Last updated 7 September 2026.
This policy explains what personal information The Cabinet of Curiosities collects, why we collect it, what we do with it, and the rights you have over it. It forms part of our Terms & Conditions.
We are governed by Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, for commercial email, Canada’s Anti-Spam Legislation (CASL).
1. Who is responsible for your information
The Cabinet of Curiosities — and otherwise needful things
341 Ottawa Street North, Hamilton, Ontario, L8H 3Z8, Canada
Telephone: 905-818-5728
Privacy enquiries: curator@cabinetofcuriosities.ca
If you have a question or complaint about how we handle your information, write to us at that address and we will respond.
2. What we collect, and why
When you buy something
- Name, email, telephone, billing and shipping address — to take the order, ship it, and contact you about it.
- Order history — to handle returns, warranty questions and layaway agreements.
- Payment details. Card payments are processed by Square. Your card number is entered directly into Square’s systems — we never see it, and it is never stored on our servers. We receive only confirmation that a payment succeeded, the amount, and the last four digits for reconciliation. Square’s own handling of your data is governed by its privacy policy.
When you pay in the shop
- In-person card and debit payments are also processed by Square, through its point-of-sale terminal. The same applies: we do not see or store your card number.
When you enter a layaway agreement
- The above, plus the agreement itself — item, price, deposit, instalment schedule and payment record. We keep this for the life of the agreement and for as long afterwards as tax and limitation law requires.
When you enquire about a prop rental or a production
- Your details, your studio or production company, the production name and your required dates — to quote and to arrange the rental.
When you sell or consign something to us
- Your contact details and information about the item’s history. Provenance information may be retained with the object’s record permanently — it is part of what the object is, and it may matter to a future owner or researcher.
When you contact us or sign up for email
- Name, email, and whatever you choose to tell us. We use it to reply, and — only if you have asked for it — to send you news of new stock.
When you simply visit
- Standard server logs: IP address, browser and device type, pages viewed, and how you arrived. Our web host records these to keep the site running and secure.
- Analytics. We use analytics to understand which pages people read, how visitors find us, and what is not working. This tells us about patterns, not people: we do not use it to identify individual visitors, we do not build advertising profiles, and we do not sell or share it with advertising networks.
3. What we do not do
- We do not sell your personal information. Not to anyone, ever.
- We do not rent or trade mailing lists.
- We do not use your information to make automated decisions about you.
- We do not track you across other websites or hand your browsing to advertising networks.
- We do not ask for information we do not need. If a field is optional, you can leave it blank.
4. Who we share it with
Only where it is necessary to do what you have asked:
- Square — to process card payments, online and in the shop.
- Shipping carriers and customs brokers — to deliver, and to clear items across borders. International shipments require us to give the carrier and the receiving customs authority the information they demand, including a description and declared value of the item.
- Our web host, email provider and analytics provider — who store or process the data on our behalf, on our instructions.
- Professional advisers — accountants and, if needed, lawyers.
- Where the law requires it — including tax obligations, and cultural-property, endangered-species or export enquiries relating to an object.
Information held outside Canada. Square is headquartered in the United States, and some of our other providers may also store or process data outside Canada. Where that happens, your information is subject to the laws of that country, and may be accessible to its courts and law-enforcement or national-security authorities. PIPEDA requires us to tell you this.
5. Cookies
This site uses cookies:
- Necessary cookies make the shop function — they keep your cart working and remember your preferences between pages. Without them the cart and checkout break. WooCommerce sets these.
- Analytics cookies tell us which pages are read and how people arrived. They are not used to identify you, and not used for advertising.
You can block or delete cookies in your browser settings. Blocking the necessary ones will stop the shop working.
6. Email and CASL
- We send marketing email only to people who have asked for it.
- Every message identifies us, gives our address, and carries a working unsubscribe link.
- Unsubscribes are actioned promptly and always within the ten working days CASL allows.
- Messages about an order, a layaway agreement or a rental you have entered into are transactional, not marketing — we will still send those.
7. How long we keep it
| Information | Kept for |
|---|---|
| Order and transaction records | As long as tax and accounting law requires — generally six years |
| Layaway agreements | The life of the agreement, then as above |
| Rental agreements | The life of the agreement, then as above |
| Mailing list | Until you unsubscribe |
| General enquiries | Two years, unless they become an order |
| Analytics | Aggregated, and retained no longer than we need it |
| Object provenance records | Indefinitely — see below |
A note on provenance. Where you have sold or consigned an object to us, the record of that object’s history may be kept permanently and may be published as part of the object’s description, because provenance is part of what gives an object its meaning and value. We will not publish your name or contact details as part of that record without asking you first.
8. Your rights
Under PIPEDA you may:
- Ask what we hold about you, and get a copy.
- Ask us to correct anything inaccurate.
- Withdraw consent to marketing at any time.
- Ask us to delete information we no longer need. We may have to keep some of it — tax records, for instance — and if so we will tell you which and why.
- Complain — to us first, and if we do not resolve it, to the Office of the Privacy Commissioner of Canada.
Write to curator@cabinetofcuriosities.ca. We will respond within 30 days, as PIPEDA requires. We may need to verify who you are before releasing anything.
9. Keeping it safe
The site runs over an encrypted connection (HTTPS). Access to customer records is limited to people who need it to do their job. Card details are handled entirely by Square and are never stored on our systems.
No system is perfectly secure. If a breach occurs that creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner, as PIPEDA requires.
10. Children
This site is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe we have, tell us and we will delete it.
11. Other sites
We link to other places — our auction listings, our social media, and occasionally reference sources. Those sites have their own privacy policies and we are not responsible for them.
12. Changes to this policy
If we change this policy we will update the date at the top. Material changes will be flagged on the site.
13. Contact
curator@cabinetofcuriosities.ca · 905-818-5728 · 341 Ottawa Street North, Hamilton, Ontario, L8H 3Z8.
Office of the Privacy Commissioner of Canada: priv.gc.ca · 1-800-282-1376.