Privacy Policy

Last updated: May 29, 2026.

This Privacy Policy explains how Provenance Luxury Inc. (“PROVENANCE”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal information when you visit, interact with, or make a purchase from provenance.shop (the “Site”) or use our services. It also describes the rights and choices available to you regarding your personal information. By using the Site, you acknowledge the practices described in this Policy.

Who we are

PROVENANCE is a Toronto-based luxury authentication, resale, and consignment business operating online at provenance.shop. For the purposes of applicable privacy legislation, PROVENANCE is the business responsible for the personal information it collects through the Site. Questions about this Policy or about our handling of personal information may be directed to our Privacy Officer at customercare@provenance.shop.

Personal information we collect

We collect the following categories of personal information:

• Device and usage information — when you visit the Site, we automatically collect information about your device and browsing activity, including your IP address, browser type and settings, time zone, operating system, referring and exit pages, the pages and products you view, and the dates and times of your interactions. We refer to this as “Device Information,” and we collect it using cookies, log files, web beacons, tags, and pixels.
• Order and account information — when you make or attempt to make a purchase, or create an account, we collect information you provide, including your name, billing address, shipping address, email address, telephone number, and payment information. Payment card details are processed by our payment providers; we do not store full payment card numbers on our own systems. We refer to this as “Order Information.”
• Communications and service information — when you contact us, request authentication, appraisal, sourcing, or consignment services, or correspond with us regarding an order, return, or dispute, we collect the information contained in those communications, including any images or documentation you submit.

In this Policy, “Personal Information” means both Device Information and Order Information, together with any other information described above that identifies or can reasonably be associated with you.

How we use your personal information

We use Personal Information to:

• Process, fulfill, and deliver your orders, including arranging shipping, handling customs and duties, and providing invoices and order confirmations;
• Provide authentication, appraisal, sourcing, consignment, and related services you request;
• Communicate with you about your orders, accounts, inquiries, returns, and disputes;
• Detect, investigate, and prevent fraud, chargeback abuse, and other unlawful or unauthorized activity, including by screening orders and analyzing Device Information such as IP address;
• Operate, maintain, improve, and secure the Site and our services, including through analytics;
• Comply with our legal, tax, accounting, and regulatory obligations, and to establish, exercise, or defend legal claims;
• Where permitted, send you marketing or promotional communications consistent with your preferences and applicable law. You may withdraw consent to marketing at any time using the unsubscribe link in our emails or by contacting us.

Legal bases and consent

We collect and use Personal Information where you have consented; where it is necessary to perform a contract with you (such as fulfilling an order); where it is necessary to comply with a legal obligation; or where it is necessary for our legitimate business interests, such as preventing fraud and securing our Site, provided those interests are not overridden by your rights. Where required by law, we obtain your consent before collecting, using, or disclosing your Personal Information, and you may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.

Cookies and tracking technologies

We use cookies and similar technologies to operate the Site, remember your preferences, analyze traffic, and support marketing. You can control or disable cookies through your browser settings; disabling certain cookies may affect Site functionality. For general information about cookies, visit allaboutcookies.org.

How we share personal information

We share Personal Information only as needed for the purposes described above, including with:

• Service providers who act on our behalf, including Shopify Inc., which powers our online store (see shopify.com/legal/privacy), payment processors, shipping and logistics partners, customs brokers, and analytics providers such as Google Analytics (see google.com/policies/privacy; opt out at tools.google.com/dlpage/gaoptout);
• Professional advisors such as accountants, auditors, and legal counsel, where necessary;
• Authorities and other parties where we believe in good faith that disclosure is required to comply with applicable law, a subpoena, warrant, or other lawful request, to enforce our agreements, or to protect our rights, property, or safety or those of others.

We do not sell your Personal Information for money. We do not share your Personal Information for cross-context behavioural advertising except through the analytics and advertising technologies described in this Policy, which in some jurisdictions may be considered a “sale” or “sharing.” You may exercise choices regarding this as described under “Your privacy rights” below.

Behavioural advertising

We may use your Personal Information to provide advertising or marketing we believe may interest you. You can learn about how targeted advertising works through the Network Advertising Initiative at networkadvertising.org, and opt out of certain services via the Digital Advertising Alliance at optout.aboutads.info, the Facebook ad settings, the Google ad settings, and the Bing ad settings.

International transfers

PROVENANCE operates from Canada and uses service providers located in Canada, the United States, and elsewhere. As a result, your Personal Information may be stored and processed outside your province, state, or country, including in jurisdictions whose data protection laws may differ from those of your own. Where required, we take steps to ensure your Personal Information receives an adequate level of protection in the jurisdictions in which it is processed.

Data retention

We retain Personal Information for as long as necessary to fulfill the purposes for which it was collected, including to provide our services, maintain business and transaction records, and comply with our legal, tax, accounting, and regulatory obligations. Because tax and corporate law require us to retain certain transaction records for multi-year periods, order information may be retained for the duration of those statutory periods even after an account is closed. When Personal Information is no longer required, we will delete or anonymize it. You may request deletion of your Personal Information as described below, subject to information we are required or permitted by law to retain.

Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect Personal Information against loss, theft, and unauthorized access, use, or disclosure, appropriate to the sensitivity of the information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your privacy rights

Depending on where you live, you may have some or all of the following rights regarding your Personal Information: the right to access the information we hold about you; to request correction of inaccurate or incomplete information; to request deletion; to withdraw consent; to request a copy of your information in a portable format; to object to or restrict certain processing; and to opt out of marketing and of any “sale” or “sharing” of Personal Information as defined by applicable law. To exercise any of these rights, contact us at customercare@provenance.shop. We will respond within the timeframe required by applicable law. We will not discriminate against you for exercising your rights. We may need to verify your identity before fulfilling a request.

Residents of Quebec and Canada

PROVENANCE complies with Quebec’s Act respecting the protection of personal information in the private sector (“Law 25”) and Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”). Our Privacy Officer is responsible for our handling of personal information and may be reached at customercare@provenance.shop. Quebec residents have the right to access and correct their personal information, to withdraw consent, to request that we cease disseminating their information or de-index certain information in defined circumstances, and to data portability. If you are not satisfied with our response, you may contact the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada.

Residents of California

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), California residents have the right to know what Personal Information we collect, use, and disclose; to request access to and deletion of that information; to correct inaccurate information; to opt out of the “sale” or “sharing” of Personal Information and of targeted advertising; and to limit the use of sensitive Personal Information. We do not sell Personal Information for money, and we honor recognized opt-out preference signals, including Global Privacy Control, where required. To exercise these rights, contact us at customercare@provenance.shop. You may use an authorized agent to submit a request on your behalf, subject to verification.

Global Privacy Control and Do Not Track

Some browsers offer a “Do Not Track” signal. There is no common industry standard for responding to Do Not Track, and our practices for those signals may vary. Where required by law, however, we honor recognized opt-out preference signals such as Global Privacy Control as a valid request to opt out of the sale or sharing of Personal Information for the browser or device from which the signal is sent.

Children’s privacy

The Site is intended for individuals who are at least the age of majority in their jurisdiction and is not directed to children under 18. We do not knowingly collect Personal Information from children under 18. If you believe a child has provided us Personal Information, contact us and we will take appropriate steps to delete it.

Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will post the updated Policy on this page with a revised “Last updated” date. Your continued use of the Site after changes take effect constitutes acknowledgment of the updated Policy.

Contact us

For questions, requests, or complaints regarding this Privacy Policy or our handling of Personal Information, contact our Privacy Officer by email at customercare@provenance.shop.