PRIVACY POLICY
Last updated: August 2026
This Privacy Policy explains how we collect, use, and share your personal information when you visit or make a purchase from harrygeorge.co (the "Site").
Harry George is a brand of MHG Group Inc., a company incorporated in Quebec, Canada. In this policy, "we", "us", and "our" mean MHG Group Inc.
We keep this policy short and plain. If anything is unclear, email us at privacy@harrygeorge.co and we'll explain it.
1. Information we collect
Information you give us
What & Why we collect it
Name, email address, phone number
To process your order, send confirmations, and answer questions
Shipping and billing address
To deliver your order and calculate taxes and duties
Payment details
To take payment. Card numbers are entered directly with our payment processor and are never stored on our servers
Account details (email, password, saved addresses, order history)
To let you sign in, track orders, and check out faster
Marketing preferences
To send you email or SMS only if you've asked us to
Returns, exchanges, and support messages
To resolve your request
Information we collect automatically
When you visit the Site, we collect device and usage information: IP address, browser type and version, operating system, device type, time zone, referring page, the pages and products you view, search terms, and how you move through the Site. We collect this using cookies, log files, and similar technologies.
We use this to load the Site correctly, keep it secure, understand how it's used, and improve it.
2. Where your information goes
We don't sell your personal information. We share it only with the service providers we need to run the business, and only for the purposes described here.
Our store runs on Medusa, an open-source commerce platform that we host ourselves. Unlike a hosted platform, Medusa isn't a company that receives your data — your order data sits in our own database. The providers we rely on cover hosting, payment processing, email and SMS, shipping, analytics, and advertising.
We may also disclose your information where we're legally required to — to comply with applicable law, respond to a lawful request from an authority, or to establish, exercise, or defend legal claims.
3. Transfers outside Quebec
We're based in Canada, and your information is processed here. Some of our providers process it in the United States and the European Union.
Before any transfer of personal information outside Quebec, we carry out a privacy impact assessment to confirm that the information will receive adequate protection, as required under Law 25.
Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses (or the UK equivalent), together with our providers' own safeguards.
4. Marketing
We send marketing email and SMS only with your consent. Every message includes an unsubscribe link, and you can opt out at any time by clicking it or emailing us. Opting out of marketing doesn't stop transactional messages like order confirmations and shipping updates.
We also show ads on other platforms. We share limited information — such as your email address in hashed form, or your activity on the Site — with advertising partners so those ads are relevant to you. You can:
Opt out of Google Analytics:
https://tools.google.com/dlpage/gaoptout
Opt out via the Digital Advertising Alliance:
Opt out via the Network Advertising Initiative:
https://optout.networkadvertising.org
Adjust your choices in our cookie banner at any time
5. Cookies
Cookies are small files stored on your device when you visit the Site. We use four kinds:
- Strictly necessary — your cart, checkout, sign-in, and security. These can't be turned off.
- Performance — anonymous statistics on how the Site is used.
- Functional — remembering your region, currency, and preferences.
- Advertising — measuring ad performance and showing you relevant ads.
Session cookies disappear when you close your browser. Persistent cookies last between 30 minutes and two years.
You can manage cookies through our cookie banner or your browser settings. Blocking cookies may break parts of the Site, including checkout.
Do Not Track
There is still no common standard for how websites should respond to Do Not Track signals, so we do not currently change our practices when we receive one. We do honour Global Privacy Control (GPC) signals where the law requires it.
6. How long we keep it
- Order and transaction records: seven years, to meet Canadian tax and accounting requirements.
- Account information: until you ask us to delete your account.
- Marketing contacts: until you unsubscribe, then we keep a suppression record so we don't contact you again.
- Analytics data: up to 26 months.
- Support messages: three years.
After these periods we delete or anonymise the information.
7. Automated decision-making
We don't make decisions about you that have a legal or similarly significant effect using automated processing alone.
Our payment processor runs automated fraud screening on orders, which may decline a transaction. If your order is declined and you think it shouldn't have been, email us and a person will review it.
8. Your rights
Whatever your location, you can email privacy@harrygeorge.co to access, correct, delete, or receive a copy of your information, or to withdraw consent. We'll respond within 30 days. We may ask you to verify your identity first.
If you're in Canada: Under PIPEDA and Quebec's Law 25, you have the right to access and correct your information, to withdraw consent, to receive it in a structured, portable format, and to ask us to stop distributing information or de-index a link where it causes you serious injury. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca).
If you're in the EEA or UK: Under the GDPR you have the rights to access, rectification, erasure, restriction, portability, and objection, including objection to direct marketing. We process your information on these lawful bases: performance of our contract with you (orders and delivery), your consent (marketing and non-essential cookies), our legal obligations (tax and accounting), and our legitimate interests (security, fraud prevention, and improving the Site). You can complain to your national data protection authority.
If you're in California: Under the CCPA/CPRA you have the rights to know, delete, correct, and opt out of the sale or sharing of your personal information, and not to be discriminated against for exercising them. We do not sell your personal information for money. We may share it for cross-context behavioural advertising — you can opt out through our cookie banner. You may use an authorised agent; email us to arrange this.
9. Children
The Site isn't intended for anyone under 16, and we don't knowingly collect information from children. If you're a parent or guardian and believe your child has given us personal information, email us and we'll delete it.
10. Security
We protect your information with encryption in transit (TLS), encryption at rest, access controls limiting who on our team can see what, and regular review of our providers. No system is perfectly secure, but if a breach ever presents a risk of serious injury we'll notify you and the relevant authorities as the law requires.
11. Changes
We may update this policy to reflect changes in our practices or the law. We'll update the date at the top, and if the changes are significant we'll tell you by email or a notice on the Site.