Privacy Policy

    Last updated: April 15, 2026

    This Privacy Policy describes how NYX Vape INC. ("NYX," "we," "us," or "our") collects, uses, discloses, and safeguards your personal information when you visit or make a purchase from www.nyxecigs.com or any of our physical retail locations. We comply with Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA) and the 10 fair information principles set out in Schedule 1 of that Act.

    1. What personal information we collect

    We collect the following categories of personal information for the purposes described in Section 2 below:

    • Identity and contact information — your name, shipping and billing address, email address, and phone number, collected when you create an account, place an order, or contact customer support.
    • Age verification information — your date of birth, and at the point of delivery a signature and confirmation that valid government-issued photo ID was presented showing you meet the legal age of majority for vaping products in your province or territory. See our Age Verification Policy for details on the IDs we accept and why.
    • Transaction information — products purchased, order totals, payment method (card type and last four digits only), and delivery preferences.
    • Account credentials — username and encrypted password, if you create a customer account.
    • Device and usage information — your IP address, browser type, device identifiers, and pages visited, collected automatically when you browse our website.
    • Marketing preferences — your opt-in/opt-out status for email and SMS communications.

    We do not collect sensitive personal information beyond the above, and we do not store full credit card numbers on our servers.

    2. Why we collect it (purposes)

    We collect and use your personal information only for the following specific purposes:

    • To process, fulfill, and deliver your orders, including age verification at delivery.
    • To communicate with you about your order (confirmations, shipping updates, delivery notifications, and customer support).
    • To verify your age and comply with Canada's Tobacco and Vaping Products Act (TVPA) and the applicable provincial vapour-product statute for your province or territory.
    • To process returns, refunds, and warranty claims.
    • To send marketing communications, but only where you have expressly opted in.
    • To detect and prevent fraud, secure our website, and comply with legal obligations.
    • To improve our products, services, and website experience using aggregated, de-identified data.

    We will not use your personal information for any new purpose without first obtaining your consent.

    3. Consent

    When you provide personal information to complete a transaction, verify your age, place an order, arrange for delivery, or return a purchase, you consent to our collecting and using that information for the purposes stated above. For secondary purposes such as marketing, we will ask for your express opt-in consent separately (for example, a checkbox at signup or checkout).

    You may withdraw your consent at any time. To withdraw consent for marketing communications, click the "unsubscribe" link in any marketing email, reply STOP to any marketing SMS, or contact us at privacy@nyxecigs.com. Our marketing communications comply with Canada's Anti-Spam Legislation (CASL) — each message identifies NYX as the sender, provides our contact information, and contains a working unsubscribe mechanism that is honoured within 10 business days. To withdraw consent for other collection or use of your information, contact our Privacy Officer using the details in Section 11 below. Withdrawing consent may prevent us from providing some services; for example, we cannot fulfill an order without the information necessary to verify age and arrange delivery.

    4. How long we keep your information (retention)

    We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods:

    • Order and transaction records — 6 years from the end of the tax year to which they relate, as required for business records under subsection 230(4) of Canada's Income Tax Act.
    • Age verification records — up to 2 years from the date of the transaction. Neither the federal Tobacco and Vaping Products Act nor the applicable provincial vapour-product statutes prescribe a specific retention period for retailer age-verification records, so this period reflects NYX's business practice of retaining enough detail to respond to a regulatory inquiry from Health Canada or a provincial public health authority, consistent with PIPEDA's principle of limiting retention to what is necessary.
    • Customer account information — while your account remains active. If you request account closure, we remove your account within 30 days except where we are legally required to retain specific records (for example, the order-and-transaction records described above).
    • Marketing lists — until you withdraw consent, after which we remove you within 10 business days.
    • Website analytics — aggregated data is retained up to 26 months; individual identifiers are de-identified as soon as practicable.

    5. Disclosure and third-party service providers

    We do not sell, rent, or trade your personal information. We disclose it only to trusted third-party service providers, and only to the extent necessary for them to perform services for us:

    • Shopify Inc. — e-commerce platform. Transaction data is handled in accordance with the Payment Card Industry Data Security Standard (PCI-DSS). See Shopify's Privacy Statement.
    • Payment gateways (e.g., Shopify Payments, PayPal) — to process payments. Full card numbers are tokenized and are not stored on our servers.
    • Shipping and delivery providers (e.g., Canada Post, Purolator, UberDirect) — receive only the information required to deliver your order and verify age at delivery.
    • Email and SMS platforms (e.g., Klaviyo, Shopify Email) — for transactional and, with your consent, marketing communications.
    • Analytics providers (e.g., Google Analytics, Meta Pixel) — in aggregated, pseudonymized form.
    • Legal and professional advisors — accountants, auditors, and legal counsel, bound by professional confidentiality obligations.

    We may also disclose personal information where required by law — for example, in response to a valid court order, subpoena, or lawful request from a Canadian law enforcement or regulatory authority.

    6. Cross-border transfers

    Some of our service providers are located outside Canada, including in the United States. When your personal information is processed in another jurisdiction, it may be subject to that jurisdiction's laws, including lawful access by foreign authorities. We use service providers that contractually commit to safeguarding personal information to a standard consistent with PIPEDA.

    7. Security

    We protect your personal information using administrative, technical, and physical safeguards appropriate to its sensitivity, including:

    • Transport Layer Security (TLS) encryption for data transmitted between your browser and our website and between us and our service providers.
    • PCI-DSS-compliant payment processing.
    • Access controls limiting employee access to personal information on a need-to-know basis.
    • Regular security reviews of our platform and third-party providers.

    No method of transmission over the internet or electronic storage is 100% secure. In the event of a privacy breach that creates a "real risk of significant harm" as defined in Section 10.1 of PIPEDA, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as soon as feasible, and will also notify any other organization or government institution that may be able to reduce or mitigate the harm, in accordance with Sections 10.1 and 10.2 of PIPEDA.

    8. Your rights

    Under PIPEDA, you have the right to:

    • Access the personal information we hold about you, including a description of how it is being used and to whom it has been disclosed. We will respond to a written access request within 30 days of receipt, or, where a lawful extension applies under Section 8(4) of PIPEDA, within an additional 30 days.
    • Challenge the accuracy and completeness of that information and request correction where appropriate.
    • Withdraw your consent for the collection, use, or disclosure of your personal information at any time, subject to legal and contractual restrictions and on reasonable notice.
    • File a complaint about how we handle your personal information, first with our Privacy Officer and, if not resolved, with the Office of the Privacy Commissioner of Canada.

    PIPEDA does not establish a general right of deletion or erasure. Where you ask us to remove information and we are not legally obliged to retain it (for example, marketing list entries), we will do so promptly. Where retention is required by law or necessary for ongoing services (for example, tax-record obligations under the Income Tax Act), we will explain why we cannot delete the information and for how long we will keep it.

    9. Cookies

    Our website uses cookies and similar technologies to operate core functions and improve your browsing experience. Categories of cookies:

    • Strictly necessary cookies — session tokens, cart contents, age-gate confirmation, and checkout-security cookies. These cannot be disabled without breaking the site.
    • Analytics cookies — aggregate usage statistics (for example, Google Analytics). You may opt out using browser extensions such as Google Analytics Opt-Out.
    • Marketing cookies — used for remarketing and advertising measurement, only where you have consented.

    You can manage cookies through your browser settings. Blocking strictly necessary cookies may prevent checkout and age verification from working.

    10. Age of majority

    Our products are intended only for adults of the legal age of majority for the purchase of vaping products in their province or territory of residence. The minimum age in Canada by jurisdiction is: 18 in Alberta, Manitoba, Northwest Territories, and Quebec; 19 in British Columbia, New Brunswick, Newfoundland and Labrador, Nova Scotia, Nunavut, Ontario, Saskatchewan, and Yukon; and 21 in Prince Edward Island. The federal minimum under the Tobacco and Vaping Products Act is 18. By using this site or purchasing from us, you confirm you meet the requirement for your province or territory. We do not knowingly collect personal information from anyone under the applicable age. If we discover we have collected information from an underage individual, we will delete it promptly.

    11. Contact our Privacy Officer

    If you have questions about this policy, would like to access or correct your personal information, wish to withdraw consent, or want to file a privacy complaint, contact our Privacy Officer:

    Privacy Officer
    NYX Vape INC.
    7800 Woodbine Avenue, Unit 107
    Markham, Ontario, Canada, L3R 2N7
    Email: privacy@nyxecigs.com

    If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

    12. Changes to this policy

    We may update this Privacy Policy from time to time. Material changes will be notified on this page with a revised "Last updated" date. We encourage you to review this policy periodically. If our business is acquired or merged, your personal information may be transferred to the successor entity under the same privacy protections.