Privacy policy
Last updated: August 3, 2026
1. About this policy
White Wave Sportswear Inc., doing business as O'Neill Canada ("O'Neill Canada," "we," "us"), operates oneillcanada.com and the related online store and services (the "Services"). We are established in Québec and are subject to Québec's Act respecting the protection of personal information in the private sector (Law 25), as well as other applicable Canadian privacy legislation.
This policy explains, in plain language:
- what personal information we collect and why
- how we obtain your consent, and how you can withdraw it
- who we share your information with, and where it is stored
- how long we keep it and how we protect it
- what rights you have and how to exercise them
If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy governs with respect to personal information.
2. Person in charge of the protection of personal information
We have designated a person responsible for the protection of personal information. You may contact this person with any question about this policy, to exercise your rights, or to make a complaint.
Responsable de la protection des renseignements personnels / Privacy Officer
O'Neill Canada
Email: customerservice@oneillcanada.com
Telephone: +1 514-789-0809
Mail: O'Neill Canada, 5800 rue Ferrier, Montréal, Québec H4P 1M7, Canada
We respond to requests within 30 days.
3. What personal information we collect, and why
The information we collect depends on how you interact with us.
| When | What we collect | Why |
|---|---|---|
| You browse the site | IP address, device and browser identifiers, operating system, referring site, pages and products viewed, interaction and navigation behaviour, approximate location inferred from IP address | Operate and secure the site; measure and improve performance; understand browsing trends. Where you have activated them, personalize content and show you relevant advertising on this and other sites |
| You place an order | Name, email, telephone, billing address, shipping address, payment details (processed by our payment provider — we do not store full card numbers), order contents and history | Process, fulfil and ship your order; process payment; handle returns, exchanges and refunds; provide order updates; detect and prevent fraud |
| You create an account | Name, email, telephone, address, language preference, username and password, saved preferences | Create and maintain your account; save your preferences; provide order history and faster checkout |
| You subscribe to marketing | Email address, language preference, marketing preferences, engagement with our messages | Send you promotions, product news and offers; measure and improve our communications. You may unsubscribe at any time |
| You contact customer service | Name, contact details, the content of your message, related order information | Respond to your inquiry, complaint or request |
| You submit a product review | Display name, review content, associated order and product | Publish your review; improve our product assortment |
| You initiate a return or exchange | Order details, contact details, reason for return | Process your return, exchange or refund |
| You use our store credit or loyalty program | Account identifier, credit balance, transaction history | Administer the program and apply credits to your purchases |
| You order as a wholesale customer | Business contact details, company information, account terms, order history | Manage your wholesale account and orders |
We do not collect sensitive personal information as defined by Law 25, and we do not sell your personal information.
4. Cookies and tracking technologies
Our website uses cookies and similar technologies. Some of these have functions that allow you to be identified, located or profiled — specifically, technologies used for analytics, advertising and personalization. Examples include Google Analytics, which analyses how you browse our site; the Meta advertising pixel, which allows advertising to be tailored to your interests; and Klaviyo, which records the products you view in order to personalize our communications to you.
These functions are deactivated by default. They are activated only if you choose to activate them.
You can activate or deactivate them at any time:
- through the cookie banner that appears on your first visit, and
- at any time afterwards, using the Cookie preferences link in the footer of our site.
Cookies that are strictly necessary — those required for the site to function, such as maintaining your cart, keeping you signed in and securing checkout — cannot be deactivated and do not require your consent.
The full list of cookies we use, with their provider, purpose and duration, appears in the Appendix at the end of this policy.
5. Your consent
How we obtain it. We ask for your consent separately for each purpose that requires it. Consent to analytics, advertising and personalization technologies is obtained through our cookie banner, which lets you accept or decline them. Consent to receive marketing communications is obtained separately, when you subscribe.
We do not require you to accept marketing or profiling in order to purchase from us.
How to withdraw it. You may withdraw your consent at any time, as easily as you gave it:
| To withdraw consent for | Do this |
|---|---|
| Analytics, advertising and personalization technologies | Use the Cookie preferences link in our footer |
| Marketing emails | Click "Unsubscribe" at the bottom of any marketing email |
| Any other use of your personal information | Contact our Privacy Officer using the details in Section 2 |
Withdrawing consent does not affect processing carried out before the withdrawal, and does not apply where we are permitted or required by law to continue processing — for example, retaining transaction records to meet tax obligations.
6. Who we share your personal information with
We share personal information only where necessary for the purposes described above. We do not sell your personal information.
| Category | Who | What they receive | What they do for us |
|---|---|---|---|
| Ecommerce platform and hosting | Shopify Inc. | Contact details, account information, order details, browsing information | Host our store, process orders, and provide the underlying commerce platform |
| Payment processing | Shopify (Shopify Payments and Shop Pay, including Apple Pay and Google Pay) | Payment and billing information, order amount | Process and secure payments; verify transactions and prevent fraud. Card details are tokenized and we do not receive full card numbers |
| Order fulfilment and shipping management | ShipStation | Name, shipping address, telephone, email, order contents | Process and manage the fulfilment of your order, generate shipping labels, and provide tracking |
| Shipping and delivery | The carriers we engage to deliver orders | Name, shipping address, telephone, email, order contents | Deliver your order and provide tracking |
| Returns management | ReturnGo | Contact details, order details, reason for return | Process returns and exchanges |
| Email marketing | Klaviyo | Contact details, marketing preferences, purchase history, browsing and engagement information | Send and measure our marketing communications |
| Customer support | Re:amaze | Contact details, order history, the content of your inquiry | Respond to your inquiries and operate our support chat |
| Product reviews | Judge.me | Display name, review content, order and product information | Collect and publish product reviews |
| Advertising partners | Meta Platforms, Google (Google Ads, Merchant Center) | Device identifiers, browsing information, purchase information | Show you relevant advertising on third-party sites, list our products, and measure advertising performance. These technologies operate only where you have activated them |
| Analytics partners | Google Analytics, Shopify Analytics | Device identifiers, browsing information | Help us understand how our site is used and improve it. These technologies operate only where you have activated them |
| Cloud infrastructure | Microsoft | Order and customer data | Host and process data for our order processing, inventory and reporting systems |
We may also disclose personal information where required by law, in response to valid legal process, to protect our rights or the safety of others, or in connection with a corporate transaction such as a merger or sale of assets.
Where we engage a service provider, we enter into a written agreement requiring them to protect your information and to use it only for the purposes we specify.
Shop Pay. Shop Pay accounts are operated by Shopify and work across multiple merchants. Where you use Shop Pay, Shopify is responsible for the personal information it processes for that purpose, and you may exercise your rights with Shopify directly through the Shopify Consumer Privacy Policy at https://privacy.shopify.com.
7. Storage and communication of information outside Québec
Some of your personal information is stored and processed outside Québec, primarily in the United States. Our store is hosted by Shopify on infrastructure located in the United States, and our marketing, customer support, reviews, advertising, analytics and cloud infrastructure providers are also located outside Québec, primarily in the United States.
Some of our systems, including our internal inventory and order management database, are operated on our own premises in Montréal.
When personal information is communicated outside Québec, it becomes subject to the laws of that jurisdiction and may be accessible to courts, law enforcement and regulatory authorities there.
Before communicating personal information outside Québec, we assess whether it will receive adequate protection. This assessment considers the sensitivity of the information, the purposes for which it will be used, the protection measures in place — including contractual measures — and the legal framework of the destination jurisdiction. We enter into a written agreement with each recipient reflecting that assessment.
8. How long we keep your personal information
We keep personal information only for as long as necessary for the purposes for which it was collected, or as required by law. When those purposes are fulfilled, we destroy the information or anonymize it.
| Type of information | How long we keep it |
|---|---|
| Customer accounts, order and transaction records | We keep this information for as long as necessary to maintain your customer relationship with us, including providing your order history and handling returns and warranty matters, and to meet our tax and accounting obligations, which require us to retain transaction records for a minimum of seven years. We review the information we hold periodically and destroy or anonymize what is no longer necessary |
| Marketing contact information | Until you unsubscribe. After you unsubscribe, we keep a minimal record of your email address on a suppression list so that we do not contact you again. This record is used only to honour your opt-out |
| Customer service correspondence | For as long as necessary to resolve your inquiry and handle any related follow-up. We review this correspondence periodically and destroy what is no longer needed |
| Product reviews | Review content is retained indefinitely as published content on our site. If you ask us to stop displaying a review, we will remove it or remove the attribution |
| Records of your consent choices | For as long as necessary to demonstrate the choice you made and to apply it, and reviewed periodically for destruction |
| Website analytics and cookie data | As set out in the durations listed in the Appendix |
9. How we protect your personal information
We have implemented physical, technological and organizational measures to protect your personal information against loss, theft, and unauthorized access, use, communication or destruction.
Access to personal information is limited to personnel who require it to perform their duties, and we enter into written agreements with the service providers who process personal information on our behalf.
No security measure is absolute. If a confidentiality incident occurs that presents a risk of serious injury, we will notify the Commission d'accès à l'information and the individuals concerned as required by law, and take reasonable measures to reduce the risk of harm.
10. Your rights
Under Québec law you have the following rights. To exercise any of them, contact our Privacy Officer using the details in Section 2. We will respond within 30 days. We may need to verify your identity before acting on a request.
- Access. You may ask us to confirm whether we hold personal information about you, to receive a copy of it, and to be informed of how it has been used and to whom it has been communicated.
- Rectification. You may ask us to correct information that is inaccurate, incomplete or ambiguous, and to delete information collected without authority.
- Withdrawal of consent. You may withdraw your consent to the collection, use or communication of your personal information at any time (see Section 5).
- Cessation of dissemination and de-indexing. You may ask us to stop disseminating your personal information, or to de-index a hyperlink giving access to it, where the dissemination contravenes the law or a court order, or where it causes you serious injury to your reputation or privacy that clearly outweighs the public interest in the information.
- Portability. You may ask to receive the computerized personal information you have provided to us in a structured, commonly used technological format, or to have it communicated to another organization.
- Complaint. If you are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec: https://www.cai.gouv.qc.ca
If we refuse a request in whole or in part, we will inform you in writing of the reasons, tell you how to seek a review of our decision, and give you the applicable time limit for doing so.
We will not treat you differently for exercising these rights.
11. Automated decision-making
We do not use your personal information to make decisions about you based exclusively on automated processing.
12. Minors
Our Services are directed to adults and we do not knowingly collect personal information from children.
In Québec, consent on behalf of a minor under 14 years of age must be given by the person having parental authority. If you are a parent or guardian and believe a child under your authority has provided us with personal information, contact our Privacy Officer and we will delete it.
13. Third-party websites
Our Services may link to websites operated by third parties. We do not control those sites and this policy does not apply to them. We encourage you to review their own privacy policies before providing them with personal information.
14. Changes to this policy
We may update this policy to reflect changes in our practices or in the law. We will post the revised policy on this page and update the "Last updated" date above. Where changes are significant, we will provide notice on our website and, where appropriate, by email to account holders.
15. Contact
Responsable de la protection des renseignements personnels / Privacy Officer
O'Neill Canada
customerservice@oneillcanada.com
+1 514-789-0809
5800 rue Ferrier, Montréal, Québec H4P 1M7, Canada
Commission d'accès à l'information du Québec — https://www.cai.gouv.qc.ca
Appendix — Cookies and similar technologies
The technologies below are used on oneillcanada.com. Those listed under Analytics and Marketing and advertising are deactivated until you activate them through our cookie banner or the Cookie preferences link in our footer.
Strictly necessary — no consent required
These cookies are required for the site to function and cannot be deactivated.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
localization |
Shopify | Remember your selected country and language | 1 year |
cart_currency |
Shopify | Remember the currency for your cart | 2 weeks |
cart, cart_ts, cart_sig
|
Shopify | Maintain the contents of your shopping cart | 2 weeks |
_secure_session_id |
Shopify | Maintain your browsing session | 24 hours |
secure_customer_sig |
Shopify | Keep you signed in to your account | 1 year |
checkout_token, _checkout_queue_token
|
Shopify | Secure and complete checkout | Varies |
shopify_client_id |
Shopify | Identify your browser session for site operation | 1 year |
_tracking_consent |
Shopify | Record your cookie preferences | 1 year |
returngo_customer_id, returngo_discount_code_*
|
ReturnGo | Operate our returns and exchanges portal | Session |
Analytics — requires your consent
Used to understand how our site is used so that we can improve it.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
_shopify_y |
Shopify | Distinguish visitors for analytics | 1 year |
_shopify_s |
Shopify | Track the current analytics session | 30 minutes |
_ga, _ga_*
|
Google Analytics | Distinguish visitors, maintain session state, and measure how our site and product listings are used | 2 years |
Marketing and advertising — requires your consent
Used to show you relevant advertising and to measure our marketing.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
_gcl_au |
Measure advertising conversions | 3 months | |
_fbp |
Meta | Identify your browser to deliver and measure advertising | 3 months |
__kla_id |
Klaviyo | Assign an identifier to your browser in order to record the products and pages you view, and to link that activity to your profile if you later subscribe or make a purchase | 2 years |
_shopify_sa_t, _shopify_sa_p
|
Shopify | Record marketing attribution for your visit | 30 minutes |
_landing_page, _orig_referrer
|
Shopify | Record how you arrived at our site | 2 weeks |
Durations shown are the providers' standard values and may vary. Cookie names and providers are current as of the date of this policy and are reviewed when we add or remove a service.