when reasonably needed
  • Improve and secure our website, search, and operations
  • Meet legal, tax, accounting, and payment-network obligations
  • Send transactional messages (order, shipping, pickup, and account notices)
  • Send marketing emails or other commercial electronic messages only with consent as required by CASL, or as otherwise permitted by law. You can unsubscribe from marketing at any time using the link in the message or by emailing us. Transactional messages are not marketing

We collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances, and for other purposes with your consent or as permitted or required by law.

3. Service providers and sharing

We do not sell your personal information.

We share personal information with service providers who process it on our behalf, and only as needed for their services. They include:

  • Shopify Inc., which hosts our online store, checkout, and customer accounts. Shopify’s privacy policy is at https://www.shopify.com/legal/privacy
  • Payment processors: Shopify Payments, Shop Pay, PayPal, and Afterpay/Klarna, whose use of your information is governed by their own privacy policies: https://www.shopify.com/legal/privacy , https://www.paypal.com/privacy/policy , https://www.afterpay.com/en-CA/privacy-policy , and https://www.klarna.com/ca/privacy/
  • Shipping carriers and fulfillment partners (for example, Purolator, UPS, Canada Post, or Stallion Express partners)
  • Analytics and advertising vendors: Google Analytics, Google Ads, and Meta Pixel. Google’s privacy policy is at https://policies.google.com/privacy. Meta’s privacy policy is at https://www.facebook.com/privacy/policy
  • Professional advisers, insurers, and payment networks, when reasonably required

We may also disclose personal information if required by law or a valid legal request, or if we reasonably believe disclosure is necessary to protect our rights, our customers, or the public, to investigate suspected fraud or wrongdoing, or in connection with a merger, sale, or reorganization of the business, in which case we will take reasonable steps to protect the information.

If you interact in public areas of the site or through a third-party social network, other users may see information you choose to share.

4. Transfers outside Canada

Our store is hosted on Shopify, and some of our service providers are located in the United States or other countries. Personal information may be processed and stored outside Ontario or Canada, where it may be subject to the laws of that country, including lawful access by foreign courts, governments, or regulators. By using our services or providing personal information, you consent to that transfer, subject to PIPEDA and other applicable law. We use contractual and other reasonable means to require service providers to protect personal information.

5. Retention

We keep personal information only as long as it is reasonably needed for the purposes above, or as required for legal, tax, accounting, payment-network, or dispute-resolution reasons (for example, order and transaction records). When information is no longer needed, we will destroy, erase, or de-identify it in a reasonable manner.

6. Security

We use commercially reasonable administrative, technical, and physical safeguards to protect personal information. Payment card details are handled by PCI-DSS-compliant processors. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your privacy rights

Subject to PIPEDA and other applicable law, you may request:

  • Access to the personal information we hold about you
  • Correction of information that is inaccurate or incomplete
  • Withdrawal of consent, where we rely on consent, with the understanding that we may no longer be able to provide some services (for example, fulfilling an order or maintaining an account)
  • That we stop sending you marketing messages

To make a request, email info@blackrosehobbies.com or use our PIPEDA request page. We may need to verify your identity before we respond. We will respond within the time PIPEDA requires, or explain if a legal exception applies (for example, information that cannot be disclosed because it would reveal another person’s information).

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca. Quebec residents may also contact the Commission d’accès à l’information du Québec.

If other privacy laws give you additional rights (for example, if you live in Quebec, the European Economic Area, the United Kingdom, or certain U.S. states), we will honour those rights where they apply. Our GDPR, APPI, and U.S. laws request pages remain available for those requests.

8. Cookies and similar technologies

We use cookies and similar technologies, including Google Analytics, Meta Pixel, and Google Ads, as described in our Cookies Policy. You can control cookies through your browser and through the opt-out tools described in that policy. Some features of the site may not work if you disable cookies.

9. Children

Our store is intended for customers who have reached the age of majority in their province or territory, or who are using the site with the consent of a parent or guardian, as stated in our Terms of Service. We do not knowingly collect personal information from children for marketing purposes. If you believe we have collected information from a child in error, please contact us and we will delete it where required.

10. Third-party websites

Our website may link to third-party sites (including payment, shipping, social, or publisher sites). Their privacy practices are their own, and we are not responsible for them. Please read their policies before providing information to them.

11. Changes to this policy

We may update this Privacy Policy from time to time. The revised policy will be posted on this page with an updated “Last updated” date. For material changes, we will provide additional notice where required by law, such as a notice on the website or an email. Please review this page periodically. Continued use of the website or our services after a change is posted constitutes acceptance of the updated policy, except where the law requires a different form of consent.