Effective Date: July 20, 2026
Last Updated: July 20, 2026
1. Introduction
This Privacy Policy explains how NativaFiber collects, uses, discloses, stores, and protects personal information when individuals in Canada:
- visit nativafiber.com or a Canadian version of our website;
- create or use a customer account;
- place an order;
- purchase or redeem a gift card;
- subscribe to marketing communications;
- contact customer service;
- submit an inquiry, review, photograph, or other content;
- interact with our advertising; or
- otherwise use our products, services, or website features.
NativaFiber is a trade name operated by:
Legal operator: Svitlana Bodanova Legal form: Austrian sole proprietorship Business address: Längdorfer Straße, 30, St.Jakob im Rosental, 9184, Austria, AUSTRIA
Privacy Officer: Svitlana Bodanova
In this Privacy Policy, “NativaFiber,” “we,” “us,” and “our” refer to the legal operator identified above.
NativaFiber sells blankets, throws, and related home textile products made primarily from wool and other natural fibers.
2. Accountability
NativaFiber is responsible for personal information under its control.
The legal operator of NativaFiber acts as the person responsible for privacy compliance unless that responsibility is formally delegated to another person.
Our Privacy Officer is responsible for:
- overseeing this Privacy Policy;
- receiving privacy questions and complaints;
- processing access and correction requests;
- managing consent and withdrawal requests;
- reviewing privacy incidents;
- overseeing service providers; and
- maintaining NativaFiber’s privacy management practices.
Contact details for the Privacy Officer are provided in Section 23.
3. Application of Canadian and European Privacy Laws
Depending on the circumstances, personal information relating to Canadian customers may be governed by:
- the Personal Information Protection and Electronic Documents Act;
- Alberta’s Personal Information Protection Act;
- British Columbia’s Personal Information Protection Act;
- Quebec’s Act respecting the protection of personal information in the private sector;
- Canada’s Anti-Spam Legislation; and
- other applicable federal or provincial laws.
Because NativaFiber is operated from Austria, the General Data Protection Regulation also applies to NativaFiber’s processing activities.
Where more than one law applies, we intend to apply the protections required by the applicable laws.
4. Meaning of Personal Information
“Personal information” generally means information about an identifiable individual.
- information that directly identifies a person;
- information that identifies a person when combined with other information;
- factual information;
- subjective information;
- technical identifiers connected with a person or device; and
- inferences about an identifiable person.
Information that has been irreversibly anonymized so that it can no longer be associated with an identifiable individual is not treated as personal information to the extent permitted by law.
5. Personal Information We Collect
The information we collect depends on how you interact with NativaFiber.
5.1 Identity and contact information
- first and last name;
- email address;
- telephone number;
- billing address;
- shipping address;
- province or territory;
- city;
- postal code;
- country;
- customer number; and
- information identifying an authorized recipient.
5.2 Account information
If you create an account, we may collect:
- email address;
- account credentials;
- saved addresses;
- order history;
- saved products or wish lists;
- language and market preferences;
- communication preferences; and
- account activity.
5.3 Purchase and transaction information
When you place an order, purchase a gift card, request a return, or receive a refund, we may collect:
- products ordered;
- quantities and prices;
- product variants;
- discount or promotional codes;
- gift card details;
- order number;
- billing and shipping information;
- shipping method;
- delivery tracking;
- payment status;
- return reason;
- refund information;
- customs-related information; and
- communications relating to the transaction.
5.4 Payment information
Payments may be processed by third-party payment providers such as Stripe or another provider identified during checkout.
The payment provider may collect:
- payment card number;
- expiration date;
- security code;
- billing details;
- bank or wallet information;
- authentication information; and
- fraud-prevention information.
NativaFiber generally does not receive or store the complete card number or security code.
- payment method;
- card brand;
- last four card digits;
- payment status;
- transaction identifier; and
- authentication or fraud-check results.
The payment provider processes payment data according to its own privacy policy and contractual obligations.
5.5 Customer service information
When you communicate with us, we may collect:
- your message;
- contact information;
- order or account details;
- photographs or documents you provide;
- chat or email history;
- complaint information;
- information about damaged, returned, delayed, or missing products; and
- any other information you voluntarily provide.
Please do not send unnecessary sensitive information through ordinary email or chat.
5.6 Reviews and submitted content
Where reviews or similar features are available, we may collect:
- display name;
- review text;
- rating;
- photographs or videos;
- product information; and
- information about whether the reviewer purchased the product.
Information submitted for publication may be visible to other website visitors.
5.7 Technical and website information
Our systems and service providers may automatically collect:
- IP address;
- browser type and version;
- device type;
- operating system;
- language;
- time zone;
- approximate location derived from an IP address;
- device or advertising identifiers;
- referring website or campaign;
- pages viewed;
- links and buttons used;
- session duration;
- shopping cart activity;
- checkout activity;
- error records;
- server logs; and
- security or fraud signals.
5.8 Marketing information
Subject to applicable law and your choices, we may collect:
- marketing consent;
- newsletter subscription status;
- consent date and source;
- email engagement information;
- products viewed;
- cart activity;
- advertising interactions;
- campaign source; and
- inferred product interests.
5.9 Wholesale and business inquiries
If you contact us regarding wholesale purchasing, manufacturing, partnerships, or another business relationship, we may collect:
- name;
- professional contact details;
- company name;
- job title;
- business address;
- business registration or tax details;
- expected order volume;
- product specifications; and
- the contents of the inquiry.
6. How We Collect Personal Information
We may collect personal information:
- Directly from you, including through checkout, accounts, forms, customer support, reviews, email, and privacy requests.
- Automatically, through cookies, local storage, server logs, analytics technologies, advertising technologies, and security tools.
- From service providers, including payment providers, shipping carriers, customer support providers, fraud-prevention providers, and infrastructure providers.
- From advertising or analytics providers, where the applicable technology is permitted by your choices.
- From another person, such as when someone sends you a gift or identifies you as an order recipient.
7. Purposes for Which We Use Personal Information
We identify the purposes of collection at or before the time personal information is collected, unless otherwise permitted by law.
We may use personal information for the following purposes.
7.1 Orders and delivery
- process purchases;
- verify payment;
- issue order confirmations, invoices, and receipts;
- prepare and ship products;
- provide tracking;
- complete customs documentation;
- communicate about delivery;
- process returns and refunds; and
- resolve transaction-related issues.
7.2 Customer accounts
- create and maintain accounts;
- authenticate customers;
- save addresses and preferences;
- provide order history;
- prevent unauthorized access; and
- respond to account requests.
7.3 Customer support
- answer questions;
- investigate complaints;
- resolve delivery or product issues;
- process warranty, refund, and return requests; and
- maintain records of customer service outcomes.
7.4 Website operation
- display website content;
- maintain cart and checkout functions;
- remember preferences;
- detect errors;
- maintain security;
- understand basic website use; and
- improve website functionality.
7.5 Security and fraud prevention
- authenticate transactions;
- prevent fraudulent payments;
- detect unauthorized activity;
- protect accounts;
- investigate security incidents;
- enforce our terms; and
- protect customers, NativaFiber, and service providers.
7.6 Analytics and improvement
Where permitted, we may use information to:
- measure website traffic;
- understand navigation;
- identify technical problems;
- evaluate product and content interest;
- improve website design; and
- measure business performance.
7.7 Marketing
Subject to consent and other applicable legal requirements, we may use information to:
- send newsletters;
- announce products;
- send promotional offers;
- provide permitted cart reminders;
- personalize communications;
- measure campaigns; and
- display advertising.
7.8 Legal and administrative purposes
We may use information to:
- comply with tax and accounting obligations;
- comply with customs requirements;
- maintain legally required records;
- respond to lawful requests;
- prevent or investigate unlawful conduct;
- establish, exercise, or defend legal claims;
- enforce agreements;
- complete audits; and
- administer a sale, reorganization, financing, or transfer of the business.
8. Consent
Where consent is required, we seek consent that is appropriate to:
- the sensitivity of the information;
- the reasonable expectations of the individual;
- the purpose of processing; and
- the consequences of the processing.
Depending on the circumstances, consent may be:
- express;
- implied where legally permitted; or
- provided through an authorized representative.
We distinguish processing necessary to provide a requested product or service from optional processing such as marketing or advertising.
8.1 Information required to complete an order
Certain information is necessary to:
- process payment;
- deliver the order;
- comply with tax or customs requirements;
- prevent fraud; and
- communicate about the transaction.
If you do not provide the required information, we may be unable to complete the transaction.
8.2 Optional information
You may decline optional processing, such as:
- marketing subscriptions;
- analytics cookies;
- advertising cookies; and
- optional personalization.
Declining optional processing will not prevent you from purchasing products, although some optional website features may be unavailable.
8.3 Withdrawing consent
You may withdraw consent at any time, subject to:
- legal requirements;
- contractual restrictions;
- reasonable notice; and
- information that must be retained to complete a transaction or defend a legal claim.
Withdrawal does not invalidate processing completed before the withdrawal.
We will explain material consequences of withdrawing consent where appropriate.
9. Cookies and Similar Technologies
Our website may use cookies, local storage, pixels, tags, and similar technologies.
9.1 Essential technologies
Essential technologies may support:
- website security;
- session management;
- shopping cart functions;
- checkout;
- account authentication;
- language and currency settings;
- fraud prevention; and
- storage of privacy preferences.
These technologies are required for the website to function.
9.2 Preference technologies
Preference technologies may remember:
- language;
- country or market;
- currency;
- display settings; and
- previously selected options.
9.3 Analytics technologies
With consent where required, analytics technologies may collect:
- pages viewed;
- navigation paths;
- traffic source;
- device category;
- approximate location;
- interaction data;
- website errors; and
- aggregate performance information.
9.4 Advertising and profiling technologies
With consent where required, advertising technologies may:
- recognize a browser or device;
- measure advertisements;
- create advertising audiences;
- associate website activity with advertising campaigns;
- infer general product interests; and
- display advertisements based on prior activity.
For purposes of Quebec privacy law, these technologies may constitute profiling because they may be used to infer interests or preferences.
Advertising and analytics technologies are not activated unless enabled in accordance with your privacy choices and applicable law.
You may manage them through:
You can change your choices at any time by selecting “Cookie Settings” in the footer. This option opens the cookie management panel.
10. Disclosure of Personal Information
We may disclose personal information to the following categories of recipients.
10.1 E-commerce and infrastructure providers
- hosting;
- content delivery;
- e-commerce functionality;
- account management;
- checkout;
- databases;
- backups;
- security;
- technical monitoring; and
- website performance.
These may include Saleor, Cloudflare, hosting providers, and related technical providers.
10.2 Payment providers
Payment information may be disclosed to:
- Stripe or another payment provider;
- banks;
- card networks;
- wallet providers;
- payment authentication services; and
- fraud-prevention providers.
10.3 Shipping and fulfillment providers
Delivery information may be disclosed to:
- postal operators;
- couriers;
- freight providers;
- fulfillment partners;
- customs brokers; and
- customs and import authorities.
10.4 Communications and customer service providers
We may use providers supporting:
- transactional email;
- newsletters;
- customer support;
- chat;
- contact forms; and
- customer relationship management.
10.5 Analytics and advertising providers
Where permitted by your choices, we may disclose:
- technical identifiers;
- device and browser information;
- website activity;
- campaign information;
- approximate location; and
- inferred interests
to analytics, measurement, advertising, search, or social media providers.
10.6 Professional advisers
Information may be disclosed to:
- accountants;
- tax advisers;
- lawyers;
- auditors;
- insurers; and
- other professional advisers.
10.7 Legal and government recipients
We may disclose information where reasonably necessary to:
- comply with law;
- respond to a legally binding request;
- protect rights or safety;
- investigate fraud or security incidents;
- enforce agreements; or
- establish or defend a legal claim.
10.8 Business transfers
Information may be disclosed in connection with a proposed or completed:
- sale;
- merger;
- reorganization;
- financing;
- transfer of assets; or
- succession of the business.
The information remains subject to applicable privacy protections.
11. Service Providers
We may use service providers to process personal information on our behalf.
We require service providers, as appropriate, to:
- process information only for authorized purposes;
- implement appropriate safeguards;
- limit access;
- maintain confidentiality;
- notify us of relevant security incidents;
- assist with privacy requests where required; and
- delete or return information at the end of the service relationship, subject to legal requirements.
Some providers may also act independently for specific activities. For example, payment providers and shipping carriers may process certain information under their own legal obligations and privacy policies.
12. International and Cross-Border Processing
NativaFiber is operated from Austria. Personal information relating to Canadian customers may therefore be transferred to and processed in:
- Austria;
- other countries in the European Economic Area;
- Canada;
- the United States; and
- other countries where service providers operate.
Information processed outside Canada may be accessible to courts, law enforcement, national security authorities, or other government authorities under the laws of the country where it is processed.
NativaFiber remains responsible for personal information transferred to a service provider for processing to the extent required by applicable law.
We use contractual, organizational, and technical measures appropriate to the transfer. Where required under European data protection law, we may use:
- adequacy decisions;
- Standard Contractual Clauses;
- contractual safeguards;
- technical safeguards; or
- another legally recognized transfer mechanism.
You may contact the Privacy Officer for information about our use of service providers outside Canada.
13. Retention and Destruction
We retain personal information only for as long as necessary to:
- fulfil the identified purposes;
- provide requested products and services;
- comply with legal obligations;
- resolve disputes;
- prevent fraud;
- maintain security; and
- establish or defend legal claims.
Our typical retention criteria are:
When personal information is no longer required, we:
- delete it;
- securely destroy it;
- irreversibly anonymize it; or
- isolate it from ordinary use until deletion from backups is completed.
14. Safeguards
We use technical, organizational, and contractual safeguards appropriate to:
- the sensitivity of the information;
- the amount of information;
- the format in which it is stored;
- the risks involved; and
- the purpose of processing.
- access controls;
- authentication;
- encryption in transit;
- administrative access restrictions;
- logging and monitoring;
- backups;
- fraud-prevention tools;
- software updates;
- data minimization;
- confidentiality obligations; and
- service-provider data protection terms.
No electronic system is completely secure. You are responsible for protecting your account credentials and notifying us if you suspect unauthorized access.
15. Privacy Incidents
We maintain procedures for assessing and responding to unauthorized access, use, loss, or disclosure of personal information.
Where required by applicable law, we will:
- investigate the incident;
- take steps to contain and remediate it;
- assess the risk of harm;
- notify affected individuals;
- notify the appropriate privacy regulator;
- notify another organization capable of reducing harm; and
- maintain required incident records.
16. Access and Correction
Subject to applicable law, you may request:
- confirmation of whether we hold personal information about you;
- access to your personal information;
- information about how it has been used;
- information about organizations to which it has been disclosed;
- correction of inaccurate information; and
- completion of incomplete information.
Requests should be submitted in writing to the Privacy Officer.
We may request information reasonably necessary to verify your identity.
Where PIPEDA applies, we generally respond within 30 days unless a legally permitted extension is necessary.
Access may be restricted where permitted or required by law, including where disclosure would:
- reveal another person’s personal information;
- reveal confidential commercial information;
- threaten another person’s safety;
- interfere with an investigation;
- disclose legally privileged information; or
- be prohibited by law.
If we refuse access or correction, we will explain the reason where legally permitted and provide information about available complaint procedures.
17. Data Portability
Where required by applicable law and where technically feasible, you may request that computerized personal information collected directly from you be provided:
- in a structured and commonly used technological format; or
- to another person or organization authorized by you.
This right is subject to legal exceptions and does not require us to disclose information that would create serious practical difficulties or affect another person’s rights.
18. Quebec Privacy Rights
If Quebec privacy law applies, you may have rights to:
- access personal information;
- correct inaccurate, incomplete, or ambiguous information;
- withdraw consent, subject to legal and contractual restrictions;
- request information about the use and disclosure of personal information;
- request data portability where applicable;
- request that dissemination of personal information cease in circumstances provided by law;
- request de-indexation or re-indexation of certain information in circumstances provided by law;
- submit observations concerning a decision based exclusively on automated processing, if such processing is used; and
- file a complaint with the Commission d’accès à l’information du Québec.
Requests should be directed to the person responsible for the protection of personal information identified in Section 23.
19. Profiling, Identification, and Location Technologies
Our website may use technologies that:
- identify a browser or device;
- establish an approximate location from an IP address;
- analyze website activity; or
- infer general product interests.
Essential technologies are activated where necessary for the website.
Analytics and advertising technologies are activated only in accordance with your consent and applicable privacy settings.
You can activate or deactivate optional technologies through:
You can change your choices at any time by selecting “Cookie Settings” in the footer. This option opens the cookie management panel.
We do not use profiling to make solely automated decisions that produce legal or similarly significant effects concerning customers.
20. Marketing Communications and CASL
We send commercial electronic messages only where permitted by applicable law.
Depending on the circumstances, we may rely on:
- express consent;
- a legally recognized implied consent;
- an existing business relationship; or
- another applicable exception.
Marketing messages identify NativaFiber and include an unsubscribe mechanism.
- selecting the unsubscribe link in an email;
- updating account preferences, where available; or
- contacting [email protected].
We will process unsubscribe requests within the period required by law.
We may retain a suppression record to ensure that we continue to respect your request.
Unsubscribing from marketing does not stop non-promotional messages relating to:
- an order;
- delivery;
- payment;
- refund;
- account security;
- customer support;
- a privacy request; or
- another transactional or legally required matter.
21. Children and Minors
Our website is intended for a general adult audience and is not directed to children.
We do not knowingly collect personal information directly from children under 13 without legally valid authorization.
For individuals in Quebec, personal information concerning a minor under 14 will not knowingly be collected directly from that minor without the consent of the person having parental authority or the tutor, unless the collection is clearly for the minor’s benefit and is otherwise permitted by law.
Persons under the age of majority in their province or territory should use the website with the involvement of a parent or legal guardian.
If you believe a child has provided personal information without appropriate authorization, contact [email protected].
22. European Data Protection Rights
Because NativaFiber is established in Austria, you may also have rights under the GDPR, including:
- access;
- rectification;
- erasure;
- restriction of processing;
- data portability;
- objection to processing based on legitimate interests;
- objection to direct marketing;
- withdrawal of consent; and
- the right to lodge a complaint with a competent data protection authority.
The competent supervisory authority for the Austrian operator is generally:
Austrian Data Protection AuthorityÖsterreichische Datenschutzbehörde
The exercise of a right is subject to applicable conditions and exceptions.
23. Contacting the Privacy Officer
Questions, complaints, consent withdrawals, and privacy requests may be submitted in writing to:
Privacy Officer — NativaFiber. Operated by: Svitlana Bodanova, Längdorfer Straße, 30, St.Jakob im Rosental, 9184, Austria
Please write “Privacy Request — Canada” in the subject line and provide sufficient information for us to understand and process your request.
We may request additional information where reasonably necessary to verify your identity or confirm that another person is authorized to act on your behalf.
We will investigate privacy complaints and respond within the period required by applicable law.
If you are not satisfied with our response, you may contact the privacy regulator applicable to your location or circumstances, which may include:
- the Office of the Privacy Commissioner of Canada;
- the Office of the Information and Privacy Commissioner of Alberta;
- the Office of the Information and Privacy Commissioner for British Columbia; or
- the Commission d’accès à l’information du Québec.
24. French Version
A French version of this Privacy Policy is available at:
If the Canadian website is offered to customers in Quebec, the French version should be presented and made available under conditions equivalent to the English version.
25. Changes to This Privacy Policy
We may update this Privacy Policy when:
- our products or website features change;
- our service providers change;
- we introduce a new use of personal information;
- applicable law changes; or
- we improve our privacy practices.
The current version will be posted on this page with an updated “Last Updated” date.
Where a material change affects previously collected personal information, we will provide additional notice or obtain consent where required.
