Privacy Policy

The data controller responsible for your personal information is Chloé Desormeaux / MTD, a business operating out of Montréal, Québec, Canada. We operate the website chloemtd.com and provide related products and digital content including apparel, training plans, and community resources related to mountain biking and enduro riding. When this Privacy Policy refers to "we," "us," or "our," it refers to this business entity. Any questions regarding our identity as a data controller, or about this Privacy Policy more broadly, can be directed to us via the contact form.

We collect several categories of information depending on how you interact with our Site and Services. The types of information we may collect include, but are not limited to, the following:

2.1 Information you provide directly to us:

• Account registration: When you create an account on our Site, we collect your full name, email address, username, and password (stored in encrypted form). You may also optionally provide a profile photo, bio, or social media handles.
• Purchase information: When you place an order, we collect your billing name, billing address, shipping address, phone number, email address, and payment information. Payment card details are transmitted directly to and processed by our payment processor (Stripe, Inc.) and are never stored on our servers. We retain only a tokenized reference and the last four digits of your card for your records.
• Communications: Any messages, inquiries, feedback, or support requests you send us via email, contact forms, or social media direct messages. This includes the content of those communications and any attachments you provide.
• Newsletter and marketing subscriptions: Your email address and, where provided, your name and communication preferences when you subscribe to our newsletter, "The Rider's Dispatch."
• User-generated content: Reviews, ratings, comments, photos, or other content you submit to our Site or tag us in on social media platforms.
• Contest and giveaway entries: If you participate in any contests, sweepstakes, or giveaways we run, we may collect your name, email, social media handles, and any other information required for entry or prize fulfilment.

2.2 Information collected automatically:

• Log and usage data: When you visit our Site, our servers automatically record information including your IP address, browser type and version, operating system, referring URLs, pages visited, time and date of your visit, time spent on pages, links clicked, and other diagnostic data.
• Cookies and tracking technologies: We use cookies, pixel tags, web beacons, local storage, and similar tracking technologies to collect information about your browsing behaviour, preferences, and interactions with our Site. See Section 6 for a detailed breakdown of the cookies we use.
• Device information: Hardware model, device identifiers, operating system and version, mobile network information, screen resolution, and language settings.
• Location data: General geographic location derived from your IP address (country, region, city). We do not collect precise GPS location data unless you explicitly grant permission.
• E-commerce behaviour: Products viewed, added to cart, wishlisted, purchased, or abandoned, as well as search queries made on our Site.

2.3 Information from third parties:

• If you connect a social media account (Instagram, TikTok, YouTube) to our Site or log in via a third-party authentication provider, we may receive your public profile information, email address, and any other data you have authorised that provider to share with us.
• We may receive information about you from analytics providers, advertising networks, and payment processors to help us improve our services, prevent fraud, and understand how customers discover our products.

We use the information we collect for the following purposes, relying on the legal bases noted where applicable under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where relevant, the EU General Data Protection Regulation (GDPR):

3.1 To provide and fulfil our services (contractual necessity):

• Process, fulfil, and ship your orders, including sending order confirmations, shipping notifications, and delivery updates
• Manage your account and provide customer support
• Deliver digital products (training plans, ebooks, presets) electronically to your registered email or account
• Process returns, exchanges, and refunds in accordance with our Return Policy
• Communicate with you about your orders, account, or any purchases you have made

3.2 For legitimate business interests:

• Analyse usage patterns and purchase behaviour to improve our website, product offerings, and overall customer experience
• Conduct internal analytics, reporting, and business planning
• Detect, prevent, and investigate fraudulent transactions, chargebacks, and other illegal or unauthorised activities
• Monitor and enforce our Terms and Conditions and other applicable policies
• Maintain the security, integrity, and functionality of our Site and systems
• Train and evaluate our internal processes and customer service operations

3.3 With your consent (marketing and optional communications):

• Send you marketing emails, newsletters, promotional offers, and updates about new products, events, or content — only if you have opted in
• Personalise your experience on our Site and display products or content we think may be relevant to you
• Deliver targeted advertising on third-party platforms such as Instagram, Facebook, and Google, based on your browsing and purchase history, where you have not opted out of such tracking
• Contact you regarding user research, surveys, or feedback requests

3.4 To comply with legal obligations:

• Retain transaction records for a minimum of 7 years as required under Canadian tax and accounting law
• Respond to lawful requests from regulatory authorities, courts, or law enforcement agencies
• Comply with applicable consumer protection, privacy, and e-commerce legislation

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We may share your information in the following limited circumstances:

• Service providers and vendors: We share data with trusted third-party companies that assist us in operating our business, including payment processors (Stripe), shipping and fulfilment carriers (Canada Post, UPS, FedEx), email marketing platforms, cloud hosting providers, analytics tools (Google Analytics, Vercel Analytics), customer support software, and tax compliance services. All such providers are bound by data processing agreements and are prohibited from using your data for their own purposes beyond what is required to provide services to us.
• Advertising and retargeting partners: With your consent (or where permitted by applicable law), we may share limited identifiers (such as hashed email addresses or pixel data) with advertising platforms including Meta (Instagram/Facebook), Google, and TikTok to enable targeted advertising and lookalike audience features.
• Legal and compliance disclosures: We may disclose your personal information where required by law or legal process, including in response to a subpoena, court order, governmental request, or to protect the rights, property, or safety of our business, our customers, or the general public.
• Business transfers: If we are involved in a merger, acquisition, sale of assets, financing, or corporate restructuring, your personal information may be transferred as part of that transaction. We will provide notice and, where required by law, seek your consent before any such transfer occurs.
• With your consent: We may share your information with other third parties in any other circumstances where you have provided your explicit prior consent.

We retain your personal information for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Specific retention periods include:

• Account data: Retained for as long as your account remains active, plus a reasonable period thereafter to allow for account reactivation, dispute resolution, or legal hold requirements. If you request deletion of your account, we will remove your personal data within 30 days, subject to exceptions below.
• Order and transaction records: Retained for a minimum of 7 years following the date of transaction as required under the Canada Revenue Agency guidelines and applicable provincial tax legislation.
• Marketing and newsletter data: Retained until you unsubscribe or withdraw consent, at which point we will suppress your contact information from future communications. We may retain a record of your opt-out indefinitely to ensure compliance.
• Support and communications: Retained for up to 3 years following the resolution of a support inquiry to enable continuity of service and dispute resolution.
• Log and analytics data: Typically retained for 14 to 26 months, depending on the analytics provider and applicable data minimisation policies.

When personal information is no longer needed, it is either securely deleted or anonymised so that it can no longer be associated with you.

We use cookies and similar technologies to enhance your experience, understand Site usage, and deliver relevant advertising. A cookie is a small text file stored on your device when you visit our Site. You can control cookies through your browser settings at any time, though disabling certain cookies may affect functionality.

The specific categories of cookies we use are:

• Strictly necessary cookies: Required for the Site to function. These include session management cookies, shopping cart persistence, authentication tokens, and fraud prevention identifiers. These cannot be disabled without affecting your ability to use the Site.
• Functional cookies: Remember your preferences such as language, currency, recently viewed products, and saved addresses to personalise your experience across visits.
• Analytics cookies: Collect aggregate, anonymised data about how visitors interact with our Site — pages viewed, time spent, traffic sources, and conversion events. We use Google Analytics 4 and Vercel Analytics for this purpose. Data is not linked to your identity.
• Marketing and advertising cookies: Track browsing behaviour across sites and sessions to deliver personalised advertising on third-party platforms (Meta, Google, TikTok). These include the Meta Pixel, Google Ads conversion tags, and TikTok Pixel.
• Third-party cookies: Set directly by our partners and service providers (e.g., Stripe for fraud prevention, Google for reCAPTCHA). We do not control these cookies and encourage you to review the relevant third-party privacy policies.

You may opt out of analytics cookies by installing the Google Analytics Opt-out Browser Add-on. You may opt out of interest-based advertising through the Digital Advertising Alliance of Canada or equivalent opt-out mechanisms in your region.

Depending on your location, you may have certain rights regarding your personal information under applicable privacy laws including Canada's PIPEDA, Québec's Law 25 (Bill 64), and the EU/UK GDPR. These rights may include:

• Right of access: You have the right to request a copy of the personal information we hold about you, including information about how it is used and with whom it has been shared.
• Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data in certain circumstances, subject to our legal obligations to retain certain records (e.g., transaction history for tax purposes).
• Right to restrict processing: You may request that we limit the processing of your personal data in certain circumstances, such as while we verify the accuracy of data you have contested.
• Right to data portability: Where technically feasible, you may request a copy of your personal data in a structured, commonly used, machine-readable format for transfer to another controller.
• Right to object: You have the right to object at any time to the processing of your personal data for direct marketing purposes. You may also object to processing based on our legitimate interests where you believe those interests are overridden by your rights and freedoms.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to opt out of marketing: You may unsubscribe from marketing emails at any time by clicking the "unsubscribe" link at the bottom of any email we send, or by contacting us directly. Please allow up to 10 business days for your request to take effect.

To exercise any of these rights, please contact us via the contact form. We will respond to all legitimate requests within 30 days. We may need to verify your identity before fulfilling your request. If you are unsatisfied with our response, you have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) or, if you are located in Québec, the Commission d'accès à l'information (CAI).

Our business operates out of Canada. If you are accessing our Site from outside Canada, your personal information may be transferred to, stored, and processed in Canada or other jurisdictions where our service providers operate, including the United States. These jurisdictions may have different data protection laws than your country of residence.

Where we transfer personal data internationally, we take steps to ensure appropriate safeguards are in place, such as:

• Using service providers that have committed to data protection standards comparable to or exceeding those required under Canadian and applicable international law
• Executing data processing agreements with sub-processors that include standard contractual clauses where required
• Relying on adequacy decisions issued by relevant supervisory authorities where applicable

By using our Site, you acknowledge and consent to the transfer of your information to Canada and other jurisdictions as described in this policy.

Our Site contains links to third-party websites including social media platforms (Instagram, YouTube, TikTok), external retailers, sponsors, and other content providers. Clicking on these links will take you away from our Site and into environments governed by separate privacy policies. We are not responsible for the content, privacy practices, or data collection activities of any third-party websites and strongly encourage you to review their respective privacy policies before providing any personal information.

Our Site may also embed content from third parties (e.g., YouTube video embeds, Instagram feed widgets). Viewing embedded content is equivalent to visiting those third-party websites, and those providers may collect data about your interaction with their embedded content, use cookies, and track your activity, even if you do not have an account with them.

Our Services are not directed to, and we do not knowingly collect personal information from, individuals under the age of 13. If we become aware that we have inadvertently collected personal information from a child under 13 without appropriate parental consent, we will take steps to delete that information as promptly as possible. If you are a parent or guardian and believe that your child has provided personal information to us, please contact us immediately via the contact form.

Users between the ages of 13 and 18 should review this Privacy Policy with a parent or guardian before creating an account or making a purchase. We may require parental consent for marketing communications directed to users under 16, in accordance with Québec privacy law.

We take the security of your personal information seriously and implement a range of technical and organisational safeguards to protect it against unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your browser and our servers
• Secure, PCI-DSS-compliant payment processing via Stripe — we never store full payment card numbers on our systems
• Access controls limiting employee access to personal data on a need-to-know basis
• Secure, encrypted storage of passwords using industry-standard hashing algorithms
• Regular security assessments and monitoring of our infrastructure
• Firebase Authentication and Firestore security rules governing data access at the database level

Despite these measures, no method of data transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security of your information. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and relevant authorities as required by applicable law, within the timeframes prescribed by PIPEDA, Québec Law 25, or other applicable legislation.

We do not currently make any decisions about you that have significant legal or similarly significant effects based solely on automated processing of your personal data. We do use automated tools to personalise product recommendations and email content based on your browsing and purchase history, but these do not produce binding decisions affecting your legal rights or access to our Services. If this practice changes, we will update this policy accordingly and provide any required opt-out mechanisms.

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our practices, legal obligations, or operational needs. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where required or appropriate, by sending an email notification to the address associated with your account. We may also display a notice on our Site for a reasonable period following any significant update.

Your continued use of our Site and Services following the posting of any changes to this Privacy Policy constitutes your acceptance of those changes. If you do not agree with a revised policy, you should stop using our Services and may request deletion of your account and personal data.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Prior versions of this policy are available upon request.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If you feel we have not adequately addressed your concern, you have the right to contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or the Commission d'accès à l'information du Québec at www.cai.gouv.qc.ca.